Resync hq ADR references 0044-0054 -> 0039-0049 after the hq record reconciliation

internal/broker/management.go

@@ -67,7 +67,7 @@ const ExchangeName = "mesh"
 // constant that differed would be caught by the test that asserts they agree.
 const BuildQueueName = "builds"
 
-// The events bus (novox/hq ADR 0047): one topic exchange every event rides, a second for tool
+// The events bus (novox/hq ADR 0042): one topic exchange every event rides, a second for tool
 // RPC kept apart, and a dead-letter home for a poison event. The substrate owns these — a module's
 // account cannot declare them, only bind its own queue to the events one.
 const (
@@ -77,15 +77,15 @@ const (
 )
 
 // ModuleQueueFor is the durable queue a module consumes its events from — one per module per node
-// (novox/hq ADR 0047), named so the account that may read it is exactly this module's.
+// (novox/hq ADR 0042), named so the account that may read it is exactly this module's.
 func ModuleQueueFor(node, module string) string { return node + "." + module + ".events" }
 
 // modulePermissions is a module's authority on the bus, derived from its manifest (novox/hq
-// ADR 0048): what it consumes and what it emits, and nothing else. Pure, so the scope is tested as
+// ADR 0043): what it consumes and what it emits, and nothing else. Pure, so the scope is tested as
 // patterns without a broker — the way a builder's is.
 //
 // A note on the limit: the broker's write permission is per exchange, not per routing key (LavinMQ
-// has no topic permissions), so an emitting module is granted the events exchange whole. ADR 0047's
+// has no topic permissions), so an emitting module is granted the events exchange whole. ADR 0042's
 // origin reservation — a module publishes only under `module.<self>.*` — is stamped by the sdk, not
 // enforced here; that gap is the broker's, and is recorded rather than hidden. A pure consumer like
 // the audit logger is unaffected: it is granted no write to the exchange at all.
@@ -94,7 +94,7 @@ func modulePermissions(node, module string, emits, consumes []string) (configure
 	events := regexp.QuoteMeta(EventsExchangeName)
 	rpc := regexp.QuoteMeta(RPCExchangeName)
 	// A module serves each of its tools on its own queue, namespaced by the module (novox/hq
-	// ADR 0052) — serve.<module>.<tool> — so the account may declare, bind and read exactly its own,
+	// ADR 0047) — serve.<module>.<tool> — so the account may declare, bind and read exactly its own,
 	// and no other module's.
 	serve := "serve\\." + regexp.QuoteMeta(module) + "\\..*"
 
@@ -102,7 +102,7 @@ func modulePermissions(node, module string, emits, consumes []string) (configure
 	configure = "^(" + queue + "|" + serve + ")$"
 
 	// Write to bind its queue and serve queues (binding is a write on the queue), and to the RPC
-	// exchange to publish replies (ADR 0052: replies ride mesh.rpc, never the default exchange, which
+	// exchange to publish replies (ADR 0047: replies ride mesh.rpc, never the default exchange, which
 	// would let it publish into any queue). To the events exchange only if it emits.
 	writes := []string{queue, serve, rpc}
 	if len(emits) > 0 {
@@ -121,7 +121,7 @@ func modulePermissions(node, module string, emits, consumes []string) (configure
 }
 
 // CreateModuleAccount gives an assigned module its own broker account, scoped by what it emits and
-// consumes (novox/hq ADR 0048). The account name carries the node so the same module on two machines
+// consumes (novox/hq ADR 0043). The account name carries the node so the same module on two machines
 // holds two accounts, each sealed to its own; the permissions carry the module so one module cannot
 // read another's queue. Generic — the builder is one instance of this rule, not a separate kind.
 func (m *Management) CreateModuleAccount(ctx context.Context, node, module, password string, emits, consumes []string) (string, error) {
@@ -152,7 +152,7 @@ func (m *Management) CreateModuleAccount(ctx context.Context, node, module, pass
 
 // EnsureModuleQueue declares a consuming module's queue with its dead-letter exchange, idempotently.
 // The substrate declares it because a scoped module account may not: the broker refuses a queue with
-// a dead-letter exchange to a non-administrator (novox/hq ADR 0048), so a consumer passively checks
+// a dead-letter exchange to a non-administrator (novox/hq ADR 0043), so a consumer passively checks
 // the queue the mesh made rather than declaring its own.
 func (m *Management) EnsureModuleQueue(ctx context.Context, node, module string) error {
 	queue := ModuleQueueFor(node, module)

internal/broker/module_account_test.go

@@ -14,7 +14,7 @@ import (
 
 // The audit logger consumes everything and emits nothing. Its account must let it declare and read
 // its own queue and read the events exchange to bind onto — and must not reach another module's
-// queue, nor grant any write to the events exchange (novox/hq ADR 0048).
+// queue, nor grant any write to the events exchange (novox/hq ADR 0043).
 func TestAConsumerReadsItsOwnQueueAndTheEventsExchangeAndNoOthers(t *testing.T) {
 	// Rebuilt through CreateModuleAccount's own path by asking for the same scope it would apply.
 	// The queue this module reads: