The controller's seat is mesh-controller; a foundation module on a second node is refused

Renames the module's own claim the-controller -> mesh-controller (the seat is the server,
ADR 0079), and adds TestAFoundationModuleCannotBeRaisedOnASecondNode asserting each
foundation module's second assignment is refused with 'one per mesh'. Closes hq issue 056.

https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

internal/catalogue/resolve_test.go

@@ -224,6 +224,29 @@ func TestAMeshWideClaimIsHeldByOneNode(t *testing.T) {
 	}
 }
 
+func TestAFoundationModuleCannotBeRaisedOnASecondNode(t *testing.T) {
+	// novox/hq 04-ISSUES/056. The store and broker are adopted in place on the control-node; each
+	// foundation module claims a mesh-scoped seat named after its server — the same mechanism that
+	// keeps one controller — so a second `assign` to another node is refused rather than silently
+	// raising a second postgres or broker that holds none of the first's data.
+	for _, tc := range []struct{ module, seat string }{
+		{"postgres", "mesh-store"},
+		{"lavinmq", "mesh-broker"},
+		{"mesh-controller", "mesh-controller"},
+	} {
+		_, err := Resolve(
+			shelf(mod(tc.module, nil, nil, nil, Claim{Name: tc.seat, Scope: ScopeMesh})),
+			[]string{tc.module}, workstation(),
+			World{Held: []Held{{Claim: tc.seat, Scope: ScopeMesh, Node: "anchor", Module: tc.module}}})
+		if err == nil {
+			t.Fatalf("%s was raised on a second node though %s is a mesh-wide seat", tc.module, tc.seat)
+		}
+		if !strings.Contains(err.Error(), "one per mesh") {
+			t.Errorf("%s: the refusal does not say it is one per mesh: %v", tc.module, err)
+		}
+	}
+}
+
 func TestASiteClaimOnlyCollidesWithinThatSite(t *testing.T) {
 	// A DHCP server per segment. Two of them is a fault at one site and perfectly ordinary
 	// across two, and treating site as mesh would forbid the ordinary case.

module.json

@@ -7,7 +7,7 @@
   ],
   "claims": [
     {
-      "name": "the-controller",
+      "name": "mesh-controller",
       "scope": "mesh"
     }
   ],