Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

test/integration/events.test.ts

@@ -5,8 +5,8 @@
  * credential is delivered over it. This proves the other half of the bus (novox/hq ADR 0046): the
  * events exchange, where a module emits and any number listen, and the audit logger consumes `#`
  * and writes down what happened. It runs against the `mesh-broker` this scenario's own host raised
- * from the substrate bundle — not a broker a test stood up — because "the mesh hosts the broker"
- * (tier-1 substrate) is the thing being relied on.
+ * from the foundation bundle — not a broker a test stood up — because "the mesh hosts the broker"
+ * (tier-1 foundation) is the thing being relied on.
  *
  * The wire shape it asserts is ADR 0047: metadata rides as headers so the body is only the
  * payload, a consumer gets a durable per-consumer queue `<node>.<module>.events`, and a
@@ -14,10 +14,10 @@
  * on the raised broker is the check that the runtime provisioned the contract, not just that a
  * message happened to arrive.
  *
- * It needs the host binary and the substrate bundle, like the mesh walk, plus a runtime image:
+ * It needs the host binary and the foundation bundle, like the mesh walk, plus a runtime image:
  *
  *   MESH_LAB_HOST_BINARY=.../mesh-host
- *   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
+ *   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
  *   MESH_LAB_RUNTIME=.../mesh-runtime-audit.tar   (docker save of the runtime+audit-logger image;
  *                                                  built by scripts/build-runtime-image.sh)
  *
@@ -33,7 +33,7 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll, substrateBundle } from "./harness.ts";
+import { labIsUsable, destroyAll, foundationBundle } from "./harness.ts";
 import type { HeldImage } from "../../src/pinning.ts";
 import { incus } from "../../src/incus/client.ts";
 import { machineName } from "../../src/lifecycle/names.ts";
@@ -48,7 +48,7 @@ const skip = !capability.usable
   : !binary || !existsSync(binary)
     ? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
     : !bundle || !existsSync(bundle)
-      ? "MESH_LAB_BUNDLE is not set to a substrate bundle (mesh-host examples/)"
+      ? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
       : !runtime || !existsSync(runtime)
         ? "MESH_LAB_RUNTIME is not set to a runtime image tar (scripts/build-runtime-image.sh)"
         : false;
@@ -58,7 +58,7 @@ const MACHINE = "anchor";
 /** Where the audit-logger container writes its trail, on the machine — mounted from a host dir. */
 const TRAIL_DIR = "/var/lib/mesh-audit";
 const TRAIL = `${TRAIL_DIR}/audit.log`;
-/** The broker the substrate raised, reachable on the node's loopback (novox/hq ADR 0001). */
+/** The broker the foundation raised, reachable on the node's loopback (novox/hq ADR 0001). */
 const BROKER = "amqp://guest:guest@127.0.0.1:5672/";
 
 let instanceId = "";
@@ -73,7 +73,7 @@ function quote(s: string): string {
  * A command on the machine, its exit read from a marker on its own line.
  *
  * `exec 2>&1` on its own first line and the marker on its own last line, so a command that carries
- * a heredoc — the substrate bundle is written with one — terminates where it says it does rather
+ * a heredoc — the foundation bundle is written with one — terminates where it says it does rather
  * than swallowing the marker (the fault mesh.test.ts documents).
  */
 async function on(command: string, timeoutMs?: number): Promise<{ out: string; ok: boolean }> {
@@ -92,14 +92,14 @@ async function must(command: string, timeoutMs?: number): Promise<string> {
 }
 
 /**
- * The substrate bundle, its image references pointed at this scenario's own registry.
+ * The foundation bundle, its image references pointed at this scenario's own registry.
  *
  * A digest belongs to whatever registry serves it, so the committed bundle names a registry that
  * is not this one; matching by repository and rewriting to the digest this registry assigned is
  * what makes it applicable (the same rewrite mesh.test.ts does).
  */
 function bundleFor(images: HeldImage[]): string {
-  return substrateBundle(bundle, images);
+  return foundationBundle(bundle, images);
 }
 
 /** Read the trail back as parsed JSON lines. */
@@ -120,14 +120,14 @@ before(async () => {
   });
   instanceId = raised.instanceId;
 
-  // The node raises its substrate — store, broker and the rest — from the bundle, applied from a
+  // The node raises its foundation — store, broker and the rest — from the bundle, applied from a
   // file because the control plane's image is named by the ID this machine holds it under,
   // which is not knowable until it has been handed over.
-  await must(`cat > /tmp/substrate.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);
-  await must(`${HOST_PATH} apply /tmp/substrate.lock`, 600_000);
+  await must(`cat > /tmp/foundation.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);
+  await must(`${HOST_PATH} apply /tmp/foundation.lock`, 600_000);
 
   const running = await must(`docker ps --format '{{.Names}}'`);
-  assert.match(running, /mesh-broker/, `the substrate did not raise a broker:\n${running}`);
+  assert.match(running, /mesh-broker/, `the foundation did not raise a broker:\n${running}`);
 
   // Bring the runtime+audit-logger image onto the machine. Loaded, not pulled: the machine has no
   // route out (novox/hq the lab is a closed address space), so the image arrives as a tar the way