Rename mesh-control -> mesh-controller, substrate -> foundation

One name per thing, per the HQ glossary: the module/container/image/binary/repo
becomes mesh-controller, the seat the-controller, and the store+broker pair the
foundation (embedded base bundles, default template and example lock renamed with
their go:embed directives). No behaviour change — a pure vocabulary rename.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

src/broker-amqp.ts

@@ -38,7 +38,7 @@ export interface Credential {
  * Connect to the mesh broker and return a Broker. `close()` tears both channel and connection down.
  *
  * A scoped module (novox/hq ADR 0043) passes `assumeExchanges: true`: its account may not declare
- * an exchange, and the substrate already owns them, so it declares only its own queue. A credential
+ * an exchange, and the foundation already owns them, so it declares only its own queue. A credential
  * carrying a fingerprint is dialled over amqps, pinned to exactly that certificate.
  */
 export async function connectAmqp(
@@ -55,9 +55,9 @@ export async function connectAmqp(
   // at-least-once starts at the emitter, not only the consumer (ADR 0042).
   const ch = await conn.createConfirmChannel();
 
-  // The substrate owns the exchanges (ADR 0043). A bootstrap/admin connection declares them; a
+  // The foundation owns the exchanges (ADR 0043). A bootstrap/admin connection declares them; a
   // scoped module assumes they exist and never tries — its account could not, and the dead-letter
-  // queue behind the exchange is the substrate's to keep, not a module's.
+  // queue behind the exchange is the foundation's to keep, not a module's.
   if (!opts.assumeExchanges) {
     await ch.assertExchange(RPC_EXCHANGE, "topic", { durable: true });
     await ch.assertExchange(EVENTS_EXCHANGE, "topic", { durable: true });

src/main.ts

@@ -32,7 +32,7 @@ import { emit } from "@novox/mesh-sdk/events";
 
 /**
  * Connect the way this process is meant to: with its sealed credential if the mesh gave it one, and
- * over the plain bootstrap URL otherwise. A scoped module assumes the substrate's exchanges exist —
+ * over the plain bootstrap URL otherwise. A scoped module assumes the foundation's exchanges exist —
  * its account may not declare them (ADR 0043).
  */
 async function connectBroker(): Promise<Broker> {

test/amqp.test.ts

@@ -27,7 +27,7 @@ test("a module's tool serves and is invoked over a real AMQP broker", { skip: !u
   const serverBroker = await connectAmqp(url!);
   const stop = await runTools({ broker: serverBroker, moduleEntrypoints: [] });
 
-  // A separate connection — a caller, like mesh-control's command API — invokes over the broker,
+  // A separate connection — a caller, like mesh-controller's command API — invokes over the broker,
   // by module and tool (novox/hq ADR 0047: served on serve.demo.greet, invoked as demo.greet).
   const caller = await connectAmqp(url!);
   const result = (await invokeTool(caller, "demo", "greet", { who: "mesh" })) as { hello: string };

test/events-wire.test.ts

@@ -10,7 +10,7 @@ import { emit, on, type Event } from "@novox/mesh-sdk/events";
 // headers on the wire, a body that is only the payload, persistent messages, a durable per-consumer
 // queue, dead-letter, poison handling? This tests the adapter in isolation, against a disposable
 // broker that stands in for the one the mesh hosts (ADR 0001). It is NOT an event test of the mesh:
-// that lives in a full lab scenario where the mesh raises the broker as substrate. Requires
+// that lives in a full lab scenario where the mesh raises the broker as foundation. Requires
 // $MESH_BROKER_URL (a throwaway broker); skipped, never failed, when it is not set.
 const url = process.env.MESH_BROKER_URL;