ADR 0100 after review: found means unrecorded; assigning prepares, taking cuts over; openings through the found firewall on both paths; the mesh guards its own ports; ports kept as node settings; a converged genesis refuses a machine in use; designs 05, 07, 08, 09 and 17 in step

03-DESIGN/01-to-be/05-the-node-host.md

@@ -133,16 +133,21 @@ is the component; that one is what happens to it.
 
 ## What it finds, on an adopted node
 
-*2026-09-22, [ADR 0100](../../02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md).* A declaration says whether the node is adopted. On an adopted node
-the host does not replace a file it finds at a declared path: it records what was there — its
-content, so the original is kept before anything is written — and holds the file as found. A
-module's files are converged when that module is assigned, because assigning a module is
-migrating it; the rest when the node is converged. The host's report says which files it is
-holding rather than converging, so an adopted node never reads as converged. This is the
+*2026-09-22, [ADR 0100](../../02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md).* A declaration says whether the node is adopted, and which of its
+modules have been **taken**. *Found* is a file at a declared path, or a container at a declared
+name, that the host's store has no record of writing. On an adopted node the host keeps what it
+found for any module not yet taken: it records a found file's original content before anything
+else, and it reports the file or container as held — a report that says what it holds, so an
+adopted node never reads as converged. Once the module is taken, its resources converge like any
+other. A held file that changes while held is reported as changed by something else, not
+reverted; a held file is never removed, even when its module is unassigned. The host also
+converges a new resource, the **opening** — a port made reachable through the firewall it found
+([08-connectivity](08-connectivity.md)) — and reports which firewall it found. This is the
 companion the host's ownership rule needed: *never touch what you did not create, unless adoption
-made it yours — and while the node is adopted, keep it as you found it.* *How it is checked:*
-unit tests hold the host to keeping a found file on an adopted node and replacing it on a
-converged one, and the adoption bed asserts a found file byte for byte unchanged.
+made it yours — and while the node is adopted, not until its module is taken.* *How it is
+checked:* unit tests hold the host to keeping a found file and container, converging them once
+taken, never removing a held file and reporting one that changed; the adoption bed asserts a found
+file byte for byte unchanged until its module is taken.
 
 ## Where a declaration comes from