ADR 0100 after review: found means unrecorded; assigning prepares, taking cuts over; openings through the found firewall on both paths; the mesh guards its own ports; ports kept as node settings; a converged genesis refuses a machine in use; designs 05, 07, 08, 09 and 17 in step

03-DESIGN/01-to-be/07-the-foundation.md

@@ -11,8 +11,9 @@ code:
   - mesh-catalog modules/postgres
   - mesh-catalog modules/lavinmq
   - mesh-lab test/integration/mesh.test.ts (a bare machine becomes a mesh)
-updated: 2026-09-21
+updated: 2026-09-22
 decisions:
+  - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
   - 02-DECISIONS/0088-the-foundation-filters-before-anything-listens.md
   - 02-DECISIONS/0004-a-node-and-how-it-joins.md
   - 02-DECISIONS/0078-the-store-and-broker-are-modules.md
@@ -172,6 +173,16 @@ ruleset the machine loaded. **Checked** by the installer's bundle test (order an
 the genesis bed, which probes the machine from outside for the length of the install: the store's
 port never answers, the bus's does.
 
+**Except on a machine raised adopted**
+([ADR 0100](../../02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md)). A
+machine already serving under a predecessor has a firewall of its own, and a second, stricter
+table would close everything it serves. There the base ruleset is not loaded and the filter module
+is not assigned until the node converges; the foundation's ports are opened through the found
+firewall from the private network and refused from anywhere else on the forwarded path, which
+keeps the same promise — the store's port never answers from outside — by other means. The
+foundation's ports themselves are the node's, given at genesis and kept as its settings. **Checked**
+by the adoption bed, which makes the same outside probe.
+
 ## Raising it
 
 The order, from [research 011](../../01-RESEARCH/011-the-module-graph/worked-provider.md):