ADR 0100 after review: found means unrecorded; assigning prepares, taking cuts over; openings through the found firewall on both paths; the mesh guards its own ports; ports kept as node settings; a converged genesis refuses a machine in use; designs 05, 07, 08, 09 and 17 in step

03-DESIGN/01-to-be/17-raising-a-mesh.md

@@ -101,16 +101,23 @@ that runs it.
 ### Genesis on a machine in use
 
 *2026-09-22, [ADR 0100](../../02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md).* A control-node that is already running a predecessor mesh is raised
-**adopted**. The predecessor's control on it is stopped first — the daemons that write its
-configuration — and its services keep running. **Every port the foundation binds is an input to
-genesis**, not a constant in the bundle or the catalogue, and genesis checks each is free before it
-raises anything, refusing with the name of what holds it. On such a machine the store's and the
-bus's usual ports were free and the registry's, the broker's management port and the private
-network's port were held. Genesis adopted **does not load the base ruleset**: the machine's own
-firewall already filters, and the mesh opens its foundation's ports through it
-([08-connectivity](08-connectivity.md)). *How it is checked:* the adoption bed raises genesis
-with the registry's port held and asserts the refusal names its holder, then with another port
-given asserts the foundation comes up and the machine's service is still reachable.
+**adopted**, said so by the operator. The operator stops the predecessor's control on it first —
+the daemons that write its configuration — and its services keep running. **Every port the
+foundation binds is an input to genesis**, checked free before anything is raised, refused with the
+name of what holds it; the ports given become the node's settings for the foundation's modules, so
+adopting the foundation as modules keeps them, and every reader of them — the filter, the base
+ruleset, the private network's endpoint, the addresses consumers are given — reads them there. On
+the control-node measured, the store's and the bus's usual ports were free and the registry's, the
+broker's management port and, as the private network's hub, its port were held. Genesis also
+checks the private network's range does not overlap a tunnel the predecessor runs. Genesis adopted
+**does not load the base ruleset**: the machine's own firewall already filters, and the mesh opens
+its foundation's ports through it and refuses them from outside itself
+([08-connectivity](08-connectivity.md)). **A converged genesis refuses a machine in use** — an
+active firewall or listeners that are not the mesh's — so a forgotten flag cannot close a working
+machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
+asserts the refusal, then adopted with the registry's port held and asserts the refusal names its
+holder, then with another port given asserts the foundation comes up, stays on that port once
+adopted as modules, and the machine's service is still reachable.
 
 ## After the pivot, and still part of installing
 
@@ -157,7 +164,10 @@ What remains after *that* belongs to somebody else: adding machines, and decidin
 
 A machine joins with the host binary and a token. It does not raise a foundation, does not install a
 registry, and is never enrolled twice. The mesh already knows how to tell a machine what to be;
-joining is the point at which a machine starts listening.
+joining is the point at which a machine starts listening. A machine in use joins **adopted**: the
+token says so, the operator has stopped the predecessor's control on it first, and from then on it
+keeps what it has until each module is taken
+([ADR 0100](../../02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md)).
 
 ## Where the line falls