ADR 0099: a step that runs once names what it reads; issues 077 and 078 resolved; designs 08 and 20 amended

03-DESIGN/01-to-be/08-connectivity.md

@@ -9,6 +9,7 @@ code:
   - mesh-host internal/apply (the service that reflects a rule set)
 updated: 2026-09-21
 decisions:
+  - 02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md
   - 02-DECISIONS/0098-a-fact-a-provider-makes-at-first-start-is-fetched-from-it.md
   - 02-DECISIONS/0005-the-node-host.md
   - 02-DECISIONS/0004-a-node-and-how-it-joins.md
@@ -564,9 +565,9 @@ The mesh mints the authority's password and nothing else of its: a root certific
 are things only the authority can make, and a served fact written in a manifest cannot carry what
 does not exist until the authority has run. So the authority serves its root at a path beside its
 ACME directory, and the proxy that requires it fetches that root over the mesh network in a
-run-once step before it starts. The step is run once per declaration: a root that changes
-after first start is fetched again only when the declaration changes
-([issue 077](../../04-ISSUES/077-a-fact-fetched-at-first-start-is-fetched-once/00-report.md)).
+run-once step before it starts. The step names the binding it reads and the proxy names the
+step, so when the authority moves the root is fetched again and the proxy is recreated with it
+([ADR 0099](../../02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md)).
 *How it is checked:* the route-forwarding bed installs the authority, the proxy and a consumer
 from the catalogue and asserts the routed name is served.
 

03-DESIGN/01-to-be/20-writing-a-module.md

@@ -7,6 +7,7 @@ code:
   - mesh-sdk src
 updated: 2026-09-21
 decisions:
+  - 02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md
   - 02-DECISIONS/0053-a-step-that-runs-on-a-schedule.md
   - 02-DECISIONS/0074-the-wire-is-specified-not-the-types.md
   - 02-DECISIONS/0040-what-a-module-is.md
@@ -198,3 +199,11 @@ one shape this does not protect, and should not be written.
 *How it is checked:* the lab's coupled-pair spike declares exactly this pair, pushes a refused
 file, and asserts the file on disk is the new one, the service serves the old one, and the machine
 reports the push failed.
+
+A `run-once` step may itself name what it reads under `restart-on`; for a step the word means
+*run again* — a step that fetches a fact from a provider names the binding it reads, and runs
+again when the provider moved. The service that consumes what the step made names the step, so it
+is recreated with the new fact
+([ADR 0099](../../02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md)). *How it is
+checked:* the host's unit tests run a step again when its named file changed and not otherwise,
+and recreate a container naming a step after the step ran.