ADR 0100 accepted; the node host, connectivity, the node lifecycle and raising a mesh amended for a node adopted before it is converged

03-DESIGN/01-to-be/08-connectivity.md

@@ -7,8 +7,9 @@ code:
   - mesh-controller internal/identity/authority.go
   - mesh-host internal/identity/serving.go
   - mesh-host internal/apply (the service that reflects a rule set)
-updated: 2026-09-21
+updated: 2026-09-22
 decisions:
+  - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
   - 02-DECISIONS/0099-a-step-that-runs-once-names-what-it-reads.md
   - 02-DECISIONS/0098-a-fact-a-provider-makes-at-first-start-is-fetched-from-it.md
   - 02-DECISIONS/0005-the-node-host.md
@@ -532,6 +533,20 @@ undeclared one does not — then the module is removed and the port closes with
 rule. *A rule set that is written but never loaded passes every check that reads the file, which
 is why the check reads packets.*
 
+### On an adopted node
+
+*2026-09-22, [ADR 0100](../../02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md).* **The firewall found on the machine stays in force**, and the mesh
+loads no table of its own there — neither genesis's base ruleset nor the derived one. The kernel
+runs every table at a hook and a drop in any is final, so a second, stricter table would close
+every port the machine serves. What the mesh needs reachable — its foundation's ports and each
+migrated module's `listens` — it opens *through the found firewall*, as rules marked as the mesh's,
+and it removes only rules it marked. Converging the node replaces the found firewall with the
+derived filter in one step, after previewing which open ports will close. The mesh must speak the
+found firewall in its own terms; one kind is found on the machines measured, and a machine with
+another is not covered until someone writes for it. *How it is checked:* the adoption bed asserts
+the found firewall's rules differ only by the mesh's marked rules, that a second machine enrols
+through them, and that after the flip the declared port is open and the undeclared one closed.
+
 ## 5 — Certificates
 
 **Two authorities, kept separate on purpose.**