ADR 0101 accepted; raising a mesh names it

03-DESIGN/01-to-be/17-raising-a-mesh.md

@@ -8,6 +8,7 @@ code:
 updated: 2026-09-22
 decisions:
   - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
+  - 02-DECISIONS/0101-a-machines-own-resolver-does-not-make-it-in-use.md
   - 02-DECISIONS/0067-genesis-is-a-pivot.md
   - 02-DECISIONS/0069-a-module-is-a-repository-and-a-path.md
   - 02-DECISIONS/0006-the-substrate-and-the-control-plane.md
@@ -113,8 +114,10 @@ checks the private network's range does not overlap a tunnel the predecessor run
 **does not load the base ruleset**: the machine's own firewall already filters; the mesh opens its
 foundation's ports through it and keeps the store from outside with a table of its own that only
 refuses ([08-connectivity](08-connectivity.md)). **A converged genesis refuses a machine in use** —
-a container running, or a port listening on an address other than loopback that is not ssh's —
-and names every one it counted, so a forgotten flag cannot close a working machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
+a container running, or a port listening on an address other than loopback that is neither ssh's
+nor held by one of the operating system's own network daemons
+([ADR 0101](../../02-DECISIONS/0101-a-machines-own-resolver-does-not-make-it-in-use.md)) — and
+names every one it counted, so a forgotten flag cannot close a working machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
 asserts the refusal, then adopted with the registry's port held and asserts the refusal names its
 holder, then with another port given asserts the foundation comes up, stays on that port once
 adopted as modules, and the machine's service is still reachable.