ADR 0168: a converged machine is filtered by the mesh alone, and the host says what else refuses (group 7)

Designs 08 and 05 revised; 141 resolved by ADR 0140 and 084 by ADR 0102 and
issue 128, both by reading; 143 and 144 decided, built on the matching
branches in mesh-host and mesh-controller, resolved when the home server's
record names the predecessor's chain.

04-ISSUES/084-taking-networking-on-an-adopted-node-restarts-every-container/00-report.md

@@ -1,8 +1,8 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-22
 located-in: [mesh-controller internal/overlay, mesh-host internal/apply]
-fixed-by:
+fixed-by: ADR 0102 (mesh-controller internal/overlay: the runtime file written into, reloaded), issue 128 (the hosts file as a region)
 amended-design: 03-DESIGN/01-to-be/05-the-node-host.md
 ---
 
@@ -56,3 +56,12 @@ and nothing checks for it today.
 - Should an adopted node that cannot trust the registry be refused a module that needs to pull?
   Or should the refusal come earlier, when the node joins?
 
+## Resolved, 2026-10-02
+
+The runtime's file is written into and the runtime reloaded, never restarted
+([ADR 0102](../../02-DECISIONS/0102-the-mesh-writes-into-a-shared-file-never-over-it.md), the
+diagnosis above); the hosts file is a marked region the mesh owns alone
+([issue 128](../128-the-hosts-file-is-written-whole/00-report.md)). Neither whole file remains. Read
+into [ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), rule 5,
+which names the one whole machine-wide file the mesh still writes — its own filter at the
+distribution's path — as a difference a take shows, not a fault.

04-ISSUES/141-the-forward-chain-does-not-follow-the-modules/00-report.md

@@ -1,10 +1,10 @@
 ---
-status: located
+status: resolved
 opened: 2026-09-28
 located-in:
   - mesh-controller internal/catalogue/filtering.go
   - mesh-host internal/apply
-fixed-by:
+fixed-by: ADR 0140 — mesh-controller (the filter around outward links; no network ranges anywhere)
 amended-design: 03-DESIGN/01-to-be/08-connectivity.md
 ---
 
@@ -86,3 +86,11 @@ supersedes both 0137 and the first attempt at answering this.
   runtime, or left as the one constant?
 - Should the preview say which of a machine's networks are the mesh's and which are not, so a range
   that exists to protect a leftover is visible as such?
+
+## Resolved, 2026-10-02
+
+By [ADR 0140](../../02-DECISIONS/0140-the-filter-constrains-what-arrives-from-outside.md), built and
+live since 2026-09-29: the forward chain constrains what arrives on the machine's outward links and
+says nothing about networks, so there is no list to derive and nothing for a preview to tell apart.
+Read into [ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md),
+rule 5, which closes it.

04-ISSUES/143-converging-does-not-retire-the-firewall-it-found/00-report.md

@@ -100,3 +100,11 @@ harmless, but the mesh's belief about which firewall is in force has been wrong
   so". Should it?
 - Why do the host's own detail lines not reach the journal? Everything it decided during the flip is
   unrecoverable, which is why this account has candidates instead of a cause.
+
+## Decided, 2026-10-02
+
+[ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), rule 1:
+convergence is a state the host keeps — the found firewall active again is retired again and said, a
+reconcile that finds it inactive records *found so* and never *done by the mesh*, and a step skipped
+after a failed apply is said. Built in mesh-host on `feat/one-thing-filters-a-converged-machine`; the
+record of both machines of this mesh is corrected by the first report under it.

04-ISSUES/144-the-predecessors-rules-outlive-the-firewall-it-was-found-as/00-report.md

@@ -82,3 +82,12 @@ everything reached from within.
 - Is the bus and the registry being reachable from anywhere still what the mesh wants on a machine that
   faces the internet? The design says yes, for enrolment. It deserves asking on its own rather than
   being answered by a leftover.
+
+## Decided, 2026-10-02
+
+[ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), rules 2 and
+3: the host reports every table and legacy chain that refuses, with an owner, and the runtime's user
+chain's refusals as *other*; `node show`, `status` and the converge preview say it. Built on
+`feat/one-thing-filters-a-converged-machine` in mesh-host and mesh-controller. On 2026-10-02 the home
+server still carries the predecessor's chain in its legacy filter; the record's live row is reading it
+there.