ADR 0100: the guard lets the machine itself through; in use is a non-loopback listener; openings say from where; 09 in step with the flip

01-RESEARCH/012-the-minimum-viable-node/migrating-a-node-in-use.md

@@ -117,13 +117,14 @@ intention, and each thing the mesh would otherwise take must say what it does in
   module's data has moved. Assigning prepares; taking migrates. Without the distinction the rule
   never fires: the host only ever sees what assigned modules declare.
 - **The firewall found on the machine stays in force.** The mesh loads no table on an adopted node
-  that drops by default or accepts. What it needs open it declares as openings the host converges
+  that drops by default or holds an accept. What it needs open it declares as openings the host converges
   *through the found firewall*, on the incoming and the forwarded path, marked as the mesh's and
   re-checked on every reconcile so a reload or reboot does not lose them. An accept in a table of
   its own would not help: the found firewall's drop would still be final. What a table of its own
   *can* do is refuse, and a refusal is final too — so the mesh guards the store and the broker's
-  management port from outside the private network in a table that only refuses, which the found
-  firewall may not do and cannot undo. The bus, the registry and the hub's port stay open to
+  management port from everyone but the private network and the machine itself, in a table that
+  only refuses, ahead of the container runtime's redirect — which the found firewall does not do
+  and cannot undo. The bus, the registry and the hub's port stay open to
   anywhere: a node enrols before it has a private-network address.
 - **The foundation's ports are the node's to give** — set at genesis, checked free, and kept as
   that node's settings, read everywhere they are used, so adopting the foundation as modules does