ADR 0100: the guard lets the machine itself through; in use is a non-loopback listener; openings say from where; 09 in step with the flip

2026-09-22 16:34:53 +02:00
parent f3152d827f
commit 37252f9c3e
6 changed files with 47 additions and 35 deletions
@@ -297,11 +297,13 @@ the others — and the controller records it and says so in every declaration, w
 **taken** on that node. On an adopted node what is found is held until its module is taken
 ([05-the-node-host](05-the-node-host.md)): assigning a module prepares it, taking it is its
 cutover. The firewall found there stays in force and the mesh opens what it needs through it
-([08-connectivity](08-connectivity.md)). **Converging is one act per node, previewed**: it lists
-what is reachable on the machine now — listening sockets and published ports — and whether an
-assigned module declares each or it will close, then takes every module not yet taken, loads the
-mesh's own filter and disables the found one without flushing it. Returning a converged node to
-adopted enables the found firewall again. *How it is checked:* a lab bed prepares a machine the way
+([08-connectivity](08-connectivity.md)). **Converging is one act per node, previewed**: it refuses
+while an assigned module still holds a found container; otherwise it lists what is reachable on the
+machine now — listening sockets and published ports — whether an assigned module declares each or
+it will close, and which modules it will take, then takes them, loads the mesh's own filter in place
+of its refusal-only table and disables the found firewall without flushing it. Returning a
+converged node to adopted unloads the derived filter, restores the refusal-only table, enables the
+found firewall again and converges the openings through it; what was taken stays taken. *How it is checked:* a lab bed prepares a machine the way
 a predecessor leaves one and asserts nothing that serves changes until a module is taken or the
 node is converged, and that the flip closes exactly what the preview said.