ADR 0226: say a retired definition is not ADR 0230's retired consumer

The two retirements are easy to confuse; the second deletes nothing a person must approve.
2026-10-06 15:02:18 +02:00
parent 905ac0f0e4
commit 4f981cc2d7
1 changed files with 4 additions and 1 deletions
@@ -84,7 +84,10 @@ catalogue no longer holds one.
 machine.** `module forget` refuses a module the controller ships, because the next start would put
 it back; so a retired one could be removed by nothing. At start the controller removes every module
 it recorded as its own and no longer ships — unless a machine is still assigned it, or the mesh still
-holds settings, secrets or ports for it, in which case it is kept and the start says why.
+holds settings, secrets or ports for it, in which case it is kept and the start says why. This removes
+a module's *definition* from the catalogue, never a consumer's data: what a consumer leaves behind is
+[ADR 0230](0230-a-consumer-the-mesh-stops-asking-for-is-retired-and-deleted-only-by-a-person.md)'s, and
+a module holding anything is never removed here.

 **3. The proxy names its public issuer.** `route-proxy` no longer requires `acme-ca`; its `acme.env`
 states Let's Encrypt's production directory exactly as the binding rendered it. `public-acme` leaves