Merge pull request 'To-be 48: cite ADR 0368, the resolver restarts itself for that module alone' (#356) from design/48-cites-adr-0368 into main

03-DESIGN/01-to-be/48-a-module-says-how-it-is-healthy.md

@@ -2,7 +2,7 @@
 layer: to-be
 status: in-progress
 code: [mesh-host, mesh-controller, mesh-lab, mesh-catalog, mesh-sdk]
-updated: 2026-10-11
+updated: 2026-10-14
 decisions:
   - "ADR 0292"
   - "ADR 0283"
@@ -13,6 +13,7 @@ decisions:
   - "ADR 0236"
   - "ADR 0227"
   - "ADR 0256"
+  - "ADR 0368"
 ---
 
 # 48 — A module says how it is healthy
@@ -246,6 +247,11 @@ The runtime restarts what exits, as now. The node-engine never restarts, recreat
 being unhealthy. The condition reaches the operator through the conversation (to-be 46), or a healer once a
 record gives one that act.
 
+One module repairs itself, by its own record: the dnsmasq module's watch restarts the resolver's unit when
+it stops answering, at most once every two minutes and three times an hour, and says through its declared
+health whether the restart helped (ADR 0368). The node-engine still restarts nothing; any other restart on
+health needs a record of its own.
+
 ## 8. A declaration is proved before it is trusted
 
 - **`module check`** refuses a `health` field naming an endpoint the module does not declare under
@@ -520,7 +526,8 @@ controller.
 
 ## What is not decided here
 
-- Whether a healer restarts what stays unhealthy (its own record, under ADR 0231).
+- Whether a healer restarts what stays unhealthy (its own record, under ADR 0231). The resolver's own
+  restart is decided, for that module alone, by ADR 0368.
 - Health of scheduled work, and of what a module's events do (issue 276).
 - A slow starter that needs more than five minutes to be ready — a change to the bound, recorded, when one
   exists.