ADR 0187: a dead tracker is not the machine's failure; design 32

03-DESIGN/01-to-be/32-what-a-module-declares.md

@@ -11,7 +11,7 @@ code:
   - mesh-host internal/apply/apply.go
   - mesh-tools src/main.ts
   - mesh-catalog modules/mesh-catalog
-updated: 2026-09-28
+updated: 2026-10-02
 decisions:
   - 02-DECISIONS/0160-the-mesh-issues-an-assignments-subjects-and-a-runtime-serves-what-it-is-issued.md
   - 02-DECISIONS/0126-a-module-declares-its-own-seats.md
@@ -24,6 +24,7 @@ decisions:
   - 02-DECISIONS/0129-a-seat-carries-the-protocol-of-its-role.md
   - 02-DECISIONS/0135-a-module-version-prepares-its-state-before-it-runs.md
   - 02-DECISIONS/0136-a-step-gates-its-module-not-the-machine.md
+  - 02-DECISIONS/0187-a-dead-tracker-is-not-the-machines-failure.md
   - 02-DECISIONS/0134-the-mesh-says-what-it-applied.md
 ---
 
@@ -470,6 +471,21 @@ moment the mesh can mint for itself: **the bus's own accounts** (§the bootstrap
 needs an account before it can run) and **the vault's own credential**. Any third exception is a
 design failure, and naming these two is what makes a third one visible.
 
+## What a step is answerable for, 2026-10-02
+
+[ADR 0187](../../02-DECISIONS/0187-a-dead-tracker-is-not-the-machines-failure.md). A step gates its
+module and not the machine ([ADR 0136](../../02-DECISIONS/0136-a-step-gates-its-module-not-the-machine.md)),
+but a step that exits non-zero still leaves the machine reporting that it is not doing what it was
+told — and a clean apply gates other things entirely, the found firewall's retirement among them. So
+what a step calls a failure matters beyond the step.
+
+The rule the media step now follows, and the one to copy: a step fails for what the mesh chose and
+can fix, and reports what it merely found and cannot. An indexer entry the mesh re-pointed at this
+mesh's proxy is plumbing the mesh is answerable for; whether the public tracker behind it answers
+today is not. An entry the operator listed is the operator's to insist on, and still fails. Six
+hours of a machine reading as broken, for one tracker that had died, is what the distinction costs
+when it is missing.
+
 ## 11. Open
 
 **Semantic change has no mechanical defence** (§8). Recorded as open rather than solved, because