ADR 0163 built: the take digest, the minted-secret refusal, the networks setting, settings judged where stored, genesis raising the forge as declared; issues 096, 097, 126 resolved

The record gets its built note; designs 05 and 09 the revisions; 086, 098,
099, 100 and 101 stay located because every machine is converged and the
record's live row — a take read on an adopted machine — has not been run;
090 is built in part, its network difference left for the take to say.

03-DESIGN/01-to-be/09-the-node-lifecycle.md

@@ -8,7 +8,7 @@ code:
   - mesh-host packaging/nox-mesh-host-network.sh
   - mesh-controller internal/token
   - mesh-controller internal/inventory/nodes.go
-updated: 2026-10-01
+updated: 2026-10-02
 decisions:
   - 02-DECISIONS/0163-taking-a-module-over-is-a-comparison.md
   - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
@@ -323,6 +323,21 @@ network are said. `take --yes <digest>` cuts over what was previewed, as the fli
 container may keep a found network by a per-machine setting while its neighbours are not yet taken.
 *How it is checked:* ADR 0163's table.
 
+**A setting is judged where it is stored, and the take's words** — revision, 2026-10-02
+([ADR 0163](../../02-DECISIONS/0163-taking-a-module-over-is-a-comparison.md), rules 1, 2, 4 and 6).
+The preview ends with a digest of what it said; `take --yes <digest>` acts on that preview and nothing
+else, and a preview that has changed since, or an account of the machine older than the flip allows, is
+refused as the flip's is. A module the machine holds nothing for has nothing to compare, and `--yes`
+suffices. The overrides are `--downgrade`, `--replace <path>` and `--mint <name>`; the per-machine
+setting that keeps a found network is `networks`, a container id to the networks it keeps, accepted
+for an adopted machine only. Storing a setting composes it against the module's current definition and
+refuses, naming node, module, layer and key, what cannot compose or reaches nothing. A definition that
+later moves under a stored setting costs that module its place in the machine's declaration, said by
+name in `plan`, `push` and the declaration itself, and the machine is told everything else; a stray
+setting no longer refuses the machine where it is read. *How it is checked:* controller tests over the
+one judgement — refused where stored, a module left out where composed, the envelope naming it — and
+over a take's digest, staleness and secrets.
+
 A candidate machine is not empty. It has a package manager, probably a container runtime,
 configuration somebody chose. [ADR 0005](../../02-DECISIONS/0005-the-node-host.md)
 says the host never touches what it did not create — adoption is the deliberate act of taking