Design 55 § 11: say what from: machine gives the page's port, that local processes reach it until issue 1968, and that the route proxy runs on its node

Answers the second review's K1 by architectural domain.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

03-DESIGN/01-to-be/55-the-knowledge-base.md

@@ -826,9 +826,14 @@ reached which nodes is not on it: a merged group no longer waits on the operator
   unanswered verb then turns the mark into one from the verb). These are the only asks the page makes after start.
 - **It writes nothing** (ADR 0616 §4). The page has no form and no verb behind it and answers GET only. It is served by the
   module's own process on a port the module declares, reached through the route proxy by a route the module
-  requires, which only the operator may open. The port answers the route proxy alone, never the mesh network: it
-  listens `from: machine` where the route proxy runs on the same node; a listening scope that grants one module's
-  process (the route proxy's) on another node has no manifest form today, an open point tracked on issue 1968.
+  requires, which only the operator may open. The port listens `from: machine`, the narrowest listening scope the
+  manifest has today, so a connection from another node is refused. That scope does not name a module: every local
+  process of the knowledge base's node reaches the port, not only the route proxy, until issue 1968 gives a scope
+  that grants one module's process. That scope is a change to mesh-sdk's manifest types, so it rebuilds every module
+  that imports them, and it rides a later milestone's one rebuild rather than adding one here. A route proxy runs on
+  the knowledge base's node (read from placement, 2026-11-04), so the page is reachable through it; a route proxy on
+  another node cannot reach a port listening `from: machine`, so a page placed where none runs is unreachable until
+  issue 1968.
 - **Every number on it can be read by a tool** (ADR 0616 §5): a tool of the knowledge base answers the page's model as data,
   marked reads, so the page shows nothing a tool cannot read (tools-are-how-a-module-is-spoken-to); a second tool,
   marked acts, asks one source's verb again by hand and rebuilds its block, recorded as a hand act.
@@ -848,8 +853,8 @@ and in the health, never as an empty list, asked again on the backoff alone, its
 and a subscription stopping its heartbeat marks it unanswered from the subscription, asks nothing while silent, and
 asks the verb once on its next event or heartbeat. In the router, an ask offered emits `offered` once and each of its
 five ends emits `closed` once with how it ended, with no option, token or proof in either body; the knowledge base
-hears the stream and another module, an asker among them, is refused. The page's port refuses a connection from any
-module but the route proxy. The re-read tool rebuilds one source's block and asks no other. Live: after its delivery the operator opens the
+hears the stream and another module, an asker among them, is refused. A connection to the page's port from another node
+is refused (what `from: machine` gives; a local process other than the route proxy is not refused before issue 1968). The re-read tool rebuilds one source's block and asks no other. Live: after its delivery the operator opens the
 page and sees design 47's milestones, rendered headless and looked at before it is handed over.
 
 ## What it leaves out