ADR 0100 after re-review: the bus and registry stay reachable for enrolment; the mesh guards the store in a table that only refuses; a machine in use defined; the flip refuses while a found container is held; held containers and returning to adopted spelled out

03-DESIGN/01-to-be/07-the-foundation.md

@@ -178,8 +178,10 @@ port never answers, the bus's does.
 machine already serving under a predecessor has a firewall of its own, and a second, stricter
 table would close everything it serves. There the base ruleset is not loaded and the filter module
 is not assigned until the node converges; the foundation's ports are opened through the found
-firewall from the private network and refused from anywhere else on the forwarded path, which
-keeps the same promise — the store's port never answers from outside — by other means. The
+firewall, and a table of the mesh's that only refuses keeps the store's port and the broker's
+management port from anyone off the private network — the same promise, the store's port never
+answering from outside, kept by other means. The bus and the registry stay reachable from anywhere,
+as they are here, because a node enrols and pulls before it has a private-network address. The
 foundation's ports themselves are the node's, given at genesis and kept as its settings. **Checked**
 by the adoption bed, which makes the same outside probe.