ADR 0100 after re-review: the bus and registry stay reachable for enrolment; the mesh guards the store in a table that only refuses; a machine in use defined; the flip refuses while a found container is held; held containers and returning to adopted spelled out

03-DESIGN/01-to-be/17-raising-a-mesh.md

@@ -110,11 +110,11 @@ ruleset, the private network's endpoint, the addresses consumers are given — r
 the control-node measured, the store's and the bus's usual ports were free and the registry's, the
 broker's management port and, as the private network's hub, its port were held. Genesis also
 checks the private network's range does not overlap a tunnel the predecessor runs. Genesis adopted
-**does not load the base ruleset**: the machine's own firewall already filters, and the mesh opens
-its foundation's ports through it and refuses them from outside itself
-([08-connectivity](08-connectivity.md)). **A converged genesis refuses a machine in use** — an
-active firewall or listeners that are not the mesh's — so a forgotten flag cannot close a working
-machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
+**does not load the base ruleset**: the machine's own firewall already filters; the mesh opens its
+foundation's ports through it and keeps the store from outside with a table of its own that only
+refuses ([08-connectivity](08-connectivity.md)). **A converged genesis refuses a machine in use** —
+a container running, or a port listening that is neither ssh nor the operating system's own — so a
+forgotten flag cannot close a working machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
 asserts the refusal, then adopted with the registry's port held and asserts the refusal names its
 holder, then with another port given asserts the foundation comes up, stays on that port once
 adopted as modules, and the machine's service is still reachable.