Issue 197: a physical link that is down is not filtered when it comes up

2026-10-02 11:53:54 +02:00
18 changed files with 45 additions and 345 deletions
@@ -1,120 +0,0 @@
---
-topic: the mesh
-status: accepted
-date: 2026-10-02
-deciders: jochen
-reconstructed: false
-extends: 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
---
-
-# 168. A converged machine is filtered by the mesh alone, and the host says what else refuses
-
-## Context
-
-[ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md) says what converging does to
-the firewall a machine was found with: the mesh's derived filter is loaded in place of the
-refusal-only guard, and the found firewall is retired — disabled, never flushed. Four issues from
-the first two convergences are four ways that sentence was not the machine:
-
- the flip reported the found firewall retired and it was active two minutes later; fifty minutes
-  on, a reconcile found it disabled by hand and recorded that the mesh had done it
-  ([143](../04-ISSUES/143-converging-does-not-retire-the-firewall-it-found/00-report.md));
- "the firewall found" named one front end, and what filtered the forwarded path on that machine
-  was a chain a predecessor had installed in the container runtime's user hook — invisible to the
-  mesh, refusing two ports the mesh declared open, and when it was removed, carrying an allowance
-  every module reaching another by the machine's own name had been relying on
-  ([144](../04-ISSUES/144-the-predecessors-rules-outlive-the-firewall-it-was-found-as/00-report.md),
-  [145](../04-ISSUES/145-a-machine-reads-healthy-while-its-modules-cannot-reach-each-other/00-report.md));
- the forward chain listed address ranges that followed neither the modules nor the machine
-  ([141](../04-ISSUES/141-the-forward-chain-does-not-follow-the-modules/00-report.md)), answered by
-  [ADR 0140](0140-the-filter-constrains-what-arrives-from-outside.md) before this record;
- the networking module wrote two machine-wide files whole, so taking it restarted every
-  container ([084](../04-ISSUES/084-taking-networking-on-an-adopted-node-restarts-every-container/00-report.md)),
-  answered by [ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md) and the hosts
-  file's marked region ([issue 128](../04-ISSUES/128-the-hosts-file-is-written-whole/00-report.md)).
-
-Read on the four machines of this mesh on 2026-10-02, after every one had converged: on both
-machines that had a front end it is inactive, and the host's record says the mesh retired it on
-both — true of one, false of the other. On the home server the predecessor's chain is still in
-force on the forwarded path, in the legacy packet filter the mesh's reader of rules does not
-consult once a machine is converged, so that machine is filtered by two things and the mesh says
-one. The host's reader already knows how to tell a table that refuses traffic from the runtime's
-own plumbing and from a ban list; it is asked once, at adoption, and only to refuse a machine
-whose firewall nobody speaks. Nothing asks it afterwards, and nothing reports what it saw.
-
-The group's exit is one sentence: *a converged machine has exactly one thing filtering it, and
-the mesh says truthfully which.* The first half the mesh can enforce only for what it owns; the
-second half it can always do, and it is the half that was missing.
-
-## Decision
-
-**1. Convergence is a state the host keeps, not a step it takes once.** Every apply of a converged
-declaration reads whether the found firewall is in force. Active — enabled again by a package, a
-boot, a hand — it is retired again and said. The record distinguishes *the mesh disabled it* from
-*it was found inactive*, and a reconcile that finds it inactive never records that the mesh did
-it. When the step is skipped because the apply had failures, the report says the found firewall
-was left in force and why; a step that does nothing is never silent.
-
-**2. The host reports what filters the machine, with every apply, adopted or converged.** Every
-table of the packet filter, and every chain of the legacy filter, that refuses traffic — a drop or
-a reject, or a base chain whose policy drops — with an owner: the *mesh's*, the *found firewall's*,
-the *container runtime's own*, a *ban* (a refusal that names the sources it refuses, in a chain
-that accepts nothing), or *other*. The runtime's own is its plumbing — its chains, the forward
-policy it sets when it turns forwarding on, its guard against reaching a container's address from
-off its bridge. The user chain the runtime leaves for an administrator is not the runtime's:
-anything refusing in it is *other*, which is where both predecessors' chains lived. Each entry
-says in one line what it refuses. The mesh removes none of it: a rule it did not write is the
-operator's to remove, now that they can see it.
-
-**3. The mesh says which.** `node show` lists the filters with their owners. `status` names every
-converged machine that something other than the mesh's table, the runtime's plumbing and a ban
-list filters, the way it names strays and untaken modules, and such a machine is not "all well".
-The converge preview lists the filters found and the fate of each: the found firewall retired, the
-runtime's and the bans left, *other* left and named — so a person knows before the flip that the
-machine will not be filtered by the mesh alone until they remove it, and what they would be
-removing. *A converged machine is filtered by the mesh alone* when its list holds nothing but the
-mesh's, the runtime's own and bans.
-
-**4. Adoption's threshold does not move.** A machine whose front end nobody speaks is still refused
-adoption; a refusing rule in the runtime's user chain still does not refuse it — on both machines
-of this mesh it would have, and the migration would not have happened. It is reported instead,
-from the first report on.
-
-**5. Two of the group's issues are settled by records already accepted.** The forward chain follows
-the machine's outward links and says nothing about networks ([ADR 0140](0140-the-filter-constrains-what-arrives-from-outside.md)),
-which answers 141 whole. The runtime's file is written into and reloaded, and the hosts file's
-region is the mesh's alone ([ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md),
-[issue 128](../04-ISSUES/128-the-hosts-file-is-written-whole/00-report.md)), which answers 084. One
-machine-wide file the mesh still writes whole is its own filter, at the path the distribution's
-packet filter reads; an operator's own rules at that path would be contested, and are held as
-found until the filter module is taken ([ADR 0163](0163-taking-a-module-over-is-a-comparison.md)).
-That is a difference a take shows, not a fault, and is decided when it bites.
-
-## Consequences
-
- The host's report grows by the filters it found and, for a converged machine, the state of its
-  found firewall and who retired it; the controller keeps both on the node's record.
- `retireFirewall` runs on every converged apply and can disable the found firewall more than
-  once; the record's *disabled by the mesh* means exactly that.
- The reader of rules gains an owner per table and chain; what it refuses adoption for does not
-  change. A ban stays what it was: not a firewall.
- Issues 143 and 144 close on rules 1 to 3 once a machine's record names the predecessor's chain;
-  141 closes on ADR 0140 and 084 on ADR 0102, both by reading.
- Removing what is reported is the operator's act, by hand, with the preview's words in front of
-  them. The mesh never flushes and never deletes a rule it did not mark.
-
-## How this is checked
-
-| Rule | Checked by |
-|---|---|
-| Every refusing table and chain is classified, the user chain's refusals as *other* | host tests over rulesets captured from three machines of this mesh: a predecessor's chain in the legacy filter, a ban list and empty front-end chains beside the runtime's, a virtualisation host and an endpoint agent that refuse nothing |
-| The found firewall active again on a converged machine is retired again and said; found inactive is recorded as found, not done; a skipped step is said | host tests over a fake front end |
-| The report carries the filters and the found firewall's state for a converged machine | a host test reading the report |
-| `node show` lists filters with owners; `status` names a converged machine something else filters and is not well; the preview lists filters and fates | controller tests over a fixture report |
-| Live | the home server's record names the predecessor's chain in the runtime's user chain as *other*; `status` names the machine; after the operator removes the chain, the next report drops it and `status` is well |
-
-## References
-
- [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0103](0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md), [ADR 0140](0140-the-filter-constrains-what-arrives-from-outside.md), [ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md), [ADR 0163](0163-taking-a-module-over-is-a-comparison.md)
- [Design 08 — Connectivity](../03-DESIGN/01-to-be/08-connectivity.md), [Design 05 — The node host](../03-DESIGN/01-to-be/05-the-node-host.md)
- Issues 084, 141, 143, 144, 145
@@ -178,7 +178,6 @@ python3 00-META/checks/index.py            fail if stale
 - **0162** — [A merge produces a tiered plan the mesh keeps, and a module's dependencies are one relation in the catalogue](0162-a-merge-produces-a-tiered-plan-the-mesh-keeps.md)
 - **0163** — [Taking a module over is a comparison: what it compares, what it refuses, and what it carries](0163-taking-a-module-over-is-a-comparison.md)
 - **0167** — [A membership carries what its module receives, and who the mesh is](0167-a-membership-carries-what-its-module-receives-and-who-the-mesh-is.md)
- **0168** — [A converged machine is filtered by the mesh alone, and the host says what else refuses](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)

 ### Its tiers, from the bottom up

@@ -4,7 +4,6 @@ status: in-progress
 code: [mesh-host]
 updated: 2026-10-02
 decisions:
-  - 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md
  - 02-DECISIONS/0163-taking-a-module-over-is-a-comparison.md
  - 02-DECISIONS/0141-the-host-delivers-its-own-successor.md
  - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
@@ -177,14 +176,6 @@ has left to say. *How it is checked:* a host test joins a kept network and refus
 host test keeps a left-out module's record and hold and removes an absent module's; a bootstrap test
 holds the installer's constants to the module's manifest where the catalogue is checked out beside it.

-**What filters the machine, and the found firewall kept retired** — revision, 2026-10-02
-([ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)). The host
-reports, with every apply, every table and legacy chain that refuses traffic and whose it reads it as —
-the mesh's, the found firewall's, the container runtime's own, a ban, or other — and, converged, whether
-the firewall it was found with is in force and who retired it. It retires that firewall on every
-converged apply, not once, records *found inactive* apart from *disabled by the mesh*, and says when the
-step was skipped. *How it is checked:* ADR 0168's table.
-
 **Found reaches every kind that can touch what the machine has**
 ([ADR 0103](../../02-DECISIONS/0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md)). For a module not yet taken, a directory present with no record
 keeps its mode and owner, a unit present with no record keeps its state and boot setting, a
@@ -9,7 +9,6 @@ code:
  - mesh-host internal/apply (the service that reflects a rule set)
 updated: 2026-10-02
 decisions:
-  - 02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md
  - 02-DECISIONS/0167-a-membership-carries-what-its-module-receives-and-who-the-mesh-is.md
  - 02-DECISIONS/0148-the-meshs-names-are-resolved-not-copied-into-containers.md
  - 02-DECISIONS/0151-a-routes-internal-name-is-composed-under-the-node-that-serves-it.md
@@ -711,38 +710,6 @@ needs no new filter; a declared port is reachable from off the private network a
 not; no address of a machine's own networks appears in a rendered filter, asserted on the text; and a
 machine reporting no outward link is refused in the control plane with its existing filter left alone.

-### A converged machine is filtered by the mesh alone, and the host says what else refuses
-
-*2026-10-02, [ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md),
-from [issues 143](../../04-ISSUES/143-converging-does-not-retire-the-firewall-it-found/00-report.md) and
-[144](../../04-ISSUES/144-the-predecessors-rules-outlive-the-firewall-it-was-found-as/00-report.md).*
-
-Retiring the found firewall was a step the flip took once, and said it had taken whatever happened;
-on the first machine with one it did not take, and a hand's work fifty minutes later was recorded as
-the mesh's. And "the firewall found" named one front end while a predecessor's chain in the container
-runtime's user hook — legacy iptables on one machine, invisible to a reader of nftables — filtered the
-forwarded path, refused ports the mesh declared open, and carried an allowance every module reaching
-another by the machine's own name relied on.
-
-**Convergence is a state the host keeps.** Every converged apply reads whether the found firewall is in
-force; enabled again, it is retired again and said; the record says whether the mesh disabled it or
-found it inactive, and a skipped step is said. **The host reports what filters the machine**, every
-apply, adopted or converged: every table and legacy chain that refuses, with an owner — the mesh's,
-the found firewall's, the runtime's own plumbing, a ban, or *other*, which is where the runtime's user
-chain's refusals go. **The mesh says which:** `node show` lists them; `status` names a converged machine
-anything *other* filters and is not well; the converge preview lists what filters the machine and the
-fate of each — retired with the front end, left as the runtime's, left as a ban, or *left in force and
-not the mesh's*. The mesh removes none of it; adoption's threshold does not move.
-
-*How it is checked:* host tests over rulesets captured from three machines of this mesh classify every
-refusing chain (a predecessor's chain in the legacy filter as *other*, a ban list reached through the
-user chain as a ban, a leftover front-end chain as *other*); a fake front end enabled again on a
-converged machine is retired again and said, found inactive is recorded as found; the report carries
-the filters and the found firewall's state and a change in them is worth an unasked report; controller
-tests over a fixture report check the recording, the preview's fates, the status JSON and the well
-predicate. Live: the home server's record names the predecessor's chain as *other* and `status`
-names the machine until the chain is removed by hand.
-
 ## 5 — Certificates

 **Two authorities, kept separate on purpose.**
@@ -1,11 +1,8 @@
 ---
 layer: to-be
-status: in-progress
-code:
-  - mesh-controller internal/inventory
-  - mesh-controller internal/catalogue
-  - mesh-controller cmd/mesh-controller
-updated: 2026-10-01
+status: proposed
+code: []
+updated: 2026-09-27
 decisions:
  - 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
  - 02-DECISIONS/0120-a-roster-fact-carries-its-format-as-a-template.md
@@ -17,10 +14,10 @@ decisions:
 # 29 — A node has operator accounts, and the mesh owns what lives under a home

 **The mesh models machines but not the people on them.** A node record holds its name, its
-address, its mode — and nothing about *who a person is* on it: one login name on the build node,
-another on the home-server, a third on both workstations. That username is not incidental. It
-decides who a file under `~` is owned by, who a user service runs as, and — the case that surfaced
-this — which account `ssh <node>` logs in as. The predecessor knew it (its per-node `user:`, and the modules that wrote a
+address, its mode — and nothing about *who a person is* on it: `jochens` on novox, `ace` on ace,
+`jochen` on shanks and g14. That username is not incidental. It decides who a file under `~` is
+owned by, who a user service runs as, and — the case that surfaced this — which account `ssh
+<node>` logs in as. The predecessor knew it (its per-node `user:`, and the modules that wrote a
 person's `~/.ssh/config`, `~/.zshrc`, `~/.config`); the mesh, taking those over, kept the machine
 facts and dropped the human one.

@@ -31,9 +28,8 @@ Several things are missing, and they are one idea.
 A node has one or more **operator accounts**: the human logins on it. At minimum a name; the
 mesh already knows the node and its address, so `<account>@<node>` is then a complete answer to
 "who am I, where." It is the mesh's to hold because everything below is derived from it, and
-because it is exactly the fact that was silently lost — `ssh home-server` logged in under the
-workstation's own name, because nothing in the mesh said the home-server's account is a different
-one.
+because it is exactly the fact that was silently lost — `ssh ace` failed to `ace` because nothing
+in the mesh said ace's account is `ace`.

 ## 2. A resource may live under a home, owned by its account

@@ -69,14 +65,14 @@ create `~/.ssh` at `0700`, chown it to the account, and own the files it places

 **The boundary — and it is the reason this is safe:** `~/.ssh` is the one directory where a wrong
 declaration locks a person out of their own machine. So the mesh's *found-vs-owned* semantics
-([ADR 0118](../../02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md),
+([ADR 0126](../../02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md),
 adoption) apply *inside* the home directory. The mesh **owns** the directory and the files above; it
 **holds as found — never rewrites, never removes** — the operator's own contents: their **private
 keys** and their **personal drop-ins** (`config.d/personal`, the personal `Host` aliases a
 workstation carries, exactly as `hosts.local` is the home the mesh never rewrites for `/etc/hosts`).
 Reconcile removing an unassigned `config.d/mesh` is fine; the same logic aimed at `id_ed25519` or an
 operator's own `authorized_keys` entry is a lockout. This is the login-channel cousin of the rule
-[ADR 0117](../../02-DECISIONS/0117-a-machines-uplink-is-a-seat.md) draws for the uplink and the sshd
+[ADR 0125](../../02-DECISIONS/0117-a-machines-uplink-is-a-seat.md) draws for the uplink and the sshd
 module draws for the firewall: **the mesh must never be able to arrange the one failure that severs
 its own way back in.** The carve-out is not a convenience; it is that rule, in `~/.ssh`.

@@ -112,12 +108,12 @@ found-vs-owned boundary of §3 is exactly what guarantees nothing already there

 None of this needs a node to discover the mesh, and none of it needs a control-plane module of its
 own. The ssh files are **roster facts**
-([ADR 0120](../../02-DECISIONS/0120-a-roster-fact-carries-its-format-as-a-template.md)): once the
+([ADR 0128](../../02-DECISIONS/0120-a-roster-fact-carries-its-format-as-a-template.md)): once the
 roster view carries a node's **host key** and its **account** beside its name and address, the
 `ssh-client` module ships a template for `known_hosts`, `config` and `authorized_keys`, and the
 controller renders each node's copy from the full roster and pushes it. The mesh owns the data; the
 module owns ssh's format; the control plane gains no ssh syntax. It is the same act as composing a
-peer list or `/etc/hosts` — which is why there is **no control-node-only "mesh-ssh" module**: the
+peer list or `/etc/hosts` — which is why there is **no novox-only "mesh-ssh" module**: the
 centralization is the controller's composition, not a module that runs somewhere. Only non-secret
 facts travel (names, addresses, accounts, host keys, the CA public key); the private key stays the
 operator's, placed as an operator-owned file, referenced by path.
@@ -133,44 +129,6 @@ operator's, placed as an operator-owned file, referenced by path.
 They meet at the account and the CA, not at a bespoke module. The `sshd` server side already exists;
 the client/identity side and the CA are the open pieces.

-## What has shipped, and what has not
-
-*Recorded 2026-10-01 from the controller's main branch, not from intent.*
-
-**Built (mesh-controller, merged 2026-09-27):**
-
- **§1, the account as a node fact.** A node record carries an operator account and, optionally,
-  its home. Empty is a real state — a freshly enrolled or headless machine has no operator account
-  known yet — and an empty home means *derive it* (the superuser's home for the superuser, the
-  conventional per-user home otherwise), so the common case needs no entry. The controller's node
-  command sets it. One account per node is what exists; "one or several" below is still open.
- **§2, resources under a home.** The account and its home are offered as machine facts, and a
-  resource's *path and owner* resolve placeholders exactly as its content does — so a module places
-  a file under a person's home, owned by that person, naming neither. A roster file may say it lives
-  under the home: it is rendered per node, placed under that node's account's home, chowned to the
-  account, and a node with no account gets none.
- **§5, the composed ssh config.** The roster rendering carries each node's account, so the
-  `ssh-client` template can emit a `Host` block per node with the right login name. Composed
-  end-to-end in the controller's tests.
-
-**Written but not shipped:** the `ssh-client` catalogue module itself exists on a branch of the
-module repository; its pull request was closed with a hold until this design is deployed, and
-nothing has deployed it since. The predecessor's generator still writes every workstation's ssh
-client blocks today — which is where [issue 172](../../04-ISSUES/172-the-ssh-client-block-matches-one-spelling-of-a-machine/00-report.md)
-was found.
-
-**Not built:** the SSH CA and certificates (§4), `known_hosts` and `authorized_keys` as roster files,
-the found-vs-owned boundary inside `~/.ssh` (§3 — the controller has no rule yet that refuses to
-rewrite a private key), adoption of existing keys, the ssh-agent as a user service, and user-scoped
-services in general. The host vocabulary still has no user-scope unit at all; a workstation's
-per-user daemons (a bar watchdog, a config reloader, an audio service masked per user) have no form
-the mesh can send.
-
-**A gap this surfaced:** §1 shipped as code before it had a decision record. The account as a node
-fact, the home as a placement root, and what the mesh may and may not do under a home are each a
-decision this document names but no record states. They are the next records to write, before the
-family of §2 modules is built.
-
 ## Why now, and why not yet

 **Why it matters:** when HAL retires, the generators that keep `~/.ssh`, shell config and the
@@ -179,7 +137,7 @@ alias and its trust, and a fresh machine has no operator dotfiles at all — the
 service and leave the human unable to work on the box.

 **Why not build it reflexively:** it is a real addition to the node model, the resource model, and
-the seat set, and must be gotten right. The mechanism half is now settled — ADR 0120 is what lets
+the seat set, and must be gotten right. The mechanism half is now settled — ADR 0128 is what lets
 the ssh files be templates with no control-plane format — so what remains to decide here is the
 model:

@@ -198,18 +156,15 @@ model:
  unnecessary, and forwarding an agent into a node exposes the operator's keys to that node's root —
  so prefer certificates and `ProxyJump` over forwarding.

-**Now load-bearing.** The migration of every node to the mesh is complete; what remains of the
-predecessor is exactly the user environment this design covers — ssh config, dotfiles, the desktop
-stack and the per-user services of the two workstations. Those generators are the last thing
-keeping the predecessor running, so the model questions above are no longer deferred: the account
-record, the home as a placement root, user-scoped services and the one-off steps a hook used to run
-each need a decision before the modules that replace the generators can be written.
+**Not urgent, not blocking.** ssh and dotfiles work today because HAL's generators still run as the
+substrate. This becomes load-bearing in the node-by-node retirement phase, not before — which is the
+right time to build it, once the account and CA model are decided here.

 ## References

 - The gap was found generating `~/.ssh/config` from the *HAL* registry (`hal/terminal`'s
  postConfigure hook), which the nox mesh has no equivalent for.
- [ADR 0120](../../02-DECISIONS/0120-a-roster-fact-carries-its-format-as-a-template.md) — the roster
+- [ADR 0128](../../02-DECISIONS/0120-a-roster-fact-carries-its-format-as-a-template.md) — the roster
  fact mechanism that renders the ssh files, format owned by the module.
 - [ADR 0112](../../02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md) — the
  system-path placement this mirrors for home paths.
@@ -218,6 +173,6 @@ each need a decision before the modules that replace the generators can be writt
 - [ADR 0113](../../02-DECISIONS/0113-the-vault-makes-every-secret.md) — the CA key is a secret the
  vault makes; [ADR 0114](../../02-DECISIONS/0114-a-shared-credential-rotates-over-two-credentials.md)
  — short-lived certs as rotation.
- [ADR 0117](../../02-DECISIONS/0117-a-machines-uplink-is-a-seat.md),
-  [ADR 0118](../../02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md) —
+- [ADR 0125](../../02-DECISIONS/0117-a-machines-uplink-is-a-seat.md),
+  [ADR 0126](../../02-DECISIONS/0118-undeclaring-gives-a-unit-back-the-state-it-was-found-in.md) —
  the never-sever-the-channel rule and the found-vs-owned semantics, applied here to `~/.ssh`.
@@ -38,7 +38,7 @@ document is written and this one's status becomes `implemented`.
 | [`26-the-seats.md`](26-the-seats.md) | **Proposed.** What a mesh can have one of, who fills each, and a seat's holder answering for the provision it delivers — including the `git` seat a build's source can live on | [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md) (superseding [ADR 0110](../../02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md)), [ADR 0111](../../02-DECISIONS/0111-a-build-source-is-on-the-git-seat-or-external.md), [ADR 0109](../../02-DECISIONS/0109-a-package-registry-seat-is-one-per-ecosystem.md) |
 | [`27-a-module-requires-the-mesh-resolves.md`](27-a-module-requires-the-mesh-resolves.md) | **Proposed.** One concept for everything a module needs: a requirement with a contract, answered by one of four kinds of provider, resolved at assignment or refused. Retires settings, placeholders, facts and paths in definitions | [ADR 0112](../../02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md), [ADR 0113](../../02-DECISIONS/0113-the-vault-makes-every-secret.md), [ADR 0114](../../02-DECISIONS/0114-a-shared-credential-rotates-over-two-credentials.md), [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md) (superseding [ADR 0110](../../02-DECISIONS/0110-a-seat-is-a-module-assignment-from-a-closed-set.md)) |
 | [`28-building-the-bus.md`](28-building-the-bus.md) | **Proposed.** The five steps of the bus work in the order their dependencies allow, each ending at a bed — with the surface measured, so no step's size is a guess | [ADR 0116](../../02-DECISIONS/0116-the-bus-is-built-in-five-steps.md), [ADR 0106](../../02-DECISIONS/0106-the-bus-is-nats.md), [ADR 0074](../../02-DECISIONS/0074-the-wire-is-specified-not-the-types.md) |
-| [`29-a-node-has-operator-accounts.md`](29-a-node-has-operator-accounts.md) | **In progress.** A node has an operator account and a resource may live under its home — built in the controller; the ssh-client module, the SSH CA, the `~/.ssh` boundary and user-scoped services are not. The account fact still wants its decision record | [ADR 0112](../../02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md), [ADR 0051](../../02-DECISIONS/0051-shared-data-is-the-operators.md) |
+| [`29-a-node-has-operator-accounts.md`](29-a-node-has-operator-accounts.md) | **Proposed.** The mesh models machines but not the humans on them: a node gains operator accounts, and a resource may live under a home owned by its account — what would own ~/.ssh, dotfiles and ~/.config when HAL retires | [ADR 0112](../../02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md), [ADR 0051](../../02-DECISIONS/0051-shared-data-is-the-operators.md) |

 | [`32-what-a-module-declares.md`](32-what-a-module-declares.md) | **Proposed.** What a module declares and what the bus derives from it: three namespaces, subjects from local names, queues never declared, the five relationships, and the build-publish-deploy lifecycle on one bus | [ADR 0126](../../02-DECISIONS/0126-a-module-declares-its-own-seats.md), [ADR 0127](../../02-DECISIONS/0127-amqp-is-a-provision-not-the-bus.md), superseded by [ADR 0131](../../02-DECISIONS/0131-everything-on-the-mesh-speaks-to-the-broker-seat.md) (superseding [ADR 0125](../../02-DECISIONS/0125-the-bus-is-the-only-broker.md)), [ADR 0041](../../02-DECISIONS/0041-events-are-a-relationship.md) |

@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-22
 located-in: [mesh-controller internal/overlay, mesh-host internal/apply]
-fixed-by: ADR 0102 (mesh-controller internal/overlay: the runtime file written into, reloaded), issue 128 (the hosts file as a region)
+fixed-by:
 amended-design: 03-DESIGN/01-to-be/05-the-node-host.md
 ---

@@ -56,12 +56,3 @@ and nothing checks for it today.
 - Should an adopted node that cannot trust the registry be refused a module that needs to pull?
  Or should the refusal come earlier, when the node joins?

-## Resolved, 2026-10-02
-
-The runtime's file is written into and the runtime reloaded, never restarted
-([ADR 0102](../../02-DECISIONS/0102-the-mesh-writes-into-a-shared-file-never-over-it.md), the
-diagnosis above); the hosts file is a marked region the mesh owns alone
-([issue 128](../128-the-hosts-file-is-written-whole/00-report.md)). Neither whole file remains. Read
-into [ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), rule 5,
-which names the one whole machine-wide file the mesh still writes — its own filter at the
-distribution's path — as a difference a take shows, not a fault.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-22
 located-in: [mesh-controller cmd/mesh-controller/adoption.go (take previews nothing), mesh-host internal/apply (the comparison and the record)]
-fixed-by: mesh-controller 201 (the preview names the narrowing and the port's reach), 206 (`take --yes <digest>` acts on the preview read)
+fixed-by:
 amended-design:
 ---

@@ -46,7 +46,3 @@ host first, then the controller's `take`.
 mesh-controller 201 and the pull request after it: the preview names it, and `take --yes <digest>`
 acts on the preview that was read. Stays located until a take is read on an adopted machine — every
 machine of this mesh is converged today, so the record's live row has not been run.
-
-## Resolved, 2026-10-02
-
-Closed on the operator's decision of 2026-10-02 with the built and tested code live on every machine (mesh-controller 206, mesh-host 64), not on a take read on an adopted machine: every machine of this mesh is converged, so none holds a found thing to compare, and the record's live row — ADR 0163's last — will be read at the next real adoption rather than staged. Said here so nobody later believes that row was run.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-22
 located-in: [mesh-controller cmd/mesh-controller/adoption.go (take previews nothing), mesh-host internal/apply (the comparison and the record)]
-fixed-by: mesh-host 64 (genesis raises the forge as `gitea`, on the module's image digest, with the module's data directory at /data; a test holds the installer to the module's manifest)
+fixed-by:
 amended-design:
 ---

@@ -63,7 +63,3 @@ to the module's manifest where the catalogue is checked out beside it. The netwo
 left: the bootstrap forge runs on the machine's network to reach the store on its loopback, the module
 runs bridged and publishes its ports, and the take says so. Closing waits for group 9's genesis test —
 a mesh raised, the module assigned, and the module found holding rather than raising a second forge.
-
-## Resolved, 2026-10-02
-
-Closed on the operator's decision of 2026-10-02. Name, image and data directory align; the network does not — the bootstrap forge runs on the machine's network to reach the store on its loopback, the module runs bridged — and a take says so rather than hides it. Whether genesis should move the forge onto a bridge, and the test that raises a mesh and finds the module holding rather than raising a second forge, belong to group 9's genesis work and are not owed by this record any more.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-23
 located-in: [mesh-controller cmd/mesh-controller/adoption.go (take previews nothing), mesh-host internal/apply (the comparison and the record)]
-fixed-by: mesh-host 63 (the kept original's difference), mesh-controller 201 (shown; a differing file refuses unless `--replace <path>`)
+fixed-by:
 amended-design:
 ---

@@ -74,7 +74,3 @@ host first, then the controller's `take`.
 mesh-host 63 reports the difference between the kept original and the declared content; mesh-controller
 201 shows it in the preview and refuses a differing file unless `--replace <path>` names it, or the
 module declares the file partially. Stays located until a take is read on an adopted machine.
-
-## Resolved, 2026-10-02
-
-Closed on the operator's decision of 2026-10-02 with the built and tested code live on every machine (mesh-controller 206, mesh-host 64), not on a take read on an adopted machine: every machine of this mesh is converged, so none holds a found thing to compare, and the record's live row — ADR 0163's last — will be read at the next real adoption rather than staged. Said here so nobody later believes that row was run.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-23
 located-in: [mesh-controller cmd/mesh-controller/adoption.go (take previews nothing), mesh-host internal/apply (the comparison and the record)]
-fixed-by: mesh-host 63 (both images' creation dates), mesh-controller 201 (DOWNGRADE said; refused unless `--downgrade`)
+fixed-by:
 amended-design:
 ---

@@ -71,7 +71,3 @@ host first, then the controller's `take`.
 mesh-host 63 reports the found image and both images' creation dates; mesh-controller 201 says
 DOWNGRADE and refuses unless `--downgrade` is said. Stays located until a take is read on an adopted
 machine.
-
-## Resolved, 2026-10-02
-
-Closed on the operator's decision of 2026-10-02 with the built and tested code live on every machine (mesh-controller 206, mesh-host 64), not on a take read on an adopted machine: every machine of this mesh is converged, so none holds a found thing to compare, and the record's live row — ADR 0163's last — will be read at the next real adoption rather than staged. Said here so nobody later believes that row was run.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-23
 located-in: [mesh-controller cmd/mesh-controller/adoption.go (take previews nothing), mesh-host internal/apply (the comparison and the record)]
-fixed-by: mesh-controller 201 (`secret accept --provider` reaches a required secret), 206 (a module's secrets listed with origin; a minted one for found data refuses unless `--mint <name>`)
+fixed-by:
 amended-design:
 ---

@@ -78,7 +78,3 @@ The pull request after it reads every secret a module holds on a machine with it
 of a module whose data was found refuses a minted, unaccepted one — naming the accept that carries
 the existing value in, or `--mint <name>` to let the service take the new one. Stays located until
 a take is read on an adopted machine.
-
-## Resolved, 2026-10-02
-
-Closed on the operator's decision of 2026-10-02 with the built and tested code live on every machine (mesh-controller 206, mesh-host 64), not on a take read on an adopted machine: every machine of this mesh is converged, so none holds a found thing to compare, and the record's live row — ADR 0163's last — will be read at the next real adoption rather than staged. Said here so nobody later believes that row was run.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-23
 located-in: [mesh-controller cmd/mesh-controller/adoption.go (take previews nothing), mesh-host internal/apply (the comparison and the record)]
-fixed-by: mesh-controller 201 (the neighbours on a found network are named), 206 (the per-machine `networks` setting), mesh-host 64 (the taken container joins the kept network)
+fixed-by:
 amended-design:
 ---

@@ -73,7 +73,3 @@ The preview names every neighbour on a found network (mesh-controller 201). The
 adds the per-machine setting `networks` — a container id to the found networks it keeps — judged for an
 adopted machine only, and mesh-host 64 has the taken container join each once it runs. Stays located
 until a take is read on an adopted machine.
-
-## Resolved, 2026-10-02
-
-Closed on the operator's decision of 2026-10-02 with the built and tested code live on every machine (mesh-controller 206, mesh-host 64), not on a take read on an adopted machine: every machine of this mesh is converged, so none holds a found thing to compare, and the record's live row — ADR 0163's last — will be read at the next real adoption rather than staged. Said here so nobody later believes that row was run.
@@ -1,10 +1,10 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-28
 located-in:
  - mesh-controller internal/catalogue/filtering.go
  - mesh-host internal/apply
-fixed-by: ADR 0140 — mesh-controller (the filter around outward links; no network ranges anywhere)
+fixed-by:
 amended-design: 03-DESIGN/01-to-be/08-connectivity.md
 ---

@@ -86,11 +86,3 @@ supersedes both 0137 and the first attempt at answering this.
  runtime, or left as the one constant?
 - Should the preview say which of a machine's networks are the mesh's and which are not, so a range
  that exists to protect a leftover is visible as such?
-
-## Resolved, 2026-10-02
-
-By [ADR 0140](../../02-DECISIONS/0140-the-filter-constrains-what-arrives-from-outside.md), built and
-live since 2026-09-29: the forward chain constrains what arrives on the machine's outward links and
-says nothing about networks, so there is no list to derive and nothing for a preview to tell apart.
-Read into [ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md),
-rule 5, which closes it.
@@ -1,10 +1,10 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-29
 located-in:
  - mesh-host internal/apply/opening.go (retireFirewall)
  - mesh-host internal/apply/apply.go (the condition it is called under)
-fixed-by: mesh-host 67 (retire on every converged apply; found-inactive apart from disabled-by-mesh; a skipped step said), mesh-controller 211 (the found firewall's state on node show)
+fixed-by:
 amended-design:
 ---

@@ -100,21 +100,3 @@ harmless, but the mesh's belief about which firewall is in force has been wrong
  so". Should it?
 - Why do the host's own detail lines not reach the journal? Everything it decided during the flip is
  unrecoverable, which is why this account has candidates instead of a cause.
-
-## Decided, 2026-10-02
-
-[ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), rule 1:
-convergence is a state the host keeps — the found firewall active again is retired again and said, a
-reconcile that finds it inactive records *found so* and never *done by the mesh*, and a step skipped
-after a failed apply is said. Built in mesh-host on `feat/one-thing-filters-a-converged-machine`; the
-record of both machines of this mesh is corrected by the first report under it.
-
-## Resolved, 2026-10-02
-
-mesh-host 67 and mesh-controller 211, live on every machine at 10:10Z. The step now runs on every
-converged apply and says what it did; a found firewall enabled again is retired again. The record's
-one inherited lie stands as history: on the control node the machine's own record already said the
-mesh had disabled the firewall, and the host trusts its record, so `node show` says "retired by the
-mesh" there. From this build on, a reconcile that finds the firewall inactive records *found inactive*
-and never the other thing. Whether the flip's step took on 2026-09-29 is not recoverable and is not
-owed by this record any more.
@@ -1,10 +1,10 @@
 ---
-status: resolved
+status: located
 opened: 2026-09-29
 located-in:
  - mesh-host internal/apply/opening.go
  - mesh-controller cmd/mesh-controller (the converge preview)
-fixed-by: mesh-host 67 (every refusing table and legacy chain classified with an owner; the runtime's user chain is other), mesh-controller 211 (kept, shown on node show, named by status, previewed with fates)
+fixed-by:
 amended-design:
 ---

@@ -82,24 +82,3 @@ everything reached from within.
 - Is the bus and the registry being reachable from anywhere still what the mesh wants on a machine that
  faces the internet? The design says yes, for enrolment. It deserves asking on its own rather than
  being answered by a leftover.
-
-## Decided, 2026-10-02
-
-[ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), rules 2 and
-3: the host reports every table and legacy chain that refuses, with an owner, and the runtime's user
-chain's refusals as *other*; `node show`, `status` and the converge preview say it. Built on
-`feat/one-thing-filters-a-converged-machine` in mesh-host and mesh-controller. On 2026-10-02 the home
-server still carries the predecessor's chain in its legacy filter; the record's live row is reading it
-there.
-
-## Resolved, 2026-10-02
-
-mesh-host 67 and mesh-controller 211, live at 10:10Z. The live row of
-[ADR 0168](../../02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md) was read the
-same hour: the home server's record names the predecessor's chain in the legacy filter's user chain
-as *other*, with what it refuses, beside two chains a retired front end left in the IPv6 legacy filter;
-the control node's record names the same two leftovers; the laptop and the workstation read *the mesh
-alone*. `status` names both machines and is not well until the operator removes what the mesh did not
-write. The allowance the predecessor's chain carried is
-[issue 145](../145-a-machine-reads-healthy-while-its-modules-cannot-reach-each-other/00-report.md)'s,
-and that record is not closed by this one.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-10-02
 located-in: [mesh-host internal/apply (removeOrphan: a former target of a kind with no removal was fatal), mesh-host internal/store (Record keeps a former target for every kind, the host's own archive included)]
-fixed-by: mesh-host 65 — a former target of a kind the host cannot remove is left in place, said and forgotten; a dropped archive still refuses
+fixed-by:
 amended-design:
 ---

@@ -62,10 +62,3 @@ because the alternative was four machines that could apply nothing.
 - Is there a bed that replaces a host under the current rules before the live mesh does
  (the proof row of [ADR 0141](../../02-DECISIONS/0141-the-host-delivers-its-own-successor.md) was
  a single crossover, before former targets existed)?
-
-## Resolved, 2026-10-02
-
-mesh-host 65, merged 07:35Z. Recovered as the record above says: the operator dropped the one
-`@former:` entry from each machine's host record and pushed; the fixed host then ran on all four and
-its first apply said `forgotten mesh-host.next@former:… a former target left in place` and applied the
-rest. The open questions stand as questions for the host's own versions, not as faults.
@@ -1,8 +1,8 @@
 ---
-status: resolved
+status: located
 opened: 2026-10-02
 located-in: [mesh-host internal/outward (Links reported only the links carrying a default route)]
-fixed-by: mesh-host PR 66 (a link backed by a physical device is named outward, up or down), live 2026-10-02
+fixed-by:
 amended-design: []
 ---

@@ -36,8 +36,3 @@ that never carries the default route, such as a direct link to a storage box, is
 - A virtual link that faces outside (a VPN client's interface, a USB tether that appears as a virtual
  device) has no physical device behind it. It is named only while it carries the default route. Is
  that enough?
-
-## Resolved (2026-10-02)
-
-Live on the affected machine after the host was delivered and one more push: its filter now guards the
-radio, the tunnel and the unplugged wired port, before anything is plugged into it.