From 116b2d1793839217c8ea631d2e464abb768dab32 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 15:08:58 +0200 Subject: [PATCH] =?UTF-8?q?ADR=200168:=20built=20and=20proven=20live=20?= =?UTF-8?q?=E2=80=94=20the=20live=20row=20read=20on=20the=20home=20server?= =?UTF-8?q?=20and=20the=20control=20node,=20the=20five=20rule=20sets=20rem?= =?UTF-8?q?oved=20through=20ADR=200170's=20verb?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...rged-machine-is-filtered-by-the-mesh-alone.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md b/02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md index bdb6032..7d6cda7 100644 --- a/02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md +++ b/02-DECISIONS/0168-a-converged-machine-is-filtered-by-the-mesh-alone.md @@ -113,6 +113,22 @@ That is a difference a take shows, not a fault, and is decided when it bites. | `node show` lists filters with owners; `status` names a converged machine something else filters and is not well; the preview lists filters and fates | controller tests over a fixture report | | Live | the home server's record names the predecessor's chain in the runtime's user chain as *other*; `status` names the machine; after the operator removes the chain, the next report drops it and `status` is well | +## Built and proven live, 2026-10-02 + +> **Progressive insight — 2026-10-02.** The decision stands; these are the facts of its building. + +Built in mesh-host 67 (every refusing table and legacy chain classified with an owner, reported with +every apply; the found firewall retired on every converged apply, *found inactive* kept apart from +*disabled by the mesh*, a skipped step said) and mesh-controller 211 (kept per node, shown on `node +show`, named by `status` and not well, previewed with fates). The live row was read at 10:10Z: the home +server's record named the predecessor's chain in the legacy filter's user chain as *other*, beside two +chains a retired front end left in the IPv6 legacy filter; the control node's record named the same two +leftovers; the laptop and the workstation read *the mesh alone*; `status` named both machines. The five +rule sets were removed at 12:46Z through the packet filter seat's `remove` verb +([ADR 0170](0170-the-firewall-seat-serves-its-verbs.md)), and the next report read *the mesh alone* on +all four machines. The control node's record still says the mesh retired its front end, which issue 143 +records as a hand's work: the host trusts its record, and from this build on the distinction is kept. + ## References - [ADR 0100](0100-a-node-in-use-is-adopted-before-it-is-converged.md), [ADR 0103](0103-what-an-adopted-node-holds-and-what-its-guard-refuses.md), [ADR 0140](0140-the-filter-constrains-what-arrives-from-outside.md), [ADR 0102](0102-the-mesh-writes-into-a-shared-file-never-over-it.md), [ADR 0163](0163-taking-a-module-over-is-a-comparison.md) -- 2.54.0