2026-09-22 19:02:01 +00:00
3 changed files with 7 additions and 4 deletions
@@ -1,6 +1,6 @@
 ---
 topic: the mesh
-status: proposed
+status: accepted
 date: 2026-09-22
 deciders: jochen
 reconstructed: false
@@ -89,7 +89,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0088** — [The foundation filters before anything listens](0088-the-foundation-filters-before-anything-listens.md)
 - **0090** — [A failure that repeats is said to be stuck](0090-a-failure-that-repeats-is-said-to-be-stuck.md)
 - **0100** — [A node in use is adopted before it is converged](0100-a-node-in-use-is-adopted-before-it-is-converged.md)
- **0101** — [A machine's own resolver does not make it in use](0101-a-machines-own-resolver-does-not-make-it-in-use.md)  *(proposed)*
+- **0101** — [A machine's own resolver does not make it in use](0101-a-machines-own-resolver-does-not-make-it-in-use.md)

 ### Its tiers, from the bottom up

@@ -8,6 +8,7 @@ code:
 updated: 2026-09-22
 decisions:
  - 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
+  - 02-DECISIONS/0101-a-machines-own-resolver-does-not-make-it-in-use.md
  - 02-DECISIONS/0067-genesis-is-a-pivot.md
  - 02-DECISIONS/0069-a-module-is-a-repository-and-a-path.md
  - 02-DECISIONS/0006-the-substrate-and-the-control-plane.md
@@ -113,8 +114,10 @@ checks the private network's range does not overlap a tunnel the predecessor run
 **does not load the base ruleset**: the machine's own firewall already filters; the mesh opens its
 foundation's ports through it and keeps the store from outside with a table of its own that only
 refuses ([08-connectivity](08-connectivity.md)). **A converged genesis refuses a machine in use** —
-a container running, or a port listening on an address other than loopback that is not ssh's —
-and names every one it counted, so a forgotten flag cannot close a working machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
+a container running, or a port listening on an address other than loopback that is neither ssh's
+nor held by one of the operating system's own network daemons
+([ADR 0101](../../02-DECISIONS/0101-a-machines-own-resolver-does-not-make-it-in-use.md)) — and
+names every one it counted, so a forgotten flag cannot close a working machine. *How it is checked:* the adoption bed raises genesis converged on a machine in use and
 asserts the refusal, then adopted with the registry's port held and asserts the refusal names its
 holder, then with another port given asserts the foundation comes up, stays on that port once
 adopted as modules, and the machine's service is still reachable.