ADR 0140: the filter constrains what arrives from outside, and says nothing about a machine's own guests

Reading a converged machine's rendered rules showed the cause: the chain blocks
everything passing through and then allows the machine's own containers back by
listing their address ranges. 0137 made that list typeable and 0139 tried to
generate it; both refined a list that should not exist, because the mesh has no
position on a container reaching outward. Constrain what arrives from outside,
allow what did not, and let the machine report which links face outside — one
fact instead of a list. Ports keep following the modules unchanged.

The records check now allows one record to supersede several, and stops
requiring a withdrawn record's own citations to be live.

02-DECISIONS/0137-a-machine-says-which-networks-it-routes.md

@@ -1,10 +1,11 @@
 ---
 topic: what runs on it
-status: accepted
+status: superseded
 date: 2026-09-28
 deciders: jochen
 extends: 02-DECISIONS/0100-a-node-in-use-is-adopted-before-it-is-converged.md
 reconstructed: false
+superseded-by: 02-DECISIONS/0140-the-filter-constrains-what-arrives-from-outside.md
 ---
 
 # 137. A machine says which networks it routes