ADR 0140: the filter constrains what arrives from outside, and says nothing about a machine's own guests

Reading a converged machine's rendered rules showed the cause: the chain blocks
everything passing through and then allows the machine's own containers back by
listing their address ranges. 0137 made that list typeable and 0139 tried to
generate it; both refined a list that should not exist, because the mesh has no
position on a container reaching outward. Constrain what arrives from outside,
allow what did not, and let the machine report which links face outside — one
fact instead of a list. Ports keep following the modules unchanged.

The records check now allows one record to supersede several, and stops
requiring a withdrawn record's own citations to be live.

04-ISSUES/141-the-forward-chain-does-not-follow-the-modules/00-report.md

@@ -61,6 +61,18 @@ module declares — a test bed's pool — which is a much smaller residue than t
 has to know the runtime's allocations to tell whether that line is sufficient. On the machine
 measured here it read as though nothing needed saying.
 
+## What was decided
+
+*2026-09-28, later the same day.* The answer is not a better list. The question in the first open
+item below — should the chain be derived from the networks the modules declare — was answered *no*,
+after a converged machine's rendered rules were read: the chain blocks everything passing through the
+machine and then allows its own guests back by listing their addresses. Every route to a correct list
+fails, because the mesh has no position on a container reaching outward in the first place. The filter
+now constrains what arrives from **outside** the machine and says nothing about what did not, and a
+machine says which of its links face outside — one reported fact instead of a list. See
+[ADR 0140](../../02-DECISIONS/0140-the-filter-constrains-what-arrives-from-outside.md), which
+supersedes both 0137 and the first attempt at answering this.
+
 ## Open questions
 
 - Should the forward chain be derived from the network resources the node's modules declare, with the