Both follow from the same rule the mesh is built on — a node's configuration is composed from the modules assigned to it. Reach was settled separately by the filter, the proxy's names and the certificate authority, so "this must not be public" could not be written; it becomes one value on the assignment that all three read. And the forward chain consulted two constants plus a typed list although modules already declare their networks; it now forwards what they declared, with the host rendering the addresses it allocated.