One predicate for the private network: the filter's accept set is the set the names and the resolver mean; the catalogue is read once for the three mesh-wide questions

cmd/mesh-controller/network.go

@@ -396,14 +396,17 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 	return out, nil
 }
 
-// onThePrivateNetwork is every node's address on the overlay, sorted.
+// onThePrivateNetwork is every node's address on the private network, sorted — the same set
+// the names and the resolver mean by it (onTheNetwork), so a rule saying "from the mesh" admits
+// exactly the machines the mesh names.
 //
 // A node with no address is left out rather than rendered as an empty source: an empty entry in a
 // source set is a syntax error in the rule file, and a rule file that does not load leaves the
 // node filtering whatever it was filtering before -- the one outcome worse than a wrong rule,
 // because nothing reports it.
-func onThePrivateNetwork(ctx context.Context, inv *inventory.Inventory) ([]string, error) {
-	places, err := inv.Overlays(ctx)
+func onThePrivateNetwork(ctx context.Context, inv *inventory.Inventory,
+	shelf map[string]catalogue.Manifest) ([]string, error) {
+	places, err := onTheNetwork(ctx, inv, shelf)
 	if err != nil {
 		return nil, err
 	}