The filter constrains what arrives from outside, and names no network

The forward chain blocked everything passing through the machine and then allowed
the machine's own containers back by naming their address ranges: 172.16.0.0/12 and
192.168.128.0/17 fixed here, the rest recorded per machine by 0043. Every way of
keeping that list correct fails — a constant describes one machine, a recorded range
goes stale in silence and cannot tell a network the mesh made from one a predecessor
left behind, and generating it from the modules would put half the rule set on the
machine.

The mesh has no position on a container reaching outward: that is not a port opened
to anybody. So both chains are written around the links traffic arrives on. What did
not arrive from outside is accepted in one line; what did meets the declared rules.
The tunnel is named beside the outward links rather than treated as inside, or a port
nothing declares would be reachable from every machine in the mesh.

A machine that has not reported an outward link is sent no filter and keeps the one
it has, refused where a person reads it rather than as a rule set that will not load.

Removes the two constants, `node networks`, and the column behind it. novox/hq ADR
0140, superseding 0137 and 0139.

internal/catalogue/declaration.go

@@ -124,10 +124,15 @@ type Rendering struct {
 	// nothing on this node keeps them, or the mesh has no operator key.
 	Kept *KeptExport
 
-	// Routed is the networks this machine routes for what it hosts, beyond the container runtime's
-	// own default pools, which the filter allows without being told (novox/hq ADR 0137). A node-level
-	// fact: the machine routes them, and the module that loads the filter may be replaced.
-	Routed []string
+	// OutwardLinks is the links this machine reported as facing outside it, which the filter is
+	// written around (novox/hq ADR 0140). Empty means the machine has not said, and the mesh
+	// composes no filter for it rather than writing a rule around a link with no name.
+	OutwardLinks []string
+
+	// TunnelInterface is the interface the mesh's private network runs on, named here rather than
+	// imported because the overlay package rests on this one. Traffic arriving on it is the mesh's,
+	// not this machine's own guest, so the filter admits it only by a rule.
+	TunnelInterface string
 
 	// Foundation is the ports the mesh itself needs reachable on every machine, which no module
 	// declares because the foundation is not a module (novox/hq 04-ISSUES/051 and 052). The broker
@@ -350,7 +355,21 @@ func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[stri
 	if err != nil {
 		return nil, err
 	}
-	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation, with.Routed)
+	// **A machine that has not said which links face outside is sent no filter** (novox/hq ADR
+	// 0140). The whole chain is written around those links: with none, the rule that lets this
+	// machine's own guests keep working would name an empty set, which nftables refuses, and a rule
+	// set that does not load is a machine filtering nothing while its unit reports success. Refused
+	// here, where a person reads it, rather than on the machine — and the machine keeps the filter
+	// it already has.
+	if filters := r.filtersHere(); filters != "" && len(with.OutwardLinks) == 0 {
+		return nil, fmt.Errorf(
+			"%s cannot be sent a filter: it has not reported which of its links face outside, and "+
+				"every rule in the chain is written around them. It reports that on each apply; "+
+				"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
+				"keeps the filter it has", r.Node, r.Node, filters)
+	}
+	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
+		with.OutwardLinks, with.TunnelInterface)
 
 	var out []map[string]any
 	for _, m := range r.Modules {
@@ -857,6 +876,17 @@ func mapping(written string) (outer, inner int, address string, ok bool) {
 	return outer, inner, strings.Join(parts[:len(parts)-2], ":"), true
 }
 
+// filtersHere is the module on this node that loads the machine's packet filter, or empty when none
+// does. Named rather than counted: a refusal that says which module is one step from acted on.
+func (r Resolution) filtersHere() string {
+	for _, m := range r.Modules {
+		if m.Filtering != nil {
+			return m.Module
+		}
+	}
+	return ""
+}
+
 // Rules is the rule set this node's filter is derived from: every module's listens, what was
 // computed for this machine, and each module's per-node exposure. The same answer whether the node
 // is adopted or converged — the one loads it as a filter, the other declares it as openings.