The mesh says what filters a converged machine: filters kept per node, shown by node show, named by status, and previewed with their fates (hq ADR 0168)

A host reports every table and chain that refuses traffic with its owner,
and a converged machine's found firewall's state. The controller keeps both
on the node's record (migration 0054), shows them on node show, names every
converged machine something other than the mesh filters in status — text
and JSON, and such a machine is not well — and the converge preview lists
what filters the machine with the fate of each: retired with the front end,
left as the runtime's, left as a ban, or left in force and not the mesh's.
What was invisible for eleven hours (issues 144, 145) is said by name.

cmd/mesh-controller/status.go

@@ -227,6 +227,28 @@ func printStatus(asked answers) error {
 			"  not readable from a commit; that needs a version the host reports as ordered\n\n")
 	}
 
+	if len(asked.filtered) > 0 {
+		// A converged machine is filtered by the mesh alone, and the mesh says truthfully which
+		// (novox/hq ADR 0168). One that is not — a predecessor's chain still refusing, a found
+		// firewall in force again — is said here, and is not well.
+		machines := make([]string, 0, len(asked.filtered))
+		for name := range asked.filtered {
+			machines = append(machines, name)
+		}
+		sort.Strings(machines)
+		fmt.Printf("%d converged machine(s) are not filtered by the mesh alone:\n", len(machines))
+		for _, name := range machines {
+			f := asked.filtered[name]
+			if fw := f.FoundFirewall; fw != nil && fw.Active {
+				fmt.Printf("  %-12s the found firewall (%s) is in force again; the next apply retires it\n", name, fw.Kind)
+			}
+			for _, x := range f.Others() {
+				fmt.Printf("  %-12s %s (%s): %s\n", name, x.Where, x.Owner, x.Refuses)
+			}
+		}
+		fmt.Printf("\n  the mesh wrote none of these and removes none; `node show <node>` lists every filter with its owner\n\n")
+	}
+
 	if len(asked.untaken) > 0 {
 		// **Before the adopted line, and it breaks "all well".** An adopted machine is a state
 		// somebody chose and can leave alone; a module assigned to one and never taken is work
@@ -357,6 +379,13 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	if err != nil {
 		return answers{}, err
 	}
+	// And which converged machines something other than the mesh filters (novox/hq ADR 0168), as
+	// each last reported — the account that was missing when a predecessor's chain refused what the
+	// mesh declared open for eleven hours (04-ISSUES/144, 145).
+	out.filtered, err = filteredMachines(ctx, inv, out.nodes)
+	if err != nil {
+		return answers{}, err
+	}
 	out.plans, err = inv.RecentPlans(ctx, 5)
 	if err != nil {
 		return answers{}, err
@@ -406,6 +435,30 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 //
 // A machine that reports no holds contributes nothing, so a converged mesh answers an empty map and
 // the caller prints nothing.
+// filteredMachines is every converged machine not filtered by the mesh alone, with what it last said
+// filters it (novox/hq ADR 0168). An adopted machine keeps its found firewall by design and is not
+// counted; a machine that has not said is not said to be filtered by anything.
+func filteredMachines(ctx context.Context, inv *inventory.Inventory, nodes []inventory.Node) (
+	map[string]inventory.Filtering, error) {
+	out := map[string]inventory.Filtering{}
+	for _, n := range nodes {
+		if n.Adopted {
+			continue
+		}
+		f, err := inv.FilteringOf(ctx, n.Name)
+		if err != nil {
+			return nil, fmt.Errorf("what filters %s cannot be read: %w", n.Name, err)
+		}
+		if len(f.Filters) == 0 && f.FoundFirewall == nil {
+			continue
+		}
+		if !f.Alone() {
+			out[n.Name] = f
+		}
+	}
+	return out, nil
+}
+
 func untakenModules(ctx context.Context, inv *inventory.Inventory, nodes []inventory.Node) (
 	map[string]map[string]int, error) {
 
@@ -442,7 +495,8 @@ func untakenModules(ctx context.Context, inv *inventory.Inventory, nodes []inven
 // read as success for the whole of the edge cut-over outage (novox/hq 04-ISSUES/125).
 func (a answers) well() bool {
 	return len(a.wrong) == 0 && len(a.quiet) == 0 && len(a.behind) == 0 &&
-		len(a.waiting) == 0 && len(a.refused) == 0 && a.network == "" && len(a.untaken) == 0
+		len(a.waiting) == 0 && len(a.refused) == 0 && a.network == "" && len(a.untaken) == 0 &&
+		len(a.filtered) == 0
 }
 
 // hostSplit is which machines report which host version, for every version more than one machine