Transit, host firewalls, and the whole topology raising

The full topology now raises: four machines, three routers, a transit
router, six segments, in 35 seconds. Everything the declaration model can
express except `place`, which is refused because the node host it would
place does not exist yet.

Transit was a real gap, not a bug. The design says public networks are
unrelated and routed to each other, never bridged — and I built the
segments and never built the thing that routes between them, so three
public networks were islands and nothing crossed. A transit router now
holds an interface on every public segment, forwarding and no translation:
the closest thing the lab has to the internet, deliberately dumb.

Proven rather than asserted, by ping TTL across the raised topology:

  within one segment                     ttl=64   no hops
  across two unrelated public networks   ttl=62   gateway + transit
  multicast between public networks      0 replies

A flat internet would have shown ttl=64 and answered multicast — which
would let a node discover a peer it could never reach in production, and
report success. That is the fault the as-is layer records the mesh already
hitting with multicast name resolution.

inbound: deny is implemented as a host firewall on the machine, read back
after applying. A declared refusal that silently did not load leaves the
machine wide open, which looks exactly like a machine that is working.
Established and related traffic is accepted, so a defended machine can
still dial out rather than being a disconnected one.

Verified by running, all of it:

  home -> devices (policy allow)               reachable
  devices -> home (policy deny)                blocked
  behind unforwardable NAT -> out              reachable
  in -> behind unforwardable NAT               unreachable
  inbound: deny, dialling out                  reachable
  reaching a machine that denies inbound       refused

The two routers differ exactly as declared: the forwardable one carries the
policy rule and no inbound drop, the unforwardable one carries `ct state
new drop` and no DNAT.

test/supported.test.ts

@@ -41,11 +41,11 @@ machines:
   assert.doesNotThrow(() => assertSupported(scenario));
 });
 
-test("inbound: deny is still refused rather than silently absent", () => {
+test("inbound: deny is implemented — a host firewall is applied and read back", () => {
   const scenario = parseScenario(`scenario: x
 segments: { net: { kind: public, cidr: [192.0.2.0/24] } }
 machines: { a: { at: { segment: net, address: [192.0.2.1] }, inbound: deny } }`);
-  assert.throws(() => assertSupported(scenario), UnsupportedError);
+  assert.doesNotThrow(() => assertSupported(scenario));
 });
 
 test("place is still refused — there is nothing to place yet", () => {
@@ -56,16 +56,16 @@ place: { all: [host] }`);
   assert.throws(() => assertSupported(scenario), UnsupportedError);
 });
 
-test("the refusal names every gap, not just the first", () => {
+test("the refusal explains what would silently be missing", () => {
   const scenario = parseScenario(`scenario: x
 segments: { net: { kind: public, cidr: [192.0.2.0/24] } }
-machines: { a: { at: { segment: net, address: [192.0.2.1] }, inbound: deny } }
+machines: { a: { at: { segment: net, address: [192.0.2.1] } } }
 place: { all: [host] }`);
   try {
     assertSupported(scenario);
     assert.fail("should have refused");
   } catch (err) {
-    assert.equal((err as UnsupportedError).missing.length, 2);
+    assert.equal((err as UnsupportedError).missing.length, 1);
     assert.match(err instanceof Error ? err.message : "", /silently lacks them/);
   }
 });