I think I now understand X.25 CUGs (closed user groups)
(IOS interface-level CUG configuration appeared to be completely backwards... until I realized it is available only on DCE mode interfaces, which reminded me how *highly* asymmetric the whole thing is. There's the "network" (DCE) and there's the "customer" (DTE). So calls exiting a DCE interface are called "incoming calls" because they're incoming to the customer, despite physically being outgoing... and the translation from network CUGs to local CUGs (instead of the other way around) makes sense because the router *is* "the network".)

