Apply one declaration at a time, so the link and the reconcile do not lose each other's record

cmd/mesh-host/main.go

@@ -799,10 +799,22 @@ func applyDeclared(ctx context.Context, opts options, raw []byte, sched *apply.S
 	return applyAndKeep(ctx, opts, raw, nil, sched)
 }
 
+// applying serialises applies on this node.
+//
+// **Two things apply here: the link and the reconcile loop**, and each reads the node's state,
+// acts on the machine, and writes the state back. Run at the same time they interleave, and the
+// one that saves last writes a state read before the other acted — losing what the first recorded:
+// a hold, the firewall found here, a resource just applied. The machine would then be one thing
+// and its record another, which is the fault every read-back in this package exists to prevent.
+var applying sync.Mutex
+
 // applyAndKeep applies a declaration and, when it came from the mesh, keeps it so this node can
-// go on obeying it while disconnected.
+// go on obeying it while disconnected. One at a time, whoever asks.
 func applyAndKeep(ctx context.Context, opts options, raw []byte, signed *store.Declared,
 	sched *apply.Scheduler) link.Report {
+	applying.Lock()
+	defer applying.Unlock()
+
 	declared, err := declaration.Parse(raw)
 	if err != nil {
 		return link.Report{Refused: err.Error()}