Keep the derived filter in force when a guard resource failed on the way back to adopted (hq ADR 0103)

internal/apply/apply.go

@@ -290,6 +290,17 @@ func ApplyKeeping(
 	var failures []*Error
 	for i, resource := range ordered {
 		if !orphansRemoved && i == guardFirst {
+			// **Only a guard that is up may let the filter go.** Removing the derived filter's
+			// resources stops its unit, whose stop deletes the mesh's table; if a guard resource
+			// failed, doing that would leave the node with neither, and the store open until some
+			// later reconcile gets the guard up (novox/hq ADR 0103).
+			if len(failures) > 0 {
+				first := failures[0]
+				first.Done = report
+				first.Others = len(failures) - 1
+				log("  kept " + guardPrefix + "*: the guard is not up, so what it replaces was left in force")
+				return report, known, first
+			}
 			if err := removeOrphans(); err != nil {
 				return report, known, err
 			}