Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)

internal/bootstrap/phase2.go

@@ -150,16 +150,22 @@ func PlaceOnTheNetwork(ctx context.Context, o Options, control controlPlane,
 
 // ChooseAndInstallFilter picks the packet filter — required, so the question is which, not
 // whether — and installs it.
-func ChooseAndInstallFilter(ctx context.Context, o Options, control controlPlane, say func(string)) error {
+func ChooseAndInstallFilter(ctx context.Context, o Options, control controlPlane, say func(string)) (string, error) {
 	filter, err := decide(Choice{
 		Name:     "packet-filter",
 		Question: "Which packet filter should this machine run?",
 		Options:  []string{"nftables"},
 	}, o.Answers["packet-filter"], o.Prompt, say)
 	if err != nil {
-		return err
+		return "", err
 	}
-	return InstallFromCatalogue(ctx, o, control, filter, say)
+	if o.Adopted {
+		// The firewall found here stays in force until the node converges; the filter is
+		// chosen now and assigned by the flip (novox/hq ADR 0100).
+		say("  not installed     " + filter + " — this machine is adopted; converging it assigns " + filter)
+		return filter, nil
+	}
+	return filter, InstallFromCatalogue(ctx, o, control, filter, say)
 }
 
 // InstallExtras installs what was asked for beyond the floor.