Raise a machine in use adopted: keep its firewall, load no dropping table, guard the mesh's own ports, and take only the mesh's own modules (hq ADR 0100)

internal/bootstrap/retire.go

@@ -132,18 +132,29 @@ func RetireTheTemporaryControlPlane(ctx context.Context, o Options, sys system.S
 // where the comment explaining it lives. A comment that outlives the thing it describes is worse
 // than no comment: it is the file telling somebody the machine has a control plane it does not.
 func removeResource(bundle []byte, id string) ([]byte, error) {
+	previous, from, to, err := resourceAt(bundle, id)
+	if err != nil {
+		return nil, err
+	}
+	return cut(bundle, previous, from, to), nil
+}
+
+// resourceAt finds one resource's object in a bundle's text by its id: where the one before it
+// ended, and where it starts and ends — comments and strings skipped, so an id quoted in a comment
+// or a command is never mistaken for the resource.
+func resourceAt(bundle []byte, id string) (previous, from, to int, err error) {
 	array := indexOutsideStrings(bundle, `"resources"`)
 	if array < 0 {
-		return nil, fmt.Errorf("this bundle has no resources array, so there is nothing to take out of it")
+		return 0, 0, 0, fmt.Errorf("this bundle has no resources array, so there is nothing to take out of it")
 	}
 	open := indexOutsideStrings(bundle[array:], "[")
 	if open < 0 {
-		return nil, fmt.Errorf("this bundle's resources are not a list")
+		return 0, 0, 0, fmt.Errorf("this bundle's resources are not a list")
 	}
 	open += array
 
-	depth, from := 0, -1
-	previous := open
+	depth := 0
+	from, previous = -1, open
 	inString, escaped, inLine, inBlock := false, false, false, false
 	for i := open + 1; i < len(bundle); i++ {
 		c := bundle[i]
@@ -181,16 +192,16 @@ func removeResource(bundle []byte, id string) ([]byte, error) {
 				break
 			}
 			if isResource(bundle[from:i+1], id) {
-				return cut(bundle, previous, from, i+1), nil
+				return previous, from, i + 1, nil
 			}
 			previous = i + 1
 			from = -1
 		case c == ']' && depth == 0:
-			return nil, fmt.Errorf(
+			return 0, 0, 0, fmt.Errorf(
 				"this bundle declares no %q, so there is nothing to take out of it", id)
 		}
 	}
-	return nil, fmt.Errorf("this bundle's resources list does not end")
+	return 0, 0, 0, fmt.Errorf("this bundle's resources list does not end")
 }
 
 // isResource reports whether one resource's text is the one wanted.