The host says what filters the machine, with owners, and keeps the found firewall retired on every converged apply (hq ADR 0168)

Every table and chain that refuses traffic is reported with whose it is:
the mesh's, the found firewall's, the container runtime's own, a ban, or
other — the runtime's user chain is other, which is where both predecessors
kept their rules, in the legacy filter on one machine and invisible to the
mesh. Adoption's threshold does not move; a converged machine's report
grows by its filters and its found firewall's state.

Convergence is a state the host keeps: a found firewall enabled again is
retired again and said; a reconcile that finds it inactive records that it
was found so, never that the mesh did it; a step skipped after a failed
apply is said. A retirement the mesh began and did not finish is finished.

Fixtures are rulesets captured from three machines of the first mesh.

internal/store/store.go

@@ -232,8 +232,13 @@ type FoundFirewall struct {
 	// retires, and returning it to adopted restores.
 	WasActive bool `json:"was_active,omitempty"`
 	// DisabledByMesh is set when converging retired it, so returning to adopted enables it again
-	// and nothing else ever does.
+	// and nothing else ever does. It means exactly that (novox/hq ADR 0168): a reconcile that finds
+	// the firewall already inactive records RetiredBy and never this.
 	DisabledByMesh bool `json:"disabled_by_mesh,omitempty"`
+	// RetiredBy says how the found firewall came to be inactive on a converged machine: "mesh" when
+	// the mesh disabled it, "found-inactive" when a reconcile found it so and nothing of the mesh's
+	// had done it. Empty while it is in force or the machine is adopted.
+	RetiredBy string `json:"retired_by,omitempty"`
 	// Forward is each family's forward policy as it was before the mesh disabled the firewall,
 	// by the tool that sets it — recorded before, so a retirement retried puts back what the
 	// machine had.