Retire the found firewall only on a converged declaration from the mesh, never on a carried apply (hq ADR 0100)

2026-09-22 18:01:49 +02:00
parent c989b57439
commit 9033e3da98
3 changed files with 30 additions and 4 deletions
@@ -318,7 +318,7 @@ func ApplyKeeping(
 	// A converged node whose found firewall was in force retires it only now, once everything —
 	// the mesh's derived filter among it — applied cleanly (novox/hq ADR 0100).
 	if len(failures) == 0 {
-		if err := retireFirewall(ctx, d, &known, run, log); err != nil {
+		if err := retireFirewall(ctx, d, origin, &known, run, log); err != nil {
 			return report, known, &Error{Resource: "the firewall found on this machine", Err: err, Done: report}
 		}
 	}