The node keeps the mesh's own certificate it applies, from its kept declaration at start, for its record; one agent test folded to hold the count (issue 1126, ADR 0555 §3)

cmd/mesh-host/main.go

@@ -2152,6 +2152,9 @@ func recordKeys(state string) func() link.RecordKeys {
 		if cert, err := os.ReadFile(identity.CertificatePath(state)); err == nil {
 			k.Certificate = string(cert)
 		}
+		if authority, err := os.ReadFile(authorityPath(state)); err == nil {
+			k.Authority = string(authority)
+		}
 		return k
 	}
 }