`restore` with no prior membership now withdraws the stable endpoint's
firewall allow before it writes the fragment and reloads. A failing `ufw
delete` retries without touching nginx, which bounds the withdrawal reload
loop at zero until the Q3-ii cut gives the abort a deadline. A crash between
the two steps is safe: a rule already gone reads as withdrawn, and the retry
removes the fragment and reloads.
Pins from Soul pass 2:
- MB2: a redeploy over an existing incumbent route installs, rolls back and
withdraws with a reload each (`changes_route` as `is_none()` survived).
- ME2/ME3: the resolver's command filter is tested with an id of equal
length and the same leading bytes.
- MJ2: the backoff test asserts the wait `back_off` writes, one poll after
the failure.
- Soul's F2 probe returns as a test: a withdrawal whose `ufw delete` keeps
failing reloads nginx not at all over 20 retries.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
f85e74377f