From 8baddceb96cfe88fd17478dbd2620a4921ae00ef Mon Sep 17 00:00:00 2001
From: Andreas Wrede <andreas@wrede.ca>
Date: Wed, 23 Sep 2026 19:13:43 -0400
Subject: [PATCH] apply-network: ignore VANLINK_WAN_NETPLAN; pin with a test

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9
---
 deploy.sh                | 2 +-
 tests/check-templates.sh | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/deploy.sh b/deploy.sh
index b34fee1..43e0ccb 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -516,7 +516,7 @@ apply_network() {  # ./deploy.sh --apply-network [--force] — explicit, root; c
     if [ "$force" = 0 ] && [ "$(apply_status_blocks_run "$st")" = yes ]; then
         die "the last apply did not finish cleanly: $(cat "$st" 2>/dev/null) — inspect $st and $log, check the backup dir named there, then re-run with --force"
     fi
-    if [ "$force" = 0 ] && [ "$(nm_wan_state_netplan)" = matches ] && [ ! -e /etc/netplan/10-dhcp-all-interfaces.yaml ]; then
+    if [ "$force" = 0 ] && [ "$(VANLINK_WAN_NETPLAN='' nm_wan_state_netplan)" = matches ] && [ ! -e /etc/netplan/10-dhcp-all-interfaces.yaml ]; then
         echo "nothing to apply (WAN netplan already matches; use --force to re-apply)"
         return 0
     fi
diff --git a/tests/check-templates.sh b/tests/check-templates.sh
index c8d590d..8cb2d0c 100755
--- a/tests/check-templates.sh
+++ b/tests/check-templates.sh
@@ -501,6 +501,11 @@ echo "$o" | grep -q -- "-> post-deploy: NetworkManager connection $conn not foun
 echo "$o" | grep -q -- '-> post-deploy: WAN netplan differs' && ok "19e: netplan differs -> warn" || bad "19e: netplan warn missing"
 printf 'id=%s\n' "$conn" > "$tc/nm/x.nmconnection"
 nm | grep -q "   ok    NetworkManager connection $conn exists" && ok "19e: cellular keyfile scan -> ok" || bad "19e: keyfile scan ok missing"
+# 19f. VANLINK_WAN_NETPLAN is a read-only-path test knob: apply_network must neutralise it, and no apply code reads other VANLINK_* vars
+an=$(sed -n '/^apply_network() {/,/^}/p' deploy.sh)
+echo "$an" | grep -q "VANLINK_WAN_NETPLAN='' nm_wan_state_netplan" && ! echo "$an" | grep -E 'nm_wan_state_netplan' | grep -qv "VANLINK_WAN_NETPLAN=''" \
+    && ok "19f: apply_network neutralises VANLINK_WAN_NETPLAN" || bad "19f: apply_network must call VANLINK_WAN_NETPLAN='' nm_wan_state_netplan"
+if { echo "$an"; sed -n '/^apply_helper_script() {/,/^}/p' deploy.sh; } | grep 'VANLINK_' | grep -vE 'VANLINK_CONF|VANLINK_WAN_NETPLAN=' | grep -q .; then bad "19f: apply path reads a VANLINK_* variable"; else ok "19f: apply path reads no VANLINK_* variable besides VANLINK_CONF"; fi
 rm -rf "$tc"
 
 exit "$fail"