@@ -610,13 +610,25 @@ jobs:
         env:
           DOCKER_CONFIG: ${{ runner.temp }}/.docker
       - name: Build VyOS router image (qcow2 + containerDisk)
-        run: make -C packages/system/vyos-router-image image
+        run: |
+          mkdir -p _out/oci
+          make -C packages/system/vyos-router-image image
         env:
           DOCKER_CONFIG: ${{ runner.temp }}/.docker
           BUILDER: ${{ steps.buildx.outputs.name }}
           IMAGE_TAG: pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
           PUBLISH_VERSIONED: '0'
           PUBLISH_FLOATING: '0'
+          # Same fork handling as the per-package build job, and it was missing
+          # here. The login step above is correctly skipped on a fork, but nothing
+          # took its place: PUSH stayed on, so a fork PR touching the appliance or
+          # its consumers pushed with a read-only token, failed, and took finalize
+          # and e2e down with it. Export to an OCI archive instead and let the
+          # privileged e2e-fork.yaml workflow_run push it by digest. Empty on
+          # same-repo PRs → normal push path; setting it also forces PUSH/LOAD off
+          # in common-envs.mk (#3257). Absolute, because `make -C <pkg>` makes
+          # buildx resolve a relative dest against the package directory.
+          OCI_EXPORT_DIR: ${{ github.event.pull_request.head.repo.fork && format('{0}/_out/oci', github.workspace) || '' }}
       - name: Capture VyOS patch fragment
         run: |
           mkdir -p _out/fragments
@@ -631,6 +643,16 @@ jobs:
           name: pr-patch-fragment-vyos
           path: _out/fragments/vyos.patch
           if-no-files-found: error
+      # Fork PR only: the containerDisk was exported rather than pushed
+      # (OCI_EXPORT_DIR above). The name has to match e2e-fork.yaml's
+      # `pattern: pr-oci-*` or the archive is built and then ignored.
+      - name: Upload OCI image archives (fork PR)
+        if: ${{ github.event.pull_request.head.repo.fork }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: pr-oci-vyos
+          path: _out/oci/*.oci.tar
+          if-no-files-found: error
 
   # Reassemble the unified pr.patch from every fragment, then build the installer
   # LAST: `make -C packages/core/installer image` runs `flux push artifact
 
@@ -135,6 +135,16 @@ transfer_from_b() {
 }
 
 # hubble_dropped <dst> <reason-substring>
+#
+# NO CURRENT CALLER, deliberately kept. The two cases that used it (a foreign
+# tenant pod, the kubernetes API ClusterIP) now assert the guest counter instead:
+# TUNNEL-INGRESS admits one /32 per Pod IP and Service ClusterIP owned by the
+# tenant namespace rather than the whole pod/service CIDRs, so both packets die
+# at the guest and never reach the pod veth where Cilium enforces. Asserting a
+# POLICY_DENIED record there failed BECAUSE the isolation is stronger than the
+# assertion assumed. Exercising the Cilium layer needs a probe originating inside
+# the pod network, which this suite does not have; this helper is what that probe
+# would use.
 #   Assert a Cilium DROPPED flow toward <dst> matching <reason> from the
 #   cilium-monitor capture taken over the probe window (POLICY_DENIED maps to
 #   cilium-monitor's "Policy denied"). Hubble need not be enabled.
 
@@ -702,11 +702,12 @@ spec:
                 -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
               API_CLUSTERIP=$(kubectl -n default get svc kubernetes -o jsonpath='{.spec.clusterIP}')
               # A POD-NETWORK pod outside tenant-test (another tenant / a system
-              # namespace). Must be pod-network (podIP != hostIP): a host-network
-              # pod's IP is a node address, which the guest TUNNEL-INGRESS drops
-              # before Cilium — this case must exercise the Cilium pod-identity
-              # policy, so filter those out and take the first pod-network pod in
-              # any other namespace.
+              # namespace). Still filtered to podIP != hostIP, but no longer to
+              # steer the drop to Cilium — the guest drops every foreign address
+              # now (see case 2). The filter stays so the probe target is a real
+              # cross-tenant pod address rather than a node address, which case 3
+              # already covers separately and which would make this case a
+              # duplicate rather than the cross-tenant one it is meant to be.
               OTHER_POD_IP=$(kubectl get pods -A \
                 -o jsonpath='{range .items[*]}{.status.podIP}{" "}{.status.hostIP}{" "}{.metadata.namespace}{"\n"}{end}' \
                 | awk -v ns="$NAMESPACE" '$1!="" && $1!=$2 && $3!=ns {print $1; exit}')
@@ -743,11 +744,23 @@ spec:
                   "guest_counter_flat TUNNEL-INGRESS default-action" \
                   tcp "$BACKEND_IP" 8080
 
-              # 2. Another tenant's pod → Cilium tenant isolation (POLICY_DENIED):
-              #    dest is in the pod CIDR so the guest dest-constraint admits it;
-              #    the pod-layer identity policy is what drops it.
+              # 2. Another tenant's pod → guest TUNNEL-INGRESS dest-constraint.
+              #    This asserted a Cilium POLICY_DENIED record until the
+              #    destination set was narrowed: the guest admits one /32 per Pod
+              #    IP and Service ClusterIP owned by THIS namespace, not the whole
+              #    pod CIDR, so a foreign pod IP matches no accept and dies at the
+              #    guest default-action. It never reaches the pod veth, Hubble
+              #    never records it, and the old assertion failed precisely
+              #    BECAUSE the isolation is stronger than it assumed.
+              #
+              #    What that costs: the tunnel can no longer exercise Cilium's
+              #    pod-identity policy as a second layer, because nothing survives
+              #    the guest to reach it. Cross-tenant isolation is asserted here
+              #    at the layer that actually enforces it. The Cilium layer needs
+              #    its own probe from inside the pod network, which is not this
+              #    suite.
               assert_dropped "another tenant's pod" \
-                "hubble_dropped $OTHER_POD_IP POLICY_DENIED" \
+                "guest_counter_incremented TUNNEL-INGRESS default-action" \
                 tcp "$OTHER_POD_IP" 8080
 
               # 3. Node address → guest TUNNEL-INGRESS dest-constraint (node/join
@@ -756,15 +769,14 @@ spec:
                 "guest_counter_incremented TUNNEL-INGRESS default-action" \
                 tcp "$NODE_IP" 10250
 
-              # 4. Kubernetes API ClusterIP → Cilium (reserved:kube-apiserver
-              #    identity denies the routed source). TUNNEL-INGRESS rule 20 admits
-              #    the service CIDR, so the guest forwards it; Cilium then denies it
-              #    at the kube-apiserver identity. The ClusterIP is DNAT'd to the
-              #    apiserver endpoint BEFORE the policy check, so the drop record
-              #    carries the "kube-apiserver" identity, not the ClusterIP — match
-              #    on that identity rather than $API_CLUSTERIP.
+              # 4. Kubernetes API ClusterIP → guest TUNNEL-INGRESS dest-constraint,
+              #    for the same reason as case 2. The old comment described a rule
+              #    admitting the whole service CIDR; the implementation admits only
+              #    ClusterIPs owned by this namespace, and the kubernetes Service
+              #    lives in `default`. So the packet is dropped at the guest and
+              #    produces no Cilium record to match on.
               assert_dropped "kubernetes API" \
-                "hubble_dropped kube-apiserver POLICY_DENIED" \
+                "guest_counter_incremented TUNNEL-INGRESS default-action" \
                 tcp "$API_CLUSTERIP" 443
 
               # 5. 169.254.0.0/16 incl. metadata → guest TUNNEL-INGRESS
 
@@ -578,22 +578,38 @@ func (r *SiteRouterReconciler) programNamespaceRoutes(ctx context.Context, inst
 		}
 		return fmt.Errorf("merge routes for namespace %s: %w", inst.namespace, err)
 	}
-	if err := r.rememberRouteGatewayIP(ctx, inst, gatewayIP); err != nil {
-		return fmt.Errorf("remember route gateway IP: %w", err)
-	}
-	if ns.Annotations[routesAnnotation] == merged {
-		return nil // already programmed; nothing to apply
+	if ns.Annotations[routesAnnotation] != merged {
+		apply := &corev1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        inst.namespace,
+				Annotations: map[string]string{routesAnnotation: merged},
+			},
+		}
+		apply.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
+		if err := r.Patch(ctx, apply, client.Apply, client.FieldOwner(routesFieldOwner), client.ForceOwnership); err != nil {
+			return fmt.Errorf("apply routes annotation on namespace %s: %w", inst.namespace, err)
+		}
 	}
 
-	apply := &corev1.Namespace{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:        inst.namespace,
-			Annotations: map[string]string{routesAnnotation: merged},
-		},
-	}
-	apply.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Namespace"))
-	if err := r.Patch(ctx, apply, client.Apply, client.FieldOwner(routesFieldOwner), client.ForceOwnership); err != nil {
-		return fmt.Errorf("apply routes annotation on namespace %s: %w", inst.namespace, err)
+	// Ownership is recorded only AFTER the entries it claims are in the
+	// namespace, and the order is the whole point. This annotation is the only
+	// way a later reconcile can tell which entries in a shared annotation are
+	// this gateway's, and mergeRoutes needs BOTH the current and the previous IP
+	// to migrate them when the gateway pod is replaced.
+	//
+	// Recording first loses that. Write the new IP, fail or crash before the
+	// namespace patch, and the next reconcile reads the new IP as "previous":
+	// the entry still keyed to the old one now looks like a co-tenant
+	// site-router's, so mergeRoutes returns RouteConflict on every attempt and
+	// reconcileDelete cannot identify it either. Nothing recovers that without
+	// hand-editing the namespace.
+	//
+	// This order fails safe instead. A crash between the patch and this write
+	// leaves the previous IP recorded, so the next reconcile migrates the same
+	// entries again and converges — mergeRoutes is idempotent under a repeated
+	// migration, which is what TestProgramNamespaceRoutes_GatewayIPChange covers.
+	if err := r.rememberRouteGatewayIP(ctx, inst, gatewayIP); err != nil {
+		return fmt.Errorf("remember route gateway IP: %w", err)
 	}
 	return nil
 }
 
@@ -22,6 +22,7 @@ import (
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	"sigs.k8s.io/controller-runtime/pkg/client/interceptor"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	"github.com/cozystack/cozystack/internal/siterouter/denyset"
@@ -779,3 +780,129 @@ func TestClassify_RecordsEveryFailure(t *testing.T) {
 		})
 	}
 }
+
+// TestProgramNamespaceRoutes_GatewayIPChange is the write-ordering regression.
+//
+// The routes annotation is shared by every site-router in the namespace, and the
+// only thing distinguishing this gateway's entries from a co-tenant's is the gw
+// address. When the gateway pod is replaced, mergeRoutes needs BOTH the new IP
+// and the previously recorded one to migrate those entries.
+//
+// Recording the new IP before writing the entries loses that. If the namespace
+// patch then fails, the next reconcile reads the new IP as "previous", the entry
+// still keyed to the old one looks like somebody else's, and mergeRoutes returns
+// RouteConflict forever with reconcileDelete unable to identify it either.
+// Nothing short of hand-editing the namespace recovers it.
+func TestProgramNamespaceRoutes_GatewayIPChange(t *testing.T) {
+	newFixture := func(t *testing.T, failPatch bool) (*SiteRouterReconciler, *instance) {
+		t.Helper()
+		hr := siteRouterHRWithValues(t, "demo", map[string]interface{}{
+			"remoteCIDRs": []interface{}{"172.31.0.0/16"},
+		})
+		hr.Annotations = map[string]string{routeGatewayIPAnnotation: "10.244.0.5"}
+		ns := &corev1.Namespace{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:        "tenant-test",
+				Annotations: map[string]string{routesAnnotation: `[{"dst":"172.31.0.0/16","gw":"10.244.0.5"}]`},
+			},
+		}
+		// The replacement gateway pod, on a different IP.
+		gateway := gwPod("virt-launcher-"+releasePrefix+"demo-fghij", "demo", "10.244.0.6")
+
+		scheme := runtime.NewScheme()
+		if err := clientgoscheme.AddToScheme(scheme); err != nil {
+			t.Fatalf("add client-go scheme: %v", err)
+		}
+		if err := helmv2.AddToScheme(scheme); err != nil {
+			t.Fatalf("add helm-controller scheme: %v", err)
+		}
+		b := fake.NewClientBuilder().WithScheme(scheme).WithObjects(hr, ns, gateway, cozystackConfigMap())
+		if failPatch {
+			b = b.WithInterceptorFuncs(interceptor.Funcs{
+				Patch: func(ctx context.Context, c client.WithWatch, obj client.Object, patch client.Patch, opts ...client.PatchOption) error {
+					if _, isNS := obj.(*corev1.Namespace); isNS {
+						return errors.New("simulated apiserver failure writing the namespace annotation")
+					}
+					return c.Patch(ctx, obj, patch, opts...)
+				},
+			})
+		}
+		r := &SiteRouterReconciler{Client: b.Build(), Scheme: scheme, ManagementCIDR: "10.244.0.0/16"}
+
+		live := &helmv2.HelmRelease{}
+		if err := r.Get(context.Background(), types.NamespacedName{Namespace: hr.Namespace, Name: hr.Name}, live); err != nil {
+			t.Fatalf("get HelmRelease: %v", err)
+		}
+		values, err := decodeValues(live)
+		if err != nil {
+			t.Fatalf("decode values: %v", err)
+		}
+		return r, &instance{hr: live, name: "demo", namespace: "tenant-test", values: values, gatewayPod: gateway}
+	}
+
+	t.Run("a failed namespace write leaves the previous owner recorded", func(t *testing.T) {
+		r, inst := newFixture(t, true)
+
+		if err := r.programNamespaceRoutes(context.Background(), inst); err == nil {
+			t.Fatal("expected the namespace patch failure to propagate")
+		}
+
+		hr := &helmv2.HelmRelease{}
+		if err := r.Get(context.Background(), types.NamespacedName{Namespace: "tenant-test", Name: releasePrefix + "demo"}, hr); err != nil {
+			t.Fatalf("get HelmRelease: %v", err)
+		}
+		if got := hr.Annotations[routeGatewayIPAnnotation]; got != "10.244.0.5" {
+			t.Fatalf("route owner = %q, want the PREVIOUS gateway IP 10.244.0.5 still recorded; "+
+				"recording %q before the entries it claims strands the old entry permanently", got, got)
+		}
+	})
+
+	t.Run("the migration converges when the namespace write succeeds", func(t *testing.T) {
+		r, inst := newFixture(t, false)
+
+		if err := r.programNamespaceRoutes(context.Background(), inst); err != nil {
+			t.Fatalf("program routes: %v", err)
+		}
+
+		ns := &corev1.Namespace{}
+		if err := r.Get(context.Background(), types.NamespacedName{Name: "tenant-test"}, ns); err != nil {
+			t.Fatalf("get namespace: %v", err)
+		}
+		if got := routeSet(t, ns.Annotations[routesAnnotation])["172.31.0.0/16"]; got != "10.244.0.6" {
+			t.Errorf("route should have migrated to the replacement gateway, got gw %q", got)
+		}
+
+		hr := &helmv2.HelmRelease{}
+		if err := r.Get(context.Background(), types.NamespacedName{Namespace: "tenant-test", Name: releasePrefix + "demo"}, hr); err != nil {
+			t.Fatalf("get HelmRelease: %v", err)
+		}
+		if got := hr.Annotations[routeGatewayIPAnnotation]; got != "10.244.0.6" {
+			t.Errorf("route owner = %q, want the new gateway IP 10.244.0.6 once the entries carry it", got)
+		}
+	})
+
+	t.Run("a repeated migration is idempotent, so a crash before the owner write converges", func(t *testing.T) {
+		// The state the first subtest leaves behind: entries already migrated,
+		// owner still recording the old IP. Running again must not conflict.
+		r, inst := newFixture(t, false)
+		if err := r.programNamespaceRoutes(context.Background(), inst); err != nil {
+			t.Fatalf("first pass: %v", err)
+		}
+		// Put the owner annotation back to the old IP, as a crash between the two
+		// writes would leave it, and reconcile again.
+		inst.hr.Annotations[routeGatewayIPAnnotation] = "10.244.0.5"
+		if err := r.Update(context.Background(), inst.hr); err != nil {
+			t.Fatalf("rewind owner annotation: %v", err)
+		}
+		if err := r.programNamespaceRoutes(context.Background(), inst); err != nil {
+			t.Fatalf("second pass must converge rather than conflict: %v", err)
+		}
+		ns := &corev1.Namespace{}
+		if err := r.Get(context.Background(), types.NamespacedName{Name: "tenant-test"}, ns); err != nil {
+			t.Fatalf("get namespace: %v", err)
+		}
+		if got := routeSet(t, ns.Annotations[routesAnnotation])["172.31.0.0/16"]; got != "10.244.0.6" {
+			t.Errorf("route should still point at the replacement gateway, got gw %q", got)
+		}
+	})
+}
@@ -98,6 +98,10 @@ const (
 	// certificate to pin, so the channel that carries the token is not verified.
 	reasonAPITLSUnverified = "APITLSUnverified"
 
+	// reasonNoTunnelDestinations marks an instance whose destination set resolved
+	// empty, which now means the guest accepts no new decrypted flows at all.
+	reasonNoTunnelDestinations = "NoTunnelDestinations"
+
 	// reasonTunnelNotConfigured marks an instance that carries no usable tunnel
 	// because peer.address or the PSK resolved empty. The schema requires
 	// peer.address, but `required` only means the key is present and its default
@@ -593,6 +597,20 @@ func (r *SiteRouterReconciler) resolveInputs(ctx context.Context, inst *instance
 	if err != nil {
 		return render.Inputs{}, err
 	}
+	// The renderer now refuses to emit any new-flow accept without destinations,
+	// which is the right failure but an invisible one: the tunnel comes up and
+	// carries only return traffic. The set is supposed to be non-empty on every
+	// pushing path (the chart's LoadBalancer Service always holds a ClusterIP in
+	// this namespace), so reaching this means that invariant broke — say which
+	// way rather than leaving a tunnel that mysteriously forwards nothing.
+	if len(tenantCIDRs) == 0 && len(remoteCIDRs) > 0 {
+		log.FromContext(ctx).Info("no tunnel destinations resolved; the guest will accept no new decrypted flows",
+			"instance", inst.name, "namespace", inst.namespace)
+		if r.Recorder != nil {
+			r.Recorder.Event(inst.hr, corev1.EventTypeWarning, reasonNoTunnelDestinations,
+				"no Pod IP or Service ClusterIP resolved in this namespace, so the gateway accepts no new decrypted flows; this clears itself once the tunnel Service and the tenant's workloads are present")
+		}
+	}
 
 	in := render.Inputs{
 		ManagementCIDR:     r.ManagementCIDR,