The control plane's firewall answered only the networks it was installed with, so a node on another subnet was set up, could not reach 7443 and showed as lost. node add now admits the node's network (or its address, when routed) into the local ruleset, keeping everything already there. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>