Check mode grants recently approved users a prompt-free Accept rule
with a short RuleExpires. When that rule expired, the connection's
policy recheck matched the base HoldAndDelegate rule instead. The
recheck read that as a policy edit and closed the connection, killing
live sessions when the prompt-free window lapsed.
Remember the rule that matched at authentication. If it has expired and
a hold rule matches instead, keep the connection. Re-authentication is
required only for new connections.
A policy edit that swaps a still-valid accept rule for a hold rule still
closes the connection. Recorder, identity, and accept-env checks still
run on the fallback path.
Updates tailscale/corp#50380
Signed-off-by: James Tucker <james@tailscale.com>
James Tucker
392c91bb86