Finding from the ESXi E2E (2026-07-21). A failed or partial AdoptNode that got as far as ApplyConfig leaves the maintenance node with a staged config on disk that pins the bootstrap admin from that attempt. It survives reboot, so re-adopting with a freshly minted admin fails at the maintenance mTLS handshake (the node demands the old admin CA; the new self-signed cert does not match). The only recovery is wiping the node's disk (recreating the VM).
Adoption should be retryable: either (a) a maintenance node with a staged-but-not-completed config should accept re-adoption (replace the staged config + admin), or (b) provide an explicit 'clear staged config' path in maintenance, or (c) the manager should detect the pinned-admin case and surface a clear 'node partially provisioned; reset required' error instead of an opaque 'tls: certificate required'. Part of manager#24.
Finding from the ESXi E2E (2026-07-21). A failed or partial AdoptNode that got as far as ApplyConfig leaves the maintenance node with a staged config on disk that pins the bootstrap admin from that attempt. It survives reboot, so re-adopting with a freshly minted admin fails at the maintenance mTLS handshake (the node demands the old admin CA; the new self-signed cert does not match). The only recovery is wiping the node's disk (recreating the VM).
Adoption should be retryable: either (a) a maintenance node with a staged-but-not-completed config should accept re-adoption (replace the staged config + admin), or (b) provide an explicit 'clear staged config' path in maintenance, or (c) the manager should detect the pinned-admin case and surface a clear 'node partially provisioned; reset required' error instead of an opaque 'tls: certificate required'. Part of manager#24.