Maestro Reload: preserve admission epoch rejection during activation

src/maestro/reload_supervisor.rs

@@ -309,13 +309,21 @@ impl ReloadSupervisor {
         } else {
             None
         };
+        let quota_guard = new_runtime
+            .proxy_shared
+            .quota_mutation_gate()
+            .lock_owned()
+            .await;
         let config = new_runtime.config();
-        let _ = new_runtime.proxy_shared.activate_user_config_source(
-            new_runtime.id,
-            Some(user_admission_epoch),
-            &config.access.users,
-            &config.access.user_enabled,
-        );
+        let user_config_accepted = new_runtime
+            .proxy_shared
+            .activate_user_config_source(
+                new_runtime.id,
+                Some(user_admission_epoch),
+                &config.access.users,
+                &config.access.user_enabled,
+            )
+            .is_some();
         let _ = new_runtime
             .ip_tracker
             .apply_policy_from_source(
@@ -343,6 +351,15 @@ impl ReloadSupervisor {
             old_runtime.stop_accepting_sessions();
             listener_manager.activate_runtime_generation(new_runtime.clone())
         };
+        // A rejected admission epoch must not be bypassed by reapplying the prepared
+        // snapshot. Quota publication retains its credential and source checks.
+        let config = new_runtime.config();
+        new_runtime.proxy_shared.publish_quota_config(
+            new_runtime.id,
+            &config,
+            user_config_accepted,
+        );
+        drop(quota_guard);
         let conntrack_firewall_published = match &self.conntrack_firewall {
             Some(conntrack_firewall) => conntrack_firewall.publish(
                 new_runtime.id,