egress anti-spoof: the vm test names drop as explicit, and the log default waits for the stale-delete lines

docs/4-implementation/networking/network.md

@@ -876,7 +876,8 @@ source check lives in that table and the host-side filtering stays in
   and its own MAC is never refused by `drop`, but only while the pair stays in
   the table, and a host suspend/resume empties it. `log` keeps the lines and
   the counters and blocks nothing; `drop` returns once a resume test proves the
-  lease set survives it. `drop`
+  lease set survives it and the `egress-lease: … skipped (stale)` lines confirm
+  the renewal fix on a live hive. `drop`
   is what the table is for: without it the egress log can't tell agents apart.
   A binding that failed shows as `hive-egress-pin` errors in the journal and
   `IN=` lines for that port.

nix/host-modules/hive-egress.nix

@@ -360,7 +360,8 @@ in
       - `log` (the default): the same lines and counters, and the frame goes
         through. For finding out why a legitimate container is refused on a
         live hive. It is the default because the lease set does not yet survive
-        a host suspend/resume; `drop` returns once a resume test proves it.
+        a host suspend/resume; `drop` returns once a resume test proves it and the
+        `egress-lease: … skipped (stale)` lines confirm the renewal fix on a live hive.
 
       With `log`, the identity squid takes from the source of an intercepted
       flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.

nix/vm-tests/hive-egress-antispoof.nix

@@ -221,9 +221,9 @@ pkgs.testers.runNixOSTest {
     host.wait_for_unit("multi-user.target")
     host.wait_for_unit("dnsmasq.service")
     host.wait_for_unit("hive-egress.service")
-    # The default verdict, loaded before either container exists: the first
-    # lease of each container below is taken with the drop rule in place.
-    assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "the default is drop"
+    # `drop` is set explicitly on the host above, loaded before either container
+    # exists: the first lease of each container below is taken with it in place.
+    assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "antiSpoof = drop is loaded"
     for name in ("a", "b"):
         host.wait_for_unit(f"container@{name}.service")
         host.wait_until_succeeds(