Summary

Fixes #254 and #256. A TrafficProtectionPolicy mode/spec change updates the extension server's local cache promptly, but Envoy Gateway only re-runs translation — and therefore the WAF-injecting extension hook — when a resource it natively watches changes. A TPP is not such a resource, so the edge keeps serving the stale WAF program until some unrelated EG-watched resource incidentally forces a re-translation. In a quiet namespace (exactly the CI test's shape) that never happens, so a mode flip can stay unenforced (or stuck enforcing) indefinitely.

There is already a dedicated retrigger controller for this class of problem, but it watches Connector only. This adds the symmetric TPP arm and makes it complete: create/spec-change, deletion, and targetRef removal all reach the edge.

Change

• internal/extensionserver/retrigger/tpp.go — new TPPReconciler, symmetric to the existing Connector Reconciler. Watches TrafficProtectionPolicy; on a spec change it touches a per-TPP trigger annotation on each owning Gateway so EG re-translates against the fresh cache. On deletion or targetRef removal it clears the annotation on the Gateways that dropped out of the target set, so EG re-translates against the now-empty cache and drops the orphaned WAF program.
• internal/extensionserver/cmd/run.go — registers the new controller alongside the Connector arm.
• internal/extensionserver/retrigger/tpp_test.go — unit tests (stamp, mode-flip, missing Gateway, multi-target, per-TPP key, predicate, deletion, targetRef removal).

Design notes

• Predicate: admits creates, generation bumps (any spec change — mode, targetRefs, ruleSets, sampling), and deletes. The cache reads spec fields only, so status/metadata churn is ignored.
• Per-TPP annotation key (networking.datumapis.com/tpp-generation-<name>): two TPPs targeting the same Gateway each own their own slot, so they never clobber each other's value and flip-flop it on every resync.
• Merge patch, no preceding Get: an unchanged generation (or clearing an already-absent annotation) is a server-side no-op (no resourceVersion bump, no EG event), so it is idempotent and never triggers a spurious re-translation.
• Previous-target tracking (delete / targetRef removal): standard Reconcile receives only the object key on delete, not the last-known object, so there are no targetRefs to resolve owning Gateways from; a targetRef edit only exposes the current targets. The controller records each TPP's owning Gateway set in an in-memory map keyed by namespaced name, populated by the create event every live TPP fires on startup (so a restart re-learns the set before any later edit or delete). On delete it clears the recorded set; on a targetRef edit it clears the members that dropped out. On a failed touch of a current target the previous set is retained so dropped Gateways are retried on requeue rather than forgotten.
• TargetRef → Gateway mapping is name-derived and local: Gateway targetRefs name the Gateway directly; HTTPRoute targetRefs share the HTTPProxy name, which is also the Gateway name (httpproxy_controller.go names Gateway, HTTPRoute, and HTTPProxy identically).

Decisive confirmation (per the issues)

• Flip a TPP mode in a quiet namespace; the change lands on the data plane within seconds rather than never.
• Delete an Enforce TPP (or remove a target); the edge stops blocking within seconds rather than serving the stale program until incidental churn.
• Re-run the waf-configuration construct e2e (datum-cloud/infra#3402).

Known limitations

• A TPP created and deleted while this controller is down leaves no event on restart, so its Gateways are not re-translated (stale WAF persists). Same restart-window caveat as the Connector arm; acceptable given the in-memory tracking.

Closes #254
Closes #256