Function remove_trusted_ca

nodedb/src/control/cluster/tls.rs:249–259

Delete the overlap-CA file identified by `fp` from `tls_dir/ca.d/`. No-op (and returns `Ok(())`) when the file isn't present — applier behaviour must be idempotent across re-apply and snapshot replay.

(tls_dir: &Path, fp: &[u8; 32])

/// No-op (and returns `Ok(())`) when the file isn't present — applier
/// behaviour must be idempotent across re-apply and snapshot replay.
pub fn remove_trusted_ca(tls_dir: &Path, fp: &[u8; 32]) -> crate::Result<()> {
    let dir = tls_dir.join(CA_TRUST_DIR);
    let path = dir.join(format!("{}.crt", nodedb_cluster::ca_fingerprint_hex(fp)));
    match fs::remove_file(&path) {
        Ok(()) => Ok(()),
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
        Err(e) => Err(crate::Error::Config {
            detail: format!("remove ca.d entry {}: {e}", path.display()),
        }),
    }
}

/// L.4 joiner-side helper: connect to `seed`'s bootstrap listener with
/// `token`, receive `(ca_cert, node_cert, node_key, cluster_secret)`,