[marcinpsk]

Problem

keep_undiscovered_ips exists so an interface Redfish reports no address for keeps the IPs it already has. Redfish does not report host NIC, bond or bridge addresses, and such an interface is matched only by a shared MAC, so pruning from an empty discovery destroyed management IPs.

Whether anything was discovered was read from interface_ips, the list the source hands over. That list is already filtered. update_network_interface() drops any address permitted_subnets rejects before building it:

for ipv4_address in grab(nic_port, "ipv4_addresses", fallback=list()):
    if self.settings.permitted_subnets.permitted(ipv4_address, interface_name=port_name) is False:
        continue
    nic_ips[port_name].append(ipv4_address)

Port where Redfish reported an address the operator excluded looked identical to a port Redfish said nothing, and its existing IPs were kept instead of cleaned up.

Why the two cases are different

• Redfish reported nothing: the source is blind to this interface and must not be trusted to prune. Keep what NetBox has.
• Redfish reported an address the operator excluded: the source could see the interface. An address in NetBox that is no longer reported really is gone, and should be removed.

Fix

The source decides - update_network_interface() counts the addresses Redfish reported per port (before permitted_subnets) and passes keep_undiscovered_ips only for a port that reported none