A firewalld rich rule is correct while the packet actually arrives through a zone bound by a newly generated virtual interface profile during a staged decommission

The rule exists, but not in the policy domain the traffic now uses. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.