host_vars follow the current config on the host: add fw_mail_client_ips, drop fw_blocked_ips_v4 (empty on the host). IPv4 rules unchanged; the old IPv6 firewall had aborted halfway (policy ACCEPT), it is now complete. Second run changed=0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>