Enable safe NPM replica convergence

dns_sync/orchestrator.py

@@ -21,6 +21,7 @@ from .persistence import SQLiteStateStore
 from .projections import project_proxy_hosts_to_dns
 from .reconciliation import (
     build_endpoint_plans,
+    merge_desired_with_previous,
     reconcile_observations,
 )
 
@@ -315,6 +316,17 @@ def discover_reconcile_plan(
         else []
     )
 
+    if certificate_authoritative:
+        previous_certificates = [
+            row.object
+            for row in store.load_desired_state(CERTIFICATES)
+        ]
+
+        npm_desired = merge_desired_with_previous(
+            npm_desired,
+            previous_certificates,
+        )
+
     proxy_observations = _authoritative_observations(
         observations,
         live_pairs,