trimming is a neat feature - thanks for that - thought the ACLs are often not there to begin with because configuring off the full node level access defaults of the vpn is difficult, at least at scale.
not specific to ts - all vpns and firewalls have the same intrinsic issue.
So even with 0 access ACLs for node-to-node communication, nodes can advertise themselves to the control plane and change their config as the ACLs are updated.
Nodes get "NetMap" streamed to them from control plane, which contains information about nodes accessible to them. Without a node showing up in netmap, you can't start discovery to connect to that node - discovery protocol follows once you get information for given node, and allows continued connection in case NetMap gets stale (but if ACLs are changed and reach the other node, it's going to filter you out, and you're not going to know about it without initial info from NetMap)
... Because I had triggered more than one alarm recently messing with a headscale upgrade and permissions involved :D