A one-line ACL meant for guests takes the whole branch offline

Security asked for the branch guest subnet 10.1.30.0/24 to be blocked from the HQ server subnet 10.2.50.0/24. At 14:05 an engineer applied this on HQ router R2, inbound on the WAN link to the branch:

ip access-list extended BLOCK-GUEST
 10 deny ip 10.1.30.0 0.0.0.255 10.2.50.0 0.0.0.255
!
interface GigabitEthernet0/0/1
 ip access-group BLOCK-GUEST in

Less than a minute later monitoring shows the whole branch unreachable: staff, guests, the branch router itself. The branch reaches the internet through HQ, and R1 and R2 run OSPF over the WAN /30.