{
  "date": "2026-10-10",
  "block": "12.5.112",
  "runtime": {
    "backend": "ux-alias112",
    "frontend": "ux-alias112-version",
    "version": "1.0.0-test.alias112"
  },
  "before": {
    "date": "2026-10-10",
    "block": "12.5.112",
    "name": "mm-ipsec112-1791601534901",
    "cn": "mm-ipsec112-1791601534901",
    "observations": [
      {
        "serverId": 1,
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec112-1791601534901",
            "state": "established",
            "dynamic-address": "198.18.112.250",
            "remote-address": "104.165.244.7",
            "uptime": "1s"
          }
        ],
        "catalog": [
          {
            "name": "CN=mm-ipsec112-1791601534901",
            "commonName": "CN=mm-ipsec112-1791601534901",
            "certName": "ipsec-user-mm-ipsec112-1791601534901-decoy",
            "online": false
          },
          {
            "name": "mm-ipsec112-1791601534901",
            "commonName": "mm-ipsec112-1791601534901",
            "certName": "ipsec-user-mm-ipsec112-1791601534901",
            "online": true,
            "activeAddress": "198.18.112.250"
          }
        ]
      },
      {
        "serverId": 2,
        "active": [
          {
            ".id": "*1",
            "id": "194.226.121.150",
            "state": "established",
            "remote-address": "194.226.121.150",
            "uptime": "1s"
          }
        ],
        "catalog": []
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "databaseWrites": false,
    "certificate": {
      "name": "ipsec-user-mm-ipsec112-1791601534901",
      "common-name": "mm-ipsec112-1791601534901",
      "ca": "mm-ipsec112-1791601534901-ca",
      "key-usage": "digital-signature,key-encipherment,tls-client"
    },
    "certificates": [
      [
        {
          "name": "mm-ipsec112-1791601534901-ca",
          "trusted": "true",
          "trust-store": "all",
          "invalid-before": "2026-10-10 06:05:35",
          "invalid-after": "2026-10-12 06:05:35",
          "common-name": "mm-ipsec112-1791601534901-CA"
        },
        {
          "name": "mm-ipsec112-1791601534901-server",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec112-1791601534901-ca",
          "invalid-before": "2026-10-10 06:05:36",
          "invalid-after": "2026-10-12 06:05:36",
          "common-name": "194.226.121.150"
        },
        {
          "name": "ipsec-user-mm-ipsec112-1791601534901",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec112-1791601534901-ca",
          "invalid-before": "2026-10-10 06:05:36",
          "invalid-after": "2026-10-12 06:05:36",
          "common-name": "mm-ipsec112-1791601534901"
        },
        {
          "name": "ipsec-user-mm-ipsec112-1791601534901-decoy",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec112-1791601534901-ca",
          "invalid-before": "2026-10-10 06:05:37",
          "invalid-after": "2026-10-12 06:05:37",
          "common-name": "CN=mm-ipsec112-1791601534901"
        }
      ],
      [
        {
          "name": "mm-ipsec112-1791601534901-client-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 05:05:36",
          "invalid-after": "2026-10-12 05:05:36",
          "common-name": "mm-ipsec112-1791601534901"
        },
        {
          "name": "mm-ipsec112-1791601534901-ca-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 05:05:35",
          "invalid-after": "2026-10-12 05:05:35",
          "common-name": "mm-ipsec112-1791601534901-CA"
        }
      ]
    ],
    "catalogCorrect": true,
    "dnPhase": {
      "active": [
        {
          ".id": "*1",
          "id": "CN=mm-ipsec112-1791601534901",
          "state": "established",
          "dynamic-address": "198.18.112.250",
          "remote-address": "104.165.244.7",
          "uptime": "1s"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec112-1791601534901",
          "commonName": "CN=mm-ipsec112-1791601534901",
          "certName": "ipsec-user-mm-ipsec112-1791601534901-decoy",
          "online": false
        },
        {
          "name": "mm-ipsec112-1791601534901",
          "commonName": "mm-ipsec112-1791601534901",
          "certName": "ipsec-user-mm-ipsec112-1791601534901",
          "online": true,
          "activeAddress": "198.18.112.250"
        }
      ],
      "decoyOnline": false
    },
    "fqdnPhase": {
      "configuredRemoteId": "fqdn:mm-ipsec112-1791601534901.example",
      "nativeId": "mm-ipsec112-1791601534901.example",
      "assignedAddress": "198.18.112.250",
      "originalOnline": true,
      "decoyOnline": false
    },
    "aliasName": "mm-ipsec112-1791601534901-psk",
    "aliasPhase": {
      "native": [
        {
          "id": "mm-ipsec112-1791601534901.example",
          "state": "established",
          "dynamic-address": "198.18.112.250"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec112-1791601534901",
          "kind": "cert",
          "online": false
        },
        {
          "name": "mm-ipsec112-1791601534901",
          "kind": "cert",
          "online": true,
          "activeAddress": "198.18.112.250"
        },
        {
          "name": "mm-ipsec112-1791601534901-psk",
          "kind": "psk",
          "online": true,
          "activeAddress": "198.18.112.250"
        }
      ],
      "summary": {
        "clientsTotal": 3,
        "clientsOnline": 2
      }
    },
    "error": "One session still attributed to multiple configured clients"
  },
  "accepted": {
    "date": "2026-10-10",
    "block": "12.5.112",
    "name": "mm-ipsec112-1791602887310",
    "cn": "mm-ipsec112-1791602887310",
    "observations": [
      {
        "serverId": 1,
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec112-1791602887310",
            "state": "established",
            "dynamic-address": "198.18.112.250",
            "remote-address": "104.165.244.7",
            "uptime": "1s"
          }
        ],
        "catalog": [
          {
            "name": "CN=mm-ipsec112-1791602887310",
            "commonName": "CN=mm-ipsec112-1791602887310",
            "certName": "ipsec-user-mm-ipsec112-1791602887310-decoy",
            "online": false
          },
          {
            "name": "mm-ipsec112-1791602887310",
            "commonName": "mm-ipsec112-1791602887310",
            "certName": "ipsec-user-mm-ipsec112-1791602887310",
            "online": true,
            "activeAddress": "198.18.112.250"
          }
        ]
      },
      {
        "serverId": 2,
        "active": [
          {
            ".id": "*1",
            "id": "194.226.121.150",
            "state": "established",
            "remote-address": "194.226.121.150",
            "uptime": "0s"
          }
        ],
        "catalog": []
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "databaseWrites": false,
    "certificate": {
      "name": "ipsec-user-mm-ipsec112-1791602887310",
      "common-name": "mm-ipsec112-1791602887310",
      "ca": "mm-ipsec112-1791602887310-ca",
      "key-usage": "digital-signature,key-encipherment,tls-client"
    },
    "certificates": [
      [
        {
          "name": "mm-ipsec112-1791602887310-ca",
          "trusted": "true",
          "trust-store": "all",
          "invalid-before": "2026-10-10 06:28:08",
          "invalid-after": "2026-10-12 06:28:08",
          "common-name": "mm-ipsec112-1791602887310-CA"
        },
        {
          "name": "mm-ipsec112-1791602887310-server",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec112-1791602887310-ca",
          "invalid-before": "2026-10-10 06:28:09",
          "invalid-after": "2026-10-12 06:28:09",
          "common-name": "194.226.121.150"
        },
        {
          "name": "ipsec-user-mm-ipsec112-1791602887310",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec112-1791602887310-ca",
          "invalid-before": "2026-10-10 06:28:10",
          "invalid-after": "2026-10-12 06:28:10",
          "common-name": "mm-ipsec112-1791602887310"
        },
        {
          "name": "ipsec-user-mm-ipsec112-1791602887310-decoy",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec112-1791602887310-ca",
          "invalid-before": "2026-10-10 06:28:10",
          "invalid-after": "2026-10-12 06:28:10",
          "common-name": "CN=mm-ipsec112-1791602887310"
        }
      ],
      [
        {
          "name": "mm-ipsec112-1791602887310-client-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 05:28:10",
          "invalid-after": "2026-10-12 05:28:10",
          "common-name": "mm-ipsec112-1791602887310"
        },
        {
          "name": "mm-ipsec112-1791602887310-ca-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 05:28:08",
          "invalid-after": "2026-10-12 05:28:08",
          "common-name": "mm-ipsec112-1791602887310-CA"
        }
      ]
    ],
    "catalogCorrect": true,
    "dnPhase": {
      "active": [
        {
          ".id": "*1",
          "id": "CN=mm-ipsec112-1791602887310",
          "state": "established",
          "dynamic-address": "198.18.112.250",
          "remote-address": "104.165.244.7",
          "uptime": "1s"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec112-1791602887310",
          "commonName": "CN=mm-ipsec112-1791602887310",
          "certName": "ipsec-user-mm-ipsec112-1791602887310-decoy",
          "online": false
        },
        {
          "name": "mm-ipsec112-1791602887310",
          "commonName": "mm-ipsec112-1791602887310",
          "certName": "ipsec-user-mm-ipsec112-1791602887310",
          "online": true,
          "activeAddress": "198.18.112.250"
        }
      ],
      "decoyOnline": false
    },
    "fqdnPhase": {
      "configuredRemoteId": "fqdn:mm-ipsec112-1791602887310.example",
      "nativeId": "mm-ipsec112-1791602887310.example",
      "assignedAddress": "198.18.112.250",
      "originalOnline": true,
      "decoyOnline": false
    },
    "aliasName": "mm-ipsec112-1791602887310-psk",
    "aliasPhase": {
      "native": [
        {
          "id": "mm-ipsec112-1791602887310.example",
          "state": "established",
          "dynamic-address": "198.18.112.250"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec112-1791602887310",
          "kind": "cert",
          "online": false
        },
        {
          "name": "mm-ipsec112-1791602887310",
          "kind": "cert",
          "online": false,
          "sessionAmbiguous": true
        },
        {
          "name": "mm-ipsec112-1791602887310-psk",
          "kind": "psk",
          "online": false,
          "sessionAmbiguous": true
        }
      ],
      "summary": {
        "clientsTotal": 3,
        "clientsOnline": 0,
        "clientsSessionAmbiguous": 2
      }
    },
    "recovered": {
      "originalOnline": true,
      "sessionAmbiguous": false,
      "activeAddress": "198.18.112.250"
    }
  },
  "preliminaryFrontendVersion": {
    "displayedVersion": "dev",
    "reason": "APP_VERSION was ignored by frontend Dockerfile; corrected NEXT_PUBLIC_APP_VERSION",
    "functionalBrowser": {
      "date": "2026-10-10",
      "runtime": {
        "backend": "ux-alias112",
        "frontend": "ux-alias112"
      },
      "httpMocks": false,
      "cases": [
        {
          "theme": "dark",
          "width": 1280,
          "rootThemeConfirmed": true,
          "unconnectedCertificateOffline": true,
          "ambiguousClientsUnknown": true,
          "unknownOnlineCount": true,
          "reloadConfirmed": true,
          "noPageOverflow": true
        },
        {
          "theme": "dark",
          "width": 320,
          "rootThemeConfirmed": true,
          "unconnectedCertificateOffline": true,
          "ambiguousClientsUnknown": true,
          "unknownOnlineCount": true,
          "reloadConfirmed": true,
          "noPageOverflow": true
        },
        {
          "theme": "light",
          "width": 1280,
          "rootThemeConfirmed": true,
          "unconnectedCertificateOffline": true,
          "ambiguousClientsUnknown": true,
          "unknownOnlineCount": true,
          "reloadConfirmed": true,
          "noPageOverflow": true
        },
        {
          "theme": "light",
          "width": 320,
          "rootThemeConfirmed": true,
          "unconnectedCertificateOffline": true,
          "ambiguousClientsUnknown": true,
          "unknownOnlineCount": true,
          "reloadConfirmed": true,
          "noPageOverflow": true
        }
      ],
      "pageErrors": [],
      "applicationWrites": [],
      "scope": "Real certificate/PSK alias ambiguity, unknown row statuses and online count, reload, desktop/mobile, two themes"
    },
    "native": {
      "date": "2026-10-10",
      "block": "12.5.112",
      "name": "mm-ipsec112-1791602069063",
      "cn": "mm-ipsec112-1791602069063",
      "observations": [
        {
          "serverId": 1,
          "active": [
            {
              ".id": "*1",
              "id": "CN=mm-ipsec112-1791602069063",
              "state": "established",
              "dynamic-address": "198.18.112.250",
              "remote-address": "104.165.244.7",
              "uptime": "1s"
            }
          ],
          "catalog": [
            {
              "name": "CN=mm-ipsec112-1791602069063",
              "commonName": "CN=mm-ipsec112-1791602069063",
              "certName": "ipsec-user-mm-ipsec112-1791602069063-decoy",
              "online": false
            },
            {
              "name": "mm-ipsec112-1791602069063",
              "commonName": "mm-ipsec112-1791602069063",
              "certName": "ipsec-user-mm-ipsec112-1791602069063",
              "online": true,
              "activeAddress": "198.18.112.250"
            }
          ]
        },
        {
          "serverId": 2,
          "active": [
            {
              ".id": "*1",
              "id": "194.226.121.150",
              "state": "established",
              "remote-address": "194.226.121.150",
              "uptime": "1s"
            }
          ],
          "catalog": []
        }
      ],
      "cleanup": [
        {
          "serverId": 1,
          "/system/logging": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/ipsec/policy": true,
          "/ip/ipsec/policy/group": true,
          "/ip/ipsec/mode-config": true,
          "/ip/ipsec/proposal": true,
          "/ip/ipsec/profile": true,
          "/certificate": true,
          "/file": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        },
        {
          "serverId": 2,
          "/system/logging": true,
          "/ip/ipsec/identity": true,
          "/ip/ipsec/peer": true,
          "/ip/ipsec/policy": true,
          "/ip/ipsec/policy/group": true,
          "/ip/ipsec/mode-config": true,
          "/ip/ipsec/proposal": true,
          "/ip/ipsec/profile": true,
          "/certificate": true,
          "/file": true,
          "/ip/address": true,
          "/ip/route": true,
          "/ip/firewall/nat": true
        }
      ],
      "databaseWrites": false,
      "certificate": {
        "name": "ipsec-user-mm-ipsec112-1791602069063",
        "common-name": "mm-ipsec112-1791602069063",
        "ca": "mm-ipsec112-1791602069063-ca",
        "key-usage": "digital-signature,key-encipherment,tls-client"
      },
      "certificates": [
        [
          {
            "name": "mm-ipsec112-1791602069063-ca",
            "trusted": "true",
            "trust-store": "all",
            "invalid-before": "2026-10-10 06:14:30",
            "invalid-after": "2026-10-12 06:14:30",
            "common-name": "mm-ipsec112-1791602069063-CA"
          },
          {
            "name": "mm-ipsec112-1791602069063-server",
            "trusted": "false",
            "trust-store": "all",
            "ca": "mm-ipsec112-1791602069063-ca",
            "invalid-before": "2026-10-10 06:14:32",
            "invalid-after": "2026-10-12 06:14:32",
            "common-name": "194.226.121.150"
          },
          {
            "name": "ipsec-user-mm-ipsec112-1791602069063",
            "trusted": "false",
            "trust-store": "all",
            "ca": "mm-ipsec112-1791602069063-ca",
            "invalid-before": "2026-10-10 06:14:33",
            "invalid-after": "2026-10-12 06:14:33",
            "common-name": "mm-ipsec112-1791602069063"
          },
          {
            "name": "ipsec-user-mm-ipsec112-1791602069063-decoy",
            "trusted": "false",
            "trust-store": "all",
            "ca": "mm-ipsec112-1791602069063-ca",
            "invalid-before": "2026-10-10 06:14:34",
            "invalid-after": "2026-10-12 06:14:34",
            "common-name": "CN=mm-ipsec112-1791602069063"
          }
        ],
        [
          {
            "name": "mm-ipsec112-1791602069063-client-imported",
            "trusted": "true",
            "trust-store": "ipsec",
            "invalid-before": "2026-10-10 05:14:33",
            "invalid-after": "2026-10-12 05:14:33",
            "common-name": "mm-ipsec112-1791602069063"
          },
          {
            "name": "mm-ipsec112-1791602069063-ca-imported",
            "trusted": "true",
            "trust-store": "ipsec",
            "invalid-before": "2026-10-10 05:14:30",
            "invalid-after": "2026-10-12 05:14:30",
            "common-name": "mm-ipsec112-1791602069063-CA"
          }
        ]
      ],
      "catalogCorrect": true,
      "dnPhase": {
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec112-1791602069063",
            "state": "established",
            "dynamic-address": "198.18.112.250",
            "remote-address": "104.165.244.7",
            "uptime": "1s"
          }
        ],
        "clients": [
          {
            "name": "CN=mm-ipsec112-1791602069063",
            "commonName": "CN=mm-ipsec112-1791602069063",
            "certName": "ipsec-user-mm-ipsec112-1791602069063-decoy",
            "online": false
          },
          {
            "name": "mm-ipsec112-1791602069063",
            "commonName": "mm-ipsec112-1791602069063",
            "certName": "ipsec-user-mm-ipsec112-1791602069063",
            "online": true,
            "activeAddress": "198.18.112.250"
          }
        ],
        "decoyOnline": false
      },
      "fqdnPhase": {
        "configuredRemoteId": "fqdn:mm-ipsec112-1791602069063.example",
        "nativeId": "mm-ipsec112-1791602069063.example",
        "assignedAddress": "198.18.112.250",
        "originalOnline": true,
        "decoyOnline": false
      },
      "aliasName": "mm-ipsec112-1791602069063-psk",
      "aliasPhase": {
        "native": [
          {
            "id": "mm-ipsec112-1791602069063.example",
            "state": "established",
            "dynamic-address": "198.18.112.250"
          }
        ],
        "clients": [
          {
            "name": "CN=mm-ipsec112-1791602069063",
            "kind": "cert",
            "online": false
          },
          {
            "name": "mm-ipsec112-1791602069063",
            "kind": "cert",
            "online": false,
            "sessionAmbiguous": true
          },
          {
            "name": "mm-ipsec112-1791602069063-psk",
            "kind": "psk",
            "online": false,
            "sessionAmbiguous": true
          }
        ],
        "summary": {
          "clientsTotal": 3,
          "clientsOnline": 0,
          "clientsSessionAmbiguous": 2
        }
      },
      "recovered": {
        "originalOnline": true,
        "sessionAmbiguous": false,
        "activeAddress": "198.18.112.250"
      }
    }
  },
  "local": {
    "ipsecStateChecks": 102,
    "profileScripts": 8,
    "uniqueE2eAccepted": 14,
    "enhancedServerCardCases": 2,
    "initialWebServerTimeout": true,
    "initialGeneratedNextTypesErrors": true,
    "sourceTypeScriptPassed": true,
    "generatedNextTypesExcluded": true,
    "productionTypeScriptPassed": true,
    "eslintPassed": true
  },
  "browserEvidence": "browser-ipsec-alias-2026-10-10.json",
  "deployment": {
    "backendImage": "sha256:03e110dd414b575ad9a8f13f7b0302f241dbd3e439418c8ad1bbca7dc1c6fc9c",
    "frontendImage": "sha256:4bf4cad8b3c990a7259f84cf27fd6bb9ee34e3db904223b559c0559dbbe094a2",
    "revisionLabel": "alias112",
    "health": {
      "status": "ok",
      "timestamp": "2026-10-10T03:19:59.783Z",
      "version": "1.0.0-test.alias112",
      "eventLoopDelayMs": 20,
      "flowWorker": {
        "alive": false,
        "bound": false,
        "pendingSize": 0,
        "dropped": 0,
        "packetsReceived": 0
      }
    },
    "contextHashes": {
      "backend": {
        "backend/src/services/ipsec-live.ts": "7f5cccea14c63e96aa9774beab28257a9a81d624cc15a7ef88d19e17e25d5fd2",
        "backend/src/services/ipsec-state.test.ts": "8a0f19b3a16962a2217ac76bfd4c1009813f59cf9e50a4b90fb31165ff6a9a6d",
        "packages/contracts/src/ipsec.ts": "17f9fdcd528fba5fc5df539ca4392bdcd98d99957b1273e83c51537efa1630e5"
      },
      "frontend": {
        "app/(main)/ipsec/page.tsx": "2673411a60fd1796389ddbb6cba37a16b607af87fceedfc37e89e18717fd013e",
        "components/ipsec/ipsec-users-grid.tsx": "75a4f4c7f66badbc425669114982fbd067121e93ecf7800e02b3c8da83d80cfe",
        "components/ipsec/ipsec-server-grid.tsx": "c48e55cb0e63c9b7ca55f6277b194aa748bc7b40982459cdb9c4fe331df68011",
        "packages/contracts/src/ipsec.ts": "17f9fdcd528fba5fc5df539ca4392bdcd98d99957b1273e83c51537efa1630e5"
      }
    },
    "frontendInitialImage": "sha256:0cf246b79dd054e5ecb4ce692d82badc3324211615fb9313aaa7b6dbfc2881f9",
    "frontendTag": "ux-alias112-version",
    "frontendVersion": "1.0.0-test.alias112"
  },
  "limits": [
    "Single observed session claimed by several visible catalog clients is marked unknown",
    "Duplicate native IDs and one certificate referenced by several identities remain separate acceptance bounds",
    "No new data-plane throughput, full PKI/restore, client OS or IPv6 claim"
  ]
}