fix(ipsec): показывать неопределённый статус при общих Remote ID

backend/src/services/ipsec-live.ts

@@ -286,6 +286,13 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
   }
 
   const out: IpsecClientDto[] = []
+  const sessionClaims = new Map<RosIpsecActivePeer, IpsecClientDto[]>()
+  const claimSession = (active: RosIpsecActivePeer | undefined) => {
+    if (!active) return
+    const claims = sessionClaims.get(active) ?? []
+    claims.push(out[out.length - 1]!)
+    sessionClaims.set(active, claims)
+  }
 
   // 1. Клиентские сертификаты (роль client), подписанные нашим CA / выданные менеджером / referenced identity.
   for (const cert of state.certs) {
@@ -332,6 +339,7 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
       comment: comment || undefined,
       managed: isUser || isIpsecManagedComment(comment),
     })
+    claimSession(active)
   }
 
   // 2. PSK-identity (managed или IKEv2 remote-access).
@@ -363,8 +371,20 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
       comment: i.comment || undefined,
       managed,
     })
+    claimSession(active)
   }
 
+  // The native snapshot does not identify the configured identity/auth type.
+  // Never assign one observed session/address to multiple catalog clients.
+  for (const claims of sessionClaims.values()) {
+    if (claims.length < 2) continue
+    for (const client of claims) {
+      client.online = false
+      client.sessionAmbiguous = true
+      client.activeAddress = undefined
+      client.activeSince = undefined
+    }
+  }
   return out.sort((a, b) => a.name.localeCompare(b.name))
 }
 
@@ -443,6 +463,7 @@ export function mapServerSummary(state: IpsecServerState, clients: IpsecClientDt
     natRuleManaged,
     clientsTotal: clients.length,
     clientsOnline: clients.filter((c) => c.online).length,
+    ...(clients.some(c => c.sessionAmbiguous) ? { clientsSessionAmbiguous: clients.filter(c => c.sessionAmbiguous).length } : {}),
     certs: relevantCerts.map((c) => mapCertificate(c, roleCtx)),
   }
 }