{
  "date": "2026-10-10",
  "block": "12.5.111",
  "runtime": {
    "backend": "ux-id111",
    "frontend": "ux-a11y101"
  },
  "nativeBefore": {
    "date": "2026-10-10",
    "block": "12.5.111",
    "name": "mm-ipsec111-1791600431289",
    "cn": "mm-ipsec111-1791600431289",
    "observations": [
      {
        "serverId": 1,
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec111-1791600431289",
            "state": "established",
            "dynamic-address": "198.18.111.250",
            "remote-address": "104.165.244.7",
            "uptime": "1s"
          }
        ],
        "catalog": [
          {
            "name": "CN=mm-ipsec111-1791600431289",
            "commonName": "CN=mm-ipsec111-1791600431289",
            "certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
            "online": true,
            "activeAddress": "198.18.111.250"
          },
          {
            "name": "mm-ipsec111-1791600431289",
            "commonName": "mm-ipsec111-1791600431289",
            "certName": "ipsec-user-mm-ipsec111-1791600431289",
            "online": true,
            "activeAddress": "198.18.111.250"
          }
        ]
      },
      {
        "serverId": 2,
        "active": [
          {
            ".id": "*1",
            "id": "194.226.121.150",
            "state": "established",
            "remote-address": "194.226.121.150",
            "uptime": "1s"
          }
        ],
        "catalog": []
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "databaseWrites": false,
    "certificate": {
      "name": "ipsec-user-mm-ipsec111-1791600431289",
      "common-name": "mm-ipsec111-1791600431289",
      "ca": "mm-ipsec111-1791600431289-ca",
      "key-usage": "digital-signature,key-encipherment,tls-client"
    },
    "certificates": [
      [
        {
          "name": "mm-ipsec111-1791600431289-ca",
          "trusted": "true",
          "trust-store": "all",
          "invalid-before": "2026-10-10 05:47:12",
          "invalid-after": "2026-10-12 05:47:12",
          "common-name": "mm-ipsec111-1791600431289-CA"
        },
        {
          "name": "mm-ipsec111-1791600431289-server",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec111-1791600431289-ca",
          "invalid-before": "2026-10-10 05:47:14",
          "invalid-after": "2026-10-12 05:47:14",
          "common-name": "194.226.121.150"
        },
        {
          "name": "ipsec-user-mm-ipsec111-1791600431289",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec111-1791600431289-ca",
          "invalid-before": "2026-10-10 05:47:15",
          "invalid-after": "2026-10-12 05:47:15",
          "common-name": "mm-ipsec111-1791600431289"
        },
        {
          "name": "ipsec-user-mm-ipsec111-1791600431289-decoy",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec111-1791600431289-ca",
          "invalid-before": "2026-10-10 05:47:16",
          "invalid-after": "2026-10-12 05:47:16",
          "common-name": "CN=mm-ipsec111-1791600431289"
        }
      ],
      [
        {
          "name": "mm-ipsec111-1791600431289-client-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 04:47:15",
          "invalid-after": "2026-10-12 04:47:15",
          "common-name": "mm-ipsec111-1791600431289"
        },
        {
          "name": "mm-ipsec111-1791600431289-ca-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 04:47:12",
          "invalid-after": "2026-10-12 04:47:12",
          "common-name": "mm-ipsec111-1791600431289-CA"
        }
      ]
    ],
    "catalogCorrect": true,
    "dnPhase": {
      "active": [
        {
          ".id": "*1",
          "id": "CN=mm-ipsec111-1791600431289",
          "state": "established",
          "dynamic-address": "198.18.111.250",
          "remote-address": "104.165.244.7",
          "uptime": "1s"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec111-1791600431289",
          "commonName": "CN=mm-ipsec111-1791600431289",
          "certName": "ipsec-user-mm-ipsec111-1791600431289-decoy",
          "online": true,
          "activeAddress": "198.18.111.250"
        },
        {
          "name": "mm-ipsec111-1791600431289",
          "commonName": "mm-ipsec111-1791600431289",
          "certName": "ipsec-user-mm-ipsec111-1791600431289",
          "online": true,
          "activeAddress": "198.18.111.250"
        }
      ],
      "decoyOnline": true
    },
    "error": "DN-looking literal CN inherited another certificate session\n\ntrue !== false\n"
  },
  "nativeAccepted": {
    "date": "2026-10-10",
    "block": "12.5.111",
    "name": "mm-ipsec111-1791600594968",
    "cn": "mm-ipsec111-1791600594968",
    "observations": [
      {
        "serverId": 1,
        "active": [
          {
            ".id": "*1",
            "id": "CN=mm-ipsec111-1791600594968",
            "state": "established",
            "dynamic-address": "198.18.111.250",
            "remote-address": "104.165.244.7",
            "uptime": "0s"
          }
        ],
        "catalog": [
          {
            "name": "CN=mm-ipsec111-1791600594968",
            "commonName": "CN=mm-ipsec111-1791600594968",
            "certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
            "online": false
          },
          {
            "name": "mm-ipsec111-1791600594968",
            "commonName": "mm-ipsec111-1791600594968",
            "certName": "ipsec-user-mm-ipsec111-1791600594968",
            "online": true,
            "activeAddress": "198.18.111.250"
          }
        ]
      },
      {
        "serverId": 2,
        "active": [
          {
            ".id": "*1",
            "id": "194.226.121.150",
            "state": "established",
            "remote-address": "194.226.121.150",
            "uptime": "0s"
          }
        ],
        "catalog": []
      }
    ],
    "cleanup": [
      {
        "serverId": 1,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      },
      {
        "serverId": 2,
        "/system/logging": true,
        "/ip/ipsec/identity": true,
        "/ip/ipsec/peer": true,
        "/ip/ipsec/policy": true,
        "/ip/ipsec/policy/group": true,
        "/ip/ipsec/mode-config": true,
        "/ip/ipsec/proposal": true,
        "/ip/ipsec/profile": true,
        "/certificate": true,
        "/file": true,
        "/ip/address": true,
        "/ip/route": true,
        "/ip/firewall/nat": true
      }
    ],
    "databaseWrites": false,
    "certificate": {
      "name": "ipsec-user-mm-ipsec111-1791600594968",
      "common-name": "mm-ipsec111-1791600594968",
      "ca": "mm-ipsec111-1791600594968-ca",
      "key-usage": "digital-signature,key-encipherment,tls-client"
    },
    "certificates": [
      [
        {
          "name": "mm-ipsec111-1791600594968-ca",
          "trusted": "true",
          "trust-store": "all",
          "invalid-before": "2026-10-10 05:49:56",
          "invalid-after": "2026-10-12 05:49:56",
          "common-name": "mm-ipsec111-1791600594968-CA"
        },
        {
          "name": "mm-ipsec111-1791600594968-server",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec111-1791600594968-ca",
          "invalid-before": "2026-10-10 05:49:57",
          "invalid-after": "2026-10-12 05:49:57",
          "common-name": "194.226.121.150"
        },
        {
          "name": "ipsec-user-mm-ipsec111-1791600594968",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec111-1791600594968-ca",
          "invalid-before": "2026-10-10 05:49:57",
          "invalid-after": "2026-10-12 05:49:57",
          "common-name": "mm-ipsec111-1791600594968"
        },
        {
          "name": "ipsec-user-mm-ipsec111-1791600594968-decoy",
          "trusted": "false",
          "trust-store": "all",
          "ca": "mm-ipsec111-1791600594968-ca",
          "invalid-before": "2026-10-10 05:49:59",
          "invalid-after": "2026-10-12 05:49:59",
          "common-name": "CN=mm-ipsec111-1791600594968"
        }
      ],
      [
        {
          "name": "mm-ipsec111-1791600594968-client-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 04:49:57",
          "invalid-after": "2026-10-12 04:49:57",
          "common-name": "mm-ipsec111-1791600594968"
        },
        {
          "name": "mm-ipsec111-1791600594968-ca-imported",
          "trusted": "true",
          "trust-store": "ipsec",
          "invalid-before": "2026-10-10 04:49:56",
          "invalid-after": "2026-10-12 04:49:56",
          "common-name": "mm-ipsec111-1791600594968-CA"
        }
      ]
    ],
    "catalogCorrect": true,
    "dnPhase": {
      "active": [
        {
          ".id": "*1",
          "id": "CN=mm-ipsec111-1791600594968",
          "state": "established",
          "dynamic-address": "198.18.111.250",
          "remote-address": "104.165.244.7",
          "uptime": "0s"
        }
      ],
      "clients": [
        {
          "name": "CN=mm-ipsec111-1791600594968",
          "commonName": "CN=mm-ipsec111-1791600594968",
          "certName": "ipsec-user-mm-ipsec111-1791600594968-decoy",
          "online": false
        },
        {
          "name": "mm-ipsec111-1791600594968",
          "commonName": "mm-ipsec111-1791600594968",
          "certName": "ipsec-user-mm-ipsec111-1791600594968",
          "online": true,
          "activeAddress": "198.18.111.250"
        }
      ],
      "decoyOnline": false
    },
    "fqdnPhase": {
      "configuredRemoteId": "fqdn:mm-ipsec111-1791600594968.example",
      "nativeId": "mm-ipsec111-1791600594968.example",
      "assignedAddress": "198.18.111.250",
      "originalOnline": true,
      "decoyOnline": false
    }
  },
  "compiledSyntheticBefore": {
    "scope": "Compiled baseline mapper with synthetic input; not native typed-ID admission",
    "clients": [
      {
        "name": "ipsec-user-original",
        "online": true
      },
      {
        "name": "ipsec-user-typed",
        "online": true
      }
    ]
  },
  "compiledSyntheticAfter": {
    "scope": "Compiled deployed mapper with synthetic input; not native typed-ID admission",
    "clients": [
      {
        "name": "ipsec-user-original",
        "online": true
      },
      {
        "name": "ipsec-user-typed",
        "online": false
      }
    ]
  },
  "deployment": {
    "imageId": "sha256:e9a5cf65433ed77b8c67991a556f3863a0e9609411a0e3e58d39463323c65414",
    "tag": "ux-id111",
    "revisionLabel": "id111",
    "health": {
      "status": "ok",
      "timestamp": "2026-10-10T02:51:44.826Z",
      "version": "1.0.0-test.id111",
      "eventLoopDelayMs": 20,
      "flowWorker": {
        "alive": false,
        "bound": false,
        "pendingSize": 0,
        "dropped": 0,
        "packetsReceived": 0
      }
    }
  },
  "browserEvidence": "browser-ipsec-id-2026-10-10.json",
  "limits": [
    "Native DN collision and explicit certificate FQDN ID accepted",
    "Typed-looking literal CN stripping tested against compiled mappers with synthetic input, not native admission of that IKE ID",
    "Shared configured Remote IDs/cross-auth aliases, arbitrary ID types, client OS, PKI/restore/IPv6 remain open"
  ]
}