identity: sha256:bdc1a0e9e18297791776aab7abcbe9645a8271289c1d143a6e5618077f6e06b9
verified: 4 members, each matching the manifest's sha256 and size
limit: unsigned: verification detects a changed member; it does not authenticate the sender
limit: no replay: this bundle shows an investigation; it does not reproduce or fix it