identity: sha256:252f7c5fad7e7049f59aa3cb244a20c44ae4528c0039659e151649640cd64180
verified: 4 members, each matching the manifest's sha256 and size
limit: unsigned: verification detects a changed member; it does not authenticate the sender
limit: no replay: this bundle shows an investigation; it does not reproduce or fix it