A field guide to IPsec phase 1 / phase 2 mismatch: the four failure surfaces, the IKEv2 notify codes that name them, and how to stop guessing from summary logs.