{
 "held": [
  "netns"
 ],
 "netns": {
  "mode": "netns (inner.py's own probe inside units.bwrap_argv's sandbox, before any engine)",
  "verdict": "enforced",
  "why": "only lo; DNS fails; the canary connect fails; loopback answers"
 },
 "unit": {
  "IPAddressAllow": "",
  "IPAddressDeny": "",
  "KillMode": "control-group",
  "MemoryMax": "infinity",
  "User": "",
  "unit": "bsw-arm-1-r-s139-iq3-24g.service"
 },
 "unit_ip_filter": {
  "mode": "ipfilter (inner.py's own probe, probe_only, in this unit outside the sandbox: a connect to the box's own non-loopback address must be dropped)",
  "outside_connect": "failed (ECONNREFUSED)",
  "rc": 3,
  "verdict": "NOT ENFORCED",
  "why": "the connect to the box's own non-loopback address was not dropped: failed (ECONNREFUSED) (a refusal means the packet reached the host's stack)"
 }
}