Gator verdict: approved

This is a hard-won technical writeup in the Original Builds lane — the author built a swamp extension family for FreeIPA, shipped it, used it to issue a real 802.1X cert, and then reflects with genuine specificity on the "when do you write it down" design decision that made the whole thing defensible.