diag: log per-entry skip reason in applyVerifiedPeerManifest

@@ -356,6 +356,8 @@356356 357357     for (const entry of body.devices) {358358       if (entry.deviceId === ourDeviceId || entry.deviceId === issuer.deviceId) {359+        // ponytail: temporary mesh-propagation diagnostic, strip before save360+        console.info("[Peach diag] skip entry (self or issuer):", entry.deviceId);359361         continue;360362       }361363       // Terminal: no manifest re-admits a revoked device. Matched on the key as@@ -364,6 +366,8 @@364366       // ahead of the existing-device lookup so it also refuses rotating a device365367       // we still trust onto a revoked key.366368       if (await isDeviceRevoked(entry.deviceId, entry.longTermPublicKeyHex)) {369+        // ponytail: temporary mesh-propagation diagnostic, strip before save370+        console.info("[Peach diag] skip entry (revoked):", entry.deviceId, "longTerm=" + entry.longTermPublicKeyHex?.slice(0, 12) + "...", "hasRelay=" + !!entry.relayUrl);367371         continue;368372       }369373       const existing = await findPairedDeviceById(entry.deviceId);@@ -372,6 +376,14 @@372376         localKeys.publicKey,373377         entry,374378       );379+      // ponytail: temporary mesh-propagation diagnostic, strip before save380+      if (existing) {381+        console.info("[Peach diag] skip entry (existing):", entry.deviceId, "trustSource=" + existing.trustSource);382+      } else if (!meshRoute) {383+        console.info("[Peach diag] skip entry (no mesh route):", entry.deviceId, "hasRelay=" + !!entry.relayUrl);384+      } else {385+        console.info("[Peach diag] admit entry:", entry.deviceId, "relay=" + meshRoute.relayUrl);386+      }375387 376388       // A v3 manifest from an admitted, KK-authenticated issuer proves377389       // same-vault membership and carries enough route material for the two