The pinned binary's policy parser rejects unknown actions and exits 1 on startup (verified against the image binary: the valid action literals are ALLOW, CHALLENGE, DENY). The first cut of the own-endpoints accept rule used ACCEPT and crash-looped the unit on deploy.