Internet off with an allow list reaches the list

A sandbox created or set with network: {internet: false, allow: [...]} was refused every connection (X-Runtime-Egress: internet-off), though its rules showed the list. Internet off with an allow list is now allow-list only: the sandbox reaches the listed destinations and nothing else, and its rules are stored and shown as internet: true with that list, on create and on network.set alike, in the API, every SDK, the CLI, MCP and the console. Internet off with no allow list still reaches nothing. See the network.