ycb_cilium_c51ebb84427a8

what a new run launched now would send

Cilium’s Gateway API controller currently accepts Gateways that place an HTTPS (TLS terminate) listener and a TLS passthrough listener on the same port when their hostnames overlap for SNI—including when either hostname is omitted (catch-all). That configuration is invalid because both listeners claim the same SNI space on one port.

Fix listener status reconciliation so conflicting pairs are rejected: each conflicting listener must report the Conflicted condition with reason ProtocolConflict and must not be Accepted, and a Gateway with no remaining valid listeners must not be treated as having accepted listeners. Combinations that do not share a port, or that share a port but have non-overlapping hostnames, must keep working as today. Add/update conformance-style coverage for the same-port overlapping-hostname case and for existing mixed HTTPS+TLS-passthrough fixtures that omit hostnames.

Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.

When you are done, leave your changes committed or in the working tree;
they are collected automatically.

Stay on this snapshot checkout (`task/ycb_cilium_c51ebb84427a8`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.

Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.