Another instance, VyOS Stream 2026.03 (vyos-1x 1.5dev0-3990-g9a296ec12), site-to-site to an Azure VPN Gateway (IKEv2, no reauth, DPD restart). On 2026-10-12 the vti was left admin-down while its CHILD_SA stayed INSTALLED: IKE and child SA reported up, BGP over the vti sat in Active, bytes out 0 for two days. /tmp/ipsec_vti_interfaces had lost the entry; reset vpn ipsec site-to-site peer re-ran up-client and recovered it. Confirms the DB key needs the SA identity (PLUTO_UNIQUEID), as proposed. Workaround in place: a cron job that re-raises any xfrm interface whose if_id matches an INSTALLED CHILD_SA (via vici) by re-running the updown hook's up path.