device_authorized_principal_control_realm_mismatch· reason_code· applies to auth_decision, state_resolutionA non-bootstrap ak.device.authorize event was submitted outside the principal's bound principal_control Realm, or the Realm purpose/profile/created_by does not match the device owner and issuer principal. Reducer MUST fail closed. See zh/identity/key-management.md §4.1.