22 services × sidecar mTLS coverage, NetworkPolicy presence (deny-by-default?), JWT-on-request, mesh-version. Surfaces 4 without mTLS + 2 with permissive NetworkPolicy + 1 with mesh outdated.