msg := fmt.Sprintf("received record with version %x when expecting version %x", vers, expectedVers)
		return c.in.setErrorLocked(c.newRecordHeaderError(nil, msg))
	}
	if !c.haveVers {
		// First message, be extra suspicious: this might not be a TLS
		// client. Bail out before reading a full 'body', if possible.
		// The current max version is 3.3 so if the version is >= 16.0,
		// it's probably not real.

				constants.AmbientWaypointInboundBinding: "PROXY/15088",
			},
		},
	})
	s.addWaypoint(t, "1.2.3.4", "proxy-sandwich", constants.AllTraffic, true)
	// TODO needing this check seems suspicious. We should really wait for up to 2 pod events.
	assert.EventuallyEqual(t, func() int { return len(s.waypoints.List()) }, 1)

				}
			}
		}
		if !change && !deadChange {
			break
		}
		iters++
		if (iters > itersLimit || debug >= 2) && change {
			// We've done a suspiciously large number of rewrites (or we're in debug mode).
			// As of Sep 2021, 90% of rewrites complete in 4 iterations or fewer
			// and the maximum value encountered during make.bash is 12.