// requireNonNull is safe because the endpoint pair comes from the graph.
          subgraph.putEdgeValue(
              node,
              successorNode,
              requireNonNull(graph.edgeValueOrDefault(node, successorNode, null)));
        }
      }
    }
    return subgraph;
  }

  /**

    subgraph software["software platform"]
    end
    style software fill:#c2e0f4,stroke:#3498db,stroke-width:2px,color:#000;
    software --> core

    subgraph jvm["jvm platform"]
    end
    style jvm fill:#c2e0f4,stroke:#3498db,stroke-width:2px,color:#000;
    jvm --> core
    jvm --> software

    subgraph extensibility["extensibility platform"]
    end

ide["ide module"]
style ide stroke:#1abc9c,fill:#b1f4e7,stroke-width:2px;

subgraph software["software platform"]
end
style software fill:#c2e0f4,stroke:#3498db,stroke-width:2px;
software --> core

subgraph jvm["jvm platform"]
end
style jvm fill:#c2e0f4,stroke:#3498db,stroke-width:2px;
jvm --> core
jvm --> software

subgraph extensibility["extensibility platform"]
end

digraph { envoy -> sds [dir=both, label="SDS"] envoy -> xdsproxy [dir=both, label="ADS"] sds -> ca [label="CSR"] xdsproxy -> discovery [dir=both,label="ADS"] envoy [shape=hexagon, color=purple] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds xdsproxy } subgraph cluster_istiod { label = "Istiod" color="lightblue" ca discovery } }...

-> ca [label="Send CSR gRPC Request"] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds SecretManager -> caClient [label="Sign CSR"] caClient -> grpc grpc -> TokenProvider [dir=none,label="Fetch JWT",color=purple] grpc -> cfiles [dir=none,label="Fetch Cert",color=purple] sds -> SecretManager [label="Generate certificate"] SecretManager -> cfiles [label="Write certs to file"] cfiles [label="Certificate Files"] grpc [shape=diamond] } subgraph cluster_istiod { label = "Istiod" color="lightblue"...

```mermaid
graph TD
    subgraph Config Flow
        cu(Config Update)
        db(Debounce)
        pc(Recompute Push Context)
        pq(Push Queue)
        cu-->db
        db--Trigger Once Steady-->pc
        pc--Enqueue All Clients-->pq
    end
    subgraph Proxy
        c(Client)
    end
    subgraph Pusher
        pj(Push Job)
        pj--read-->pq

     *
     * @param dirtyGraph - dependency graph
     * @param scope - which classpath to extract
     * @param resolve - whether to resolve artifacts.
     * @return Collection of metadata objects in the linked subgraph of the graph which
     *             contains the graph.getEntry() vertice
     */
    ClasspathContainer transform(MetadataGraph dirtyGraph, ArtifactScopeEnum scope, boolean resolve)

      <w>preloader</w>
      <w>preloading</w>
      <w>preprocess</w>
      <w>proximities</w>
      <w>redeclarations</w>
      <w>reparsed</w>
      <w>smap</w>
      <w>subclassed</w>
      <w>subgraph</w>
      <w>substep</w>
      <w>tailrec</w>
      <w>typealias</w>
    </words>
  </dictionary>

            // System.err.println("Cleaned("+requestedScope+") graph("+res.getVertices().size()+"):\n"+res.toString());
            // System.err.println("Linked("+requestedScope+")
            // subgraph("+linkedRes.getVertices().size()+"):\n"+linkedRes.toString());
            return findLinkedSubgraph(res);
        } catch (MetadataResolutionException e) {
            throw new GraphConflictResolutionException(e);

Below shows an example outbound request. The "target" path is what the client sends, while the "actual" path is the real network flow after redirection.

```mermaid
graph LR
    subgraph Client Node
        Client
        CZ["Ztunnel"]
    end
    subgraph Server Node
        Server
        SZ["Ztunnel"]
    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ