both sides have auto=start

one connection comes up. One end restarts and sends Delete.
The other end gets delete but revives.

what needs to be avoided is:

Mar  1 03:44:29.442960: "conn7" #2362: received Delete SA payload: replace CHILD SA #2361 now
Mar  1 03:44:29.443537: "conn7" #2362: established IKE SA
Mar  1 03:44:29.445790: "conn7" #2361: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 646.911969s and NOT sending notification
Mar  1 03:44:29.445922: "conn7" #2361: ESP traffic information: in=0B out=0B
Mar  1 03:44:29.456144: "conn7" #2362: deleting other state #2363 (STATE_V2_REKEY_CHILD_I0) aged 0.012449s and NOT sending notification
Mar  1 03:44:29.456207: "conn7" #2362: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 252.850956s and NOT sending notification
Mar  1 03:44:29.456249: "conn7" #2362: deleting IKE SA but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS
Mar  1 03:44:29.456365: "conn7": initiating connection 'conn7' with serial $1 which received a Delete/Notify but must remain up per local policy
Mar  1 03:44:29.456420: "conn7" #2364: initiating IKEv2 connection
Mar  1 03:44:29.458461: "conn7" #2364: sent IKE_SA_INIT request
Mar  1 03:44:29.959113: "conn7" #2364: STATE_PARENT_I1: retransmission; will wait 0.5 seconds for response
Mar  1 03:44:29.960020: "conn7" #2364: ERROR: asynchronous network error report on ens192 (172.16.1.2:500), complainant 172.16.2.2: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Mar  1 03:44:30.460694: "conn7" #2364: STATE_PARENT_I1: retransmission; will wait 1 seconds for response
Mar  1 03:44:30.461527: "conn7" #2364: ERROR: asynchronous network error report on ens192 (172.16.1.2:500), complainant 172.16.2.2: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Mar  1 03:44:31.462690: "conn7" #2364: STATE_PARENT_I1: retransmission; will wait 2 seconds for response
Mar  1 03:44:31.463574: "conn7" #2364: ERROR: asynchronous network error report on ens192 (172.16.1.2:500), complainant 172.16.2.2: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Mar  1 03:44:33.465756: "conn7" #2364: STATE_PARENT_I1: retransmission; will wait 4 seconds for response
Mar  1 03:44:33.466687: "conn7" #2364: ERROR: asynchronous network error report on ens192 (172.16.1.2:500), complainant 172.16.2.2: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Mar  1 03:44:37.470882: "conn7" #2364: STATE_PARENT_I1: retransmission; will wait 8 seconds for response
Mar  1 03:44:37.471843: "conn7" #2364: ERROR: asynchronous network error report on ens192 (172.16.1.2:500), complainant 172.16.2.2: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Mar  1 03:44:45.480036: "conn7" #2364: STATE_PARENT_I1: retransmission; will wait 16 seconds for response
Mar  1 03:44:45.481185: "conn7" #2364: ERROR: asynchronous network error report on ens192 (172.16.1.2:500), complainant 172.16.2.2: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
Mar  1 03:44:55.365359: "conn7" #2365: proposal 1:IKE=AES_CBC_128-HMAC_MD5-HMAC_MD5_96-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_128;PRF=HMAC_MD5;INTEG=HMAC_MD5_96;DH=MODP2048[first-match]
Mar  1 03:44:55.367416: "conn7" #2365: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_128 integ=HMAC_MD5_96 prf=HMAC_MD5 group=MODP2048}
Mar  1 03:44:55.376118: "conn7" #2365: processing decrypted IKE_AUTH request: SK{IDi,AUTH,SA,TSi,TSr}
Mar  1 03:44:55.376166: "conn7" #2365: IKEv2 mode peer ID is ID_IPV4_ADDR: '172.16.2.2'
Mar  1 03:44:55.376370: "conn7" #2365: authenticated using authby=secret
Mar  1 03:44:55.376628: "conn7" #2366: proposal 1:ESP=AES_CBC_128-HMAC_MD5_96-DISABLED SPI=6eee55bd chosen from remote proposals 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_MD5_96;ESN=DISABLED[first-match]
Mar  1 03:44:55.382926: "conn7" #2366: negotiated connection [172.16.11.0-172.16.11.255:0-65535 0] -> [172.16.12.0-172.16.12.255:0-65535 0]
Mar  1 03:44:55.382958: "conn7" #2366: IPsec SA established tunnel mode {ESP=>0x6eee55bd <0x5595d6e7 xfrm=AES_CBC_128-HMAC_MD5_96 NATOA=none NATD=none DPD=passive}
Mar  1 03:45:01.483735: "conn7" #2364: suppressing retransmit because IKE SA was superseded #2365 try=1; drop this negotiation
Mar  1 03:45:01.483774: "conn7" #2364: deleting state (STATE_PARENT_I1) aged 32.027378s and NOT sending notification
Mar  1 03:45:46.562116: "conn7": assign_holdpass() delete_bare_shunt() failed
Mar  1 03:45:46.562206: initiate_ondemand_body() failed to install negotiation_shunt,
Mar  1 03:45:46.562216: initiate on demand from 172.16.11.2:8 to 172.16.12.2:0 proto=1 because: acquire
Mar  1 03:45:46.564705: "conn7" #2367: sent CREATE_CHILD_SA request for new IPsec SA
Mar  1 03:45:46.575802: "conn7" #2367: negotiated connection [172.16.11.0-172.16.11.255:0-65535 0] -> [172.16.12.0-172.16.12.255:0-65535 0]

Because now two sets of Child SA states, using the same single set of SPD policies. But one of the set of states uses a
different / wrong crypto key?

the core problem is:

Mar  1 03:45:01.483735: "conn7" #2364: suppressing retransmit because IKE SA was superseded #2365 try=1; drop this negotiation
Mar  1 03:45:01.483774: "conn7" #2364: deleting state (STATE_PARENT_I1) aged 32.027378s and NOT sending notification

This seems to not just delete pluto state, but also kernel/policy ? So then we get an acquire, which negotiates a duplicate state
causing state/policy confusion?

