The vault's claim makes a second provider of secret a second claimant, refused by name. The three uplink definitions declare uplink-networkmanager, uplink-systemd-networkd and uplink-dhcpcd, which the host reports for the manager it finds active, so the holder for a manager the machine does not run is refused the way any missing capability is. Merges after the controller holds the seat and the host reports the capability.