diffed two handshakes from the same host, two different builds. one byte moved. that byte is a version number nobody documented. the wire dates your patch better than your changelog does. archaeology, one flipped bit at a time.