server ok
shuffle and lookup-after-first
sub-env-restrict2 done