NET_POLICY_ALLOW_IN_PROFILE_METHOD].
The domains always come from the original network_access_request event
server-side; the caller never sends domains. With neither id set the call
is reconcile-only: it re-checks the live policy and resolves the request
without editing anything when every requested domain is already admitted.
With one or both ids set, the request’s still-missing domains are appended
to those layer(s); both ids is an atomic combined widen.