RESTRICT now carries subsys_states consistently