anchor.diff:                  | TLS.DontWrite conn -> doHS conn
               else
                   TLS.refuse conn q
  +                closed <- true
                   raise (IOException(sprintf "TLS-HS: Refusing untrusted certificate"))
           | TLS.Handshaken conn -> closed <- false; conn
           | TLS.Read (conn,msg) ->
  
positive.code:     let rec wrapRead conn =
          match TLS.read conn with
          | TLS.ReadError (adOpt,err) ->
              match adOpt with
              | None -> raise (IOException(sprintf "TLS-HS: Internal error: %A" err))
              | Some ad -> raise (IOException(sprintf "TLS-HS: Sent fatal alert: %A %A" ad err))
          | TLS.Close ns -> closed <- true; (conn,empty_bytes) // This is a closed connection, should not be used!
          | TLS.Fatal ad -> raise (IOException(sprintf "TLS-HS: Received fatal alert: %A" ad))
          | TLS.Warning (conn,ad) -> raise (IOException(sprintf "TLS-HS: Received warning alert: %A" ad))
          | TLS.CertQuery (conn,q,advice) ->
              if advice then
                  match TLS.authorize conn q with
                  | TLS.ReadError (adOpt,err) ->
                      match adOpt with
                      | None -> raise (IOException(sprintf "TLS-HS: Internal error: %A" err))
                      | Some ad -> raise (IOException(sprintf "TLS-HS: Sent fatal alert: %A %A" ad err))
                  | TLS.Close ns -> closed <- true; (conn,empty_bytes) // This is a closed connection, should not be used!
                  | TLS.Fatal ad -> raise (IOException(sprintf "TLS-HS: Received fatal alert: %A" ad))
                  | TLS.Warning (conn,ad) -> raise (IOException(sprintf "TLS-HS: Received warning alert: %A" ad))
                  | TLS.CertQuery (conn,q,advice) -> raise (IOException(sprintf "TLS-HS: Asked to authorize a certificate twice"))
                  | TLS.Handshaken conn -> wrapRead conn
                  | TLS.Read (conn,msg) ->
                      let read = undoMsg_i conn msg in
                      if equalBytes read empty_bytes then
  
negative.code:     | TLSClient
      | TLSServer
  
  type TLStream private (s:System.IO.Stream, options, b, ?own, ?sessionID) =
      inherit Stream()
  
      let own = defaultArg own true
  