FortiGate IKEv2 deleting phase 1 SA from iOS after phase 2 established

[JJGadgets]

FortiGate seems to send ikev2_send_delete_by_spi with the phase 1 SPI tag, up to a minute after phase 2 is established.

There's also "received unknown SPI" messages with phase 1 SPI tag after phase 2 is established, which FortiGate follows up with "ignoring invalid SPI, SA negotiated", but then it runs the delete after anyway.

Unsure if it's a L3 misconfig, IPsec misconfig, or cipher misconfig.