Actually, broken on multiple levels. This is one of the causes of T642, apart from some tags I simply forgot to add.

One technical mistake is that the convertor script assumes that every regex or validator tag is inside its own constraint tag, which is just not the case, but it's only the start. The main problem is that the old backend syntax:expression: tags work like AND, not OR, so you cannot use them for multiple validation options.

"set service ssh listen-address" would work if it wasn't for that issue.

We need to check if we can change that behaviour in the backend without breaking any existing commands. For now I'm going to emulate it.