In TLSv1.3 the post-handshake KeyUpdate message replaces renegotiation as the way to refresh keys on long-lived connections, NewSessionTicket and PSK-based resumption are bounded, and certificate validation follows the same chain, validity and revocation rules as TLSv1.2 with OCSP stapling for both server and client certificates.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.