Every extension RFC 5280 defines, plus the ones in common use that it does not, plus anything at all by OID. The critical flag is separately settable on each: a validator must reject a certificate carrying a critical extension it does not understand, so making the wrong one critical is a good way to find out what your stack actually implements.

A page cannot choose which client certificate to present — the browser picks from its own store through its own UI, so the certificate you issued thirty seconds ago is not offered and “present none” is not offerable. It cannot be given a truststore, so “does this chain verify against my root, and only mine” is unaskable. It cannot read the negotiated version, cipher, ALPN protocol or the server’s chain. And a failed handshake reaches script as a generic network error with the TLS alert — the one informative thing — discarded. So the API opens the socket and reports both sides of it.

Three of those four never leave the browser; the fourth is the only one that does. It is kept because a failing handshake ten minutes later always comes down to which certificate was presented — the store above holds the answer, and this holds the sequence.