{
  "summary": "The numeric-code migration is present at local test/304-w2-enforcement-codes=85f84d73, not patch-equivalent in fold@7357ea32 or existing asm/304-w2@00c4dad9. Stable native-byte patch identity is b4f072a06f59e35d10420df175c0193aedfb4c92. The test-only tip depends on substantial production and test prerequisites; carrying 85f alone onto fold is not a compatible integration.",
  "files": [
    {
      "path": "crates/spt-daemon/src/bootstrap_firewall/windows.rs",
      "description": "Exact85f test patch, numeric production prerequisites, fold incompatibilities;85f blob848a23fe18e5ca819774f9881ef13504221992f3;parent96080953 blob912182981ff9e14cb05302f37ae6e3e6bd8252e8;fold and asm/304-w2 both blob57e32e522f795afcbed43185c17e493c1a233664."
    },
    {
      "path": ".git/packed-refs",
      "description": "Local refs: test/304-w2-enforcement-codes85f84d73, fold/304-w2-admission7357ea32, asm/304-w200c4dad9. Named test branch is packed, with no loose-file override found."
    },
    {
      "path": ".git/logs/refs/heads/test/304-w2-enforcement-codes",
      "description": "Branch created at96080953; original migration0bb2d5e amended to85f84d73. Distinguishes pre-amend near-match from complete migration."
    },
    {
      "path": ".git/worktrees/repr-fix-53d625cd/logs/HEAD",
      "description": "Reflog records53d625cd→a5f2186c→96080953→0bb2d5e→85f84d73; corroborated by exact commit-parent objects."
    },
    {
      "path": "traceable-reqs.toml",
      "description": "Changed by production prerequisitesdc8015cd,921aa68f,10d18b7f,a5f2186c,96080953; not changed by85f."
    },
    {
      "path": "crates/spt-daemon/src/bootstrap_firewall.rs",
      "description": "dc8015cd prerequisite also changes shared invocation timing infrastructure, so its windows.rs hunk is not its entire production contract."
    }
  ],
  "architecture": "Fold has string enforcement, two-store Snapshot{persistent,active}, literal scope comparisons and no address census. The85f lineage has one-pass ActiveStore/source provenance, host-derived LAN prefixes, semantic representation comparison, then raw numeric enforcement with pre-coercion CIM/type checks.85f only migrates tests against those contracts.",
  "report": "## Exact migration identity and contents\nExact git show85f84d73 confirms only windows.rs changes:91 insertions,14 deletions, all in tests/comments. Parent is96080953088f311047720bca6ad05e753e384ae2. Native cmd byte pipeline `git show --format=medium --no-ext-diff 85f84d73 | git patch-id --stable` returns b4f072a06f59e35d10420df175c0193aedfb4c92 for85f84d738fa702f35c83910f314aae17849d125c. IMPORTANT: an earlier PowerShell native-text pipeline recoded patch bytes and yielded a different identity with zero commit ID; discard those results. The reported identity is from the successful byte-preserving cmd pipeline.\n\nThree fixtures change vec![\"Full\".to_string()] to vec![ENFORCEMENT_SUCCESS]: common observed() and the two captured-spelling rule fixtures. Existing an_unenforced_rule_is_refused_loudly_after_the_pair_matches retains a positive-control reconciled snapshot and now refuses [0],[2],[5],[20],[1,1],[1,5],[5,20],and[]. The unchanged fixture setup must successfully match before enforcement is reached; it uses reconciled_store, desired_specs(...,&one_lan()), and Snapshot{active,addresses:one_lan_census()}.\n\nNew malformed_enforcement_evidence_fails_deserialization first parses[1], then rejects [\"Enforced\"],[\"Full\"],[\"1\"],[null],null,[1.5],[-1],[65536],[true],and[{\"code\":1}]. Its JSON includes sourceType. The test does not prove the PowerShell extraction boundary: a Boolean already coerced by[int] becomes1 before JSON and passes Rust numeric deserialization. Source explicitly states that ceiling.\n\nProvenance comments correct the captured bootstrap-pair enforcement values: adapted display strings are not measured raw numbers. The measured raw UInt16=1 belonged to a separate pre-existing5470 rule. Success-valued fixtures are synthetic comparison controls, not bootstrap-pair field evidence.\n\n## Local location / equivalence search\nSearched local packed refs, loose refs, main/branch/worktree reflogs using migration SHA/subject/numeric terms; exact local git log --all subjects; all-ref path history patches; all-ref exact-symbol addition history; relevant merges; and git cherry against fold and asm.\n\nNamed branch resolves85f. Its reflog contains96080953→0bb2d5e→85f. Detached304-w2-repr HEAD is85f; repr-fix worktree points to the named branch. These identities locate the worktrees, but conclusions above use git objects rather than assuming working-tree bytes are pristine.\n\n`git cherry -v 7357ea32 85f84d73 96080953` returns +85f. Same command against asm/304-w2 returns +85f. Thus the migration is not patch-equivalent in either comparison head, independent of the user-provided ancestry fact.\n\n`git log --all --no-ext-diff -p --format=medium -- windows.rs | git patch-id --stable` produced13 path-change identities; b4f072... appeared only at85f. `git log --all -S malformed_enforcement_evidence_fails_deserialization -- windows.rs` likewise returned only85f. No second local history migration candidate surfaced. This is bounded evidence across available refs/path history, not a universe-wide absence proof and not a claim that every conceivable renamed/squashed semantic equivalent was excluded.\n\nExisting assembled candidate asm/304-w2@00c4dad9 has EXACTLY the same windows blob as fold7357ea32:57e32e522f795afcbed43185c17e493c1a233664. Relevant merge history identifies00c4dad9 as merging premise lane58120cfe onto167552fe;167552fe mergesf94fe044 (FOLD-2 plus ten Linux cells) onto15460d70. This assembly therefore does not secretly contain the numeric migration in windows.rs. Other relevant path merges found were0c05e722 (remote-friction) and634b7f10(product3e7eaf67). No migration merge/cherry-pick subject surfaced in searched local logs.\n\n0bb2d5e is a genuine pre-amend numeric migration but NOT patch-equivalent or acceptance-complete relative to85f: stable identity5afc17a3d7dfd3ba6d901c6cc779c1807570c8a1. Exact0bb2d5e..85f diff adds standalone[5],[20] rejection cases and extraction-boundary coverage caveat. Similar fixture/test names at53d625cd are not numeric migration evidence: that earlier patch introduced384 lines of string-enforcement observed-spelling regression tests, subsequently migrated by85f.\n\n## Production prerequisites and exact patch lineage\nExact commit-parent chain is:\n85f84d73←96080953←a5f2186c←53d625cd←10d18b7f←921aa68f←dc8015cd←4f3f370f.\n\nWindows path changes found in7357ea32..96080953, oldest first:\n* dc8015cd428a610fe17f97345a09e5aa4c281e76: invocation timing plus one ActiveStore pass; changes shared bootstrap_firewall.rs, linux.rs, windows.rs,and manifest. Produces the source-provenance/one-store shape expected by later fixtures.\n*921aa68f89b2d2254087f0c832fc61ed59cf3522: FOLD-3 literal connected-host LAN prefixes; introduces address census/LAN fixture shape; also feature doc and manifest changes.\n*10d18b7f225e5a3f16a5e75ebe5179b940134546: FOLD-4 semantic representation comparison; windows.rs and manifest.\n*53d625cd0bd88a04815efdf6c8209a3096bf53e8: tests-only observed-spelling cells,including refusal cell and captured fixtures that85f edits.\n*a5f2186cd33ee9b9bebd9c52f940e8c7a4f4db0d: ENFORCEMENT_SUCCESS:u16=1;ENFORCEMENT_CERTIFIED:[u16;1];Rule.enforcement:Vec<u16>;raw CIM accessor;exact whole-slice success equality;representation fault distinction. Changes windows.rs and manifest. Intentionally left string fixtures unmigrated.\n*96080953088f311047720bca6ad05e753e384ae2: rejects wrong CIM property type unless UInt16Array and wrong element type unless genuine System.UInt16 BEFORE[int] conversion; preserves null property/element faults and exact[1] policy; removes extractor-only markers and unsupported explanation of multi-code semantics. Changes windows.rs and manifest.\n*Then85f84d73 test migration only.\n\nDirect compile prerequisites are ENFORCEMENT_SUCCESS,Vec<u16> enforcement, and the existing53d625cd test/fixture definitions. Behavior prerequisites additionally include ENFORCEMENT_CERTIFIED whole-slice equality and successful FOLD-4 pair matching; the full production safety contract additionally requires96080953 pre-coercion guards. Rust test greens alone cannot establish those guards.\n\n## Incompatibility with literal fold module\nExact fold source still uses Vec<String> enforcement and compares to[\"Full\"]. It has Snapshot{persistent,active},not addresses; no source_type field; desired_specs does not take the later LAN census; no numeric success constants. Its no-program comparison is observed.program.is_empty(),where the later captured fixtures use\"Any\". Later FOLD-4 assertions also rely on profile token-set equivalence and CIDR/mask equivalence that literal fold comparison does not provide. Simply changing enforcement fixture values cannot make those snapshots reach the intended enforcement arm. Porting85f directly both references absent symbols/fixture contexts and targets incompatible behavior.\n\n## Minimal test-side recommendation for Main\nFor a chosen production head that already carries dc8015cd,921aa68f,10d18b7f,a5f2186c,96080953 semantics, retain/import53d625cd regression fixture suite and85f84d73 migration together (ordered around production prerequisites as original chain),not0bb2d5e. If53d625cd is already present,85f is the single remaining test-side migration. Do not duplicate cells by matching names,do not restore\"Full\" to make old tests fit,and do not present85f as carrying its production prerequisites.\n\nIf the intended assembled head starts at unchanged fold7357ea32 or asm00c4dad9, the exact windows history above is the available coherent patch lineage,not permission to cherry-pick just85f or a claim that these module commits alone encompass every other product requirement. Main owns full assembly selection and recommendation. No changes,builds,tests,lint,formatting,ancestry rechecks,or field/provisioning actions were performed.85f provisioning remains HELD; previous r5 controls remain85f-only."
}