todlando -> doyle. REPRESENTATION-BOUNDARY CAPTURE, PROPOSED FOR REVIEW. NOT EXECUTED. No rule creation, no elevation, read-only, bounded.

WITHDRAWN FIRST, so it is not left standing anywhere: my array-equality hypothesis is dead. The captured array carries NO Full element, so membership rejects {ProfileInactive, NoLocalUser} exactly as equality does, and the gate's shape was never the question. Array TYPE establishes neither per-profile entries nor informational coexistence -- I inferred both from a type signature. My reachability discriminator is also withdrawn: traffic arriving proves nothing about WHICH rule admitted it, and a second rule's status, whatever it reads, says nothing about our predicate. And an earlier identical capture establishes recurrence only, not that attempt 2 could not have recreated the condition.

WHAT THE CAPTURE IS FOR: the installed provider's OWN value mapping, read off this box, replacing my guess-by-similar-name from documentation.

SUBJECT: rule {FF36EE51-2837-46D8-9AB8-2441D9070633}, an EXISTING rule with a field baseline I already hold. Our bootstrap rules are gone (teardown verified them absent), so they cannot be the subject without creating one, which you excluded.
NOTE THE STORE DIFFERENCE, because it matters: my earlier bounded check read the DEFAULT store and returned PolicyStoreSource=PersistentStore. EnforcementStatus is documented as meaningful only from the ActiveStore, so this capture must name -PolicyStore ActiveStore explicitly. A PersistentStore read would produce an empty or meaningless array and I would be reporting the wrong thing.

EXACT COMMAND, one invocation, bounded at 60s, terminating errors:

  $ErrorActionPreference = 'Stop'
  $r = Get-NetFirewallRule -PolicyStore ActiveStore -Name '{FF36EE51-2837-46D8-9AB8-2441D9070633}' -ErrorAction Stop
  # (a) PowerShell-RENDERED value
  'RENDERED=' + (($r.EnforcementStatus | ForEach-Object { [string]$_ }) -join ',')
  # (b) RAW numeric elements, cast past the rendering layer
  'RAW=' + (($r.CimInstanceProperties['EnforcementStatus'].Value | ForEach-Object { [int]$_ }) -join ',')
  # (c) CIM property TYPE
  'CIMTYPE=' + $r.CimInstanceProperties['EnforcementStatus'].CimType
  'FLAGS='   + $r.CimInstanceProperties['EnforcementStatus'].Flags
  # (d) THE PROVIDER'S OWN MAPPING, from the installed class qualifiers
  $q = $r.CimClass.CimClassProperties['EnforcementStatus'].Qualifiers
  foreach ($n in $q) { 'QUAL ' + $n.Name + '=' + (($n.Value) -join ',') }

Part (d) is the point. ValueMap/Values qualifiers, if present, ARE the installed provider's ordered numeric-to-name mapping. That settles what 5 and 20 are called on THIS machine instead of what the published MOF calls them.

EXPECTED DISTINGUISHING OUTCOMES, written before the run so none can be claimed afterwards:
  O1. Qualifiers carry ValueMap/Values, and Values contains "ProfileInactive" and "NoLocalUser" at the indices the published MOF labels InactiveProfile(5) and LocalUserEmpty(20).
      => The installed provider renames those two values relative to published documentation. My inferred mapping is CONFIRMED, sourced from the box rather than from a name resemblance.
  O2. Qualifiers carry ValueMap/Values matching the published MOF exactly -- InactiveProfile, LocalUserEmpty, no ProfileInactive, no NoLocalUser.
      => The renaming happens ABOVE CIM, in the NetSecurity PowerShell layer, and the numeric values in (b) tell us which two. Still establishes the mapping; relocates the boundary.
  O3. Qualifiers absent or carry no value mapping.
      => The mapping CANNOT be established this way. A distinct outcome, reported as an unestablished mapping, never as agreement with the documentation.
  O4. RAW numerics are not in the documented range, or RENDERED and RAW disagree in length.
      => The installed provider diverges from published docs and everything derived from the doc enum, mine included, is suspect. Reported as such.
  O5. The rule is absent from ActiveStore, or the query errors or times out.
      => Three separate classes -- RULE_MISSING, ACCESS_OR_PROVIDER_ERROR, TIMEOUT_60s -- none of which is "the mapping is as documented".

CONTROLS: a negative control on an impossible GUID must classify RULE_MISSING, proving the query can fail. And RENDERED is captured beside RAW in the same invocation, so the two layers are compared on ONE object rather than across two reads.

WHAT IT DOES NOT DO, stated so no one reads it as more: it establishes NAMING, not enforcement, and certainly not admission. It cannot say whether any rule admits traffic, and actual admission still needs flow-specific evidence that no status read can supply.

Awaiting your review before I run anything. Full unchanged. #300 continues.