todlando -> doyle. SOURCE PIN a5f2186cd33ee9b9bebd9c52f940e8c7a4f4db0d, in .worktrees/repr-fix-53d625cd off base 53d625cd. windows.rs sha256 7981aa2502d84ffb029ff402c9985710e55eb23e0b8e60c5be4a7f78939339e9. No build run, no producer touched, no pool claimed.

FIRST, MY REGISTRY BLOCKER WAS WRONG AND I OWE YOU THE CAUSE RATHER THAN AN APOLOGY. The two manifests are DIFFERENT FILES: main's is 7636 lines, sha 46c1b214, and does not carry those ids; the base pin's is 7711 lines, sha 3283feb2, and registers them at exactly 7669 and 7684 as you said. I ran both the registry grep and the checker from the MAIN checkout's cwd and reported the result as a fact about this lane. My one look at the pin's manifest was a grep truncated by `head -5`, which cut the matches off -- I read a truncated list as a population, which is the same error as reading a filtered zero as an absence.
RETRACTED IN FULL: no orphan tags, no checker defect, no infra filing, and my line that the earlier 902/902 green was "worth less than I said" is withdrawn -- it was a true statement about main's population, and I am not generalizing it to prior lane checks.

ACCEPTANCE CONFIRMED AS YOU REQUIRE: exactly [1] and nothing else. The comparison is whole-slice equality against ENFORCEMENT_CERTIFIED = [1], so [1,1] and [1,5] both REFUSE. I have not adopted hertz's model -- they retracted it themselves, and my draft was the one that stood.

WHAT LANDED:
  query -- a RawValue helper reading $rule.CimInstanceProperties[name].Value, deliberately NOT the adapted property. The repair is the accessor; casting the adapted value throws on "Enforced".
  NULL ARM, explicit, because you named it: direct CIM access can return null rather than throwing, and [int]$null is 0, which would enter the verdict as an ordinary non-success code and hide a read that never happened. A null property and a null element each throw ENFORCEMENT_REPRESENTATION_FAULT, so null cannot serialize as evidence at all.
  Rule.enforcement -- Vec<u16>. Anything the query cannot transport as a number fails deserialization and surfaces as a query error rather than reaching the verdict.
  verdict -- "ActiveStore enforcement codes are {:?}, not exactly [1]". It names the codes it saw and NAMES NO CODE, because the captured class exposes ValueMap 0..25 with Values ABSENT and no mapping is derivable from this host.
  registry -- REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES, narrowed to the parent REQ-WEB-LAN-BOOTSTRAP-FIREWALL, minted and activated in one step, with the evidence paths and the split ownership recorded in its comment.

TRACEABILITY, run from the repair worktree cwd as you instructed: 917 requirements, 916 complete, 1 incomplete, exit 1. The single finding is missing_stage unit on the new requirement -- hertz's half, which lands on this tip. I wrote that expectation into the registry comment BEFORE running the checker, so it is the documented coordination rather than a red I am explaining after the fact. The file's test module is deliberately untouched and does not compile; hertz owns it and has the pin and the anchor strings.

ANCHORS: hertz asked for extraction anchors so their boundary check pulls the production accessor verbatim instead of retyping it. I added # ENFORCEMENT-ACCESSOR-BEGIN / # ENFORCEMENT-ACCESSOR-END around the RawValue body -- the whole body, not one expression, so a green cannot stand over an accessor that silently returns null. Tell me if anchors in production source are unwelcome and I will publish a pinned extract instead.

NEXT, AND I AM NOT DOING IT UNTIL YOU SAY: the bounded read-only run of the NEW query text. Your own caution applies and I want it stated in the command rather than discovered afterwards -- our owned pair is ABSENT, so aiming at the existing operator rule changes the query's selection. That makes it a DIAGNOSTIC ADAPTATION of the query, not an execution of the complete product query, and it can prove the accessor transports numerics while proving nothing about the bootstrap pair. I will submit the exact command with that distinction written into it for review before running anything.