Implementation / component receipt — committed candidate; not field acceptance
Candidate: 7890ead39bb7f14ed44aaae44b0951f098ffe9ac
Parent: 527cd8e8d7ef192892d5630fce10e69a6d811893
Branch: fix/297-enforcement-shape
Scope: six files, +188/-82; exact trailer Co-authored by: todlando.
Doyle gate: LTCNATSP accepted ancestry, six-file scope, tags, raw trailer and committed traceability; asm/304-v3 fast-forwarded by doyle.

MEASURED CAUSE AND REPAIR
Window6 S2 wrote both rules within the repaired budget, but both remained Inactive/[5,20]. The field GET failed while program-scoped controls admitted.
Scratch run02: 19 variants, four Package-bearing variants Inactive/[5,20], fifteen without Package OK/[5,1]. One-factor Package addition isolated the construction defect; LocalUser was not the cause.
Writer removes ONLY -Package Any. Readback with omission is empty, not Any; query hygiene now requires Empty Package. Other writer arguments, paired ownership, profiles, remotes, opt-outs, 30s Windows budget, Linux behavior and post-write distinction are unchanged.
Verification: raw UInt16 PrimaryStatus==1 AND UInt16 enforcement contains1 AND does not contain20. Domain stays; inactive-profile5 beside success is allowed. Non-OK, no success, code20, and malformed/missing raw fields remain refusals/faults.
The successful fixture is explicitly composed: old scope/program capture plus measured Private+Domain OK/[5,1], not a fresh named-pair or all-profile capture.

COMPONENT PROOF
Render regression failed the original S2 -Package Any shape: native100, 1 failed, log sha256 809428f96acd751d11284a5084602e50d0e7ec2bacc5a2235eb37b061bdef787.
Committed firewall subset: 38/38 PASS, 5.425s; required OK/[5,1], Inactive/[5,20], OK/[1] cases and separate code20/non-OK veto controls passed.
Actual committed PowerShell query ran read-only on NETDIS-UPnPHost-Out-TCP; transported numeric PrimaryStatus2 and raw enforcement[19]. This proves transport, not admission.
Exact Package expression accepted all60 omitted-Package observations and refused all16 Package-bearing observations. Typed primary boundary: two UInt16 values passed, null/boolean/string/wrong-CIM-type/missing failed with representation faults.
Executed OWNERSHIP and QUERY byte-for-byte match the committed source after formatter cleanup; binding hashes in query-smoke-receipt.json.

COMMITTED GATES
firewall-committed: exit 0; Finished `test` profile [unoptimized + debuginfo] target(s) in 54.22s | Summary [   5.425s] 38 tests run: 38 passed, 1008 skipped; log sha256 c35a756b7e404519867ee7cbf1f39e0614157b0fe38bd1a6584a55c8c5654f12
check-committed: exit 0; Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 25s; log sha256 46dcfec435de4e6040988e8da6afc8076645e07e92794e1a3b899e87afdd47f9
clippy-committed: exit 0; Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 44s; log sha256 f38ab5faf01fa82d2973e5de5c6e6b5d12a3cb56b2a35902728d1b18b0bdadf7
trace-committed: exit 0; 918 requirements: 918 complete, 0 incomplete, 0 findings; log sha256 2ee9891218d8eb6d611b5f291a344042b3becc129edca10bab5c37d28b23f5d5
docs-check-committed: exit 0; BRAIN_READ_AUDIT_OK: 508 crate Rust files; nine feeds + attach explicit None; four reply controls; zero retired reader symbols | xtask check: OK; log sha256 3d4e01ab0eb8893e4acf31329633b6dfd57f616a4042a2413d39dcaa5d794a25

DISCLOSURES / PRESERVED EVIDENCE
Original scratch run01 failed probe instrumentation; cleanup and independent two-store census were0/0. Corrected run02 completed all19 variants and final/independent cleanup0/0. Both retained.
The initial Package=Any readback claim was wrong and retracted. All15 omitted variants capture empty; code, comments, ADR and diagnosis were corrected. package-omission-readback.json is the extracted evidence.
Initial read-only -File smoke was refused by local AllSigned policy. Command mode succeeded without changing policy; both outputs retained.
cargo fmt caused workspace spill. Per doyle5R7H6TBG, all373 non-intended paths and formatting-only hunks inside windows.rs were restored. Six-file scope enforced before commit; all gates above rerun on the committed tree. No more cargo fmt.

CONSUMER BOUNDARY
No S2 consumer carry-forward. LTCNATSP separately authorized fresh full Linux A+B under .spt/preserved/304-handoff/consumer-linux-7890ead3/. Windows consumer belongs to doyle; cold release END and both independently rehashed artifact pins were relayed at 13:07:29Z. This file does not claim either consumer or field acceptance.
Cold release and successful pool teardown are reported separately in release-artifacts-summary.json, release-build-receipt.json, pool-release.log and final-census.json.