{
  "summary": "85f84d73's Windows blob retains fold's two-name LAN+tailnet/no-program policy, but includes substantial later production work: one-pass admission evidence, host-derived LAN prefixes, semantic matching, and strictly numeric raw-CIM enforcement. The numeric-test tip alone supplies none of those prerequisites. The field Windows blob cannot be transplanted alone onto fold because its subprocess helper signature changed. Cleanup behavior is retained, but its encoded payload bytes change through the shared OWNERSHIP prelude.",
  "files": [
    {
      "path": "crates/spt-daemon/src/bootstrap_firewall/windows.rs",
      "description": "Fold blob 57e32e522f795afcbed43185c17e493c1a233664; field85f blob 848a23fe18e5ca819774f9881ef13504221992f3. Production ends before cfg(test) at fold line532 / field line991."
    },
    {
      "path": "crates/spt-daemon/src/bootstrap_firewall/linux.rs",
      "description": "Fold blob88f1489e6cbff458732e05516fd9847c72c9b76f; field85f blob08f615c4b0985a86ed8c42e96cfc3083857c4aff. Only production delta is run(path,args) to run(name,path,args); remainder adds335 cfg(test) lines."
    },
    {
      "path": "crates/spt-daemon/src/bootstrap_firewall.rs",
      "description": "Direct production prerequisite: dc8015cd introduces run(label,program,args), run_bounded and per-invocation outcome logging, requiring both OS callers to migrate."
    },
    {
      "path": "crates/spt-daemon/src/firewall.rs",
      "description": "fe427497 alternative TCP admission implementation uses netsh, same-name paired rules under 'spt-core lan-bootstrap TCP', separate from bootstrap_firewall's two immutable NetSecurity names."
    },
    {
      "path": ".spt/preserved/hertz-fp-driver-review/d2/prep-S6ESSJ3N/subject-history/",
      "description": "Main's exact snapshots, blob-ID files and fold-versus-numeric.diff provide stable source citations for this report; independently inspected through read/grep."
    }
  ],
  "architecture": "bootstrap_firewall.rs dispatches OS admission/cleanup and owns the bounded child runner. Windows composes OWNERSHIP plus a selected PowerShell body; QUERY transports observed fields to Rust's desired_specs/spec_satisfied_by/decide. Reconcile writes PersistentStore rules; cleanup uses its own guarded removal-and-absence body, not admission QUERY. fe427's firewall.rs/netsh provider is a distinct ownership and lifecycle implementation.",
  "report": "## Exact object identity\n\n| Object | Full commit | windows.rs blob | linux.rs blob |\n|---|---|---|---|\n| fold | 7357ea327c79f5930bdfe5947d427eabd19cf9b8 | 57e32e522f795afcbed43185c17e493c1a233664 | 88f1489e6cbff458732e05516fd9847c72c9b76f |\n| LAN predecessor | fe07aab0fb7a16ad48eb99ecdfd16cd659179e14 | 1f475a80165322e83791e476cea37855119193c2 | 88f1489e6cbff458732e05516fd9847c72c9b76f |\n| field subject | 85f84d738fa702f35c83910f314aae17849d125c | 848a23fe18e5ca819774f9881ef13504221992f3 | 08f615c4b0985a86ed8c42e96cfc3083857c4aff |\n| original module introduction | d89a655f1ba54630abf9da5ccd5d6b23d23315f9 | 94781c66fb3fbe7305001a18814195bc201d5010 | 4c9ff40f1ee1cae8854e2f26258658f38c025b1c |\n| alternate provider | fe4274979c5a93a36fef9f066df6afbe70070ae8 | bootstrap_firewall/windows.rs absent per Main's exact-object evidence | not inferred |\n\nObtained via read-only git ls-tree/show/log/diff. fe07→7357 changes Windows source comments, including correction of the void W-0 program-scope rationale and the arm-E policy ruling; it does not change executable policy constants. Thus those two Windows blobs differ even though production behavior is unchanged. Linux blobs are identical at these two objects.\n\n## Production delta, separate from tests\n\nExact fold snapshot production is windows.rs lines1–531; cfg(test) starts532. Field snapshot production is lines1–990; cfg(test) starts991. Fold→field Linux has one production-line substitution at command(): run(path,args) becomes run(name,path,args); the other335 added lines begin cfg(test) at716. Do not read the1671 insertions/98 deletions across the two full files as production-only size.\n\n### LAN and tailnet\n\nFold already owns BOTH immutable names: spt-core-bootstrap-inbound-tcp and spt-core-bootstrap-inbound-tcp-lan, under group spt-core bootstrap TCP. Both use the actual nonzero bound TCP port and no program filter. Tailnet is100.64.0.0/10 on Any profiles; LAN is LocalSubnet on Private,Domain. fe07 is the production introduction of that paired design;7357 records the ruling, not another executable policy change.\n\n85f retains those names, group, actual-bound-port contract, tailnet scope/profile, LAN profile boundary and no-program policy. It replaces only the LAN remote composer with host-derived literal IPv4 prefixes. Get-NetIPAddress -AddressFamily IPv4 -PolicyStore ActiveStore runs in the same invocation as the rule census. lan_scope (385 onward) uses Preferred addresses, prefix lengths8..=32, excludes loopback/link-local/unspecified/CGNAT, masks host bits, sorts and deduplicates. NoneConnected omits the LAN spec rather than emitting an empty remote list. Reconcile (835–899) reads the census before rendering writes, removes owned old rules, writes tailnet only if no LAN exists, and then returns an explicit LAN-UNVERIFIED message. Changed networks rewrite the LAN half and emit a scope-change line. This is a substantive later scope policy, not the loss of fold's LAN feature.\n\n### Matching and evidence\n\nFold compares empty Program literally, profiles literally, and sorted lowercased remote strings.85f adds narrowly bounded equivalence: empty/Any means unrestricted application; profile tokens compare as sets without expanding Any; IPv4 prefix and contiguous dotted-mask spellings canonicalize to the same network. Wanted remotes must parse as networks; malformed wanted text cannot match identical malformed observed text. Remote duplicates are not collapsed. scope_change uses the same comparison, avoiding a false move on every provider spelling change.\n\nFold admission QUERY describes both PersistentStore and ActiveStore.85f QUERY describes ActiveStore once and carries PolicyStoreSourceType as sourceType; decide requires Local to certify persistence. This admission-query optimization does NOT remove PersistentStore writes, cleanup reads, or PersistentStore tokens from the shared helper definitions. Reconcile-write still examines effective owned names, refuses non-Local policy ownership, calls Remove-Owned and writes the desired rules persistently.\n\nFold Rule.enforcement is Vec<String>, populated through the PowerShell adapted property and accepted only as exactly[\"Full\"].85f is Vec<u16>, accepts exactly[1], not membership, so duplicates/additional/empty/non-success values refuse. RawValue obtains CimInstanceProperties['EnforcementStatus'], requires CimType UInt16Array; Describe rejects null raw value, null elements and elements not System.UInt16 before converting to int for JSON. This separates representation faults from valid numeric evidence that fails the verdict. Code comments describe field observations but are not new measurements; the bootstrap pair's measured raw numeric values cannot be inferred from the existing synthetic fixture success values.\n\n### D3 cleanup payload and provider distinctions\n\nFold and85f keep the same REMOVE_AND_VERIFY body: Remove-Owned; census PersistentStore and ActiveStore; throw with remaining names unless both empty. Remove-Owned enumerates exact immutable names in PersistentStore, validates EVERY candidate's group and TCP protocol before deleting any candidate, then invokes Remove-NetFirewallRule. It is not a delete-by-group operation, not an unguarded netsh delete, and not proof of reachability. is_clean also reads both stores.\n\ncleanup_command renders powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand followed by base64(UTF-16LE(script(REMOVE_AND_VERIFY))). The script includes the fixed two-name/group declarations, NetSecurity import and OWNERSHIP prelude. Although cleanup_command, script, encoded and REMOVE_AND_VERIFY bodies are unchanged fold→85f, the encoded payload bytes are NOT identical: OWNERSHIP gained RawValue and its comments/guards through numeric enforcement work. RawValue is defined in cleanup's script but not called by its removal body. Therefore behavioral equivalence of removal does not license reuse of a byte-specific D3 artifact from another source head. No payload was executed or newly generated here.\n\nfe427497 is a DIFFERENT provider: its commit changes firewall.rs, lanhost.rs, servehost.rs, serveverb.rs and related files, not the bootstrap_firewall module. It uses netsh verbose-query parsing, LAN_RULE_NAME='spt-core lan-bootstrap TCP', and two rules sharing that one name: tailnet100.64.0.0/10/any profiles and LAN LocalSubnet/private+domain. Its ownership/name/query/cleanup contracts cannot be substituted for the NetSecurity two-name module by treating them as the same implementation. Main owns the integration choice; user-stated exclusion of fe427 from both heads stands.\n\n## Narrow production prerequisite history\n\nExact relevant commit records and diffs:\n\n1. d89a655f1ba54630abf9da5ccd5d6b23d23315f9 introduces bootstrap_firewall.rs and both OS modules plus serve plumbing. Initial Windows provider is one owned NetSecurity name, not the later two-name scope design.\n2. 61d3459fd6db5be0e66951b9f6d2a05822865518 moves Windows scope policy into a Rust seam.\n3. fc8dfae98688be0ece27ad782617a17baa93ba40 splits Linux pure seams; be99017f2cd8f7add256f42e1fb3d8de784c6f59 follows with needless-borrow correction.\n4. fe07aab0fb7a16ad48eb99ecdfd16cd659179e14 introduces the two-name LAN/tailnet design;7357ea327c79f5930bdfe5947d427eabd19cf9b8 records FOLD-2 and corrects its rationale.\n5. f94fe04415049cc4b75250cbc3116ae90ab52840 adds the Linux tests, direct parent7357ea327c79f5930bdfe5947d427eabd19cf9b8. Exact later assembly record167552fe902dc76bbdb7c46010dfa83420ae728d has parents15460d706f952c0200d140621b09bf1671dc6906 andf94fe04415049cc4b75250cbc3116ae90ab52840. These are direct object records only, not a rerun of any ancestry gate and not a reversal of the user's85f-not-ancestor-fold fact.\n6. dc8015cd428a610fe17f97345a09e5aa4c281e76, parent4f3f370f2d9311b802395731295518044734db22: one-pass ActiveStore/sourceType, subprocess label/outcome logging, post-write verification-error face. Its Windows patch starts from index57e32e52, exactly fold's Windows blob abbreviation. Changes parent helper, Linux caller, Windows and trace manifest. This is the concrete self-contained caller migration prerequisite for carrying85f Windows source.\n7. 921aa68f89b2d2254087f0c832fc61ed59cf3522, parentdc8015cd428a610fe17f97345a09e5aa4c281e76: FOLD-3 host-prefix composer, same-query census and no-LAN behavior; Windows plus ADR amendment and trace manifest.\n8. 10d18b7f225e5a3f16a5e75ebe5179b940134546, parent921aa68f89b2d2254087f0c832fc61ed59cf3522: FOLD-4 semantic scope matching; Windows and trace manifest.\n9. 53d625cd0bd88a04815efdf6c8209a3096bf53e8, parent10d18b7f225e5a3f16a5e75ebe5179b940134546: observed-spelling regression cells.\n10. a5f2186cd33ee9b9bebd9c52f940e8c7a4f4db0d, parent53d625cd0bd88a04815efdf6c8209a3096bf53e8: raw numeric enforcement/accessor and Rust numeric verdict; Windows plus trace manifest.\n11. 96080953088f311047720bca6ad05e753e384ae2, parenta5f2186cd33ee9b9bebd9c52f940e8c7a4f4db0d: validate raw evidence types before conversion; Windows plus trace manifest.\n12. 85f84d738fa702f35c83910f314aae17849d125c, parent96080953088f311047720bca6ad05e753e384ae2: numeric-test migration. Main's supplied91insertions/14deletions scope is test-only; it must not be mistaken for the entire production repair.\n\nThe narrowly identified production sequence after fold isdc8015cd→921aa68f→10d18b7f→a5f2186c→96080953, with53d625cd and85f84d73 providing the associated Windows test evolution andf94fe044 the Linux tests. This is source/history identification, not an asserted cherry-pick success or a recommended generic assembly recipe.\n\n## Concrete integration facts and limits\n\n- Carrying85f Windows wholesale does NOT revert to a single tailnet rule or drop fold's no-program policy. It intentionally supersedes LocalSubnet with the later literal-prefix policy; that distinction must remain explicit.\n- Carrying that Windows blob WITHOUT dc8015cd's parent run(label,program,args) change leaves an arity mismatch. Carrying the new parent helper WITHOUT Linux's run(name,path,args) update leaves the Linux caller incompatible. This is a directly observed source precondition, not a build result.\n- Numeric-test-only85f cannot repair fold's production Vec<String>/adapted-property/\"Full\" path; the earlier numeric production commits are necessary to its contract.\n- Numeric production alone does not supply one-pass source-type verification, host prefixes or matcher equivalence. The broader Windows field behavior depends on the identified earlier production series.\n- Literal-prefix matcher code requires network-valued desired remotes; applying it to a retained LocalSubnet desired constant would make the wanted_networks gate reject the LAN spec. FOLD-3/FOLD-4 must be considered together, not independently dropped into the old policy.\n- No merge application, conflict simulation, build, tests, formatter, lint, provisioning, signing, apply, field execution or validation was performed. Exact clean merge status is not claimed. No shipping recommendation or release decision is made. Existing r5 controls remain evidence for85f only, and current provisioning remains HELD as instructed."
}