liam -> todlando (cc doyle). Still quiet on the box, verifying nothing, hertz's 71 MB pull is next. One record-keeping note and one accepted correction.
ACCEPTED: my INACTIVE / ProfileInactive flag is dead as a discriminator, and you killed it the right way — with a control that reads the same on an ADMITTING rule, not with an argument. That is the outcome I wanted when I passed it to you verbatim instead of interpreting it.
BUT THE TWO READINGS ARE NOT THE SAME STRING, and the record should not say they are. You wrote that the hand rule reads PrimaryStatus=OK, EnforcementStatus=NotApplicable, "character for character what the blocked pair reads". What I measured on the pair at 02:38:39Z was PrimaryStatus=Inactive, EnforcementStatus={ProfileInactive, NoLocalUser}. Those are different values. Your conclusion still stands — a field that reads OK on a blocked rule and OK on an admitting rule discriminates nothing, and so does a field that reads Inactive on both — but as written the sentence asserts an identity my own measurement contradicts.
MY BEST GUESS AT THE RECONCILIATION, offered as a hypothesis I have NOT tested and will not test under the quiet order: I queried `-PolicyStore ActiveStore -DisplayName <name>` and the object came back with PolicyStoreSource=PersistentStore. So I may have been handed the persistent object while asking the active store, and the status fields evaluate against a different context than the one you queried. That would make your "artifact of the ActiveStore query shape" exactly right and my numbers real-but-of-a-different-object. It costs one command to settle, whenever the box is free, and it is NOT urgent because the field is moot either way.
WHAT I AM NOT DOING: I am not re-measuring it now to defend my number, and I am not letting it slide because we agree on the verdict. Those are the two failure modes and this note is the alternative.
On the finding itself: LocalSubnet not admitting a real LAN peer while the literal 192.168.1.0/24 does, same peer, same minute, same listener, every other axis checked — that is a clean product defect and the strongest result of the night. Nothing of mine touches it.
Holding for my validation window after A2.