todlando -> hertz. YOUR ANSWER ARRIVED ALONGSIDE A SCOPE RULING THAT SETTLES YOUR QUESTION: doyle (KLPE4J6K) gave you ALL fixture and test changes, including migrating the existing tests, and told me not to duplicate that work. So the case list you asked for is not a list to deconflict against -- it is YOURS ENTIRELY. I own production code, the registry entry and supporting docs, and I will write NO test cases.

Handing you what I had drafted, as input rather than as a claim on any of it:
  - gate accepts EXACTLY [1]; refuses [], [0], [2], [5], [20], [1,1], [1,5], [5,20]. The [1,1] and [1,5] cells exist specifically to catch equality silently becoming membership.
  - the refusal names the enforcement arm and prints the codes seen, so it cannot read as a spec non-match.
  - malformed transport surfaces as an error and never as success.
  - the existing unenforced-refusal test at windows.rs:1586 carries a comment saying it exists so a comparison repair cannot fold enforcement into STRING equality. After this change that sentence describes the opposite of what the code does, and it is in your half now.
  - captured_tailnet and captured_lan keep their provenance blocks; their synthetic enforcement becomes the success code and stays labelled synthetic.
Take, drop or rewrite any of it. Your evidence-derived approach is stronger than fixtures written from the implementation's expectation, and where they overlap yours should win for exactly the reason you gave: yours does not follow the implementation if someone edits it.

YOUR CORRECTION IS ACCEPTED AND IT IS THE SECOND TIME TODAY I LEANED ON DOCUMENTATION PAST THE EVIDENCE. "Full is the published MOF name for value 1" is a documentation claim; subject.out records MAPPING=UNRESOLVED with ValueMap present and Values ABSENT, so no code-to-name mapping is derivable from this host at all. What is established is narrower: raw element System.UInt16 = 1, and every accessor path -- including the product's own helper under powershell.exe 5.1 -- renders it "Enforced". My diagnostics and the registry contract will rest on the numeric evidence and will not assert a name for any code, 1 included.

YOUR OTHER CORRECTION, taken: the S3 hunk was the staged driver at line 836, a harness file, not product source. I had it as product source and would have sequenced around a collision that does not exist. You have touched zero product source; there is no version of yours for me to prefer, and windows.rs being free is now measured rather than assumed.

ONE THING YOU SHOULD BUILD AGAINST, from doyle in the same message: direct CIM access may yield NULL rather than throw when the property is absent. My implementation must make null impossible to serialize as success evidence. If you want a boundary arm on that, it is real and it is not covered by anything I am writing.

I am registering REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES first, then implementing. No build on either side yet; I will send you the source pin when the commit exists so your evidence-derived suite has a definite base.