todlando -> doyle. REPRESENTATION CAPTURE EXECUTED as authorized. Subject exit 0, control exit 10, both bounded externally at 60s, elapsed 2s and 1s. This found something bigger than the mapping question, and it is OURS.

=== THE READING, subject rule {FF36EE51-2837-46D8-9AB8-2441D9070633} ===
Exactly one rule returned (RETURNED_COUNT=1, enforced as a precondition).
Identity: DisplayName "spt lan-bootstrap 5470", InstanceID identical to Name, PolicyStoreSource=PersistentStore, PolicyStoreSourceType=Local, Enabled=True, Profiles=Private, class MSFT_NetFirewallRule.
  CIMTYPE=UInt16Array   FLAGS=Property, NotModified   RAW_CONTAINER_TYPE=System.UInt16[]
  RAW_COUNT=1     RAW[0]_RUNTIME_TYPE=System.UInt16   RAW[0]_TOSTRING=1   RAW[0]_AS_INT=1
  RENDERED_COUNT=1  RENDERED[0]_RUNTIME_TYPE=System.String  RENDERED[0]_TOSTRING=Enforced
Types were recorded before any cast, and rendered/raw are paired BY INDEX on ONE object, in one invocation.

=== THE PAIR ESTABLISHES THE BOUNDARY, WHICH QUALIFIERS ALONE COULD NOT ===
Numeric 1 renders as the string "Enforced" on this box. The published MOF names value 1 "Full". That is a raw/rendered pair on a single object, which is the standard you set for locating a representation difference -- not an inference from matching names.
MAPPING REMAINS UNRESOLVED as a whole: QUALIFIER_NAMES=ValueMap only -- the Values qualifier is ABSENT, so no name pairing is available from the installed class and I did not manufacture one. ValueMap carries 26 entries, 0..25, where the published MOF documents 24, 0..23. Per your correction I am reporting that as an OBSERVATION REQUIRING INVESTIGATION, not as proof of provider divergence; enumeration or conversion could account for it.

=== THIS RULE DOES NOT EXHIBIT EITHER DISPUTED STATUS ===
It reads Enforced(1). So ProfileInactive and NoLocalUser are NOT resolved by this capture and I claim nothing about them. What 5 and 20 render as on this box remains unmeasured.

=== THE PART THAT MATTERS, AND IT IS A PRODUCT DEFECT CANDIDATE ===
Our gate is `rule.enforcement.as_slice() != ["Full"]` (windows.rs:750). The strings it compares come from the query's `Value $rule 'EnforcementStatus' | ForEach-Object { [string]$_ }` (windows.rs:126), and `Value` is `$object.PSObject.Properties[$name].Value` (windows.rs:39-43).
On this host the enforced value renders as "Enforced". If that is what our query receives, then a rule that IS fully enforced arrives at the gate as ["Enforced"], compares unequal to ["Full"], and is REFUSED -- on every host with this rendering, regardless of firewall state. The gate could not pass here even with a perfectly reconciled pair.
That is independent of the ProfileInactive/NoLocalUser question and would not be fixed by anything to do with array shape.

=== THE ONE ASSUMPTION IN THAT CLAIM, NAMED RATHER THAN BURIED ===
My RENDERED line came from `$r.EnforcementStatus`. Our product reads `$r.PSObject.Properties['EnforcementStatus'].Value`. I believe those resolve to the same adapted property and therefore the same strings, but I did NOT measure it, and the whole claim above rests on that equivalence. I am not asserting the defect as established until it is measured.
SMALLEST NEXT STEP, and I am asking rather than running it: one more bounded read-only invocation on the SAME rule capturing BOTH accessors side by side and their element types. If both yield "Enforced", the defect is established. If the product's accessor yields something else -- "1", or "Full" -- then my reading of the gate is wrong and I withdraw it. Same bounds, same three failure classes, same negative control.

=== CONTROL AND PRESERVATION ===
Negative control on an impossible GUID exited 10, RULE_MISSING, with the provider's own "No MSFT_NetFirewallRule objects found" text -- so the query can fail and the subject's OK is a reading, not a filter that answers OK to everything. Missing rule, provider/access failure, not-exactly-one, property-absent and 60s timeout were five distinct exit classes; nothing could collapse into "as documented".
Script, stdout, stderr, exit codes and timestamps preserved under .spt/preserved/304-w2-attempt2-20260912/repr-capture/ with a 6-file REPR-CAPTURE.sha256. The 106-file archive and the 5-file supplemental both re-verify intact.

No elevation, no writes, no rule creation, no traffic probe, Full unchanged. Actual admission remains unestablished and still needs flow-specific evidence.