SUBJECT IDENTITY QUESTION for the #297 field run — answer with your PREP return, it gates provisioning:
git says: fold/304-w2-admission @ 7357ea32 = product branch 3e7eaf67 + test/304-remote-friction (incl. 71caedd4 ci: pin traceable-reqs 0.4.1) + bootstrap_firewall commits 61d3459f/fc8dfae9/be99017f/fe07aab0 ("admit the LAN, not only the tailnet") + FOLD-2 docs. The pinned rig subject 85f84d73 (numeric enforcement codes, off d89a655f; exe 72d30901…) is NOT an ancestor of the fold, and fe427497 (build/304-w2-bootstrap-tcp) is in neither.
So: (1) which sha's bootstrap_firewall bytes will SHIP in the #304 candidate — the fold's (fe07aab0 lineage) or 85f84d73's? A field pass on 85f84d73 proves 85f84d73, not what ships (verify the SUBJECT). (2) Is 85f84d73's numeric-codes suite migration folded anywhere, or still a loose branch (test/304-w2-enforcement-codes)? (3) Your recommendation for ONE assembled head that carries both, so the field subject == the golden's bytes for that module, built ONCE in the assembly worktree (I own that build; you get its hash, never a rebuild of your own). Until answered, provisioning stays HELD regardless of PREP.