/// SCOPE: the WRITE BODY -- what `render_writes` emits. Its sibling cell
    /// `the_query_body_makes_one_store_pass_and_reads_no_persistent_store` is scoped
    /// to the QUERY BODY, and the two `PersistentStore` counts are OPPOSITE BY
    /// DESIGN: 2 here (both halves are persisted) and 0 there (the query leg reads
    /// no store constant). They are about different strings, so a later reader must
    /// NOT reconcile one into agreement with the other. Neither is scoped to the
    /// COMPOSED script, where `OWNERSHIP` legitimately contributes both tokens.
    ///
    /// ARM 1 (releases#304 W-2): the pair is ONE UNINTERRUPTED WRITE of two
    /// creates, and its LAN half is scoped to the derived literal prefix.
    ///
    /// WHY ADJACENCY IS THE PROPERTY AND NOT A STYLE NOTE. `pair_satisfied_by`
    /// made the VERDICT total over both halves; nothing made the WRITE atomic in
    /// SHAPE. A statement landing between the two creates -- a conditional, a
    /// store switch, a scope reassignment, an `$ErrorActionPreference` reset --
    /// would let the second half be written under a state the first was not, and
    /// every scope cell in this module would still pass, because they all read
    /// `render_writes` per spec and none reads the SEQUENCE. One composer over
    /// one census is a property of the emitted text, so it is asserted there.
    ///
    /// THE POSITIVE CONTROL IS LOAD-BEARING, NOT DECORATION. After FOLD-3 a
    /// CORRECT product no longer emits the string `LocalSubnet`, so a predicate
    /// that only checks for its absence passes on a render it never looked at --
    /// and passes identically if `render_writes` returns "". The control is the
    /// derived prefix that MUST appear; the two absence assertions are evidence
    /// only because the control matched first. (The trap was named in advance by
    /// todlando, and it is hertz's own zero-match-filter class: a filter that
    /// cannot match reads as absence.)
    // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]
    #[test]
    fn the_write_body_renders_an_adjacent_persistentstore_pair_scoped_to_the_derived_prefix() {
        const CALL: &str = "New-NetFirewallRule";
        const END: &str = "| Out-Null";
        let want = desired_specs("c:/spt/spt.exe", 5470, &one_lan());
        let rendered = render_writes(&want);
        // POSITIVE CONTROL FIRST: the predicate can see this render's remotes at
        // all. Everything below is void if this line does not hold.
        assert!(
            rendered.contains("-RemoteAddress 192.168.1.0/24"),
            "positive control: the derived LAN prefix must be in the render, or the              absence assertions below are about nothing: {rendered}"
        );
        // Meaningful ONLY because the control above matched.
        assert!(
            !rendered.contains("LocalSubnet"),
            "the keyword measured not to admit is not rendered: {rendered}"
        );
        assert!(
            !rendered.contains("-RemoteAddress Any"),
            "neither half widens its remote to Any: {rendered}"
        );
        // ADJACENCY: between the end of the first create and the start of the
        // second there is whitespace and nothing else.
        let first_end = rendered.find(END).expect("the first create ends in a pipeline to Out-Null")
            + END.len();
        let second_start = rendered[first_end..]
            .find(CALL)
            .map(|offset| offset + first_end)
            .expect("the second create follows the first");
        let between = &rendered[first_end..second_start];
        assert!(
            between.trim().is_empty(),
            "the two creates are adjacent; a statement between the halves could write              the second under a state the first was not: {between:?}"
        );
        // The create COUNT is deliberately not asserted here: it is owned by the
        // sibling cell `the_write_path_renders_both_halves_and_no_program_filter_by_default`.
        // This cell reads the SEQUENCE, which no sibling does.
        // Both halves are written to the store the pair is persisted in, so a
        // half landing in ActiveStore alone cannot read as a written pair.
        assert_eq!(
            rendered.matches("-PolicyStore PersistentStore").count(),
            2,
            "each half is written to PersistentStore: {rendered}"
        );
    }