RFC 9830 - BGP Extensions for the Advertisement of Segment Routing (SR) Policies

Overview

Positive

what Ze has

Neutral

measures that are neither good news nor bad

Negative

what Ze owes

The 8 shares marked as a part above are the whole of the 97 gated MUSTs: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.

At a glance

Enrolment

Enrolled: BGP Extensions for SR Policy

What the public ledger says

Status: Partial

Coverage

Positive and negative tests (70): RFC9830-2.1-1, RFC9830-2.1-2, RFC9830-2.1-3, RFC9830-2.2-1, RFC9830-2.2-3, RFC9830-2.3-1, RFC9830-2.3-3, RFC9830-2.4-1, RFC9830-2.4-2, RFC9830-2.4.1-2, RFC9830-2.4.1-3, RFC9830-2.4.1-4, RFC9830-2.4.1-5, RFC9830-2.4.1-6, RFC9830-2.4.1-7, RFC9830-2.4.2-2, RFC9830-2.4.2-4, RFC9830-2.4.2-12, RFC9830-2.4.2-5, RFC9830-2.4.2-6, RFC9830-2.4.2-7, RFC9830-2.4.2-8, RFC9830-2.4.2-9, RFC9830-2.4.2-10, RFC9830-2.4.2-11, RFC9830-2.4.3-4, RFC9830-2.4.3-5, RFC9830-2.4.3-6, RFC9830-2.4.3-7, RFC9830-2.4.4-4, RFC9830-2.4.4-5, RFC9830-2.4.4.1-2, RFC9830-2.4.4.1-3, RFC9830-2.4.4.1-4, RFC9830-2.4.4.1-5, RFC9830-2.4.4.1-6, RFC9830-2.4.4.1-7, RFC9830-2.4.4.2.1-1, RFC9830-2.4.4.2.1-2, RFC9830-2.4.4.2.1-3, RFC9830-2.4.4.2.1-4, RFC9830-2.4.4.2.1-5, RFC9830-2.4.4.2.2-1, RFC9830-2.4.4.2.2-2, RFC9830-2.4.4.2.2-3, RFC9830-2.4.4.2.2-4, RFC9830-2.4.4.2.3-1, RFC9830-2.4.4.2.3-2, RFC9830-2.4.4.2.3-3, RFC9830-2.4.4.2.4-2, RFC9830-2.4.4.2.4-3, RFC9830-2.4.6-3, RFC9830-2.4.6-4, RFC9830-2.4.6-5, RFC9830-2.4.6-6, RFC9830-2.4.7-5, RFC9830-2.4.7-6, RFC9830-2.4.7-7, RFC9830-2.4.8-5, RFC9830-2.4.8-6, RFC9830-2.4.8-7, RFC9830-4.2.1-2, RFC9830-4.2.1-3, RFC9830-4.2.1-6, RFC9830-4.2.1-7, RFC9830-4.2.3-6, RFC9830-5-1, RFC9830-5-2, RFC9830-5-4, RFC9830-5-9

Annotated (including scoped evidence) (27): RFC9830-2.2-2, RFC9830-2.4.3-3, RFC9830-2.4.3-9, RFC9830-2.4.4.2.4-4, RFC9830-2.4.5-2, RFC9830-2.4.5-3, RFC9830-2.4.5-4, RFC9830-2.4.5-5, RFC9830-2.4.5-6, RFC9830-2.4.5-7, RFC9830-2.4.5-8, RFC9830-3-3, RFC9830-4.1-2, RFC9830-4.2.1-1, RFC9830-4.2.1-4, RFC9830-4.2.1-5, RFC9830-4.2.1-8, RFC9830-4.2.1-9, RFC9830-4.2.2-1, RFC9830-4.2.2-2, RFC9830-4.2.2-5, RFC9830-4.2.3-1, RFC9830-4.2.3-2, RFC9830-5-5, RFC9830-5-6, RFC9830-5-7, RFC9830-5-8

Requirements

Gaps and untested MUSTs

Proof state

A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.

RFC9830-2.1-1

The AFI used MUST be IPv4(1) or IPv6(2) (§2.1)

Audit verdict: not audited: no reader has judged these tests

RFC9830-2.1-2

When AFI = 1, the value MUST be 96; when AFI = 2, the value MUST be 192. (§2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830NLRIAddressFamilies. Forbidden: a length octet other than 96 for AFI 1 or other than 192 for AFI 2. Red: assert.Equal(byte(96), v4[0]) and assert.Equal(byte(192), v6[0]) on EncodeNLRIHex output, with assert.Len on the 12/24-octet body. Negative: Parse(AFIIPv6, 12-octet body) require.ErrorIs ErrSRPolicyTruncated, and SplitSRPolicy refuses a 100-bit length.

RFC9830-2.1-3

A BGP UPDATE message that carries the MP_REACH_NLRI or MP_UNREACH_NLRI attribute with the SR Policy SAFI MUST also carry the BGP mandatory attributes. (§2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Both halves now proven. MP_UNREACH_NLRI: TestRFC9830SRPolicyWithdrawalCarriesMandatoryAttributes (planBatchAttrs records, unchanged). MP_REACH_NLRI: TestRFC9830SRPolicyAnnounceCarriesMandatoryAttributes finds MP_REACH 00 01 49, ORIGIN 40/00 and the eBGP AS_PATH 40/02 01 0000FDE8 by attribute.AttrFind over the parsed path attribute section, iBGP MP_REACH and ORIGIN likewise; TestRFC9830SRPolicyIBGPAnnounceKeepsAnEmptyASPath forces the iBGP empty-path input (R1(b)) and requires AS_PATH present, flags 40, zero-length value. BuildPlugin is the producer the reactor's config send shares (peer_initial_sync.go). Judge break (overlay, update_build_plugin.go: drop every attribute appendASPath wrote on iBGP) turned the new negative red and the new positive green; the c32 author's probes cover dropped ORIGIN (positive red). Revert records on BuildPlugin for the two new units and the two HEAD tags of TestRFC9830UpdateCarriesMandatoryAttributes. Residual: the HEAD negative (LOCAL_PREF only on iBGP) proves attribute categorisation rather than presence of the mandatory set, supplementary here.

RFC9830-2.2-1

This document specifies the use of the Tunnel Encapsulation Attribute with the SR Policy Tunnel Type and the use of any other Tunnel Type with the SR Policy SAFI MUST be considered malformed and handled by the "treat-as-withdraw" strategy [RFC7606]. (§2.2)

Audit verdict: not audited: no reader has judged these tests

RFC9830-2.2-2

A Tunnel Encapsulation Attribute MUST NOT contain more than one TLV of type "SR Policy" (§2.2)

Audit verdict: not audited: no reader has judged these tests

RFC9830-2.2-3

A Tunnel Encapsulation Attribute MUST NOT contain more than one TLV of type "SR Policy"; such updates MUST be considered malformed and handled by the "treat-as-withdraw" strategy [RFC7606]. (§2.2)

Audit verdict: not audited: no reader has judged these tests

RFC9830-2.3-1

If these sub-TLVs are present, a BGP speaker MUST ignore them (§2.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent whole-clause rejudgment against RFC 9830 §2.3: "The Tunnel Egress Endpoint and Color sub-TLVs of the Tunnel Encapsulation Attribute, as defined in [RFC9012], are not utilized for SR Policy encodings. Consequently, their values are not relevant within the context of the SR Policy SAFI NLRI. If these sub-TLVs are present, a BGP speaker MUST ignore them and MAY remove them from the Tunnel Encapsulation Attribute during propagation." The current summary has no partial/gap annotation for this requirement. All four current tags were read: both polarities in reactor TestRFC9830InapplicableSubTLVsIgnoredOnReceipt and attribute TestRFC9830EgressEndpointAndColorSubTLVsIgnored. The reactor's positive cases compare a clean policy with individually added endpoint and Color sub-TLVs on actual AFI 1/73 and 2/73 carriers, requiring no error, exactly RFC7606ActionNone, unchanged MP_REACH including its NLRI and next hop, one retained type-15 tunnel, and readable Preference 100. Its negative controls add duplicate endpoints or an endpoint with a one-octet value and require the same outcomes, catching erroneous application of unicast endpoint-count/value validation to an SR Policy. These inputs isolate applicability: teSub/teTLV encode their actual lengths, so the short endpoint has invalid endpoint content but intact sub-TLV and outer framing; teSRPolicyBody supplies a single type-15 TLV, correctly sized policy NLRI, ORIGIN, four-octet AS_SEQUENCE 65002 and an IPv4-format Route Target, with no legacy announcement. The attribute positive control reads equal Preference values with and without endpoint/Color; its separate negative control changes the applicable Preference from 4242 to 9999 and requires a changed result, excluding blanket disregard of all sub-TLVs. Round-trip equality additionally pins Ze's permitted retention choice. Source inspection confirms applyRFC7606 calls applyTunnelEncap and consumes both returned values; applyTunnelEncap identifies the policy from MP_REACH AFI/SAFI, and tunnelTLVLayout still validates framing but skips endpoint semantic/count checks when policy is true and assigns no meaning to Color. TunnelTLV.Preference consumes only type 12 with the required six-octet value; its readback is a codec assertion, not evidence of SRPM selection. processValidatedMessage forwards accepted announcements through onMessageReceived; notifyMessageReceiver caches the accepted WireUpdate before dispatch. teForwardedAttrs exercises that real receive/cache/ForwardUpdate path to an iBGP socket and a downstream processMessage consumer, both without the MED policy and with an actual MED=50 rebuild, asserting preserved attributes/MP_REACH, one announcement and no synthesized withdrawal. Ignoring these contents does not require erasing their wire bytes: byte retention is a conforming implementation choice under MAY, not an additional RFC MUST. Stored native records for this reactor cover name replacement of applyTunnelEncap by panic; those establish sensitivity to that producer halt only, not selective endpoint/Color discrimination. Historical records naming the former carry-test cover likewise do not extend current semantic proof. No checks, mutations, hashes or canonical edits were performed for this rejudgment. Credit is limited to the implemented receive, codec and cached propagation behavior demonstrated by these assertions; no separate route-server rail, SR Policy Manager, attribute-driven steering or dataplane proof is claimed, and absent consumers remain separately unimplemented scope. RFC9830-2.3-3 is not rejudged. No code map is needed for this enforced pending entry.

RFC9830-2.3-3

Similarly, any other sub-TLVs, including those specified in [RFC9012], that do not have explicitly defined applicability to the SR Policy SAFI MUST be ignored by the BGP speaker (§2.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent RFC 9830 Section 2.3 rejudgment retains enforced for ignoring sub-TLVs without explicitly defined applicability to the SR Policy SAFI; the same full sentence permits their removal during propagation. TestRFC9012MeaninglessSubTLVIgnoredNotRemoved proves the applicable Preference counter-control but is not the sole proof. TestRFC9830InapplicableSubTLVsIgnoredOnReceipt isolates well-framed VXLAN, Embedded Label Handling and UDP sub-TLVs on both SAFI 73 AFIs and requires exact no-action, intact MP_REACH and readable Preference. teForwardedAttrs traverses actual receive/cache/ForwardUpdate/Session output/downstream receipt with unchanged and MED-rebuilt cached forwarding. The corrected tag now describes those two cached modes rather than claiming the separate RS rail. applyTunnelEncap/tunnelTLVLayout ignore inapplicable semantics while retaining framing checks; Preference consumes only its applicable type. A native four-octet next hop on AFI-2 SR Policy remains legal under the independent wire-family contract. Preserving the bytes is a conforming choice, not a prohibition on the RFC’s MAY removal. No SRPM, dataplane, full-RFC or fresh selective execution claim is made.

RFC9830-2.4-1

For the TLVs/sub-TLVs that are specified as single instance, only the first instance of that TLV/sub-TLV is used: the other instances MUST be ignored (§2.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Judge 2026-09-30, re-read after the RFC9012-13-7 tag lines left the unit (assertions unchanged). TestRFC9012DuplicateSingleInstanceSubTLVs: + with two Preference sub-TLVs Preference() returns the first (100); - the second value standing alone IS returned (200), so the choice is positional.

RFC9830-2.4-2

For the TLVs/sub-TLVs that are specified as single instance, only the first instance of that TLV/sub-TLV is used: the other instances MUST be ignored and MUST NOT considered to be malformed. (§2.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Judge 2026-09-30, re-read after the RFC9012-13-7 tag lines left the unit (assertions unchanged). TestRFC9012DuplicateSingleInstanceSubTLVs: the duplicate Preference parses without error, both sub-TLVs are enumerated and the attribute round-trips octet-equal, so the ignored instance is not treated as malformed.

RFC9830-2.4.1-2

The Preference sub-TLV is OPTIONAL; it MUST NOT appear more than once in the SR Policy encoding. (§2.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PreferenceSubTLV. Forbidden: two Preference sub-TLVs in one encoding. Red: assert.Len(srpAll(repeated, subTLVPreference), 1) for a config naming preference twice. Negative: a config with no preference emits none (assert.Empty), so the count is real.

RFC9830-2.4.1-3

Specifies the length of the value field (i.e., not including Type and Length fields) in terms of octets. The value MUST be 6. (§2.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PreferenceSubTLV. Forbidden: a Preference length other than 6. Red: require.Len(value, 6) on a value srpSubs cut at the declared length (a wrong declared length also fails the walk's require.NoError), with the preference in value[2:6]. Negative (internal/core/bgp/attribute/rfc9830_test.go::TestRFC9830PreferenceFlagsAndReservedIgnored): 4- and 8-octet values are not read.

RFC9830-2.4.1-4

The Flags field MUST be set to zero on transmission (§2.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PreferenceSubTLV. Forbidden: a non-zero Preference Flags octet on transmission. Red: assert.Equal(byte(0), value[0]) on the srpDirty encoding. Negative: assert.NotEqual(make([]byte, 6), value), preference 0xDEADBEEF beside it.

RFC9830-2.4.1-5

The Flags field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.1: "The Flags field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Preference Flags now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-01-preference-flags changes buf[2] = 1 in buildPreferenceSubTLV and produces only the field diagnostics ["Preference Flags = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.1-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PreferenceSubTLV. Forbidden: a non-zero Preference RESERVED octet on transmission. Red: assert.Equal(byte(0), value[1]) on the srpDirty encoding. Negative: assert.NotEqual(make([]byte, 6), value).

RFC9830-2.4.1-7

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.1: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Preference RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-02-preference-reserved changes buf[3] = 1 in buildPreferenceSubTLV and produces only the field diagnostics ["Preference RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.2-2

The Binding SID sub-TLV is OPTIONAL; it MUST NOT appear more than once in the SR Policy encoding. (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830BindingSIDSubTLV. Forbidden: two Binding SID sub-TLVs. Red: assert.Len(srpAll(repeated, subTLVBindingSID), 1) for 'binding-sid mpls 24000 binding-sid null'. Negative: none configured, none emitted (assert.Empty).

RFC9830-2.4.2-4

6 when an SR-MPLS BSID is present, or 2 when no BSID is present. (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Row narrowed to the two clauses ze produces: 6 with an SR-MPLS BSID, 2 with none (the 18-octet SRv6 clause split to RFC9830-2.4.2-12, a {gap}). TestRFC9830BindingSIDSubTLV asserts require.Len(withBSID, 6) from a binding-sid mpls config and require.Len(noBSID, 2) from binding-sid null, through the sub-TLV the config encoder emits; a constant-length or swapped encoder fails one of them. Revert records observed red for both tags (buildBindingSIDSubTLV, buildBindingSIDNullSubTLV). The label-width defect (spec-bgp-sr-policy-rfc-defects D2) will change buildBindingSIDSubTLV and stale the positive record

RFC9830-2.4.2-12

The value MUST be 18 when a SRv6 BSID is present (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-judged 2026-10-19 (independent auditor, after 8d18d4c4c3). The earlier not-applicable verdict rested on the owner's 2026-10-11 decline of the type-13 SRv6 form; 8d18d4c4c3 records the owner's reversal, implements the form and removes the {feature-declined} annotation, so no_code_path no longer holds. RFC 9830 Section 2.4.2: "Length: Specifies the length of the value field (i.e., not including Type and Length fields) in terms of octets. The value MUST be 18 when a SRv6 BSID is present, 6 when an SR-MPLS BSID is present, or 2 when no BSID is present." Producer: srpolicy/config.go::buildBindingSIDSRv6SubTLV, reached from parseConfigRoute via 'binding-sid srv6 <ipv6-address>' (buildTunnelEncap writes at most one type-13 sub-TLV); receive rendering srpolicy/attr_json.go::bindingSIDToJSON reads type 13 by length (2, 6, 18, else malformed). TestRFC9830BindingSIDSRv6Encode asserts the whole Tunnel Encapsulation TLV octet for octet (0d12 0000 + 16-octet SID); its negative tag (SR-MPLS written at Length 6) shows 18 is not a constant but strictly exercises the neighbouring RFC9830-2.4.2-4 form. TestRFC9830BindingSIDSRv6Decode asserts a Length-18 sub-TLV renders as the SRv6 SID and a Length-20 one carrying the same 16 octets is malformed and never an SRv6 SID, a genuine violating input of this row. Overlay mutants (tags ze_core ze_bgp): encoder writes Length 16 (Encode red); decoder accepts any length >= 18 as SRv6 (Decode red); decoder rejects 18 (Decode red). All killed. Note: when 'binding-sid mpls' and 'binding-sid srv6' are both configured the MPLS form silently wins (Section 2.4.2 single-instance rule); not this row.

RFC9830-2.4.2-5

The unassigned bits in the Flags field MUST be set to zero upon transmission (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-only judgment of RFC9830-2.4.2-5 after removing its obsolete gap annotation. RFC9830 Section 2.4.2 states the whole sentence: "The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt." This row extracts the transmission conjunct only; the receive conjunct remains the separately judged RFC9830-2.4.2-6. Figure 5 assigns S/I to 0x80/0x40, leaving 0x3F unassigned. buildBindingSIDSubTLV now leaves Flags zero instead of writing 0x10, and buildBindingSIDNullSubTLV already leaves Flags zero. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission carries both -5 polarities: bsid[0]&0x3F must be zero beside the exact configured 0xFFFFF label, so an empty/all-zero payload cannot satisfy the pair. The actual pre-fix log job-enum-bsid-unassigned-before-4d050848.log fails precisely the Flags assertion. The repaired tagged test passes in job-enum-acl-bsid-repaired-race-f0d445d5.log, whose separate old-golden package failures are not erased. In semantic-observations-9r9vkava, clean selected baseline passes and rfc9830-tx-22-binding-sid-unassigned-flags restores only buf[2]=0x10; the observed sole tagged-unit failure is Binding SID unassigned Flags = 0x10 on transmission, want 0, with the single-TLV control passing. These executions precede only the new -5 tag comments; the assertion and producer behavior are unchanged, but fresh canonical tagged-unit/claim records remain parent-owned. This proves implemented TX zeroing, not exhaustive per-bit fault enumeration, S/I behavior, SRPM, dataplane, live FRR or full RFC conformance.

RFC9830-2.4.2-6

The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt. (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent bounded new-row rejudgment. RFC9830 Section 2.4.2: "The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt." RFC9830 Figure 5 assigns only S/I (0x80/0x40), leaving mask 0x3F unassigned. buildBindingSIDSubTLV now leaves the zeroed Flags octet untouched; buildBindingSIDNullSubTLV already does so. The change removes the unconditional 0x10 write without changing label bits, framing, assigned S/I behavior or buffer allocation. New tagged TX assertions require bsid[0]&0x3F==0 beside label 0xFFFFF. The actual pre-fix job-enum-bsid-unassigned-before-4d050848.log fails exactly Binding SID unassigned Flags = 0x10; the repaired tagged unit passes in job-enum-acl-bsid-repaired-race-f0d445d5.log (that package run separately failed old Go goldens, so no full-package success is inferred). The current selected semantic baseline passes, and rfc9830-tx-22-binding-sid-unassigned-flags reinstates only buf[2]=0x10 and fails exactly the new Flags assertion while the single-TLV control passes. Existing tagged TestRFC9830ReceivedFieldsAreIgnoredNotRead contrasts 0x3F and zero with fixed label and exact Preference/round-trip controls. Supplementary actual-carrier rx-bsid-unassigned in semantic-observations-nsr9c7y4 rejects only policy type13 flags&0x3F: both AFIs fail the isolated ignored-octet-14 and combined-dirty receive-action assertion while clean and every other isolated leaf survive. That reactor witness is supplementary, not falsely claimed as a new RFC9830-2.4.2-6 reactor tag. TX zeroing and implemented BGP RX disregard are now observed; no Binding SID/SRPM interpretation is invented. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.2-7

RESERVED: 1 octet of reserved bits. MUST be set to zero on transmission (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830BindingSIDSubTLV. Forbidden: a non-zero Binding SID RESERVED octet. Red: assert.Equal(byte(0), withBSID[1]) and assert.Equal(byte(0), noBSID[1]). Negative: assert.NotEqual(make([]byte, 6), withBSID) beside label 0xFFFFF.

RFC9830-2.4.2-8

RESERVED: 1 octet of reserved bits. MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.2: "MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Binding SID RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-03-binding-sid-reserved changes buf[3] = 1 in buildBindingSIDSubTLV and produces only the field diagnostics ["Binding SID RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.2-9

Traffic Class (TC), S, and TTL (Total of 12 bits) are RESERVED and MUST be set to zero (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830BindingSIDSubTLV. Forbidden: non-zero TC, S or TTL in the transmitted label stack entry. Red: assert.Equal(byte(0), withBSID[4]&0x0E) (TC), withBSID[4]&0x01 (S), withBSID[5] (TTL). Negative: the 20-bit label reads 0xFFFFF, so the zeroes are field layout, not a small label.

RFC9830-2.4.2-10

Traffic Class (TC), S, and TTL (Total of 12 bits) are RESERVED and MUST be set to zero and MUST be ignored. (§2.4.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.2: "Traffic Class (TC), S, and TTL (Total of 12 bits) are RESERVED and MUST be set to zero and MUST be ignored." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Binding SID TC/S/TTL now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-04-binding-sid-tc changes buf[6] |= 2 in buildBindingSIDSubTLV and produces only the field diagnostics ["Binding SID TC and S = 0x02 on transmission, want 0"]. rfc9830-tx-05-binding-sid-s changes buf[6] |= 1 in buildBindingSIDSubTLV and produces only the field diagnostics ["Binding SID TC and S = 0x01 on transmission, want 0"]. rfc9830-tx-06-binding-sid-ttl changes buf[7] = 1 in buildBindingSIDSubTLV and produces only the field diagnostics ["Binding SID TTL = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.2-11

The Label field is validated by the SRPM but MUST NOT contain the reserved MPLS label values (0-15). (§2.4.2)

Audit verdict: not audited: no reader has judged these tests

RFC9830-2.4.3-3

The value MUST be 26 when the SRv6 Endpoint Behavior and SID Structure is present; else, it MUST be 18. (§2.4.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SRv6BindingSIDSubTLV. Forbidden: a length other than 18 without the Endpoint Behavior and SID Structure. Red: require.Len(value, 18). The 26 case has no producer (buildSRv6BindingSIDSubTLV never appends the structure), carried by the row's single-polarity annotation.

RFC9830-2.4.3-4

The unassigned bits in the Flags field MUST be set to zero upon transmission (§2.4.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SRv6BindingSIDSubTLV. Forbidden: non-zero unassigned Flags bits on transmission (ze sets no assigned flag). Red: assert.Equal(byte(0), value[0]). Negative: assert.NotEqual(make([]byte, 18), value), SID octets non-zero.

RFC9830-2.4.3-5

The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt. (§2.4.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.3: "The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of SRv6 Binding SID unassigned Flags now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-07-srv6-binding-sid-unassigned-flags changes buf[2] = 1 in buildSRv6BindingSIDSubTLV and produces only the field diagnostics ["SRv6 Binding SID Flags = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.3-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SRv6BindingSIDSubTLV. Forbidden: a non-zero RESERVED octet on transmission. Red: assert.Equal(byte(0), value[1]). Negative: assert.NotEqual(make([]byte, 18), value).

RFC9830-2.4.3-7

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.3: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of SRv6 Binding SID RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-08-srv6-binding-sid-reserved changes buf[3] = 1 in buildSRv6BindingSIDSubTLV and produces only the field diagnostics ["SRv6 Binding SID RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.3-9

The SRv6 Endpoint Behavior and SID Structure MUST NOT be included when the SRv6 SID has not been included (§2.4.3)

Audit verdict: not audited: no reader has judged these tests

RFC9830-2.4.4-4

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentListSubTLV. Forbidden: a non-zero Segment List RESERVED octet on transmission. Red: assert.Equal(byte(0), value[0]). Negative: the following sub-TLVs are non-empty (require.NotEmpty(inner)) and the value is not blank.

RFC9830-2.4.4-5

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of both MPLS and SRv6 Segment List RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-09-segment-list-reserved changes payload[0] = 1 in buildSegmentListSubTLV and produces only the field diagnostics ["Segment List RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.1-2

The Weight sub-TLV is OPTIONAL; it MUST NOT appear more than once inside the Segment List sub-TLV. (§2.4.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentListSubTLV. Forbidden: a second Weight sub-TLV in one Segment List. Red: require.Len(weights, 1) on the srpDirty encoding, and require.Error on parseConfigRoute for 'segment-list weight 1 weight 2 ...', so the config path cannot produce a second one.

RFC9830-2.4.4.1-3

Specifies the length of the value field (i.e., not including Type and Length fields) in terms of octets. The value MUST be 6. (§2.4.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentListSubTLV. Forbidden: a Weight length other than 6 (e.g. the 8-octet total). Red: require.Len(weight, 6) on a value cut at the declared length, srpSegSubs require.NoError on the walk, and assert.Len(value, 1+8+8+28) on the whole segment list.

RFC9830-2.4.4.1-4

The Flags field MUST be set to zero on transmission (§2.4.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentListSubTLV. Forbidden: a non-zero Weight Flags octet. Red: assert.Equal(byte(0), weight[0]). Negative: assert.NotEqual(make([]byte, 6), weight), weight 0xCAFEBABE.

RFC9830-2.4.4.1-5

The Flags field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.1: "The Flags field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of both nested Weight Flags now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-10-weight-flags changes wbuf[2] = 1 in buildSegmentListSubTLV and produces only the field diagnostics ["Weight Flags = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.1-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentListSubTLV. Forbidden: a non-zero Weight RESERVED octet on transmission. Red: assert.Equal(byte(0), weight[1]) on the srpDirty encoding. Negative: assert.NotEqual(make([]byte, 6), weight) with weight[2:6] pinned to 0xCAFEBABE, so the zero is written, not a blank buffer.

RFC9830-2.4.4.1-7

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.4.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.1: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of both nested Weight RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-11-weight-reserved changes wbuf[3] = 1 in buildSegmentListSubTLV and produces only the field diagnostics ["Weight RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.2.1-1

Specifies the length of the value field (i.e., not including Type and Length fields) in terms of octets. The value MUST be 6. (§2.4.4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeASubTLV. Forbidden: a Type A length other than 6 (e.g. the 8-octet total). Red: require.Len(value, 6) on a value srpSegSubs cut at the declared length. Negative: assert.Len(inner, 3), which a length of 8 breaks by swallowing the Type B sub-TLV header that follows.

RFC9830-2.4.4.2.1-2

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeASubTLV. Forbidden: a non-zero Type A RESERVED octet on transmission. Red: assert.Equal(byte(0), value[1]). Negative: assert.NotEqual(make([]byte, 6), value) with the label pinned to 0xFFFFF.

RFC9830-2.4.4.2.1-3

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.2.1: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Type A RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-12-type-a-reserved changes buf[3] = 1 in buildSegmentTypeA and produces only the field diagnostics ["Type A RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.2.1-4

The S bit MUST be zero upon transmission (§2.4.4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeASubTLV. Forbidden: S bit set in the transmitted Type A label stack entry. Red: assert.Equal(byte(0), value[4]&0x01). Negative: assert.Equal(uint32(0xFFFFF), label), so every label bit is set beside the clear S bit and the zero is not a blank low octet.

RFC9830-2.4.4.2.1-5

The S bit MUST be zero upon transmission and MUST be ignored upon reception. (§2.4.4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.2.1: "The S bit MUST be zero upon transmission and MUST be ignored upon reception." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Type A S now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-13-type-a-s changes buf[6] |= 1 in buildSegmentTypeA and produces only the field diagnostics ["Type A S bit = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.2.2-1

The value MUST be 26 when the SRv6 Endpoint Behavior and SID Structure is present; else, it MUST be 18. (§2.4.4.2.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeBSubTLV. Forbidden: a length other than 26 with the Endpoint Behavior and SID Structure, or other than 18 without it. Red: require.Len(value, 26) on the srpDirty segment and require.Len(bare[0], 18) on the bare type-b segment; both clauses have an assertion and the pair shows the length tracks the content.

RFC9830-2.4.4.2.2-2

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.4.2.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeBSubTLV. Forbidden: a non-zero Type B RESERVED octet on transmission. Red: assert.Equal(byte(0), value[1]) and assert.Equal(byte(0), bare[0][1]), with and without the structure. Negative: assert.NotEqual(make([]byte, 26), value) and value[2] pinned to 0xFC.

RFC9830-2.4.4.2.2-3

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.4.2.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.2.2: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Type B RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-14-type-b-reserved changes buf[3] = 1 in buildSegmentTypeB and produces only the field diagnostics ["Type B RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.2.2-4

The SRv6 Endpoint Behavior and SID Structure MUST NOT be included when the SRv6 SID has not been included. (§2.4.4.2.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeBSubTLV. Forbidden: the Endpoint Behavior and SID Structure encoded without an SRv6 SID. Red: require.Error on parseSegmentList and on parseConfigRoute for 'segment endpoint-behavior ...' with no preceding type-b srv6 SID, the only route to a structure ze has. Positive: the structure follows a 16-octet SID (assert.Equal(byte(0xEF), value[17])).

RFC9830-2.4.4.2.3-1

The unassigned bits in the Flags field MUST be set to zero upon transmission (§2.4.4.2.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeASubTLV and TestRFC9830SegmentTypeBSubTLV. Forbidden: any unassigned Segment Flags bit set on transmission. Red: assert.Equal(byte(0), value[0]) on Type A and assert.Equal(byte(0), value[0]&^byte(0x10)) on Type B. Negative: the Type B Flags octet is 0x10 (the assigned B-Flag, bit 3 per Figure 13) and not zero, and 0 without the structure, so the assertion is on which bits are set, not on a blank byte.

RFC9830-2.4.4.2.3-2

The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt. (§2.4.4.2.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.2.3: "The unassigned bits in the Flags field MUST be set to zero upon transmission and MUST be ignored upon receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Type A and Type B unassigned Flags now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-15-type-a-unassigned-flags changes buf[2] = 1 in buildSegmentTypeA and produces only the field diagnostics ["Type A Flags = 0x01 on transmission, want 0"]. rfc9830-tx-16-type-b-unassigned-flags changes buf[2] |= 1 in buildSegmentTypeB and produces only the field diagnostics ["Type B unassigned Flags bits = 0x01 on transmission, want 0", "Type B Flags (B-Flag only) = 11, want 10"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.2.3-3

If B-Flag appears with Segment Type A, it MUST be ignored. (§2.4.4.2.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent semantic rejudgment: RFC9830 Section 2.4.4.2.3: "If B-Flag appears with Segment Type A, it MUST be ignored." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. The source-mapped rx-typea-b mutant is bounded to nested Type A value[0]&0x10. Both AFIs fail their isolated Type A B-bit victim and combined dirty input at the receive-action assertion; unchanged B=0 controls and valid Type B B=1/structure controls pass. This is the receive-only obligation: no missing transmit conjunct is invented, and assigned Type B B is not rejected. These are inspected scratch semantic executions, not canonical discrimination records. Current native record renewal/stamping remains parent-owned; no pending FRR carrier run, SRPM behavior, dataplane behavior, or full-RFC acceptance is inferred.

RFC9830-2.4.4.2.4-2

Reserved: 2 octets of reserved bits. This field MUST be set to zero on transmission (§2.4.4.2.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830SegmentTypeBSubTLV. Forbidden: non-zero Reserved octets in the Endpoint Behavior and SID Structure on transmission. Red: assert.Equal([]byte{0x00, 0x00}, value[20:22]). Negative: endpoint behavior 0xFFFF at value[18:20] and structure 32/16/16/64 at value[22:26], so the zeros are written at the right offset.

RFC9830-2.4.4.2.4-3

Reserved: 2 octets of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.4.2.4)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.4.2.4: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of both SRv6 endpoint-behavior Reserved octets in Type B and top-level SRv6 Binding SID now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-17-endpoint-behavior-reserved-first-octet changes if seg.hasEndpointBehavior { buf[22] = 1 } in buildSegmentTypeB and produces only the field diagnostics ["SRv6 Endpoint Behavior Reserved = 0100, want 0000"]. rfc9830-tx-18-endpoint-behavior-reserved-second-octet changes if seg.hasEndpointBehavior { buf[23] = 1 } in buildSegmentTypeB and produces only the field diagnostics ["SRv6 Endpoint Behavior Reserved = 0001, want 0000"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.4.2.4-4

The total of the locator block, locator node, function, and argument lengths MUST be less than or equal to 128 (§2.4.4.2.4)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.4.2.4-4, so no unit is bound to it.

RFC9830-2.4.5-2

The ENLP sub-TLV is OPTIONAL; it MUST NOT appear more than once in the SR Policy encoding. (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-2, so no unit is bound to it.

RFC9830-2.4.5-3

Length: Specifies the length of the value field (i.e., not including Type and Length fields) in terms of octets. The value MUST be 3. (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-3, so no unit is bound to it.

RFC9830-2.4.5-4

The Flags field MUST be set to zero on transmission (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-4, so no unit is bound to it.

RFC9830-2.4.5-5

The Flags field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-5, so no unit is bound to it.

RFC9830-2.4.5-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-6, so no unit is bound to it.

RFC9830-2.4.5-7

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-7, so no unit is bound to it.

RFC9830-2.4.5-8

Implementations adhering to this document MUST ignore the ENLP sub-TLV with unrecognized values (viz. other than 1 through 4). (§2.4.5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-2.4.5-8, so no unit is bound to it.

RFC9830-2.4.6-3

The Priority sub-TLV is OPTIONAL; it MUST NOT appear more than once in the SR Policy encoding. (§2.4.6)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PrioritySubTLV. Forbidden: two Priority sub-TLVs in one encoding. Red: assert.Len(srpAll(repeated, subTLVPriority), 1) for a config naming priority twice. Negative (control): a config with no priority emits none (assert.Empty), so the instance is counted rather than always written; a violating output cannot be built from a conforming encoder.

RFC9830-2.4.6-4

Length: Specifies the length of the value field (i.e., not including Type and Length fields) in terms of octets. The value MUST be 2. (§2.4.6)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PrioritySubTLV and TestRFC9830PriorityLengthIsValueLength. Forbidden: a Priority length other than 2 (e.g. the 4-octet total). Red: require.Len(value, 2) on a value cut at the declared length, and assert.Equal([]byte{15, 2, 255, 0}, only[4:]) pinning the length octet itself.

RFC9830-2.4.6-5

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.6)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830PrioritySubTLV. Forbidden: a non-zero Priority RESERVED octet on transmission. Red: assert.Equal(byte(0), value[1]). Negative: assert.NotEqual([]byte{0,0}, value) with value[0] pinned to 255, so the zero is written and the fields are not transposed.

RFC9830-2.4.6-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.6)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.6: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Priority RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-19-priority-reserved changes buf[3] = 1 in buildPrioritySubTLV and produces only the field diagnostics ["Priority RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.7-5

The SR Policy Candidate Path Name sub-TLV is OPTIONAL; it MUST NOT appear more than once in the SR Policy encoding. (§2.4.7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830NameSubTLVs. Forbidden: two Candidate Path Name sub-TLVs in one encoding. Red: assert.Len(srpAll(repeated, subTLVCandidatePathNam), 1) for a config naming the candidate path twice. Negative (control): an unnamed candidate path emits none (assert.Empty); a violating output cannot be built from a conforming encoder.

RFC9830-2.4.7-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830NameSubTLVs. Forbidden: a non-zero Candidate Path Name RESERVED octet on transmission. Red: assert.Equal(byte(0), value[0]) in the loop case for 'primary'. Negative: require.Len(value, 1+len(want)) and assert.Equal(want, string(value[1:])), so the zero is a separate written octet ahead of the whole name.

RFC9830-2.4.7-7

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.7)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.7: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Candidate Path Name RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-20-candidate-path-name-reserved changes if stype == subTLVCandidatePathNam { buf[3] = 1 } in buildNameSubTLV and produces only the field diagnostics ["Candidate Path Name RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-2.4.8-5

The SR Policy Name sub-TLV is OPTIONAL; it MUST NOT appear more than once in the SR Policy encoding. (§2.4.8)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830NameSubTLVs. Forbidden: two SR Policy Name sub-TLVs in one encoding. Red: assert.Len(srpAll(repeated, subTLVPolicyName), 1) for a config naming the policy twice. Negative (control): an unnamed policy emits none (assert.Empty); a violating output cannot be built from a conforming encoder.

RFC9830-2.4.8-6

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission (§2.4.8)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/component/bgp/plugins/nlri/srpolicy/rfc9830_test.go::TestRFC9830NameSubTLVs. Forbidden: a non-zero SR Policy Name RESERVED octet on transmission. Red: assert.Equal(byte(0), value[0]) in the loop case for 'alpha'. Negative: assert.NotEqual(make([]byte, 6), ...) and assert.Equal(want, string(value[1:])), so the zero is written ahead of the whole name.

RFC9830-2.4.8-7

RESERVED: 1 octet of reserved bits. This field MUST be set to zero on transmission and MUST be ignored on receipt. (§2.4.8)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent TX-completion rejudgment. RFC9830 Section 2.4.8: "This field MUST be set to zero on transmission and MUST be ignored on receipt." TestRFC9830ReservedFieldsIgnoredOnReceipt uses valid route-target/ASN4 carriers for both SAFI-73 AFIs, exact no-action and one-attribute assertions before real cache/export/downstream announcement, and nonzero meaningful neighbors. Renewed receive-source-mapped-assessment.json maps actual teSRPolicyValue offsets to immutable mutant/log victim names; its corrected receive victims, not original classifier false flags, are credited. Selective overvalidation of Policy Name RESERVED now fails the intended receive-action assertion while clean and structurally valid B=1 controls survive. The corrected 14-case aggregate is 34 isolated victim leaves plus 28 all-ignored-fields failures and 56 clean controls, not 62 isolated field tests. The missing transmission counterfactual is now executed: rfc9830-tx-21-policy-name-reserved changes if stype == subTLVPolicyName { buf[3] = 1 } in buildNameSubTLV and produces only the field diagnostics ["Policy Name RESERVED = 0x01 on transmission, want 0"]. Current TestRFC9830FieldsToIgnoreAreZeroOnTransmission traverses config parsing/buildTunnelEncap, pins zero/mask fields beside the configured Preference, labels, SID, Weight, endpoint behavior/structure, Priority and names, and keeps the positive neighbors intact. Only that tagged unit fails under each TX fault; TestRFC9830SinglePolicyTLVPerAttribute passes. The selected baseline unit passes without overlays. Both clauses are therefore independently discriminated, replacing the prior TX-evidence hold; the earlier RX mapping limitations are unchanged. This is executed host semantic evidence, not a canonical native discrimination renewal. Native recording/stamping and the five FRR scenarios remain parent-owned and are not declared verified here. No SRPM, dataplane, absent encoding form, full-RFC, or exhaustive-per-bit claim follows.

RFC9830-3-3

Type 3 (bits 11): Reserved for future use and SHOULD NOT be used. Upon reception, an implementation MUST treat it like Type 0. (§3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-3-3, so no unit is bound to it.

RFC9830-4.1-2

In such a case, the NO_ADVERTISE community [RFC1997] MUST be attached to the SR Policy update (see further details in Section 4.2.3). (§4.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.1-2, so no unit is bound to it.

RFC9830-4.2.1-1

When a BGP speaker receives an SR Policy NLRI from a neighbor, it MUST first perform validation based on the following rules in addition to the validation described in Section 5 (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.1-1, so no unit is bound to it.

RFC9830-4.2.1-2

The SR Policy NLRI MUST include a distinguisher, Color, and Endpoint field (§4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-judged 2026-10-18 (independent auditor, after e5724325c1). Section 4.2.1: "The SR Policy NLRI MUST include a distinguisher, Color, and Endpoint field that implies that the length of the NLRI MUST be either 12 or 24 octets (depending on the address family of the Endpoint)." TestRFC9830NLRILengthReceiveVerdicts changed only in its MP_UNREACH-alone block, which bears the RFC9830-5-2 and RFC7606-5.2-1 claims, not this row's. The two RFC9830-4.2.1-2 blocks are identical: positive, 12 octets under AFI 1 and 24 under AFI 2 accepted through processMessage with nothing written and dispatched byte-identical (srRequireKept); negative, 13 and 24 octets under AFI 1, 12 and 25 under AFI 2, a 13-octet NLRI beside a good one and in MP_UNREACH beside reachable NLRI are treat-as-withdraw with the session Established and the received body never dispatched (srRequireWithdrawn). Producer: srpolicy/split.go judgeSRPolicySection; a receiver accepting any byte-aligned length reddens the negative, and 12 octets under AFI 2 is the missing-field case.

RFC9830-4.2.1-3

the length of the NLRI MUST be either 12 or 24 octets (depending on the address family of the Endpoint). (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

RFC9830-4.2.1-4

* The SR Policy update MUST have either the NO_ADVERTISE community, at least one Route Target extended community in IPv4-address format, or both. (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.1-4, so no unit is bound to it.

RFC9830-4.2.1-5

If a router supporting this specification receives an SR Policy update with no Route Target extended communities and no NO_ADVERTISE community, the update MUST be considered to be malformed. (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.1-5, so no unit is bound to it.

RFC9830-4.2.1-6

The Tunnel Encapsulation Attribute MUST be attached to the BGP UPDATE message (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

RFC9830-4.2.1-7

The Tunnel Encapsulation Attribute MUST be attached to the BGP UPDATE message and MUST have a Tunnel Type TLV set to SR Policy (code point is 15). (§4.2.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-judged 2026-10-14 (independent auditor) after 9450048187. RFC 9830 Section 4.2.1: 'The Tunnel Encapsulation Attribute MUST be attached to the BGP UPDATE message and MUST have a Tunnel Type TLV set to SR Policy (code point is 15).' First clause: rfc9830_tunnel_receive_test.go::TestRFC9830SRPolicyWithoutTunnelEncapIsMalformed requires an AFI 1/2 SAFI 73 UPDATE with NLRI and no attribute 23 to be treat-as-withdraw through processMessage, and the same NLRI with one type-15 TLV to be delivered unchanged. Second clause: TestRFC9830SRPolicyTunnelTypeNot15IsMalformed attaches attribute 23 whose only TLV is VXLAN (8) or 0xFFFE and requires treat-as-withdraw with the session kept, and requires the type-15 TLV in the same position to be delivered unchanged. The recorded breaks replace all of applyTunnelEncap with a panic, which shows reachability only, so the auditor ran a targeted mutant through a go test overlay: disabling only the '!= 15' check in applyTunnelEncap (session_tunnel_encap.go, 'non-SR-Policy tunnel type on SAFI 73') turns TestRFC9830SRPolicyTunnelTypeNot15IsMalformed red ('vxlan: the malformed UPDATE was dispatched as received'), so the tagged negative discriminates the type-15 rule itself; an over-rejecting producer fails the type-15 positive.

RFC9830-4.2.1-8

A router that receives an SR Policy update that is not valid according to these criteria MUST treat the update as malformed (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.1-8, so no unit is bound to it.

RFC9830-4.2.1-9

A router that receives an SR Policy update that is not valid according to these criteria MUST treat the update as malformed, and the SR Policy CP MUST NOT be passed to the SRPM. (§4.2.1)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.1-9, so no unit is bound to it.

RFC9830-4.2.2-1

If one or more route targets are present, then at least one route target MUST match the BGP Identifier of the receiver for the update to be considered usable. (§4.2.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.2-1, so no unit is bound to it.

RFC9830-4.2.2-2

The BGP Identifier is defined in [RFC4271] as a 4-octet IPv4 address and is updated by [RFC6286] as a 4-octet, unsigned, non-zero integer. Therefore, the Route Target extended community MUST be of the same format. (§4.2.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.2-2, so no unit is bound to it.

RFC9830-4.2.2-5

When an update for an SR Policy NLRI results in its becoming unusable, BGP MUST delete its corresponding SR Policy CP from the SRPM. (§4.2.2)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.2-5, so no unit is bound to it.

RFC9830-4.2.3-1

SR Policy NLRIs that have the NO_ADVERTISE community attached to them MUST NOT be propagated. (§4.2.3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.3-1, so no unit is bound to it.

RFC9830-4.2.3-2

By default, a BGP node receiving an SR Policy NLRI MUST NOT propagate it to any External BGP (EBGP) neighbor. (§4.2.3)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-4.2.3-2, so no unit is bound to it.

RFC9830-4.2.3-6

A BGP node MUST NOT alter the SR Policy information carried in the Tunnel Encapsulation Attribute during propagation (§4.2.3)

Audit verdict: not audited: no reader has judged these tests

RFC9830-5-1

A BGP speaker MUST perform the following syntactic validation of the SR Policy NLRI to determine if it is malformed. This includes the validation of the length of each NLRI and the total length of the MP_REACH_NLRI and MP_UNREACH_NLRI attributes. It also includes the validation of the consistency of the NLRI length with the AFI and the endpoint address as specified in Section 2.1. (§5)

Audit verdict: not audited: no reader has judged these tests

RFC9830-5-2

When the error determined allows for the router to skip the malformed NLRI(s) and continue the processing of the rest of the BGP UPDATE message, then it MUST handle such malformed NLRIs as 'treat-as- withdraw'. (§5)

Audit verdict: not audited: no reader has judged these tests

RFC9830-5-4

Alternately, the router MUST perform "session reset" when the session is only being used for SR Policy or when a "AFI/SAFI disable" action is not possible. (§5)

Audit verdict: not audited: no reader has judged these tests

RFC9830-5-5

The validation of the TLVs/sub-TLVs introduced in this document and defined in their respective subsections of Section 2.4 MUST be performed to determine if they are malformed or invalid. (§5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-5-5, so no unit is bound to it.

RFC9830-5-6

The validation of the Tunnel Encapsulation Attribute itself and the other TLVs/sub-TLVs specified in Section 13 of [RFC9012] MUST be done as described in that document. (§5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-5-6, so no unit is bound to it.

RFC9830-5-7

In case of any error detected, either at the attribute or its TLV/sub-TLV level, the "treat-as-withdraw" strategy MUST be applied. (§5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-5-7, so no unit is bound to it.

RFC9830-5-8

An SR Policy update that is determined not to be valid (and, therefore, malformed) based on the rules described in Section 4.2.1 MUST be handled by the "treat-as-withdraw" strategy. (§5)

Audit verdict: not audited: no reader has judged these tests

No test carries RFC9830-5-8, so no unit is bound to it.

RFC9830-5-9

A BGP implementation MUST NOT perform semantic verification of such fields nor consider the SR Policy update to be invalid or not usable based on such validation. (§5)

Audit verdict: enforced (the tests do what the requirement demands), fresh. internal/core/bgp/attribute/rfc9830_test.go::TestRFC9830NoSemanticVerification. ParseTunnelEncap is the only receive parser of attribute 23 (wire.go knownAttrParsers) and Preference the only field ze consumes. Forbidden: refusing, or not using, an SR Policy update because a field value is semantically wrong. Red: require.NoError(ParseTunnelEncap), require.NoError(SubTLVs) with assert.Len(stlvs, 5), assert.Equal(uint32(4242), pref) and the byte-identical round trip, over weight 0, reserved label 3, a SID structure totalling 255, ENLP 99 and an empty segment list. Negative: framing errors are still refused (require.Error twice), so the skip is limited to field semantics. A verification with no observable effect cannot be asserted; every effect it could have is.

Extraction sign-off

Sections

Excluded sentences

Superseded

No document obsoletes RFC 9830, so its obligations are stated where they were written.