The generic-account floor misses the JSON-serialised Windows home root. accountRootPrefixes (internal/adapter/scanner/identity.go) carries the single-backslash spelling (\users\) but not the doubled one every JSON encoder writes, so C:\\Users\\carol\\Desktop in a transcript line raises no finding at all while C:\Users\carol\Desktop hard-fails; the home-literal clause of standsAsAccountName compares the configured home verbatim and misses its doubled spelling the same way. Before the generic floor the bare word was flagged, so the floor narrowed a hard_fail rule in the redactor's own input shape: a caller whose login is on the generic list leaks the home path of every Windows path a JSON transcript quotes through capture and history.

The generic-account floor misses the JSON-serialised Windows home root. accountRootPrefixes (internal/adapter/scanner/identity.go) carries the single-backslash spelling (\users) but not the doubled one every JSON encoder writes, so C:\Users\carol\Desktop in a transcript line raises no finding at all while C:\Users\carol\Desktop hard-fails; the home-literal clause of standsAsAccountName compares the configured home verbatim and misses its doubled spelling the same way. Before the generic floor the bare word was flagged, so the floor narrowed a hard_fail rule in the redactor's own input shape: a caller whose login is on the generic list leaks the home path of every Windows path a JSON transcript quotes through capture and history.

Grounds

• pursued: a generic login in a JSON-escaped Windows home path is reported as local_username; a transcript line quoting C:\Users\carol that yields no local_username finding would show it wrong.