@@ -0,0 +1,273 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# Part of PyBLE (https://pyble.dev) — see /LICENSE.
+#
+# [red] Frozen destinations and generated BOARD_DIR source paths are distinct.
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+import unittest
+
+
+FIXTURE_PATH = Path(__file__).with_name(
+    "test_release_license_policy_v2_integration.py"
+)
+SPEC = importlib.util.spec_from_file_location(
+    "pyble_frozen_source_path_fixtures", FIXTURE_PATH
+)
+if SPEC is None or SPEC.loader is None:
+    raise RuntimeError("cannot load frozen reconstruction fixtures")
+FIXTURES = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(FIXTURES)
+RELEASE = FIXTURES.RELEASE
+BASE = FIXTURES.BASE
+
+
+class CanonicalPybleFixture(FIXTURES.ObservationV2Fixture):
+    """Real retained board layout with deterministic synthetic compiler tools.
+
+    The observer, manifest resolver, descriptor snapshot, byte comparisons and
+    reconstruction subprocesses are production code, not patched test models.
+    Only the compiler inputs/tools are the existing explicitly synthetic ones.
+    """
+
+    def _install_frozen_proof_fixture(self):
+        super()._install_frozen_proof_fixture()
+        canonical = self.firmware / "pyble"
+        canonical.mkdir()
+        (canonical / "pyble_workspace.py").write_text(
+            "# SPDX-License-Identifier: MIT\nWORKSPACE = 'canonical'\n",
+            encoding="utf-8",
+        )
+        (canonical / "pyble_agent.py").write_text(
+            "# SPDX-License-Identifier: MIT\n", encoding="utf-8"
+        )
+        # Deliberately unlike the generated lock-derived copy: comparing this
+        # placeholder instead of the lock output must not become acceptable.
+        (canonical / "_version.py").write_text(
+            "# SPDX-License-Identifier: MIT\nAGENT_VERSION = 'placeholder'\n",
+            encoding="utf-8",
+        )
+        generator = (
+            self.firmware / "upstream/micropython/tools/makemanifest.py"
+        )
+        text = generator.read_text(encoding="utf-8")
+        marker = 'manifest_bytes = b"".join(\n'
+        if text.count(marker) != 1:
+            raise AssertionError("synthetic generator insertion point changed")
+        generator.write_text(
+            text.replace(
+                marker,
+                'sources += (\n'
+                '    ("pyble_workspace.py", board / "pyble/pyble_workspace.py"),\n'
+                '    ("_version.py", board / "pyble/_version.py"),\n'
+                ')\n' + marker,
+            ),
+            encoding="utf-8",
+        )
+        for _profile_id, target, _idf_target in FIXTURES.PROFILE_TARGETS:
+            overlay = self.firmware / "board_overlays" / target
+            # This selects firmware/pyble through the production resolver's
+            # canonical fallback, not a same-named overlay source.
+            (overlay / "pyble/pyble_agent.py").unlink()
+            manifest = overlay / "manifest.py"
+            manifest.write_text(
+                manifest.read_text(encoding="utf-8")
+                + 'module("pyble_workspace.py", base_path="$(BOARD_DIR)/pyble", opt=3)\n'
+                + 'module("_version.py", base_path="$(BOARD_DIR)/pyble", opt=3)\n',
+                encoding="utf-8",
+            )
+            board = (
+                self.firmware
+                / "upstream/micropython/ports/esp32/boards"
+                / RELEASE.FROZEN_TARGET_SETTINGS[target]["board"]
+            )
+            (board / "manifest.py").write_bytes(manifest.read_bytes())
+            (board / "pyble/pyble_workspace.py").write_bytes(
+                (canonical / "pyble_workspace.py").read_bytes()
+            )
+            (board / "pyble/_version.py").write_bytes(
+                b"# SPDX-License-Identifier: MIT\n"
+                b"# GENERATED by firmware/scripts/build.sh from "
+                b"firmware/versions.lock [pyble] \xe2\x80\x94 do not edit.\n"
+                b'AGENT_VERSION = "0.5.0"\n'
+                b'PROTOCOL_VERSION = "PBLE/1"\n'
+            )
+            self.regenerate_frozen_payload(target)
+
+
+class FrozenSourcePathTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.fixture = CanonicalPybleFixture()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.fixture.close()
+
+    def setUp(self):
+        self.target = "esp32"
+        self.manifest = (
+            self.fixture.firmware / "board_overlays/esp32/manifest.py"
+        )
+        self.board = (
+            self.fixture.build_root
+            / ".sources/esp32/micropython/ports/esp32/boards"
+            / RELEASE.FROZEN_TARGET_SETTINGS[self.target]["board"]
+        )
+        self.workspace = self.board / "pyble/pyble_workspace.py"
+        self.canonical = self.fixture.firmware / "pyble/pyble_workspace.py"
+
+    def observe(self):
+        # Same production observer called by the all-profile license collector;
+        # pass the independently known synthetic compiler hash to avoid an
+        # unrelated repeated compiler rebuild, not a frozen-proof mock.
+        compiler = (
+            self.fixture.firmware
+            / "upstream/micropython/mpy-cross/build/mpy-cross"
+        )
+        return RELEASE._audit_manifest_evidence_record(
+            self.manifest,
+            self.fixture.build_root / self.target / "frozen_content.c",
+            repo_root=self.fixture.repo,
+            target=self.target,
+            trusted_mpy_cross_sha256=BASE.sha256_path(compiler),
+        )
+
+    def test_flat_workspace_and_prefixed_package_reach_full_observer(self):
+        context = RELEASE._audit_observe_policy_v2_context(
+            self.fixture.policy,
+            repo_root=self.fixture.repo,
+            build_root=self.fixture.build_root,
+        )
+        self.assertEqual(len(context["manifest_evidence"]), 4)
+        for record in context["manifest_evidence"]:
+            selected = {
+                item["destination"]: item for item in record["selections"]
+            }
+            workspace = selected["pyble_workspace.py"]
+            self.assertEqual(
+                workspace["source_path"], "firmware/pyble/pyble_workspace.py"
+            )
+            self.assertEqual(workspace["sha256"], BASE.sha256_path(self.canonical))
+            self.assertEqual(workspace["optimization"], 3)
+            self.assertEqual(
+                selected["pyble/pyble_agent.py"]["source_path"],
+                "firmware/pyble/pyble_agent.py",
+            )
+            frozen = {item["destination"] for item in record["frozen_mpy"]}
+            self.assertIn("pyble_workspace.mpy", frozen)
+            self.assertIn("pyble/pyble_agent.mpy", frozen)
+            self.assertNotIn("pyble/pyble_workspace.mpy", frozen)
+            self.assertNotIn("pyble/pyble/pyble_agent.mpy", frozen)
+        self.assertFalse((self.board / "pyble_workspace.py").exists())
+        self.assertFalse((self.board / "pyble/pyble").exists())
+
+    def test_missing_nested_workspace_is_rejected(self):
+        with BASE.removed_file(self.workspace):
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "source.*missing"):
+                self.observe()
+
+    def test_matching_flat_decoy_cannot_replace_missing_nested_source(self):
+        decoy = self.board / "pyble_workspace.py"
+        decoy.write_bytes(self.canonical.read_bytes())
+        try:
+            with BASE.removed_file(self.workspace):
+                with self.assertRaisesRegex(RELEASE.ReleaseError, "source.*missing"):
+                    self.observe()
+        finally:
+            decoy.unlink()
+
+    def test_matching_flat_decoy_cannot_hide_stale_nested_source(self):
+        decoy = self.board / "pyble_workspace.py"
+        decoy.write_bytes(self.canonical.read_bytes())
+        try:
+            with BASE.patched_bytes(self.workspace, b"# stale nested bytes\n"):
+                with self.assertRaisesRegex(RELEASE.ReleaseError, "source.*stale"):
+                    self.observe()
+        finally:
+            decoy.unlink()
+
+    def test_nested_workspace_file_symlink_is_rejected(self):
+        with BASE.removed_file(self.workspace):
+            self.workspace.symlink_to(self.canonical)
+            try:
+                with self.assertRaisesRegex(RELEASE.ReleaseError, "symlink"):
+                    self.observe()
+            finally:
+                self.workspace.unlink()
+
+    def test_nested_pyble_directory_symlink_is_rejected(self):
+        nested = self.board / "pyble"
+        backup = self.board.parent / "pyble-path-test-backup"
+        nested.rename(backup)
+        try:
+            nested.symlink_to(backup, target_is_directory=True)
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "symlink"):
+                self.observe()
+        finally:
+            nested.unlink()
+            backup.rename(nested)
+
+    def test_changed_canonical_workspace_is_rejected(self):
+        with BASE.patched_bytes(self.canonical, b"# changed canonical bytes\n"):
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "source.*stale"):
+                self.observe()
+
+    def test_already_prefixed_package_copy_is_still_byte_checked(self):
+        with BASE.patched_bytes(
+            self.board / "pyble/pyble_agent.py", b"# stale package\n"
+        ):
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "source.*stale"):
+                self.observe()
+
+    def test_lock_version_exception_does_not_compare_placeholder(self):
+        version = self.board / "pyble/_version.py"
+        placeholder = self.fixture.firmware / "pyble/_version.py"
+        self.assertNotEqual(version.read_bytes(), placeholder.read_bytes())
+        self.observe()
+        with BASE.patched_bytes(version, placeholder.read_bytes()):
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "lock-derived.*stale"):
+                self.observe()
+
+    def test_overlay_copy_keeps_its_existing_byte_check(self):
+        with BASE.patched_bytes(self.board / "_boot.py", b"# stale boot\n"):
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "source.*stale"):
+                self.observe()
+
+    def test_duplicate_destination_remains_rejected(self):
+        original = self.manifest.read_text(encoding="utf-8")
+        with BASE.patched_text(
+            self.manifest,
+            original
+            + 'module("pyble_workspace.py", base_path="$(BOARD_DIR)/pyble")\n',
+        ):
+            with self.assertRaisesRegex(RELEASE.ReleaseError, "duplicates destination"):
+                self.observe()
+
+    def test_historical_overlay_package_layout_still_reconstructs(self):
+        historical = FIXTURES.ObservationV2Fixture()
+        try:
+            context = RELEASE._audit_observe_policy_v2_context(
+                historical.policy,
+                repo_root=historical.repo,
+                build_root=historical.build_root,
+            )
+            for record in context["manifest_evidence"]:
+                selected = {
+                    item["destination"]: item for item in record["selections"]
+                }
+                self.assertNotIn("pyble_workspace.py", selected)
+                self.assertEqual(
+                    selected["pyble/pyble_agent.py"]["source_path"],
+                    "firmware/board_overlays/%s/pyble/pyble_agent.py"
+                    % record["target"],
+                )
+        finally:
+            historical.close()
+
+
+if __name__ == "__main__":
+    unittest.main()