Where managed policy is read from, and whether that location is certain.
fallback holds why the path is a guess, or None when the path is
authoritative. A failed registry query leaves the lookup pointing at the
hardcoded default. On a host whose ProgramData is relocated, the guessed
path holds no file, which reads as "no administrator deployed policy" — the
same state as a machine with no policy at all. The reason travels with the
path so the two can never be confused: a guessed path yields an
INDETERMINATE snapshot rather than a clean MISSING one.
