PASS atomic UTF-8 JSON preserves non-ASCII text without relying on a BOM
PASS new deployment has no recovery or hidden initialization
PASS valid existing main config is retained without a repair prompt
PASS two all-zero auxiliary files recover only after identity verification and explicit approval
PASS main config and administrator hashes are unchanged byte-for-byte
PASS recovered deployment state uses only the recorded existing Windows SID
PASS recovered native host targets only the fixed after-sales extension and installed executable
PASS corrupt deployment state backup retains all original bytes
PASS corrupt native host backup retains all original bytes
PASS recovery is idempotent and never reopens initialization
PASS declined approval does not write files or backups
PASS main config changed during consent stops repair without undoing external changes
PASS auxiliary config changed during consent stops repair and retains the external file
PASS damaged main config is never reset or reconstructed from auxiliary data
PASS unowned main config cannot authorize auxiliary recovery
PASS different existing Windows SID blocks recovery before consent or writes
PASS administrator target cannot be adopted as an after-sales account
PASS independently registered native host is not overwritten
PASS valid state with a different owner is not replaced by recovery
PASS non-boolean permissions cannot be promoted during recovery
PASS zero-filled temporary readback is detected before replacing a valid original
