PASS PowerShell 5.1 syntax Ledger-RoleTrust.ps1
PASS PowerShell 5.1 syntax Ledger-Trust-Model.ps1
PASS Native certificate API rejects HKLM
PASS Native certificate API rejects .Default
PASS Native certificate API rejects S-1-5-18
PASS Native certificate API rejects unrelated
PASS Native certificate API rejects S-1-5-21-4130294341-4077735866-1349376530-1001
PASS Actual chain validation: certificate-name-mismatch / RemoteCertificateNameMismatch
PASS Actual chain validation: certificate-missing / RemoteCertificateNotAvailable
PASS Actual chain validation: machine-chain-rejected / None
PASS Actual chain validation: accepted / RemoteCertificateChainErrors
PASS Actual chain validation: approved-root-mismatch / RemoteCertificateChainErrors
PASS Actual chain validation: machine-chain-rejected / RemoteCertificateChainErrors
PASS Actual chain validation: machine-chain-rejected / RemoteCertificateChainErrors
PASS Actual chain validation: machine-chain-rejected / RemoteCertificateChainErrors
PASS Actual chain validation: machine-chain-rejected / RemoteCertificateChainErrors
PASS In-memory fixture is never installed into machine or role trust stores
PASS Actual refused TCP connection adds no trust
PASS Signed exact pin migrates only verified missing machine approval: machine-root-migrated / probes=2 / pins=1 / writes=1
PASS Cards, reader binding, origin, ledger and local settings remain byte-identical
PASS Machine readback never claims role Edge or business acceptance
PASS Previously approved machine root needs no writes or pin exception
PASS Busy refuses confirmed success
PASS Busy prevents all trust writes
PASS Admin refuses confirmed success
PASS Admin prevents all trust writes
PASS Deny refuses confirmed success
PASS Deny prevents all trust writes
PASS BadReadback refuses confirmed success
PASS Wrong SID never adopts a deployment
PASS missing cannot become machine trust
PASS malformed cannot become machine trust
PASS wrong-url cannot become machine trust
PASS wrong-hash cannot become machine trust
PASS wrong-peer cannot become machine trust
PASS host-unreachable never invokes pinned migration
PASS certificate-name-mismatch never invokes pinned migration
PASS health-invalid never invokes pinned migration
PASS tls-handshake-failed never invokes pinned migration
PASS Pin does not waive expiry, usage, signatures or other chain errors
PASS Concurrent root removal cannot silently grant unsigned approval
PASS Fresh deployment never invents a ledger host
PASS Safe nested failure host-unreachable
PASS Safe nested failure certificate-name-mismatch
PASS Safe nested failure machine-root-missing
PASS Safe nested failure tls-handshake-failed
PASS Safe nested failure health-request-failed
PASS Safe nested failure health-not-ready
PASS Safe nested failure health-invalid
PASS Safe nested failure approved-root-mismatch
PASS Safe nested failure approved-root-unavailable
PASS Safe nested failure probe-failed
PASS Pending migration retries only under an exclusive idle lease
PASS Background migration retains protected configuration byte for byte
PASS Successful unchanged host is not re-probed every update cycle
PASS Changed host has no inherited pin approval
PASS Busy prevents background trust and network work
PASS Busy leaves no open lease
PASS Race prevents background trust and network work
PASS Race leaves no open lease
PASS Hold prevents background trust and network work
PASS Hold leaves no open lease
PASS Disabled prevents background trust and network work
PASS Disabled leaves no open lease
