# Sanitized validation transcript

- `[PASS] Exact active subscription confirmed: Visual Studio Enterprise Subscription (identifier redacted).`
- `[PASS] PowerShell 7.6.3 and Azure CLI 2.88.0 detected.`
- `[PASS] virtual-network-manager CLI extension 3.0.2 detected.`
- `[PASS] Microsoft.Network, Microsoft.Compute, and Microsoft.PolicyInsights are registered.`
- `[PASS] 10.140.0.0/14 does not overlap an existing Azure VNet.`
- `[PASS] Ubuntu 24.04 and Standard_B1s capacity preflight passed in West Europe.`
- `[PASS] Network Manager scope and Connectivity/SecurityAdmin access provisioned.`
- `[PASS] Root /14 and West Europe /16 IPAM pools provisioned.`
- `[PASS] 10.140.240.0/20 reserved and unused.`
- `[PASS] Four unique /20 VNet allocations returned by IPAM.`
- `[PASS] Core and Edge Standard_B1s VMs deployed with no inbound SSH rule.`
- `[PASS] Edge proof listeners active on TCP 8080 and 8443.`
- `[PASS] Exact-resource-group Microsoft.Network.Data policy assigned.`
- `[PASS] Initial dynamic membership converged to three VNets.`
- `[PASS] Edge excluded by NetworkGroup=Mseh; TCP 8080 and 8443 blocked.`
- `[PASS] Edge corrected to NetworkGroup=Mesh; dynamic membership converged to four VNets.`
- `[PASS] Three active ConnectedGroup routes present on the Core NIC.`
- `[PASS] TCP 8080 and 8443 opened after mesh convergence without manual peering.`
- `[PASS] Security Admin Deny for TCP 8080 deployed at priority 100.`
- `[PASS] Effective Security Admin API reports Deny, Inbound, TCP 8080.`
- `[PASS] Final traffic proof: TCP 8080 blocked; TCP 8443 open.`
- `[PASS] Final validation: four unique /20 allocations, unused reservation, four members, no SSH allow.`
- `[PASS] SecurityAdmin and Connectivity configurations undeployed before definition removal.`
- `[PASS] Exact workshop resource group removed.`
- `[PASS] Dynamic policy assignment absent.`
- `[PASS] Subscription-level policy definition absent.`
- `[PASS] No workshop deployment, IPAM allocation, VNet, VM, NIC, NSG, disk, or public IP remains.`

Identifiers, public addresses, tokens, raw ARM IDs, and account data are intentionally omitted.
