# Screenshot evidence map

The published lab uses ten sanitized 16:9 evidence images:

1. `01-cli-preflight-safety-gate.png` — read-only CLI preflight and zero-mutation safety gate.
2. `02-portal-nsp-learning-associations.png` — Azure portal profile with Storage, Key Vault, and Log Analytics in Learning/Transition mode.
3. `03-cli-transition-managed-identity-success.png` — managed-identity Storage and Key Vault HTTP 200 proof.
4. `04-portal-nsp-diagnostic-setting.png` — NSP diagnostic setting routing `allLogs` to Log Analytics.
5. `05-cli-transition-nsp-access-logs.png` — Transition fallback rows from `NSPAccessLogs`.
6. `06-portal-nsp-enforced-associations.png` — three associations promoted to Enforced.
7. `07-cli-enforced-dual-403.png` — Storage and Key Vault HTTP 403 negative test.
8. `08-portal-nsp-subscription-access-rule.png` — final subscription-based Inbound rule.
9. `09-cli-recovered-access-logs-zero-drift.png` — recovered HTTP 200, three log categories, and Terraform detailed exit code 0.
10. `10-cli-cleanup-baseline-proof.png` — zero artifacts, Key Vault purge, and protected-baseline comparison.

Raw portal captures and command output belong only under ignored `work/`. Public images must mask or omit tenant IDs, subscription IDs, object IDs, workspace IDs, public IPs, emails, tokens, SSH material, live DNS names, local paths, and unrelated resources.

