# Validation record

**Release status: PASSED live rehearsal.** All 22 required live checks passed. The final archive's extraction/privacy audit and SHA-256 are recorded separately in its immutable external receipt after packaging. This record does not claim that a native blog or listing has already been published.

## Observed Azure results

All 22 required checks passed, including all three isolated faults and first/repeated repairs and two exact cleanup checks preserving the unrelated baseline. The final four checks were evaluated after cleanup from genuine retained live observations collected at 14:49–14:57 UTC, the historical DC fault event at 13:11 UTC and the actual zero-change plan completed before deletion. This was a later offline evaluation, not a new Azure execution after cleanup. All 20 genuine privacy-reviewed captures are included.

| Check | Actual recorded UTC | Result |
|---|---|---|
| preflight | 2026-11-07 11:13:20 UTC | PASS |
| deploy-Foundation | 2026-11-07 11:15:46 UTC | PASS |
| bootstrap | 2026-11-07 11:39:17 UTC | PASS |
| deploy-Identity | 2026-11-07 11:42:21 UTC | PASS |
| configure | 2026-11-07 12:41:14 UTC | PASS |
| baseline | 2026-11-07 14:52:03 UTC | PASS |
| final-healthy | 2026-11-07 15:10:33 UTC | PASS |
| terraform-no-drift | 2026-11-07 15:10:33 UTC | PASS |
| storage-log-correlation | 2026-11-07 15:10:33 UTC | PASS |
| kerberos-event-correlation | 2026-11-07 15:10:33 UTC | PASS |
| cleanup-absence | 2026-11-07 15:01:30 UTC | PASS |
| cleanup-repeat | 2026-11-07 15:01:46 UTC | PASS |
| baseline-preserved | 2026-11-07 15:01:46 UTC | PASS |
| fault-Kerberos | 2026-11-07 13:12:03 UTC | PASS |
| recovery-Kerberos | 2026-11-07 13:16:02 UTC | PASS |
| repeated-recovery-Kerberos | 2026-11-07 13:20:13 UTC | PASS |
| fault-ShareGate | 2026-11-07 13:27:37 UTC | PASS |
| recovery-ShareGate | 2026-11-07 13:31:59 UTC | PASS |
| repeated-recovery-ShareGate | 2026-11-07 13:35:30 UTC | PASS |
| fault-Ntfs | 2026-11-07 14:21:38 UTC | PASS |
| recovery-Ntfs | 2026-11-07 14:33:02 UTC | PASS |
| repeated-recovery-Ntfs | 2026-11-07 14:38:14 UTC | PASS |

| Scenario | Fault accepted | First recovery | Repeated recovery |
|---|---|---|---|
| Kerberos | 2026-11-07 13:12:03 UTC | 2026-11-07 13:16:02 UTC | 2026-11-07 13:20:13 UTC |
| ShareGate | 2026-11-07 13:27:37 UTC | 2026-11-07 13:31:59 UTC | 2026-11-07 13:35:30 UTC |
| Ntfs | 2026-11-07 14:21:38 UTC | 2026-11-07 14:33:02 UTC | 2026-11-07 14:38:14 UTC |

The last healthy guest probe actually executed at 14:49 UTC; its full configuration and domain audit were observed at 14:50–14:52, client audit and strict storage-log collection at 14:54, and the independent zero-change Terraform plan completed at 14:57 before deletion. After cleanup, the guarded offline evaluator recorded the final checks at **2026-11-07 15:10:33 UTC**, verifying exact original file hashes, native Azure response journals, fresh PASSWORD/Limited actor reports, nonce-correlated log rows and the saved plan's 39 no-op managed-resource actions. Each check retains its original observation/source times separately from its later evaluation time. There was no new Azure execution after cleanup.

The original final aggregation check at 14:54 failed because Windows PowerShell 5.1 named-property Sort-Object -Unique collapsed distinct hashtable event records. The fix uses explicit sort expressions. The original FAILED check remains in history; the later checksum-bound evaluation joins the genuine historical 13:11 DC failure and the genuine latest healthy success. It does not rewrite the latest DC audit or infer a failure from an unrelated count.

The final actor matrix covers fresh named Reader, Writer and Outsider PASSWORD task logons and all 12 actor/target combinations. Healthy paths supplied exact CIFS AES256 tickets, encrypted SMB 3.1.1 sessions, marker hash matches and the expected file operations. The channel-cipher proof is **sole configured cipher + observed encrypted session**; no direct per-session cipher getter is claimed. NTFS new-file creation and directory DACL denial were the primary fault gates; existing-file outcomes remain in the evidence, while recovery requires all create/read/modify/delete behavior to be restored.

The missing-SPN local diagnostic was klist 0xc000018b with GetTicket substatus 0x6fb; the actual DC 4769 failure status was 0x7. Native net use system error 1223 was EOF cancellation after a credential prompt, not a server-returned Kerberos status. Native/management timeout 1460 did not satisfy intended fault acceptance. The original failed attempt remains in [rehearsal history](docs/evidence/rehearsal-history.md).

The supplemental observed SMB CREATE denial retains StatusCode=-1073741790 with blank SmbStatusCode and StatusText. Its separately labeled signed-32-bit interpretation is NTSTATUS 0xC0000022 (STATUS_ACCESS_DENIED), not an HTTP status or an invented missing field. Correlated final READ 8 / WRITE 9 rows match actual nonce filenames, Writer identity and both accounts; optional extension import success is not required because collection uses the official core Logs REST query route.

## Local checks

The [local validation record](docs/evidence/local-validation.json) reports **201 Pester passes** (Controller 122, Acceptance 35, Logs REST 17, RunCommand maintenance 18, fault-log helper 9), **32 actual Windows PowerShell 5.1 guest checks**, **3 Terraform mock-provider tests**, **22 synthetic release-helper checks** and **7 CLI formatter checks**. These local checks made no Azure calls and do not establish live faults or cleanup. Checked-source hashes still match the package.

ScriptAnalyzer findings remain recorded. In particular, AzureFiles.Common.psm1 has the intentional PSAvoidUsingConvertToSecureStringWithPlainText error: the in-memory generated secret JSON is converted to SecureString immediately before current-user Windows DPAPI encryption in the protected private store. The finding was not suppressed; plaintext credentials are not public artifacts. Warnings and informational findings are enumerated in the report; this is not a zero-findings claim.

## Captures, cleanup and privacy

All 20 genuine reviewed images are included: 6 Portal, 11 CLI and 3 Windows, with source/public SHA-256 bindings, original timestamps and redaction sidecars. The conceptual synthwave cover does not count as evidence. Later displays of retained execution reports preserve their original execution times and are labeled accordingly.

Cleanup began at 2026-11-07 14:57:57 UTC, before the original 4.5-hour stop. Exact absence was checked at 2026-11-07 15:01:30 UTC, repeated at 2026-11-07 15:01:46 UTC, and the protected baseline was preserved. The original 6-hour deadline was 2026-11-07 16:27:58 UTC; the conservative active estimate was EUR 5.81, with EUR 5 cleanup reserve under the EUR 20 total limit. The estimate is not a billing invoice.

See [sanitized evidence](docs/evidence/sanitized-evidence.json), [capture inventory](docs/capture-plan.json) and [operational history](docs/evidence/rehearsal-history.md). Credentials, storage keys, private identifiers, raw logs, original screenshots, plans and Terraform state remain outside the package. The ZIP's SHA-256 is kept outside its own archive.