PASS: Managed policy blocks changes
PASS: Policy refusal performs no registry write
PASS: VBS firmware lock is respected
PASS: HVCI firmware lock is respected
PASS: Mandatory protection is respected
PASS: Enable checks active Secure Boot
PASS: Enable checks hypervisor capability
PASS: Enforced App Control blocks disable
PASS: VBS disable preserves running Credential Guard
PASS: VBS disable preserves other configured protections
PASS: VBS disable respects Credential Guard configuration
PASS: Unknown security action is rejected
PASS: Enable preserves the stronger DMA requirement
PASS: HVCI enable records the boot recovery safeguard
PASS: HVCI enable also configures VBS
PASS: An unchanged stronger value is not added to recovery
PASS: Repeated toggles preserve the first original snapshot
PASS: Restore removes values that were originally absent
PASS: Restore preserves original DMA requirement
PASS: HVCI disable leaves VBS enabled
PASS: Existing HVCI On is restored
PASS: Allowed VBS disable requests both settings Off
PASS: Missing boot recovery counter blocks HVCI enable
PASS: Missing boot counter causes no registry mutation
PASS: Security backup failure aborts before mutation
PASS: Failed security backup performs no registry write
PASS: Registry access denial propagates
PASS: Denied write still retains its saved original
PASS: Recovery rejects an unrelated registry target
PASS: Unexpected recovery record is not written
PASS: Security enable requires elevation and restart notice
PASS: Game Mode uses the gaming account without elevation
PASS: Desktop app cannot dispatch installer actions
PASS: Malformed argument cannot append an operation
PASS: Game path with spaces is a single literal argument
All 35 control-center checks passed (Windows APIs mocked).
