Exercise public profile configuration against native audit policy

docs/audit-profiles.md

@@ -90,3 +90,5 @@ RSoP schema references: [registry policy](https://learn.microsoft.com/en-us/prev
 Targeted file/registry SACL prerequisites are included as a read-only companion plan. See [targeted SACL planning](targeted-sacl-planning.md) for per-user gaps, source distinctions and `-SaclMode Skip`.
 
 The stronger profile's optional IPsec Main Mode control additionally requires positive local native prerequisite evidence during shared planning/configuration. See [conditional IPsec prerequisites](ipsec-prerequisites.md) for scope, statuses and fresh pre-write checks.
+
+A separate [public custom-profile native acceptance fixture](custom-audit-profiles.md#verification-and-recovery) exercises the shared configuration/precedence engine with actual writes on disposable Server 2022/2025 hosts. It verifies all 59 effective masks and exact cleanup without claiming full baseline, GPO, event or Sigma acceptance.

docs/custom-audit-profiles.md

@@ -110,7 +110,14 @@ undo partially applied changes, restore a GPO, or invoke policy refresh. Re-run
 assessment after GPO/MDM refresh to verify effective state.
 
 Tests exercise malformed files, preservation modes, validation ordering, mocked
-writes, prompt-time file changes and final drift. Windows CI performs real read-only
-custom-profile audits on Server 2022/2025 with PowerShell 5.1/7. Configuration and
-benign event/backend acceptance on Windows 11, DC and AD CS labs remain separate;
+writes, prompt-time file changes and final drift. Windows CI also exercises the actual public Plan, DryRun, Configure and Audit
+commands on disposable Server 2022/2025 hosts with PowerShell 5.1/7. A fixture-owned
+custom file selects four canonical controls: minimum and exact masks, an explicit
+optional control, and Not Configured preservation. Tests compare all 59 masks,
+typed precedence, source fingerprints, native channels and original journals,
+then verify exact fixture restoration. Invalid role selection is refused before
+configuration, and repeated configuration makes no further native change.
+These are hosted standalone servers classified by the shared profile engine as
+MemberServer; no domain join or GPO refresh is simulated. Configuration and
+benign event/backend acceptance on Windows 11, domain-joined servers, DC and AD CS labs remain separate;
 no clean-install or detection-coverage claim is made.