Unify event-log size and retention profiles with verified configuration

tests/EventLogSettings.Windows.Tests.ps1

@@ -0,0 +1,14 @@
+# Real Windows reader smoke only. No native setter, SaveChanges or policy mutation.
+$ErrorActionPreference = 'Stop'
+Import-Module (Join-Path $PSScriptRoot '../modules/EventLogSettings.psm1') -Force
+foreach ($log in @('Application', 'System', 'Setup', 'Security')) {
+    $before = Get-WelaEventLogState -Log $log
+    if ($before.ReadStatus -ne 'Available') { throw "Cannot inspect $log : $($before.Diagnostic)" }
+    $row = @(Get-WelaEventLogAudit -Profile 'cis-v4-source' | Where-Object Log -eq $log)
+    $after = Get-WelaEventLogState -Log $log
+    if ($row.Count -ne 1 -or $row[0].CurrentMaximumBytes -ne $before.MaximumSizeInBytes -or $row[0].RetentionDays -ne 'Unknown') { throw "Audit did not represent the live $log configuration." }
+    if ($before.MaximumSizeInBytes -ne $after.MaximumSizeInBytes -or $before.LogMode -ne $after.LogMode) { throw "Observed concurrent change to $log during read-only smoke." }
+}
+$missing = Get-WelaEventLogState -Log ('WELA-Unregistered-' + [guid]::NewGuid().ToString('N'))
+if ($missing.ReadStatus -ne 'Missing') { throw "Missing Windows channel was misclassified: $($missing.ReadStatus) $($missing.Diagnostic)" }
+Write-Host 'PASS: live read-only event-log audit; exact bytes, modes and missing-channel reporting verified.'