RED    R17 trust-path check removed                  -> test_a_bundle_that_changes_a_signer_is_refused
RED    R16 table check removed                       -> test_a_path_outside_the_table_is_refused
RED    bundle sha check removed                      -> test_wrong_sha_is_refused
RED    per-file sha check removed                    -> test_content_not_matching_its_sha_is_refused
RED    version pin removed                           -> test_version_mismatch_is_refused
RED    visudo/sh/nft content check removed           -> test_sudoers_failing_visudo_is_refused
RED    python compile check removed                  -> test_python_syntax_error_is_refused
RED    RuntimeDirectory guard removed                -> test_unit_with_runtime_directory_is_refused
RED    agent-unit User= check removed                -> test_agent_unit_not_as_the_agent_user_is_refused
RED    route-line pre-check removed                  -> test_sudoers_dropping_the_route_is_refused
RED    wrapper bundle-mode pre-check removed         -> test_wrapper_without_bundle_mode_is_refused
RED    table re-ordering removed                     -> test_sudoers_is_written_after_every_wrapper
RED    self-check sudo -l removed                    -> test_route_missing_after_install_puts_everything_back
RED    undo removed                                  -> test_route_missing_after_install_puts_everything_back
RED    crash-guard kernel.panic self-check removed   -> test_crash_guard_disagreeing_with_kernel_panic_puts_everything_back
RED    nonce burn removed                            -> test_fresh_box_gets_every_file_and_a_record
RED    nonce burned before the sha check             -> test_wrong_sha_is_refused
RED    pinned-key bootstrap removed (always the file) -> test_missing_signers_verifies_against_the_pinned_key_and_creates_it
RED    signers written even when present             -> test_present_signers_are_never_touched
RED    SUDO_UID refusal removed                      -> test_installer_entry_is_refused_through_sudo
RED    if-absent policy ignored                      -> test_tuned_crash_guard_conf_is_kept
RED    oob policy ignored                            -> test_fresh_box_gets_every_file_and_a_record
unmutated: OK
ALL RED
