== M1: Admit admits everything
--- FAIL: TestAdmit_EveryClassIsRefused (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/network_mode_host (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/pid (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/uts (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/volumes_from (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/extends_file (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/devices (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/seccomp_off (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/apparmor_off (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/sysctls (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/env_file_outside (0.00s)
    --- FAIL: TestAdmit_EveryClassIsRefused/interpolated (0.00s)
== M2: copyTemplates asks nothing
--- FAIL: TestR971_RefusedCorrectionWritesNothing (0.00s)
--- FAIL: TestR971_RefusedTemplateOfAnAppNotInstalled (0.00s)
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/sync	0.010s
--- FAIL: TestAllowList_IsWiredIntoEveryComposeWriter (0.20s)
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.208s
== M3: a NEW compose writer nobody gated
    allowlist_wiring_test.go:124: internal/stacks/zz_redproof_writer.go:redproofNewWriter writes a file and names the compose file, and the allow-list guard does not know it — gate it (admitCompose before the write) or add it to `writers` as exempt with the reason
--- FAIL: TestAllowList_IsWiredIntoEveryComposeWriter (0.23s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.237s
== M4: no once-per-definition
--- FAIL: TestAllowList_OneEventPerRefusedDefinition (0.00s)
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.007s
== M5: the app page line removed
--- FAIL: TestR971_AppPage_SaysTheDefinitionWasRefused (0.28s)
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/web	0.296s
== M6: the install asks nothing
--- FAIL: TestAllowList_IsWiredIntoEveryComposeWriter (0.24s)
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.251s
== restored
ok  	gitea.dooplex.hu/admin/felhom-controller/internal/privpolicy	(cached)
ok  	gitea.dooplex.hu/admin/felhom-controller/internal/sync	(cached)
ok  	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	423.793s
13
