RED    mask: no line-break tolerance                           -> FAILED (failures=1)    restored=True
RED    mask: no carry buffer (emit every byte at once)         -> FAILED (failures=2)    restored=True
RED    run: exit code not passed through                       -> FAILED (failures=2)    restored=True
RED    put: value on sops's command line                       -> FAILED (failures=1)    restored=True
RED    put: value as a sops argument                           -> FAILED (failures=1)    restored=True
RED    import: half-quoted line accepted                       -> FAILED (failures=1)    restored=True
RED    rules: kubectl -o yaml not refused                      -> FAILED (failures=9)    restored=True
RED    rules: refusal suggests a refused form (the spike's bug) -> FAILED (failures=1)    restored=True
RED    rules: printenv of a stored name allowed                -> FAILED (failures=1)    restored=True
RED    hook: no crash wrapper                                  -> FAILED (failures=1)    restored=True
RED    hook: no persisted-output scrub                         -> FAILED (failures=1)    restored=True
RED    hook: exception passes silently                         -> FAILED (errors=1)      restored=True
RED    hook: the masked key is not named                       -> FAILED (failures=1)    restored=True
RED    hook: a persisted-only hit is not named                 -> FAILED (errors=1)      restored=True
RED    store: plain names masked anyway                        -> FAILED (failures=1)    restored=True
RED    store: plain list is an off switch                      -> FAILED (errors=1)      restored=True
RED    rules: substitutions not looked into                    -> FAILED (failures=4)    restored=True
RED    rules: substitutions skipped under sec run              -> FAILED (failures=1)    restored=True
RED    rules: unparseable risky command passes                 -> FAILED (failures=5)    restored=True
RED    rules: a leading sec run exempts every segment          -> FAILED (failures=3)    restored=True
RED    rules: the child of sec run is not checked              -> FAILED (failures=7)    restored=True
RED    rules: option B not applied                             -> FAILED (failures=5)    restored=True
RED    run: unloaded stored names reach the child              -> FAILED (failures=1)    restored=True
RED    rules: docker config not protected                      -> FAILED (failures=4, errors=1) restored=True
RED    install: foreign hooks dropped                          -> FAILED (failures=1)    restored=True
RED    install: malformed settings overwritten                 -> FAILED (failures=1)    restored=True
after all restores, full suite: OK
