A fully tested setup is deliberately narrow. One named platform must pass installation, configuration, first-agent creation, a real tool call, log inspection, a pinned upgrade, configuration and version rollback, refusal of unauthorized or irreversible actions, secret and private-path redaction, and baseline rerun on one named runtime and official access path. The record also carries a test date and evidence paths. A compatible endpoint pass does not verify the official path. A vendor claim, documentation screenshot, or test on another runtime cannot be substituted. When any retest fails, support for that exact combination is paused until a fresh run passes.