# Replays the Admin roles of a timeline (Export-CellTimeline.ps1) against a model of the failures that the effective-access tests of the Admin role showed in
# the cells of the operating-system matrix (Decision 24). The model is a description of the observations, not an explanation of Windows:
#
# A remote authorization manager (the one of the client for the default -ServerName, the one of the file server for its own name) computes the groups of an
# account at the first request for the account name and answers from that result for L minutes, also when the account was deleted and created again under
# the same name in the meantime, with a new SID and new group memberships. The answer then has no access through the groups (0x100000, Synchronize only).
#
# For each L from -FromMinutes to -ToMinutes, the script walks the Admin roles in time order, keeps one entry per computer and account name, and predicts
# whether the first (file server) and the second (client) test pass: a test passes when no entry that is younger than L minutes and was made for another
# account instance exists. It reports how many of the observed outcomes each L predicts. A fit says that the position of a cell in the sequence is enough to
# explain the failures, whichever module was under test; it doesn't say how Windows does it, or that the lifetime is a constant. A run whose account name is
# new always passes, which is what the controller relies on since 1dec389. It reads files only; Windows PowerShell 5.1 or PowerShell 7.
#
# -Lifetime L lists every run with the observed and the predicted outcome of both tests for that one L instead of searching for the best L. -AsIfSameSubject
# gives every run the same account name: for the cells of a controller that gives each fixture a new name (rc7l and later), the listing then shows where a
# controller that reuses the name would have met a stale entry. -Permutations N asks how often a random assignment of the observed outcomes to the runs
# (the same number of failures, a fixed random seed) reaches the best agreement of the real outcomes for some L: if the position of a cell decides the
# The lifetimes are those of a grid with the step -StepMinutes, so a range is known to within one step (use 0.05 to see the ranges of the record). The model
# doesn't know that a computer restarted. If the state lives in the memory of the computer, a restart would clear it; for the real account names of the series
# of Decision 24, no restart of the client or of a file server changes a prediction (the entry that a restart would have cleared had expired, or the run that
# read it had the same account). For -AsIfSameSubject it matters once: the client restarted between ab6 and ab7.
'{0} ({1}): the model predicts {2} of {3} outcomes for L from {4} minutes; {5} runs failed'-f$test,
$(if($test-eq'Test1'){'the name of the file server'}else{'the default server name, the client'}),$best,$rows.Count,(Get-Range-Result$bestResults),$failures
' {0} of {1} random assignments of the outcomes to the runs reach {2} of {3} for some L; the best of them reaches {4}'-f$reached,$Permutations,$best,$rows.Count,$highest
'Both tests with one L: the model predicts {0} of {1} outcomes for L from {2} minutes'-f$bestTogether,(2*$rows.Count),(Get-Range-Result@($together|Where-Object-FilterScript{$_.Agree-eq$bestTogether}))
