A production HSM and its server may serve temporarily for testing only where a business rationale exists and all keying material has first been deleted; after testing, every test key is deleted, the platform is wiped and reinstalled from read-only media, and production keys are reloaded under split knowledge and dual control, with physical and logical security maintained throughout.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.