diff --git a/docs/TEST-7.4-e2e.md b/docs/TEST-7.4-e2e.md
new file mode 100644
index 0000000..8f0f819
--- /dev/null
+++ b/docs/TEST-7.4-e2e.md
@@ -0,0 +1,161 @@
+# §7.4 — E2e test refactor Deploy↔Setup
+
+Valida che il refactor §7 (2026-05-10) funzioni su VM reale:
+Deploy possiede OS hardening → Setup valida senza re-applicare.
+
+**Non toccare l'existing template** (`CI-WinBuild.vmx` + snapshot `BaseClean`).
+Usare VM separata per i test.
+
+---
+
+## Prerequisiti
+
+- `F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso` presente
+- `F:\CI\ISO\VMware-tools-windows.iso` presente
+- VMware Workstation aperto, sufficiente spazio su `F:\CI\Templates\WinBuildTest\`
+
+---
+
+## Step 1 — Deploy su VM test
+
+```powershell
+cd N:\Code\Workspace\Local-CI-CD-System\template
+
+.\Deploy-WinBuild2025.ps1 `
+    -WinISO   'F:\CI\ISO\26100.1742.240906-0331.ge_release_svc_refresh_SERVER_VOL_x64FRE_en-us.iso' `
+    -ToolsISO 'F:\CI\ISO\VMware-tools-windows.iso' `
+    -VMXPath  'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
+    -VMName   'WinBuild2025-test' `
+    -ProductKey 'TVRH6-WHNXV-R9WG3-9XRFY-MY832'
+```
+
+Durata attesa: 30–90 min. Exit 0 = OK, snapshot `PostInstall` preso automaticamente.
+
+Se timeout su `install_complete.flag`: aumentare `-GuestPollMaxMinutes 120`.
+
+---
+
+## Step 2 — Verifica stato Deploy (§7.1 + §7.2)
+
+Sostituire `192.168.79.xxx` con IP reale della VM test (`ipconfig` dentro la VM).
+
+```powershell
+$ip   = '192.168.79.xxx'
+$cred = Get-Credential   # Administrator / WinBuild!
+$so   = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
+
+Invoke-Command -ComputerName $ip -Credential $cred `
+    -Authentication Basic -SessionOption $so -ScriptBlock {
+
+    "=== §7.1 Firewall ==="
+    Get-NetFirewallProfile | Select-Object Name, Enabled
+
+    "=== §7.2 WU services ==="
+    Get-Service wuauserv, UsoSvc | Select-Object Name, StartType, Status
+
+    "=== §7.2 WU GPO ==="
+    $au = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
+    $wu = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
+    [PSCustomObject]@{
+        NoAutoUpdate              = (Get-ItemProperty $au  -EA SilentlyContinue).NoAutoUpdate
+        DisableWindowsUpdateAccess = (Get-ItemProperty $wu -EA SilentlyContinue).DisableWindowsUpdateAccess
+    }
+
+    "=== §7.1 WinRM limits ==="
+    [PSCustomObject]@{
+        MaxMemoryPerShellMB = (Get-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB).Value
+        IdleTimeOut         = (Get-Item WSMan:\localhost\Shell\IdleTimeOut).Value
+    }
+
+    "=== §7.1 UAC ==="
+    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' |
+        Select-Object EnableLUA, LocalAccountTokenFilterPolicy
+}
+```
+
+**Atteso**:
+| Check | Valore atteso |
+|---|---|
+| Firewall tutti profili | `Enabled=False` |
+| `wuauserv` StartType | `Manual` |
+| `UsoSvc` StartType | `Manual` |
+| `NoAutoUpdate` | `1` |
+| `DisableWindowsUpdateAccess` | `1` |
+| `MaxMemoryPerShellMB` | `>= 2048` |
+| `EnableLUA` | `0` |
+
+---
+
+## Step 3 — Prepare -SkipWindowsUpdate (Assert-Step validation)
+
+```powershell
+.\Prepare-WinBuild2025.ps1 `
+    -VMIPAddress 192.168.79.xxx `
+    -SkipWindowsUpdate
+```
+
+**Cosa verificare nel log**:
+- Step 1 (Firewall): solo `[OK]` — nessun `Set-NetFirewallProfile`
+- Step 3 (WinRM): solo `[OK]` — nessun `Enable-PSRemoting` né `winrm set`
+- Step 4b (UAC): solo `[OK]` — nessun `Set-ItemProperty EnableLUA`
+- Step 5b (Explorer): solo `[OK]`
+- Step 5c (CIUX): solo `[OK]`
+- Step 4 (user `ci_build`): crea utente — operativo, non validation
+- Step 5 (CI dirs): crea `C:\CI\{build,output,scripts}` — operativo
+- Step 6: `[Setup] Skipping Windows Update` — corretto con `-SkipWindowsUpdate`
+- Step 6b: disabilita wuauserv/UsoSvc — deve girare sempre
+- Step 7-10: .NET, Python, VS Build Tools installati
+- Final gate: tutti e 7 i check `[OK]`
+- Exit code: `0`
+
+Se un Assert-Step fallisce con `[FAIL]` su Step 1/3/4b/5b/5c → Deploy non ha applicato
+quel setting → debug Deploy post-install.ps1 (controllare log nella VM).
+
+---
+
+## Step 4 — Prepare senza -Skip (WU lifecycle §7.2)
+
+> Solo se Step 3 è passato. La VM deve avere internet (VMnet8 NAT).
+
+```powershell
+.\Prepare-WinBuild2025.ps1 -VMIPAddress 192.168.79.xxx
+```
+
+**Atteso**:
+- Step 6 Step A: rimuove `DisableWindowsUpdateAccess` e `NoAutoUpdate` GPO keys
+- Step 6 Step D: avvia wuauserv/UsoSvc/bits/cryptsvc (già Manual → solo Start)
+- Step 6: WU gira via SchTask SYSTEM, ResultCode ∈ {0, 2, 3}
+- Step 6b: `wuauserv StartType=Disabled`, `UsoSvc StartType=Disabled`, GPO keys re-scritti
+- Final gate `Windows Update permanently disabled` → `[OK]`
+- Exit code: `0` (o `3010` se WU richiede reboot — ripetere con `-SkipWindowsUpdate`)
+
+---
+
+## Step 5 — Snapshot e promozione (opzionale)
+
+Se tutti i check di Step 3 e 4 passano:
+
+```powershell
+# Spegni VM test
+& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
+    -T ws stop 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' soft
+
+# Snapshot versionato
+& 'C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe' `
+    -T ws snapshot 'F:\CI\Templates\WinBuildTest\CI-WinBuild-test.vmx' `
+    "BaseClean_$(Get-Date -Format yyyyMMdd)"
+```
+
+Per promuovere a produzione (rimpiazza template esistente):
+1. Copia `F:\CI\Templates\WinBuildTest\` → `F:\CI\Templates\WinBuild\` (backup prima)
+2. Aggiorna `GITEA_CI_TEMPLATE_PATH` in `runner/config.yaml` se path cambia
+3. Aggiorna `GITEA_CI_SNAPSHOT_NAME` se usi nome versionato (vedi TODO §2.5)
+
+---
+
+## Checklist §7.4
+
+- [ ] Step 1: Deploy exit 0, snapshot `PostInstall` presente
+- [ ] Step 2: Firewall=False, wuauserv=Manual, NoAutoUpdate=1, MaxMemory≥2048, UAC=0
+- [ ] Step 3: Prepare `-SkipWindowsUpdate` exit 0, nessun Set in Step 1/3/4b/5b/5c
+- [ ] Step 4: Prepare senza `-Skip` exit 0, wuauserv=Disabled post-Step 6b