docs: gather-rule phase scoping + emit-on-change concept doc (OKF)

New rules/ section in the knowledge bundle: semantics table, from-phase latch
behavior (never via Failed, sticky through it), on_change x emitOnlyIfExists
composition, restart re-emit, no-phase-signal caveat, old-agent degradation,
and the prerequisite toggle-wipe fix. Index + log updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/build-agent.yml

@@ -58,10 +58,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: '8.0.x'
+          dotnet-version: '10.0.x'
 
       # Build numbers come from the shared counter blob (single source of truth for CI
       # AND local build.ps1). Reserve-before-build with ETag-CAS: concurrent builds can
@@ -265,6 +266,12 @@ jobs:
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
           $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          # Legacy mirror (transition until customers moved to the download.-alias):
+          # blobs are ALSO pushed to the old account so the bootstrap URL baked into
+          # customers' Intune scripts keeps serving current bits. Fail-soft -- a
+          # legacy hiccup must never fail a release. Counter lives ONLY on eu.
+          $legacyContainerUrl = "https://autopilotmonitor.blob.core.windows.net/agent"
+          $legacySasToken = "${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}".TrimStart('?')
 
           function Send-Blob {
             param([string]$Local, [string]$BlobName, [string]$ContentType)
@@ -279,6 +286,14 @@ jobs:
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1MB, 2)) MB)..."
             Invoke-RestMethod -Uri $url -Method Put -Headers $headers -Body $bytes
             Write-Host "  uploaded $BlobName"
+            if (-not [string]::IsNullOrEmpty($legacySasToken)) {
+              try {
+                Invoke-RestMethod -Uri "$legacyContainerUrl/$BlobName`?$legacySasToken" -Method Put -Headers $headers -Body $bytes
+                Write-Host "  mirrored $BlobName to legacy storage"
+              } catch {
+                Write-Host "::warning::legacy mirror failed for $BlobName -- $($_.Exception.Message)"
+              }
+            }
           }
 
           # Versioned namespace (always)

.github/workflows/deploy-web.yml

@@ -1,4 +1,4 @@
-name: Azure Static Web Apps CI/CD
+name: Deploy Web (Static Web App)
 
 on:
   push:
@@ -6,7 +6,7 @@ on:
       - main
     paths:
       - 'src/Web/autopilot-monitor-web/**'
-      - '.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml'
+      - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened, closed]
@@ -14,7 +14,7 @@ on:
       - main
     paths:
       - 'src/Web/autopilot-monitor-web/**'
-      - '.github/workflows/azure-static-web-apps-brave-grass-0070b5703.yml'
+      - '.github/workflows/deploy-web.yml'
 
 jobs:
   build_and_deploy_job:
@@ -37,7 +37,7 @@ jobs:
           NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL: ${{ vars.NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL }}
           NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING: ${{ secrets.NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING }}
         with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_BRAVE_GRASS_0070B5703 }}
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
           repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
           action: "upload"
           ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
@@ -56,7 +56,7 @@ jobs:
         id: closepullrequest
         uses: Azure/static-web-apps-deploy@v1
         with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_BRAVE_GRASS_0070B5703 }}
+          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
           action: "close"
 
 

build.ps1

@@ -53,7 +53,7 @@ try {
     Write-Host "  ✓ .NET SDK version: $dotnetVersion" -ForegroundColor Green
 }
 catch {
-    Write-Host "  ✗ .NET SDK not found. Please install .NET 8 SDK." -ForegroundColor Red
+    Write-Host "  ✗ .NET SDK not found. Please install .NET 10 SDK." -ForegroundColor Red
     exit 1
 }
 
@@ -145,7 +145,7 @@ Write-Host "============================================" -ForegroundColor Cyan
 Write-Host ""
 Write-Host "Output locations:" -ForegroundColor White
 Write-Host "  Agent:     src\Agent\AutopilotMonitor.Agent.V2\bin\$Configuration\net48\" -ForegroundColor Gray
-Write-Host "  Functions: src\Backend\AutopilotMonitor.Functions\bin\$Configuration\net8.0\" -ForegroundColor Gray
+Write-Host "  Functions: src\Backend\AutopilotMonitor.Functions\bin\$Configuration\net10.0\" -ForegroundColor Gray
 
 if ($IncludeWeb) {
     Write-Host "  Web UI:    src\Web\autopilot-monitor-web\.next\" -ForegroundColor Gray

docs/agent/endpoint-migration.md

@@ -0,0 +1,88 @@
+---
+type: Concept
+title: Agent Endpoint Migration — Config-Channel Re-Home
+description: How the backend re-homes agents to a new API base URL (backend move or per-tenant region move) via MigrateToApiBaseUrl on the agent config response, and why HTTP redirects were rejected.
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/EndpointMigration.cs
+tags:
+  - agent
+  - backend
+  - config
+  - migration
+  - security
+timestamp: 2026-07-18T00:00:00+02:00
+---
+
+# Problem
+
+The agent's API base URL is compiled into the binary (`Constants.ApiBaseUrl`). No DNS/domain
+indirection is possible in front of the API: mTLS client-cert auth does not survive a reverse
+proxy (Front Door), and Flex Consumption custom-domain TLS is broken. A backend move (like the
+2026-07-18 WEU→GWC subscription migration) therefore hard-cuts every deployed agent still
+pointing at the old hostname. In-flight agents self-terminate safely (local MaxLifetime watchdog
++ CleanupService), but their sessions are lost and a per-tenant region move (EU→US) has no
+mechanism at all.
+
+# Mechanism
+
+`AgentConfigResponse.MigrateToApiBaseUrl` — served on `GET /api/agent/config` (incl. the
+bootstrap wrapper), the same control channel as the kill switch, fetched at every agent
+process start.
+
+Agent flow (`Program.RunAgent`, Phase 4):
+
+1. Config fetched from the compiled-in (old) base URL.
+2. Kill-switch check runs FIRST — **kill wins over migrate**.
+3. `AgentRuntimeConfig.Resolve` detects the migration signal directly after the fetch and
+   returns early, BEFORE merge / binary-integrity / bootstrap-cleanup — none of those side
+   effects may run against a config from the backend being abandoned (a migration stub may
+   advertise stale agent hashes; a spurious `IntegrityCheckFailed` + force-update would be
+   harmful).
+4. `Program.RunAgent` swaps `AgentConfiguration.ApiBaseUrl`, disposes the old client stack,
+   rebuilds Phase 3 (auth clients) and re-runs Phase 4 against the new URL —
+   `allowEndpointMigration: false`, so the new backend's config **cannot chain a second hop**.
+5. Kill-switch check runs again on the NEW backend's config; startup continues normally
+   (Phase 5+ builds mTLS/telemetry clients from the updated base URL).
+
+# Hardening (mirrors the kill switch)
+
+* **Live fetch only** — the on-disk config cache strips `MigrateToApiBaseUrl` on write AND
+  read (`RemoteConfigService.CacheConfig` / `LoadCachedConfig`); `EndpointMigration.ResolveTarget`
+  re-checks `LastFetchOutcome == Succeeded` as defence-in-depth. A planted cache file can
+  never re-home an agent.
+* **Allowlist validated on BOTH sides** — `AgentEndpointMigrationRules` (Shared, single
+  source): https only, host must end in `.azurewebsites.net` on a label boundary, no
+  path/query/userinfo/port. The backend refuses to serve an invalid admin value
+  (`AgentMigrateRejected` warning); the agent refuses to honour one even if the backend was
+  compromised.
+* **One hop, no loops** — second Resolve pass never migrates; a target equal to the current
+  base URL is a no-op (steady state during the migration window).
+
+# Operation
+
+Global admin settings (`AdminConfiguration`, admin portal → Global Settings):
+
+* `AgentMigrateApiBaseUrl` — global target, set on the backend being **abandoned**; clear it
+  after the migration window.
+* `AgentMigrateTenantOverridesJson` — JSON object `tenantId → URL` for per-tenant moves.
+  An entry with an **empty string** pins that tenant against the global target (staged rollout).
+  Overrides win over the global value.
+
+Delivery evidence: every served target logs `AgentMigrateServed` (Warning — reaches App
+Insights) with tenant, serial, agent version and target. Agent-side, the re-home is logged as
+`Endpoint migration: backend re-homed this agent from … to …`.
+
+Reach limitation: agents that cannot complete an authenticated config fetch (e.g. cert-broken
+devices) never see the signal — they fall back to the local MaxLifetime/emergency-break
+lifecycle. During a migration window the old backend must keep running as a serving stub;
+keeping the old `*.azurewebsites.net` name parked afterwards also prevents hostname
+re-registration by third parties while stragglers drain.
+
+# Citations
+
+* `src/Shared/AutopilotMonitor.Shared/Services/AgentEndpointMigrationRules.cs` — shared validation rules
+* `src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs` — wire field
+* `src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs` — `ResolveMigrateTarget` + serving (ConfigVersion 33)
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/EndpointMigration.cs` — agent-side evaluation
+* `src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeConfig.cs` — early return before merge/integrity
+* `src/Agent/AutopilotMonitor.Agent.V2/Program.cs` — one-hop rebuild in `RunAgent`
+* Tests: `AgentEndpointMigrationTests` (backend), `EndpointMigrationTests` + `RemoteConfigServiceCacheHardeningTests` (agent)

docs/index.md

@@ -17,6 +17,11 @@ https://docs.autopilotmonitor.com (separate repository).
 
 * [V2 Agent](agent/index.md) - How the on-device agent works: [runtime overview](agent/overview.md), [decision engine](agent/decision-engine.md) (reducer, signals, completion arms), [logs & persistence](agent/logs-and-persistence.md) (signal log, snapshot, crash recovery), [Hello wizard un-skip](agent/hello-wizard-unskip.md) (why a single "WHfB disabled" read never decides completion), [Autopilot ZTD diagnostics](agent/autopilot-ztd-diagnostics.md) (event IDs, diagnostic registry, endpoints, error-code map).
 * [Build Counter Blob](agent/build-counter-blob.md) - How agent build numbers are minted: shared counter blob with ETag-CAS so local and CI builds never collide; CI additionally attests build provenance (Sigstore).
+* [Agent Endpoint Migration](agent/endpoint-migration.md) - How the backend re-homes agents to a new API base URL via the config channel (backend move or per-tenant region move): live-fetch-only, allowlist-validated on both sides, one hop, kill wins.
+
+# Rules
+
+* [Gather Rule Phase Scoping & Emit-on-Change](rules/gather-rule-phase-scoping.md) - Restricting gather rules to enrollment phases (activePhases / activeFromPhase sticky latch) and emitMode "on_change" result-dedup — the anti-spam pair for interval rules.
 
 # Security & Identity
 

docs/log.md

@@ -1,5 +1,13 @@
 # Log
 
+## 2026-07-20
+
+* **Creation**: Added `rules/gather-rule-phase-scoping.md` (new `rules/` section) — gather rules gain `activePhases` (run only during listed phases), `activeFromPhase` (sticky latch from a phase onwards, never via Failed) and `emitMode: "on_change"` (canonical-hash result dedup with `suppressedPolls` observability), ConfigVersion 34. Includes the prerequisite backend fix: the custom-rule toggle PUT no longer wipes the stored rule definition (partial-merge in `GatherRuleService.UpdateRuleAsync`).
+
+## 2026-07-18
+
+* **Creation**: Added `agent/endpoint-migration.md` — config-channel agent re-home (`MigrateToApiBaseUrl` on `GET agent/config`, ConfigVersion 33): backend or per-tenant API-URL moves without DNS indirection (impossible due to mTLS/Flex-TLS). Live-fetch-only with cache strip, `AgentEndpointMigrationRules` allowlist validated on both sides, one hop, kill-switch wins. Built as the lesson from the 2026-07-18 WEU→GWC cutover, which hard-cut all in-flight agents.
+
 ## 2026-07-17
 
 * **Creation**: Added `agent/build-counter-blob.md` — agent build numbers now come from a shared public counter blob (`buildcounter-v{N}.txt`, reserve-before-build with ETag-CAS) so local `build.ps1` and CI `build-agent.yml` builds can never mint the same number. Documents the CI parity fixes (SummaryDialog.exe.config in the ZIP, EXE-vs-manifest version check, hash-oracle update gated on stable cutover) and the Sigstore provenance attestation on CI-built ZIPs.

docs/rules/gather-rule-phase-scoping.md

@@ -0,0 +1,97 @@
+---
+type: Concept
+title: Gather Rule Phase Scoping & Emit-on-Change
+description: How gather rules are restricted to enrollment phases (activePhases / activeFromPhase) and how emitMode "on_change" suppresses repeated identical results — the anti-spam pair for interval rules.
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs
+tags:
+  - agent
+  - backend
+  - gather-rules
+  - config
+timestamp: 2026-07-20T00:00:00+02:00
+---
+
+# Problem
+
+Interval gather rules (e.g. a registry poll every 60 s) ran during **all** enrollment phases
+and emitted an event on **every** tick — including `exists=false` events while the target key
+did not exist yet. A rule needed only from Account Setup onwards produced hundreds of
+identical noise events per session and wasted collector runs.
+
+# Schema
+
+Three opt-in fields on `GatherRule` (Shared model, `rules/schema/gather-rule.schema.json`,
+delivered to the agent via `GET agent/config`; ConfigVersion 34). Absent fields = legacy
+behavior — full back-compat.
+
+| Field | Type | Semantics |
+|---|---|---|
+| `activePhases` | `string[]` \| null | Rule runs only while the current phase is in the list. Null/empty = unrestricted. |
+| `activeFromPhase` | `string` \| null | Sticky latch: activates when the phase first reaches the threshold, then stays active for the rest of the session — including through `Failed`. Null = unrestricted. |
+| `emitMode` | `"always"` \| `"on_change"` \| null | `on_change`: poll on the trigger cadence, emit only when the collected result changes. Null/`always` = emit every collection (legacy). |
+
+Canonical phase tokens are the `EnrollmentPhase` enum **names** `Start`(0) …`Complete`(7).
+Backend validation (`GatherRulesFunction.ValidateScopeAndEmitMode`) rejects `Unknown`/`Failed`,
+numeric tokens, unknown emit modes, and both scope fields set at once (400). The agent
+defensively prefers `activePhases` if both arrive anyway.
+
+# Scope semantics (agent, `GatherRuleExecutor`)
+
+* Scope applies to **all trigger types**:
+  * `interval` — timers keep running; an out-of-scope tick is a free early-return (no
+    start/stop lifecycle races on phase transitions).
+  * `startup` — a scoped startup rule not yet in scope at `UpdateRules` is **deferred**: it
+    runs exactly once from `OnPhaseChanged` when its scope activates (same
+    `_startupRulesExecuted` dedup; it is not part of the `WaitForStartupRules` latch).
+  * `phase_change` — evaluated against the **new** phase; the scope gate runs before the
+    per-(rule, phase) dedup so an out-of-scope pass does not consume the execution slot.
+  * `on_event` — gated by the current phase.
+* **Before the first phase signal** of a session (`_currentPhase == Unknown`) scoped rules are
+  inactive. Sessions that never produce phase signals never run them (documented behavior).
+* **From-phase latch**: activates when `phase != Unknown && phase != Failed && (int)phase >=
+  (int)fromPhase`. `Failed=99` would ordinal-satisfy every threshold, hence the explicit
+  exclusion — but once latched, a rule stays active through `Failed`. A config refresh that
+  delivers a from-phase rule after its threshold passed latches it immediately.
+* `--run-gather-rules` (diagnostic CLI) sets `IgnorePhaseScope = true` — no phase context
+  exists there, scoped rules execute unconditionally (log line marks the bypass).
+
+# Emit-on-change semantics
+
+* The collector result dict is canonically hashed (keys ordinal-sorted at every nesting
+  level, invariant value formatting, SHA-256) **before** `ruleId`/`ruleTitle` injection.
+* First in-scope non-empty result always emits — on an absent registry key that first
+  `exists=false` event *is* the visible "we're polling now" indicator.
+* Unchanged results increment a per-rule suppression counter; the next emitted event carries
+  `suppressedPolls` + `suppressedSinceUtc` in its `Data` so the gap is observable.
+* Composition with `emitOnlyIfExists=true` (collector-level): a miss returns an empty dict —
+  no emit AND no hash update. Result: zero noise while absent, one event on appearance, then
+  only on change.
+* State is in-memory and survives `UpdateRules` config refreshes; an agent restart causes at
+  most one re-emit per rule (acceptable under the per-enrollment lifecycle).
+* Volatile collectors (eventlog timestamps, logparser positions) degrade `on_change` to
+  `always` — every poll hashes differently. The option stays visible for them since some
+  outputs are stable; this is documented, not hidden.
+
+# Portal & delivery
+
+* Create form defaults new rules to `emitMode: "on_change"`; existing rules load as
+  `always`. The scope UI is a three-way mode (always / during phases / from phase) backed by
+  a canonical `GATHER_PHASES` list — the same list replaced the free-text `triggerPhase`
+  input, whose placeholder used to suggest invalid tokens.
+* The custom-rule toggle PUT (`{enabled, isBuiltIn, isCommunity}`) previously full-replaced
+  the stored rule and wiped Title/Target/Trigger — `GatherRuleService.UpdateRuleAsync` now
+  merges toggle-style partials (empty Title/CollectorType/Target) into the existing row and
+  preserves `CreatedAt` on full edits. This fix is a prerequisite: without it every toggle
+  would silently clear the new fields.
+* Old agents (Newtonsoft) ignore unknown config properties: scoped rules run everywhere,
+  `emitMode` is ignored — graceful degradation until the fleet rolls forward.
+* `ContentEquivalent` treats null and empty `activePhases` as equal, so pre-existing DB rows
+  (absent columns → null) never diff against seeds — no reseed churn.
+
+# Citations
+
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs` — scope gates, latch, canonical hash
+* `src/Backend/AutopilotMonitor.Functions/Functions/Rules/GatherRulesFunction.cs` — `ValidateScopeAndEmitMode`
+* `src/Backend/AutopilotMonitor.Functions/Services/GatherRuleService.cs` — partial-PUT merge, `ContentEquivalent`
+* `src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs` — field contracts
+* Tests: `GatherRuleExecutorPhaseScopeTests`, `GatherRuleExecutorEmitModeTests` (agent); `GatherRuleUpdatePartialMergeTests`, `GatherRuleScopeFieldsTests` (backend)

global.json

@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "10.0.200",
+    "rollForward": "latestFeature"
+  }
+}

rules/schema/gather-rule.schema.json

@@ -96,6 +96,24 @@
           "type": "string",
           "description": "Event type to trigger on (only used when trigger = \"on_event\")."
         },
+        "activePhases": {
+          "type": "array",
+          "description": "Run the rule only while the current enrollment phase is one of these phases (EnrollmentPhase enum names). Empty/absent = unrestricted. Mutually exclusive with activeFromPhase.",
+          "items": {
+            "type": "string",
+            "enum": ["Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup", "AppsUser", "FinalizingSetup", "Complete"]
+          }
+        },
+        "activeFromPhase": {
+          "type": "string",
+          "description": "Activate the rule once the enrollment phase first reaches this phase, then keep it active for the rest of the session (sticky latch). Absent = unrestricted. Mutually exclusive with activePhases.",
+          "enum": ["Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup", "AppsUser", "FinalizingSetup", "Complete"]
+        },
+        "emitMode": {
+          "type": "string",
+          "description": "Emit behavior: \"always\" (default — emit on every collection) or \"on_change\" (poll on the trigger cadence but emit only when the collected result changes; the first in-scope result always emits).",
+          "enum": ["always", "on_change"]
+        },
         "outputEventType": {
           "type": "string",
           "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/EndpointMigrationTests.cs

@@ -0,0 +1,99 @@
+using AutopilotMonitor.Agent.V2.Core.Configuration;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
+{
+    /// <summary>
+    /// Pins the agent-side endpoint-migration contract (<see cref="EndpointMigration"/>):
+    /// only a LIVE fetch is honoured, the target must pass the shared allowlist rules even
+    /// though the backend already validated it, and serving the agent its own current URL is
+    /// a no-op — the exact mirror of the kill-switch live-fetch hardening.
+    /// </summary>
+    public sealed class EndpointMigrationTests
+    {
+        private const string CurrentUrl = "https://autopilotmonitor-api-eu.azurewebsites.net";
+        private const string TargetUrl = "https://autopilotmonitor-api-us.azurewebsites.net";
+
+        private static AgentConfigResponse Config(string migrateUrl) =>
+            new AgentConfigResponse { MigrateToApiBaseUrl = migrateUrl };
+
+        [Fact]
+        public void Live_fetch_with_valid_differing_target_migrates()
+        {
+            var target = EndpointMigration.ResolveTarget(
+                Config(TargetUrl), RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null);
+
+            Assert.Equal(TargetUrl, target);
+        }
+
+        [Fact]
+        public void Target_is_normalized_to_lowercase_host_without_trailing_slash()
+        {
+            var target = EndpointMigration.ResolveTarget(
+                Config("https://AutopilotMonitor-API-US.azurewebsites.net/"),
+                RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null);
+
+            Assert.Equal(TargetUrl, target);
+        }
+
+        [Theory]
+        [InlineData(RemoteConfigFetchOutcome.FromCache)]
+        [InlineData(RemoteConfigFetchOutcome.UsedDefaults)]
+        [InlineData(RemoteConfigFetchOutcome.NotAttempted)]
+        public void Non_live_fetch_is_never_honoured(RemoteConfigFetchOutcome outcome)
+        {
+            Assert.Null(EndpointMigration.ResolveTarget(
+                Config(TargetUrl), outcome, CurrentUrl, logger: null));
+        }
+
+        [Fact]
+        public void Null_config_and_empty_signal_are_noops()
+        {
+            Assert.Null(EndpointMigration.ResolveTarget(
+                null, RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null));
+            Assert.Null(EndpointMigration.ResolveTarget(
+                Config(null), RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null));
+            Assert.Null(EndpointMigration.ResolveTarget(
+                Config("   "), RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null));
+        }
+
+        [Fact]
+        public void Target_equal_to_current_url_is_a_noop()
+        {
+            // Steady state during a migration window: agent already runs on the target
+            // (case/trailing-slash differences must not cause a rebuild loop).
+            Assert.Null(EndpointMigration.ResolveTarget(
+                Config(CurrentUrl), RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null));
+            Assert.Null(EndpointMigration.ResolveTarget(
+                Config(CurrentUrl.ToUpperInvariant() + "/"), RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null));
+        }
+
+        [Theory]
+        [InlineData("http://autopilotmonitor-api-us.azurewebsites.net")]        // https only
+        [InlineData("https://attacker.example.com")]                             // host not allowlisted
+        [InlineData("https://evil-azurewebsites.net")]                           // suffix must sit on a label boundary
+        [InlineData("https://.azurewebsites.net")]                               // empty host prefix
+        [InlineData("https://api.azurewebsites.net:8443")]                       // non-default port
+        [InlineData("https://user:pw@api.azurewebsites.net")]                    // userinfo
+        [InlineData("https://api.azurewebsites.net/some/path")]                  // base URL only
+        [InlineData("https://api.azurewebsites.net?x=1")]                        // no query
+        [InlineData("not a url")]
+        public void Invalid_targets_are_rejected(string candidate)
+        {
+            Assert.Null(EndpointMigration.ResolveTarget(
+                Config(candidate), RemoteConfigFetchOutcome.Succeeded, CurrentUrl, logger: null));
+        }
+
+        [Fact]
+        public void Dev_api_url_override_still_migrates_to_valid_target()
+        {
+            // The running base URL may be a non-allowlisted dev override (--api-url); the
+            // comparison falls back to plain normalization and the migration still applies.
+            var target = EndpointMigration.ResolveTarget(
+                Config(TargetUrl), RemoteConfigFetchOutcome.Succeeded, "http://localhost:7071", logger: null);
+
+            Assert.Equal(TargetUrl, target);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/RemoteConfigServiceCacheHardeningTests.cs

@@ -62,6 +62,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
                 DeviceBlocked = true,
                 DeviceKillSignal = true,
                 UnblockAt = new DateTime(2099, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+                MigrateToApiBaseUrl = "https://attacker.azurewebsites.net",
             };
 
             probe.DoCache(config);
@@ -76,9 +77,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.False(persisted.DeviceBlocked);
             Assert.False(persisted.DeviceKillSignal);
             Assert.Null(persisted.UnblockAt);
+            Assert.Null(persisted.MigrateToApiBaseUrl);
 
-            // The attacker EXE hash must not appear anywhere in the persisted bytes.
+            // The attacker EXE hash / re-home host must not appear anywhere in the persisted bytes.
             Assert.DoesNotContain("deadbeef", raw);
+            Assert.DoesNotContain("attacker.azurewebsites.net", raw);
 
             // Benign fields survive the strip.
             Assert.Equal(77, persisted.ConfigVersion);
@@ -92,6 +95,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.True(config.DeviceBlocked);
             Assert.True(config.DeviceKillSignal);
             Assert.Equal(new DateTime(2099, 1, 1, 0, 0, 0, DateTimeKind.Utc), config.UnblockAt);
+            Assert.Equal("https://attacker.azurewebsites.net", config.MigrateToApiBaseUrl);
         }
 
         // ── Read path: LoadCachedConfig strips a planted (attacker) cache file ─
@@ -103,6 +107,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
         [InlineData("DeviceBlocked")]
         [InlineData("DeviceKillSignal")]
         [InlineData("UnblockAt")]
+        [InlineData("MigrateToApiBaseUrl")]
         public void LoadCachedConfig_strips_planted_security_sensitive_field(string field)
         {
             var probe = NewProbe();
@@ -119,6 +124,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
                 DeviceBlocked = true,
                 DeviceKillSignal = true,
                 UnblockAt = new DateTime(2099, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+                MigrateToApiBaseUrl = "https://attacker.azurewebsites.net",
             };
             File.WriteAllText(_cachePath, JsonConvert.SerializeObject(attacker, Formatting.Indented));
 
@@ -145,6 +151,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
                 case "UnblockAt":
                     Assert.Null(loaded.UnblockAt);
                     break;
+                case "MigrateToApiBaseUrl":
+                    Assert.Null(loaded.MigrateToApiBaseUrl);
+                    break;
                 default:
                     throw new InvalidOperationException($"unknown field {field}");
             }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorEmitModeTests.cs

@@ -0,0 +1,249 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// EmitMode "on_change" on <see cref="GatherRuleExecutor"/>: poll on the trigger cadence but
+    /// emit only when the collected result changes. The dedup state machine is asserted
+    /// synchronously via the internal <c>ShouldEmitOnChange</c> / <c>ComputeCanonicalHash</c>
+    /// (no timer races); the ExecuteRule wiring (hash-before-injection, empty-result no-op,
+    /// emitOnlyIfExists composition) through the public startup path.
+    /// </summary>
+    [Collection("SerialThreading")] // startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorEmitModeTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_7e3a1f4b-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorEmitModeTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private int EventCount { get { lock (_eventsGate) return _events.Count; } }
+
+        private EnrollmentEvent SingleEvent()
+        {
+            lock (_eventsGate) return Assert.Single(_events);
+        }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                if (EventCount >= count) return true;
+                Thread.Sleep(25);
+            }
+            return EventCount >= count;
+        }
+
+        private static GatherRule OnChangeRule(string id = "GATHER-OC-001") => new GatherRule
+        {
+            RuleId = id,
+            Title = id,
+            CollectorType = "registry",
+            Target = AbsentPath,
+            Trigger = "interval",
+            IntervalSeconds = 3600,
+            OutputEventType = "gather_test",
+            Enabled = true,
+            EmitMode = "on_change",
+        };
+
+        private static Dictionary<string, object> Result(params (string Key, object Value)[] pairs)
+        {
+            var d = new Dictionary<string, object>();
+            foreach (var (key, value) in pairs) d[key] = value;
+            return d;
+        }
+
+        // ── on_change state machine (synchronous) ──────────────────────────
+
+        [Fact]
+        public void FirstResult_AlwaysEmits_ThenUnchangedIsSuppressed_ThenChangeReemits()
+        {
+            var rule = OnChangeRule();
+
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));   // first
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));  // unchanged
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));  // unchanged
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", true), ("Version", "1")))); // changed
+        }
+
+        [Fact]
+        public void EmitAfterSuppressionStreak_CarriesSuppressedPollCount_AndResets()
+        {
+            var rule = OnChangeRule();
+
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+
+            var changed = Result(("exists", true));
+            Assert.True(_executor.ShouldEmitOnChange(rule, changed));
+            Assert.Equal(3, changed["suppressedPolls"]);
+            Assert.True(changed.ContainsKey("suppressedSinceUtc"));
+
+            // Counter must reset: the next change emits without a suppression payload.
+            var changedAgain = Result(("exists", false));
+            Assert.True(_executor.ShouldEmitOnChange(rule, changedAgain));
+            Assert.False(changedAgain.ContainsKey("suppressedPolls"));
+            Assert.False(changedAgain.ContainsKey("suppressedSinceUtc"));
+        }
+
+        [Fact]
+        public void SuppressionState_IsIsolatedPerRule()
+        {
+            var ruleA = OnChangeRule("GATHER-OC-A");
+            var ruleB = OnChangeRule("GATHER-OC-B");
+            var payload = Result(("exists", false));
+
+            Assert.True(_executor.ShouldEmitOnChange(ruleA, new Dictionary<string, object>(payload)));
+            // Same content, different rule: B has no hash yet — must emit.
+            Assert.True(_executor.ShouldEmitOnChange(ruleB, new Dictionary<string, object>(payload)));
+            Assert.False(_executor.ShouldEmitOnChange(ruleA, new Dictionary<string, object>(payload)));
+            Assert.False(_executor.ShouldEmitOnChange(ruleB, new Dictionary<string, object>(payload)));
+        }
+
+        [Fact]
+        public void DedupState_SurvivesUpdateRulesRefresh()
+        {
+            var rule = OnChangeRule();
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+
+            // Config refresh mid-session must not reset the last-emitted hash (that would
+            // re-emit an unchanged result on every refresh).
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+        }
+
+        // ── Canonical hashing ──────────────────────────────────────────────
+
+        [Fact]
+        public void CanonicalHash_IsKeyOrderInsensitive()
+        {
+            var a = new Dictionary<string, object> { ["alpha"] = 1, ["beta"] = "x" };
+            var b = new Dictionary<string, object> { ["beta"] = "x", ["alpha"] = 1 };
+
+            Assert.Equal(
+                GatherRuleExecutor.ComputeCanonicalHash(a),
+                GatherRuleExecutor.ComputeCanonicalHash(b));
+        }
+
+        [Fact]
+        public void CanonicalHash_DetectsValueChanges_IncludingNested()
+        {
+            var baseline = new Dictionary<string, object>
+            {
+                ["exists"] = true,
+                ["entries"] = new List<object> { new Dictionary<string, object> { ["id"] = 1 } },
+            };
+            var changedScalar = new Dictionary<string, object>
+            {
+                ["exists"] = false,
+                ["entries"] = new List<object> { new Dictionary<string, object> { ["id"] = 1 } },
+            };
+            var changedNested = new Dictionary<string, object>
+            {
+                ["exists"] = true,
+                ["entries"] = new List<object> { new Dictionary<string, object> { ["id"] = 2 } },
+            };
+
+            var baseHash = GatherRuleExecutor.ComputeCanonicalHash(baseline);
+            Assert.NotEqual(baseHash, GatherRuleExecutor.ComputeCanonicalHash(changedScalar));
+            Assert.NotEqual(baseHash, GatherRuleExecutor.ComputeCanonicalHash(changedNested));
+        }
+
+        [Fact]
+        public void CanonicalHash_DistinguishesTypeShapes()
+        {
+            // "1" (string) vs 1 (int) and null vs "<null>"-like strings must not collide.
+            Assert.NotEqual(
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = "1" }),
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = 1 }));
+            Assert.NotEqual(
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = null }),
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = "<null>" }));
+        }
+
+        // ── ExecuteRule wiring (async via startup path) ────────────────────
+
+        [Fact]
+        public void AlwaysMode_EmitsEveryCollection()
+        {
+            // EmitMode absent (legacy) — repeated identical results all emit. Two executions of
+            // the same collector via two rules sharing the target prove no dedup is applied.
+            var rule1 = OnChangeRule("GATHER-AL-1"); rule1.EmitMode = null; rule1.Trigger = "startup";
+            var rule2 = OnChangeRule("GATHER-AL-2"); rule2.EmitMode = null; rule2.Trigger = "startup";
+
+            _executor.UpdateRules(new List<GatherRule> { rule1, rule2 });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(2));
+        }
+
+        [Fact]
+        public void OnChange_FirstInScopePoll_EmitsExistsFalse_AsPollingIndicator()
+        {
+            // The first result on an absent key IS the visible "we're polling now" indicator.
+            var rule = OnChangeRule();
+            rule.Trigger = "startup";
+
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            var evt = SingleEvent();
+            Assert.Equal(false, evt.Data["exists"]);
+            Assert.Equal("GATHER-OC-001", evt.Data["ruleId"]); // injection happened after hashing
+        }
+
+        [Fact]
+        public void OnChange_ComposedWithEmitOnlyIfExists_EmptyResultDoesNotTouchHashState()
+        {
+            // emitOnlyIfExists miss → empty result → no emit AND no hash update: the eventual
+            // first real result must still count as "first emit".
+            var rule = OnChangeRule();
+            rule.Trigger = "startup";
+            rule.Parameters = new Dictionary<string, string> { ["emitOnlyIfExists"] = "true" };
+
+            _executor.UpdateRules(new List<GatherRule> { rule });
+            Assert.True(_executor.WaitForStartupRules(30));
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount); // zero noise while the key is absent
+
+            // When the key appears (simulated via the state machine), the result emits as first.
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", true), ("Version", "1"))));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorPhaseScopeTests.cs

@@ -0,0 +1,326 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// Phase scoping on <see cref="GatherRuleExecutor"/> (ActivePhases / ActiveFromPhase):
+    /// the scope matrix is asserted synchronously via the internal <c>IsRuleInScope</c>
+    /// (no timer races); the trigger-path wiring (deferred startup, phase_change / on_event
+    /// gating) is asserted through the public API with positive event waits.
+    /// Rules use the absent-registry-path pattern from
+    /// <see cref="RegistryCollectorEmitOnlyIfExistsTests"/> so no real system state is touched.
+    /// </summary>
+    [Collection("SerialThreading")] // deferred startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorPhaseScopeTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_5b1c8d2e-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorPhaseScopeTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                // Bypass the registry allowlist guard for the synthetic test path.
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private int EventCount { get { lock (_eventsGate) return _events.Count; } }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                if (EventCount >= count) return true;
+                Thread.Sleep(25);
+            }
+            return EventCount >= count;
+        }
+
+        /// <summary>Interval rule with a 1h period — the timer never ticks within a test run,
+        /// so these rules exist purely for synchronous scope-matrix assertions.</summary>
+        private static GatherRule ScopeProbeRule(string id, List<string> activePhases = null, string fromPhase = null)
+            => new GatherRule
+            {
+                RuleId = id,
+                Title = id,
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "interval",
+                IntervalSeconds = 3600,
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = activePhases,
+                ActiveFromPhase = fromPhase,
+            };
+
+        private static GatherRule StartupRule(string id, List<string> activePhases = null, string fromPhase = null)
+            => new GatherRule
+            {
+                RuleId = id,
+                Title = id,
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "startup",
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = activePhases,
+                ActiveFromPhase = fromPhase,
+            };
+
+        // ── Scope matrix (synchronous) ─────────────────────────────────────
+
+        [Fact]
+        public void UnscopedRule_IsInScope_EvenBeforeAnyPhaseSignal()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-000");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void ActivePhases_InactiveBeforeFirstPhaseSignal()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-001", activePhases: new List<string> { "AccountSetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.False(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void ActivePhases_ActiveDuringListedPhase_InactiveAfterLeaving()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-002", activePhases: new List<string> { "AccountSetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.False(_executor.IsRuleInScope(rule));
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            Assert.False(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void ActivePhases_MatchIsCaseInsensitive()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-003", activePhases: new List<string> { "accountsetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void FromPhase_LatchesAtThreshold_AndStaysSticky_IncludingThroughFailed()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-010", fromPhase: "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.False(_executor.IsRuleInScope(rule)); // threshold not reached
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(_executor.IsRuleInScope(rule)); // latched
+
+            _executor.OnPhaseChanged(EnrollmentPhase.Failed);
+            Assert.True(_executor.IsRuleInScope(rule)); // sticky through Failed
+        }
+
+        [Fact]
+        public void FromPhase_NoSpuriousActivationViaFailed()
+        {
+            // Failed=99 would ordinal-satisfy every threshold — it must never latch.
+            var rule = ScopeProbeRule("GATHER-SCOPE-011", fromPhase: "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.Failed);
+            Assert.False(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void FromPhase_LatchesWhenThresholdIsSkippedOver()
+        {
+            // The session may never report the exact threshold phase — a later phase latches too.
+            var rule = ScopeProbeRule("GATHER-SCOPE-012", fromPhase: "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.FinalizingSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void FromPhase_RuleDeliveredByRefreshAfterPhaseReached_LatchesImmediately()
+        {
+            _executor.UpdateRules(new List<GatherRule>());
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+
+            // Config refresh delivers a new from-phase rule whose threshold already passed.
+            var rule = ScopeProbeRule("GATHER-SCOPE-013", fromPhase: "DeviceSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void BothFieldsSet_ActivePhasesWins()
+        {
+            // Backend validation rejects this shape; the agent defensively prefers ActivePhases.
+            var rule = ScopeProbeRule("GATHER-SCOPE-020",
+                activePhases: new List<string> { "DeviceSetup" }, fromPhase: "Start");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.False(_executor.IsRuleInScope(rule)); // FromPhase(Start) would say yes — list wins
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void IgnorePhaseScope_BypassesScope_WithoutPhaseContext()
+        {
+            _executor.IgnorePhaseScope = true;
+            var during = ScopeProbeRule("GATHER-SCOPE-030", activePhases: new List<string> { "AccountSetup" });
+            var from = ScopeProbeRule("GATHER-SCOPE-031", fromPhase: "Complete");
+            _executor.UpdateRules(new List<GatherRule> { during, from });
+
+            Assert.True(_executor.IsRuleInScope(during));
+            Assert.True(_executor.IsRuleInScope(from));
+        }
+
+        // ── Trigger-path wiring (async, positive waits) ────────────────────
+
+        [Fact]
+        public void UnscopedStartupRule_RunsImmediately()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule("GATHER-START-000") });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+        }
+
+        [Fact]
+        public void ScopedStartupRule_IsDeferred_ThenFiresExactlyOnce_WhenScopeActivates()
+        {
+            _executor.UpdateRules(new List<GatherRule>
+            {
+                StartupRule("GATHER-START-001", fromPhase: "AccountSetup")
+            });
+
+            // Not in scope at UpdateRules: nothing queued, latch trivially satisfied.
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(WaitForEventCount(1), "deferred startup rule should fire when its scope activates");
+
+            // Later phase changes must not re-fire it (dedup via _startupRulesExecuted).
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            _executor.OnPhaseChanged(EnrollmentPhase.FinalizingSetup);
+            Thread.Sleep(300);
+            Assert.Equal(1, EventCount);
+        }
+
+        [Fact]
+        public void PhaseChangeRule_OutOfScopePhase_DoesNotFire_InScopePhaseFires()
+        {
+            // TriggerPhase empty = fires on every phase change; scope narrows it to AccountSetup.
+            var rule = new GatherRule
+            {
+                RuleId = "GATHER-PC-001",
+                Title = "pc",
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "phase_change",
+                TriggerPhase = "",
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = new List<string> { "AccountSetup" },
+            };
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(WaitForEventCount(1));
+
+            // Same phase again: the (rule, phase) dedup slot is now consumed.
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Thread.Sleep(300);
+            Assert.Equal(1, EventCount);
+        }
+
+        [Fact]
+        public void OnEventRule_GatedByScope()
+        {
+            var rule = new GatherRule
+            {
+                RuleId = "GATHER-OE-001",
+                Title = "oe",
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "on_event",
+                TriggerEventType = "app_install_failed",
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = new List<string> { "AccountSetup" },
+            };
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnEvent("app_install_failed"); // no phase signal yet → out of scope
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnEvent("app_install_failed");
+            Assert.True(WaitForEventCount(1));
+        }
+
+        [Fact]
+        public void IgnorePhaseScope_ScopedStartupRule_RunsImmediately()
+        {
+            // The --run-gather-rules diagnostic path: scoped rules must execute unconditionally.
+            _executor.IgnorePhaseScope = true;
+            _executor.UpdateRules(new List<GatherRule>
+            {
+                StartupRule("GATHER-START-002", activePhases: new List<string> { "AccountSetup" })
+            });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/EndpointMigration.cs

@@ -0,0 +1,57 @@
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Services;
+
+namespace AutopilotMonitor.Agent.V2.Core.Configuration
+{
+    /// <summary>
+    /// Agent-side evaluation of the config-channel endpoint migration signal
+    /// (<see cref="AgentConfigResponse.MigrateToApiBaseUrl"/>). Mirrors the kill-switch
+    /// hardening: only a LIVE fetch is honoured (the on-disk config cache strips the field on
+    /// write and read, and this check re-validates the outcome as defence-in-depth), and the
+    /// target must pass <see cref="AgentEndpointMigrationRules"/> even though the backend
+    /// already validated it — a compromised or misconfigured backend must not be able to
+    /// re-home agents to an arbitrary host.
+    /// </summary>
+    public static class EndpointMigration
+    {
+        /// <summary>
+        /// Returns the normalized migration target when the config carries a valid, live-fetched
+        /// re-home signal that differs from <paramref name="currentBaseUrl"/>; otherwise null.
+        /// Never throws — every rejection is logged and degrades to "no migration".
+        /// </summary>
+        public static string ResolveTarget(
+            AgentConfigResponse remoteConfig,
+            RemoteConfigFetchOutcome fetchOutcome,
+            string currentBaseUrl,
+            AgentLogger logger)
+        {
+            if (remoteConfig == null || string.IsNullOrWhiteSpace(remoteConfig.MigrateToApiBaseUrl))
+                return null;
+
+            if (fetchOutcome != RemoteConfigFetchOutcome.Succeeded)
+            {
+                logger?.Warning(
+                    $"Endpoint migration signal ignored — config source is {fetchOutcome}, not a live fetch.");
+                return null;
+            }
+
+            if (!AgentEndpointMigrationRules.IsEffectiveMigration(
+                    remoteConfig.MigrateToApiBaseUrl, currentBaseUrl, out var target))
+            {
+                // Either the target failed validation (scheme/host allowlist) or it equals the
+                // URL the agent is already using (steady state during a migration window once
+                // the new backend's own config echoes nothing).
+                if (target == null && !AgentEndpointMigrationRules.TryNormalizeTarget(
+                        remoteConfig.MigrateToApiBaseUrl, out _))
+                {
+                    logger?.Warning(
+                        $"Endpoint migration signal REJECTED — target failed validation: '{remoteConfig.MigrateToApiBaseUrl}'");
+                }
+                return null;
+            }
+
+            return target;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/RemoteConfigService.cs

@@ -249,18 +249,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                 //   - DeviceBlocked/DeviceKillSignal/UnblockAt: kill is only honoured from a
                 //     live fetch — a planted cached kill would self-destruct every future
                 //     session, a stale cached kill would outlive the admin removing the rule
+                //   - MigrateToApiBaseUrl: endpoint re-home is only honoured from a live
+                //     fetch — a planted cached URL would silently redirect every future
+                //     session's telemetry to an attacker-chosen host
                 var liveUnrestricted = config.UnrestrictedMode;
                 var liveAllowDowngrade = config.AllowAgentDowngrade;
                 var liveExeHash = config.LatestAgentExeSha256;
                 var liveBlocked = config.DeviceBlocked;
                 var liveKill = config.DeviceKillSignal;
                 var liveUnblockAt = config.UnblockAt;
+                var liveMigrateUrl = config.MigrateToApiBaseUrl;
                 config.UnrestrictedMode = false;
                 config.AllowAgentDowngrade = false;
                 config.LatestAgentExeSha256 = null;
                 config.DeviceBlocked = false;
                 config.DeviceKillSignal = false;
                 config.UnblockAt = null;
+                config.MigrateToApiBaseUrl = null;
                 var json = JsonConvert.SerializeObject(config, Formatting.Indented);
                 config.UnrestrictedMode = liveUnrestricted;
                 config.AllowAgentDowngrade = liveAllowDowngrade;
@@ -268,6 +273,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                 config.DeviceBlocked = liveBlocked;
                 config.DeviceKillSignal = liveKill;
                 config.UnblockAt = liveUnblockAt;
+                config.MigrateToApiBaseUrl = liveMigrateUrl;
 
                 File.WriteAllText(_cacheFilePath, json);
                 _logger.Debug("Remote config cached to disk");
@@ -299,6 +305,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                         config.DeviceBlocked = false;
                         config.DeviceKillSignal = false;
                         config.UnblockAt = null;
+                        config.MigrateToApiBaseUrl = null;
                     }
                     return config;
                 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs

@@ -1,6 +1,9 @@
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
 using System.Threading;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors;
@@ -28,6 +31,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         private readonly HashSet<string> _phaseRulesExecuted = new HashSet<string>();
         private CountdownEvent _startupRulesLatch;   // non-null only while startup rules are pending
 
+        // Phase-scope + emit-mode state (ActivePhases / ActiveFromPhase / EmitMode on GatherRule).
+        // Guarded by _scopeLock; collector work always runs outside the lock. The state deliberately
+        // survives UpdateRules config refreshes — an agent restart causes at most one re-emit per
+        // on_change rule (acceptable under the per-enrollment lifecycle).
+        private readonly object _scopeLock = new object();
+        private EnrollmentPhase _currentPhase = EnrollmentPhase.Unknown;
+        private readonly HashSet<string> _fromPhaseLatched = new HashSet<string>();
+        private readonly Dictionary<string, string> _lastEmittedHash = new Dictionary<string, string>();
+        private readonly Dictionary<string, (int Count, DateTime SinceUtc)> _suppressed =
+            new Dictionary<string, (int Count, DateTime SinceUtc)>();
+        private readonly HashSet<string> _scopeBypassLogged = new HashSet<string>();
+
+        /// <summary>
+        /// When true, phase scoping (ActivePhases / ActiveFromPhase) is bypassed and scoped rules
+        /// execute unconditionally. Used by the standalone <c>--run-gather-rules</c> diagnostic
+        /// mode, which has no enrollment phase context. EmitMode is unaffected.
+        /// </summary>
+        public bool IgnorePhaseScope { get; set; }
+
         /// <summary>
         /// When true, guardrails are relaxed: all registry, WMI, and command targets are allowed.
         /// File paths allow everything except C:\Users. Set from tenant configuration.
@@ -89,10 +111,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
             _activeRules = rules.Where(r => r.Enabled).ToList();
 
-            // Execute startup rules — track completion via CountdownEvent so callers can wait
-            var pendingStartup = _activeRules
-                .Where(r => r.Trigger == "startup" && !_startupRulesExecuted.Contains(r.RuleId))
-                .ToList();
+            // Execute startup rules — track completion via CountdownEvent so callers can wait.
+            // Scoped startup rules that are not yet in scope are deferred: they run once from
+            // OnPhaseChanged when their scope activates (same _startupRulesExecuted dedup — a
+            // rule runs either here or there, never both). Unscoped rules behave as before.
+            List<GatherRule> pendingStartup;
+            lock (_scopeLock)
+            {
+                // A config refresh may deliver new from-phase rules after their phase was
+                // already reached — evaluate latches against the current phase first.
+                EvaluateFromPhaseLatchesLocked();
+
+                pendingStartup = _activeRules
+                    .Where(r => r.Trigger == "startup" && !_startupRulesExecuted.Contains(r.RuleId))
+                    .Where(r => IsRuleInScopeLocked(r))
+                    .ToList();
+
+                foreach (var rule in pendingStartup)
+                {
+                    _startupRulesExecuted.Add(rule.RuleId);
+                }
+            }
 
             if (pendingStartup.Count > 0)
             {
@@ -101,7 +140,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                 foreach (var rule in pendingStartup)
                 {
-                    _startupRulesExecuted.Add(rule.RuleId);
                     ThreadPool.QueueUserWorkItem(_ =>
                     {
                         try   { ExecuteRule(rule); }
@@ -110,18 +148,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                 }
             }
 
-            // Set up interval timers
+            // Set up interval timers. Timers for scoped rules keep running while out of scope —
+            // the tick gate makes an out-of-scope tick a free no-op, avoiding start/stop
+            // lifecycle races on phase transitions.
             foreach (var rule in _activeRules.Where(r => r.Trigger == "interval" && r.IntervalSeconds.HasValue))
             {
-                var interval = TimeSpan.FromSeconds(rule.IntervalSeconds.Value);
+                var intervalRule = rule;
+                var interval = TimeSpan.FromSeconds(intervalRule.IntervalSeconds.Value);
                 var timer = new Timer(
-                    _ => ExecuteRule(rule),
+                    _ =>
+                    {
+                        if (!IsRuleInScope(intervalRule))
+                            return;
+                        ExecuteRule(intervalRule);
+                    },
                     null,
                     interval, // Initial delay = one interval
                     interval
                 );
-                _intervalTimers[rule.RuleId] = timer;
-                _logger.Info($"  Interval rule {rule.RuleId} scheduled every {rule.IntervalSeconds}s");
+                _intervalTimers[intervalRule.RuleId] = timer;
+                _logger.Info($"  Interval rule {intervalRule.RuleId} scheduled every {intervalRule.IntervalSeconds}s");
             }
 
             _logger.Info($"GatherRuleExecutor: {_activeRules.Count(r => r.Trigger == "startup")} startup, " +
@@ -135,11 +181,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         {
             var phaseName = newPhase.ToString();
 
+            // Update the phase + from-phase latches FIRST so deferred startup activation and
+            // the phase_change rules below all evaluate against the NEW phase.
+            List<GatherRule> deferredStartup;
+            lock (_scopeLock)
+            {
+                _currentPhase = newPhase;
+                EvaluateFromPhaseLatchesLocked();
+
+                deferredStartup = _activeRules
+                    .Where(r => r.Trigger == "startup" && HasPhaseScope(r)
+                                && !_startupRulesExecuted.Contains(r.RuleId)
+                                && IsRuleInScopeLocked(r))
+                    .ToList();
+
+                foreach (var rule in deferredStartup)
+                {
+                    _startupRulesExecuted.Add(rule.RuleId);
+                }
+            }
+
+            foreach (var rule in deferredStartup)
+            {
+                var deferredRule = rule;
+                _logger.Info($"Phase {phaseName} activated deferred startup rule {deferredRule.RuleId}");
+                ThreadPool.QueueUserWorkItem(_ => ExecuteRule(deferredRule));
+            }
+
             foreach (var rule in _activeRules.Where(r => r.Trigger == "phase_change"))
             {
                 if (string.IsNullOrEmpty(rule.TriggerPhase) ||
                     string.Equals(rule.TriggerPhase, phaseName, StringComparison.OrdinalIgnoreCase))
                 {
+                    // Scope gate BEFORE the dedup add — an out-of-scope pass must not consume
+                    // the once-per-(rule, phase) execution slot.
+                    if (!IsRuleInScope(rule))
+                        continue;
+
                     // Deduplicate: only fire once per (ruleId, phase) combination
                     var deduplicationKey = $"{rule.RuleId}|{phaseName}";
                     if (!_phaseRulesExecuted.Add(deduplicationKey))
@@ -163,6 +241,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             {
                 if (string.Equals(rule.TriggerEventType, eventType, StringComparison.OrdinalIgnoreCase))
                 {
+                    if (!IsRuleInScope(rule))
+                        continue;
+
                     _logger.Info($"Event triggered rule {rule.RuleId} (event: {eventType})");
                     ThreadPool.QueueUserWorkItem(_ => ExecuteRule(rule));
                 }
@@ -192,6 +273,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                 if (result.Count > 0)
                 {
+                    // EmitMode "on_change": hash the raw collector result (before ruleId/title
+                    // injection) and only emit when it differs from the last emitted one. An
+                    // empty result never reaches this point, so an emitOnlyIfExists miss neither
+                    // emits nor updates the hash — composing to "one event on appearance, then
+                    // only on change".
+                    if (IsOnChangeMode(rule) && !ShouldEmitOnChange(rule, result))
+                        return;
+
                     result["ruleId"] = rule.RuleId;
                     result["ruleTitle"] = rule.Title;
 
@@ -229,6 +318,199 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             }
         }
 
+        // ===== Phase scope (ActivePhases / ActiveFromPhase) =====
+
+        private static bool HasPhaseScope(GatherRule rule)
+        {
+            return (rule.ActivePhases != null && rule.ActivePhases.Count > 0)
+                || !string.IsNullOrEmpty(rule.ActiveFromPhase);
+        }
+
+        // Internal so the scope matrix is testable synchronously (no timer/ThreadPool races).
+        internal bool IsRuleInScope(GatherRule rule)
+        {
+            lock (_scopeLock)
+            {
+                return IsRuleInScopeLocked(rule);
+            }
+        }
+
+        private bool IsRuleInScopeLocked(GatherRule rule)
+        {
+            if (!HasPhaseScope(rule))
+                return true; // unscoped — legacy behavior
+
+            if (IgnorePhaseScope)
+            {
+                if (_scopeBypassLogged.Add(rule.RuleId))
+                    _logger.Info($"Gather rule {rule.RuleId}: phase scope ignored (diagnostic mode)");
+                return true;
+            }
+
+            // Both fields set is rejected by backend validation; defensively prefer ActivePhases.
+            if (rule.ActivePhases != null && rule.ActivePhases.Count > 0)
+            {
+                // No phase signal yet (or scope tokens that never match, e.g. "Unknown"):
+                // scoped rules stay inactive.
+                if (_currentPhase == EnrollmentPhase.Unknown)
+                    return false;
+
+                var phaseName = _currentPhase.ToString();
+                foreach (var phase in rule.ActivePhases)
+                {
+                    if (string.Equals(phase, phaseName, StringComparison.OrdinalIgnoreCase))
+                        return true;
+                }
+                return false;
+            }
+
+            return _fromPhaseLatched.Contains(rule.RuleId);
+        }
+
+        /// <summary>
+        /// Latches every from-phase rule whose threshold the current phase has reached.
+        /// Never latches on Unknown/Failed (Failed=99 would ordinal-satisfy every threshold);
+        /// once latched a rule stays active for the session — including through Failed.
+        /// Caller must hold <see cref="_scopeLock"/>.
+        /// </summary>
+        private void EvaluateFromPhaseLatchesLocked()
+        {
+            if (_currentPhase == EnrollmentPhase.Unknown || _currentPhase == EnrollmentPhase.Failed)
+                return;
+
+            foreach (var rule in _activeRules)
+            {
+                if (string.IsNullOrEmpty(rule.ActiveFromPhase)) continue;
+                if (rule.ActivePhases != null && rule.ActivePhases.Count > 0) continue; // ActivePhases wins
+                if (_fromPhaseLatched.Contains(rule.RuleId)) continue;
+
+                if (Enum.TryParse<EnrollmentPhase>(rule.ActiveFromPhase, ignoreCase: true, out var fromPhase)
+                    && fromPhase != EnrollmentPhase.Unknown
+                    && fromPhase != EnrollmentPhase.Failed
+                    && (int)_currentPhase >= (int)fromPhase)
+                {
+                    _fromPhaseLatched.Add(rule.RuleId);
+                    _logger.Info($"Gather rule {rule.RuleId}: from-phase scope latched at {_currentPhase} (activeFromPhase={rule.ActiveFromPhase})");
+                }
+            }
+        }
+
+        // ===== Emit mode (on_change) =====
+
+        private static bool IsOnChangeMode(GatherRule rule)
+        {
+            return string.Equals(rule.EmitMode, "on_change", StringComparison.OrdinalIgnoreCase);
+        }
+
+        /// <summary>
+        /// on_change decision for a non-empty collector result: true = emit (first result for the
+        /// rule, or the result changed), false = suppress. Hashes the result BEFORE ruleId/title
+        /// injection. On emit after a suppression streak, injects <c>suppressedPolls</c> and
+        /// <c>suppressedSinceUtc</c> into the result so the gap is observable.
+        /// Internal so the state machine is testable synchronously (no timer/ThreadPool races).
+        /// </summary>
+        internal bool ShouldEmitOnChange(GatherRule rule, Dictionary<string, object> result)
+        {
+            var hash = ComputeCanonicalHash(result);
+            bool emit;
+            lock (_scopeLock)
+            {
+                string lastHash;
+                if (_lastEmittedHash.TryGetValue(rule.RuleId, out lastHash) && lastHash == hash)
+                {
+                    (int Count, DateTime SinceUtc) streak;
+                    _suppressed[rule.RuleId] = _suppressed.TryGetValue(rule.RuleId, out streak)
+                        ? (streak.Count + 1, streak.SinceUtc)
+                        : (1, DateTime.UtcNow);
+                    emit = false;
+                }
+                else
+                {
+                    _lastEmittedHash[rule.RuleId] = hash;
+                    (int Count, DateTime SinceUtc) streak;
+                    if (_suppressed.TryGetValue(rule.RuleId, out streak) && streak.Count > 0)
+                    {
+                        result["suppressedPolls"] = streak.Count;
+                        result["suppressedSinceUtc"] = streak.SinceUtc.ToString("o", CultureInfo.InvariantCulture);
+                    }
+                    _suppressed.Remove(rule.RuleId);
+                    emit = true;
+                }
+            }
+
+            if (!emit)
+                _logger.Debug($"Gather rule {rule.RuleId}: result unchanged, emit suppressed (on_change)");
+            return emit;
+        }
+
+        /// <summary>
+        /// Canonical hash of a collector result: keys ordinal-sorted at every dictionary level,
+        /// values rendered with invariant formatting, then SHA-256. Internal for direct test
+        /// coverage of the canonicalization.
+        /// </summary>
+        internal static string ComputeCanonicalHash(Dictionary<string, object> result)
+        {
+            var sb = new StringBuilder();
+            AppendCanonicalValue(sb, result);
+            using (var sha = SHA256.Create())
+            {
+                var hashBytes = sha.ComputeHash(Encoding.UTF8.GetBytes(sb.ToString()));
+                return Convert.ToBase64String(hashBytes);
+            }
+        }
+
+        private static void AppendCanonicalValue(StringBuilder sb, object value)
+        {
+            if (value == null)
+            {
+                sb.Append("<null>");
+                return;
+            }
+
+            // string first — it is IEnumerable and must not be treated as a sequence
+            if (value is string str)
+            {
+                sb.Append('"').Append(str).Append('"');
+                return;
+            }
+
+            if (value is System.Collections.IDictionary dict)
+            {
+                sb.Append('{');
+                var keys = dict.Keys.Cast<object>()
+                    .Select(k => k?.ToString() ?? string.Empty)
+                    .OrderBy(k => k, StringComparer.Ordinal);
+                foreach (var key in keys)
+                {
+                    sb.Append(key).Append('=');
+                    AppendCanonicalValue(sb, dict[key]);
+                    sb.Append(';');
+                }
+                sb.Append('}');
+                return;
+            }
+
+            if (value is System.Collections.IEnumerable sequence)
+            {
+                sb.Append('[');
+                foreach (var item in sequence)
+                {
+                    AppendCanonicalValue(sb, item);
+                    sb.Append(';');
+                }
+                sb.Append(']');
+                return;
+            }
+
+            if (value is IFormattable formattable)
+            {
+                sb.Append(formattable.ToString(null, CultureInfo.InvariantCulture));
+                return;
+            }
+
+            sb.Append(value);
+        }
+
         private EventSeverity ParseSeverity(string severity)
         {
             return GatherRuleContext.ParseSeverity(severity);
@@ -245,7 +527,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
         /// <summary>
         /// Blocks until all startup rules that were queued by the most recent <see cref="UpdateRules"/>
-        /// call have finished executing, or the timeout elapses.
+        /// call have finished executing, or the timeout elapses. Deferred scoped startup rules
+        /// (waiting for their phase scope) are not part of the latch.
         /// Returns true if all rules completed within the timeout; false if timed out.
         /// </summary>
         public bool WaitForStartupRules(int timeoutSeconds = 120)

src/Agent/AutopilotMonitor.Agent.V2/Program.GatherRulesMode.cs

@@ -224,6 +224,11 @@ namespace AutopilotMonitor.Agent.V2
                     // Step 4 — run the executor and wait.
                     using (var executor = new GatherRuleExecutor(sessionId, tenantId, emitEvent, logger, config.ImeLogPathOverride))
                     {
+                        // Diagnostic mode has no enrollment phase context — scoped rules
+                        // (activePhases / activeFromPhase) execute unconditionally here.
+                        executor.IgnorePhaseScope = true;
+                        logger.Info("--run-gather-rules: phase scoping bypassed (no phase context in diagnostic mode).");
+
                         executor.UpdateRules(rules);
 
                         if (consoleMode) Console.WriteLine($"Running {startupRules.Count} rule(s)...");

src/Agent/AutopilotMonitor.Agent.V2/Program.cs

@@ -213,6 +213,8 @@ namespace AutopilotMonitor.Agent.V2
             // Control-channel kill-switch: a live-fetch DeviceKillSignal terminates the agent
             // BEFORE mTLS/registration spin-up. Covers agents the telemetry-channel kill can
             // never reach (paused drain, empty spool) at their next process start / boot.
+            // Checked BEFORE any endpoint migration — a kill from the current backend is
+            // terminal, not re-homed.
             if (CheckConfigKillSignal(
                     runtimeConfig.RemoteConfig,
                     runtimeConfig.RemoteConfigService.LastFetchOutcome,
@@ -223,6 +225,37 @@ namespace AutopilotMonitor.Agent.V2
                 return 0;
             }
 
+            // Endpoint migration (config-channel re-home): the backend served a validated
+            // MigrateToApiBaseUrl on a live fetch. Rebuild Phase 3 clients against the new base
+            // URL and re-run Phase 4 there (single hop — the second Resolve cannot migrate
+            // again), then re-check the kill signal against the NEW backend's config.
+            if (runtimeConfig.PendingMigrationTarget != null)
+            {
+                logger.Warning(
+                    $"Endpoint migration: backend re-homed this agent from {bootstrap.AgentConfig.ApiBaseUrl} " +
+                    $"to {runtimeConfig.PendingMigrationTarget} — rebuilding backend clients.");
+
+                bootstrap.AgentConfig.ApiBaseUrl = runtimeConfig.PendingMigrationTarget;
+
+                // Best-effort disposal of the old-URL client stack before it goes out of scope.
+                try { auth.BackendApiClient?.Dispose(); } catch { }
+
+                auth = Runtime.BackendClientFactory.BuildAuthClients(bootstrap.AgentConfig, GetAgentVersion(), logger);
+                runtimeConfig = Runtime.AgentRuntimeConfig.Resolve(
+                    bootstrap.AgentConfig, auth, GetAgentVersion(), consoleMode, logger,
+                    allowEndpointMigration: false);
+
+                if (CheckConfigKillSignal(
+                        runtimeConfig.RemoteConfig,
+                        runtimeConfig.RemoteConfigService.LastFetchOutcome,
+                        dataDirectory, stateSubdir,
+                        () => new CleanupService(bootstrap.AgentConfig, logger),
+                        logger, consoleMode))
+                {
+                    return 0;
+                }
+            }
+
             // Phase 5 (mTLS HttpClient + BackendTelemetryUploader) is encapsulated in
             // BackendClientFactory. Construction failures map to V1-parity exit codes
             // (4 = mTLS, 5 = uploader). See Runtime/BackendClientFactory.cs.

src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeConfig.cs

@@ -32,7 +32,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             BackendAuthBundle auth,
             string agentVersion,
             bool consoleMode,
-            AgentLogger logger)
+            AgentLogger logger,
+            bool allowEndpointMigration = true)
         {
             if (agentConfig == null) throw new ArgumentNullException(nameof(agentConfig));
             if (auth == null) throw new ArgumentNullException(nameof(auth));
@@ -49,6 +50,25 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 .FetchConfigAsync(retryOnTransientErrors: true)
                 .GetAwaiter().GetResult();
 
+            // Endpoint migration (config-channel re-home): decided BEFORE merge / binary-
+            // integrity / bootstrap-cleanup so none of those side effects run against a config
+            // from the backend being abandoned — a migration stub may advertise stale agent
+            // hashes, and a spurious IntegrityCheckFailed + force-update against them would be
+            // actively harmful. RunAgent rebuilds Phase 3 clients on the new base URL and calls
+            // Resolve again with allowEndpointMigration:false (single hop — the new backend's
+            // config cannot chain another migration).
+            if (allowEndpointMigration)
+            {
+                var migrationTarget = EndpointMigration.ResolveTarget(
+                    remoteConfig, remoteConfigService.LastFetchOutcome, agentConfig.ApiBaseUrl, logger);
+                if (migrationTarget != null)
+                {
+                    return new RuntimeConfigBundle(
+                        remoteConfigService, remoteConfig, mergeResult: null,
+                        pendingMigrationTarget: migrationTarget);
+                }
+            }
+
             // Project remote tenant-controlled knobs onto the runtime AgentConfiguration so that
             // downstream consumers (CleanupService, SummaryDialogLauncher, StartupEnvironmentProbes,
             // DiagnosticsPackageService, EnrollmentTerminationHandler, the logger, the watchdog)
@@ -71,7 +91,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
 
             TryCleanupBootstrapConfig(agentConfig, agentVersion, logger);
 
-            return new RuntimeConfigBundle(remoteConfigService, remoteConfig, configMergeResult);
+            return new RuntimeConfigBundle(remoteConfigService, remoteConfig, configMergeResult, pendingMigrationTarget: null);
         }
 
         /// <summary>
@@ -145,21 +165,30 @@ namespace AutopilotMonitor.Agent.V2.Runtime
     /// <c>rotate_config</c> ServerAction callback), the fetched <see cref="AgentConfigResponse"/>
     /// and the <see cref="RemoteConfigMergeResult"/> diff snapshot (used by the
     /// <c>EmitUnrestrictedModeAuditIfChanged</c> lifecycle hook).
+    /// <para>
+    /// When <see cref="PendingMigrationTarget"/> is non-null the bundle is a partial result:
+    /// the fetch found a live endpoint-migration signal and Resolve returned before merge /
+    /// integrity / bootstrap-cleanup (<see cref="MergeResult"/> is null). RunAgent must
+    /// rebuild the backend clients on the target URL and Resolve again.
+    /// </para>
     /// </summary>
     internal sealed class RuntimeConfigBundle
     {
         public RemoteConfigService RemoteConfigService { get; }
         public AgentConfigResponse RemoteConfig { get; }
         public RemoteConfigMergeResult MergeResult { get; }
+        public string PendingMigrationTarget { get; }
 
         public RuntimeConfigBundle(
             RemoteConfigService remoteConfigService,
             AgentConfigResponse remoteConfig,
-            RemoteConfigMergeResult mergeResult)
+            RemoteConfigMergeResult mergeResult,
+            string pendingMigrationTarget = null)
         {
             RemoteConfigService = remoteConfigService;
             RemoteConfig = remoteConfig;
             MergeResult = mergeResult;
+            PendingMigrationTarget = pendingMigrationTarget;
         }
     }
 }

src/Agent/AutopilotMonitor.DecisionCore.Tests/AutopilotMonitor.DecisionCore.Tests.csproj

@@ -2,11 +2,11 @@
 
   <PropertyGroup>
     <!--
-      Plan §4 M2: xUnit, .NET-8-Testrunner gegen netstandard2.0-Lib.
-      DecisionCore itself targets netstandard2.0, but the test runner uses .NET 8
-      so we benefit from modern xUnit + coverlet tooling.
+      Plan §4 M2: xUnit test runner against the netstandard2.0 lib.
+      DecisionCore itself targets netstandard2.0; the runner tracks the
+      repo-wide .NET version (global.json) for modern xUnit + coverlet tooling.
     -->
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
     <LangVersion>latest</LangVersion>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>

src/Backend/AutopilotMonitor.Functions.Tests/AgentEndpointMigrationTests.cs

@@ -0,0 +1,160 @@
+using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Services;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the endpoint-migration serving contract: the shared allowlist rules
+/// (<see cref="AgentEndpointMigrationRules"/>, used verbatim by the agent too) and the
+/// backend-side per-tenant resolution (<see cref="GetAgentConfigFunction.ResolveMigrateTarget"/> —
+/// tenant override wins, empty override pins, invalid values are never served).
+/// </summary>
+public class AgentEndpointMigrationTests
+{
+    private const string TenantA = "11111111-2222-3333-4444-555555555555";
+    private const string TenantB = "66666666-7777-8888-9999-000000000000";
+    private const string UsUrl = "https://autopilotmonitor-api-us.azurewebsites.net";
+    private const string EuUrl = "https://autopilotmonitor-api-eu.azurewebsites.net";
+
+    // ── Shared validation rules ─────────────────────────────────────────────
+
+    [Theory]
+    [InlineData("https://autopilotmonitor-api-us.azurewebsites.net", "https://autopilotmonitor-api-us.azurewebsites.net")]
+    [InlineData("https://AutopilotMonitor-API-US.AzureWebsites.NET/", "https://autopilotmonitor-api-us.azurewebsites.net")]
+    [InlineData("  https://x.azurewebsites.net  ", "https://x.azurewebsites.net")]
+    public void TryNormalizeTarget_accepts_and_normalizes(string candidate, string expected)
+    {
+        Assert.True(AgentEndpointMigrationRules.TryNormalizeTarget(candidate, out var normalized));
+        Assert.Equal(expected, normalized);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("http://x.azurewebsites.net")]          // https only
+    [InlineData("https://attacker.example.com")]        // not allowlisted
+    [InlineData("https://evil-azurewebsites.net")]      // label-boundary bypass attempt
+    [InlineData("https://.azurewebsites.net")]          // bare suffix
+    [InlineData("https://x.azurewebsites.net:8443")]    // non-default port
+    [InlineData("https://u:p@x.azurewebsites.net")]     // userinfo
+    [InlineData("https://x.azurewebsites.net/api")]     // path
+    [InlineData("https://x.azurewebsites.net?a=1")]     // query
+    [InlineData("https://x.azurewebsites.net#frag")]    // fragment
+    [InlineData("ftp://x.azurewebsites.net")]
+    [InlineData("not a url")]
+    public void TryNormalizeTarget_rejects(string? candidate)
+    {
+        Assert.False(AgentEndpointMigrationRules.TryNormalizeTarget(candidate!, out var normalized));
+        Assert.Null(normalized);
+    }
+
+    [Fact]
+    public void TryNormalizeTarget_rejects_overlong_candidate()
+    {
+        var candidate = "https://" + new string('a', AgentEndpointMigrationRules.MaxTargetLength) + ".azurewebsites.net";
+        Assert.False(AgentEndpointMigrationRules.TryNormalizeTarget(candidate, out _));
+    }
+
+    [Fact]
+    public void IsEffectiveMigration_rejects_target_equal_to_current()
+    {
+        Assert.False(AgentEndpointMigrationRules.IsEffectiveMigration(EuUrl, EuUrl + "/", out var target));
+        Assert.Null(target);
+
+        Assert.True(AgentEndpointMigrationRules.IsEffectiveMigration(UsUrl, EuUrl, out target));
+        Assert.Equal(UsUrl, target);
+    }
+
+    // ── Backend resolution: global vs per-tenant override ──────────────────
+
+    [Fact]
+    public void No_configuration_resolves_to_null()
+    {
+        var config = new AdminConfiguration();
+
+        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(rejected);
+    }
+
+    [Fact]
+    public void Global_target_applies_to_every_tenant()
+    {
+        var config = new AdminConfiguration { AgentMigrateApiBaseUrl = UsUrl };
+
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+    }
+
+    [Fact]
+    public void Tenant_override_wins_over_global()
+    {
+        var config = new AdminConfiguration
+        {
+            AgentMigrateApiBaseUrl = UsUrl,
+            AgentMigrateTenantOverridesJson = $"{{\"{TenantA}\": \"{EuUrl}\"}}"
+        };
+
+        Assert.Equal(EuUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+    }
+
+    [Fact]
+    public void Empty_tenant_override_pins_tenant_against_global_target()
+    {
+        var config = new AdminConfiguration
+        {
+            AgentMigrateApiBaseUrl = UsUrl,
+            AgentMigrateTenantOverridesJson = $"{{\"{TenantA}\": \"\"}}"
+        };
+
+        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(rejected); // pinned, not rejected
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+    }
+
+    [Fact]
+    public void Tenant_override_key_is_case_insensitive()
+    {
+        var config = new AdminConfiguration
+        {
+            AgentMigrateTenantOverridesJson = $"{{\"{TenantA.ToUpperInvariant()}\": \"{UsUrl}\"}}"
+        };
+
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+    }
+
+    [Fact]
+    public void Invalid_configured_target_is_never_served_and_reported_as_rejected()
+    {
+        var config = new AdminConfiguration { AgentMigrateApiBaseUrl = "https://attacker.example.com" };
+
+        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Equal("https://attacker.example.com", rejected);
+    }
+
+    [Fact]
+    public void Malformed_overrides_json_degrades_to_global_target()
+    {
+        var config = new AdminConfiguration
+        {
+            AgentMigrateApiBaseUrl = UsUrl,
+            AgentMigrateTenantOverridesJson = "{not json"
+        };
+
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+    }
+
+    [Fact]
+    public void Served_target_is_normalized()
+    {
+        var config = new AdminConfiguration
+        {
+            AgentMigrateApiBaseUrl = "https://AutopilotMonitor-API-US.azurewebsites.net/"
+        };
+
+        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GatherRuleScopeFieldsTests.cs

@@ -0,0 +1,283 @@
+using AutopilotMonitor.Functions.Functions.Rules;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Azure;
+using Azure.Data.Tables;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Covers the three gather-rule scope/emit fields (ActivePhases, ActiveFromPhase, EmitMode):
+/// Store↔Map table-serialization roundtrip (table-serialization rule: every model field in BOTH
+/// directions), legacy rows without the new columns, the <see cref="GatherRuleService.ContentEquivalent"/>
+/// null-tolerance (no reseed churn), and the create/update validation matrix in
+/// <see cref="GatherRulesFunction.ValidateScopeAndEmitMode"/>.
+/// </summary>
+public class GatherRuleScopeFieldsTests
+{
+    // ── Store ↔ Map roundtrip ──────────────────────────────────────────────
+
+    private static (TableStorageService service, Func<TableEntity?> lastUpserted) BuildStorageHarness()
+    {
+        TableEntity? captured = null;
+        var tableClient = new Mock<TableClient>();
+        tableClient
+            .Setup(c => c.UpsertEntityAsync(
+                It.IsAny<TableEntity>(), It.IsAny<TableUpdateMode>(), It.IsAny<CancellationToken>()))
+            .Returns<TableEntity, TableUpdateMode, CancellationToken>((e, _, _) =>
+            {
+                captured = e;
+                return Task.FromResult(new Mock<Response>().Object);
+            });
+
+        var serviceClient = new Mock<TableServiceClient>();
+        serviceClient.Setup(c => c.GetTableClient(It.IsAny<string>())).Returns(tableClient.Object);
+
+        var service = new TableStorageService(serviceClient.Object, NullLogger<TableStorageService>.Instance);
+        return (service, () => captured);
+    }
+
+    [Fact]
+    public async Task Roundtrip_ScopeFields_SurviveStoreAndMap()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-SCOPE-001",
+            Title = "Scoped rule",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Contoso",
+            Trigger = "interval",
+            IntervalSeconds = 60,
+            OutputEventType = "gather_scoped",
+            ActivePhases = new List<string> { "AccountSetup", "AppsUser" },
+            EmitMode = "on_change",
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.NotNull(mapped.ActivePhases);
+        Assert.Equal(new[] { "AccountSetup", "AppsUser" }, mapped.ActivePhases);
+        Assert.Null(mapped.ActiveFromPhase);
+        Assert.Equal("on_change", mapped.EmitMode);
+    }
+
+    [Fact]
+    public async Task Roundtrip_FromPhase_SurvivesStoreAndMap()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-SCOPE-002",
+            Title = "From-phase rule",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Contoso",
+            Trigger = "interval",
+            OutputEventType = "gather_scoped",
+            ActiveFromPhase = "AccountSetup",
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.Null(mapped.ActivePhases);
+        Assert.Equal("AccountSetup", mapped.ActiveFromPhase);
+        Assert.Null(mapped.EmitMode);
+    }
+
+    [Fact]
+    public async Task Roundtrip_NullScopeFields_StayNull()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-SCOPE-003",
+            Title = "Unscoped rule",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Contoso",
+            Trigger = "startup",
+            OutputEventType = "gather_plain",
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.Null(mapped.ActivePhases);
+        Assert.Null(mapped.ActiveFromPhase);
+        Assert.Null(mapped.EmitMode);
+    }
+
+    [Fact]
+    public void Map_LegacyRow_WithoutScopeColumns_DefaultsToNull()
+    {
+        var (service, _) = BuildStorageHarness();
+        // A row written before the scope fields existed: none of the new columns present.
+        var legacy = new TableEntity("global", "GATHER-LEGACY-001")
+        {
+            ["Title"] = "Legacy rule",
+            ["CollectorType"] = "registry",
+            ["Target"] = "HKLM\\SOFTWARE\\Contoso",
+            ["Trigger"] = "startup",
+            ["OutputEventType"] = "gather_legacy",
+        };
+
+        var mapped = service.MapToGatherRule(legacy);
+
+        Assert.Null(mapped.ActivePhases);
+        Assert.Null(mapped.ActiveFromPhase);
+        Assert.Null(mapped.EmitMode);
+    }
+
+    // ── ContentEquivalent ──────────────────────────────────────────────────
+
+    private static GatherRule BaseRule() => new()
+    {
+        RuleId = "GATHER-EQ-001",
+        Title = "Rule",
+        Description = "Desc",
+        Version = "1.0.0",
+        CollectorType = "registry",
+        Target = "HKLM\\SOFTWARE\\Contoso",
+        Trigger = "interval",
+        TriggerPhase = "",
+        OutputEventType = "gather_eq",
+    };
+
+    [Fact]
+    public void ContentEquivalent_NullAndEmptyActivePhases_AreEquivalent()
+    {
+        // Pre-existing DB rows map absent columns to null; seeds are also null — and an
+        // explicitly-empty list means the same "unrestricted". No reseed churn allowed.
+        var a = BaseRule();
+        var b = BaseRule();
+        b.ActivePhases = new List<string>();
+
+        Assert.True(GatherRuleService.ContentEquivalent(a, b));
+        Assert.True(GatherRuleService.ContentEquivalent(b, a));
+    }
+
+    [Fact]
+    public void ContentEquivalent_DetectsChangesInEachScopeField()
+    {
+        var baseline = BaseRule();
+
+        var phases = BaseRule();
+        phases.ActivePhases = new List<string> { "AccountSetup" };
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, phases));
+
+        var from = BaseRule();
+        from.ActiveFromPhase = "AccountSetup";
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, from));
+
+        var emit = BaseRule();
+        emit.EmitMode = "on_change";
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, emit));
+    }
+
+    [Fact]
+    public void ContentEquivalent_SameScopeFields_AreEquivalent()
+    {
+        var a = BaseRule();
+        a.ActivePhases = new List<string> { "DeviceSetup", "AccountSetup" };
+        a.EmitMode = "on_change";
+        var b = BaseRule();
+        b.ActivePhases = new List<string> { "DeviceSetup", "AccountSetup" };
+        b.EmitMode = "on_change";
+
+        Assert.True(GatherRuleService.ContentEquivalent(a, b));
+    }
+
+    // ── Validation ─────────────────────────────────────────────────────────
+
+    private static GatherRule ValidationRule(
+        List<string>? activePhases = null, string? activeFromPhase = null, string? emitMode = null) => new()
+    {
+        RuleId = "GATHER-VAL-001",
+        Title = "Rule",
+        CollectorType = "registry",
+        Target = "HKLM\\SOFTWARE\\Contoso",
+        Trigger = "interval",
+        OutputEventType = "gather_val",
+        ActivePhases = activePhases,
+        ActiveFromPhase = activeFromPhase,
+        EmitMode = emitMode,
+    };
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("Start")]
+    [InlineData("DevicePreparation")]
+    [InlineData("AccountSetup")]
+    [InlineData("Complete")]
+    [InlineData("accountsetup")] // case-insensitive
+    public void Validate_AcceptsValidFromPhase(string? fromPhase)
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(activeFromPhase: fromPhase)));
+    }
+
+    [Theory]
+    [InlineData("Unknown")]
+    [InlineData("Failed")]
+    [InlineData("4")]          // numeric enum value — canonical names only
+    [InlineData("DeviceESP")]  // the invalid token the old free-text UI suggested
+    public void Validate_RejectsInvalidFromPhase(string fromPhase)
+    {
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(activeFromPhase: fromPhase)));
+    }
+
+    [Fact]
+    public void Validate_AcceptsValidActivePhases_AndRejectsInvalidEntries()
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(
+            ValidationRule(activePhases: new List<string> { "DeviceSetup", "AppsDevice" })));
+
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(
+            ValidationRule(activePhases: new List<string> { "DeviceSetup", "Failed" })));
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(
+            ValidationRule(activePhases: new List<string> { "" })));
+    }
+
+    [Fact]
+    public void Validate_RejectsBothScopeFieldsSet()
+    {
+        var error = GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(
+            activePhases: new List<string> { "AccountSetup" }, activeFromPhase: "DeviceSetup"));
+
+        Assert.NotNull(error);
+        Assert.Contains("mutually exclusive", error);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("always")]
+    [InlineData("on_change")]
+    [InlineData("ON_CHANGE")] // case-insensitive
+    public void Validate_AcceptsValidEmitModes(string? emitMode)
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(emitMode: emitMode)));
+    }
+
+    [Fact]
+    public void Validate_RejectsUnknownEmitMode()
+    {
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(emitMode: "sometimes")));
+    }
+
+    [Fact]
+    public void Validate_TogglePartialPayload_PassesThrough()
+    {
+        // The portal toggle sends only { enabled, isBuiltIn, isCommunity } — none of the
+        // scope fields — and must not be rejected.
+        var toggle = new GatherRule { RuleId = "GATHER-VAL-002", Enabled = false };
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(toggle));
+    }
+
+    [Fact]
+    public void Validate_EmptyActivePhasesList_IsUnrestricted_AndPasses()
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(activePhases: new List<string>())));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GatherRuleUpdatePartialMergeTests.cs

@@ -0,0 +1,146 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the custom-rule partial-PUT fix on <see cref="GatherRuleService.UpdateRuleAsync"/>:
+/// the portal toggle PUTs only { enabled, isBuiltIn, isCommunity }, and full-storing that
+/// payload wiped Title/Target/Trigger/Parameters of the custom rule. Toggle-style partials
+/// (empty Title/CollectorType/Target) must merge Enabled into the existing row; full payloads
+/// (edit flow) must still replace the row but preserve the original CreatedAt.
+/// </summary>
+public class GatherRuleUpdatePartialMergeTests
+{
+    private const string TenantId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+    private const string RuleId = "GATHER-CUST-001";
+
+    private static GatherRule ExistingCustomRule() => new()
+    {
+        RuleId = RuleId,
+        Title = "Collect BIOS Config",
+        Description = "Reads the RealmJoin BIOS key",
+        Category = "device",
+        CollectorType = "registry",
+        Target = "HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS",
+        Parameters = new Dictionary<string, string> { ["valueName"] = "Version" },
+        Trigger = "interval",
+        IntervalSeconds = 60,
+        OutputEventType = "gather_bios_config",
+        Enabled = true,
+        IsBuiltIn = false,
+        IsCommunity = false,
+        CreatedAt = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc),
+        ActiveFromPhase = "AccountSetup",
+        EmitMode = "on_change",
+    };
+
+    private static (GatherRuleService service, Mock<IRuleRepository> repo, List<GatherRule> stored) BuildService(
+        GatherRule? existingTenantRule)
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Loose);
+        var stored = new List<GatherRule>();
+
+        repo.Setup(r => r.GetGatherRulesAsync("global")).ReturnsAsync(new List<GatherRule>());
+        repo.Setup(r => r.GetGatherRulesAsync(TenantId)).ReturnsAsync(
+            existingTenantRule == null ? new List<GatherRule>() : new List<GatherRule> { existingTenantRule });
+        repo.Setup(r => r.StoreGatherRuleAsync(It.IsAny<GatherRule>(), TenantId))
+            .Callback<GatherRule, string>((rule, _) => stored.Add(rule))
+            .ReturnsAsync(true);
+
+        return (new GatherRuleService(repo.Object, NullLogger<GatherRuleService>.Instance), repo, stored);
+    }
+
+    [Fact]
+    public async Task TogglePartial_merges_enabled_and_preserves_definition_fields()
+    {
+        var existing = ExistingCustomRule();
+        var (service, _, stored) = BuildService(existing);
+
+        // Exactly what the portal toggle sends: { enabled, isBuiltIn, isCommunity }.
+        var togglePayload = new GatherRule { RuleId = RuleId, Enabled = false, IsBuiltIn = false, IsCommunity = false };
+
+        var ok = await service.UpdateRuleAsync(TenantId, togglePayload);
+
+        Assert.True(ok);
+        var written = Assert.Single(stored);
+        Assert.False(written.Enabled);
+        Assert.Equal("Collect BIOS Config", written.Title);
+        Assert.Equal("HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS", written.Target);
+        Assert.Equal("registry", written.CollectorType);
+        Assert.Equal("interval", written.Trigger);
+        Assert.Equal(60, written.IntervalSeconds);
+        Assert.Equal("Version", written.Parameters["valueName"]);
+        Assert.Equal("AccountSetup", written.ActiveFromPhase);
+        Assert.Equal("on_change", written.EmitMode);
+        Assert.Equal(existing.CreatedAt, written.CreatedAt);
+    }
+
+    [Fact]
+    public async Task TogglePartial_for_unknown_custom_rule_fails_without_storing()
+    {
+        var (service, repo, stored) = BuildService(existingTenantRule: null);
+
+        var togglePayload = new GatherRule { RuleId = RuleId, Enabled = false, IsBuiltIn = false, IsCommunity = false };
+
+        var ok = await service.UpdateRuleAsync(TenantId, togglePayload);
+
+        Assert.False(ok);
+        Assert.Empty(stored);
+        repo.Verify(r => r.StoreGatherRuleAsync(It.IsAny<GatherRule>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task FullPayload_replaces_rule_but_preserves_original_CreatedAt()
+    {
+        var existing = ExistingCustomRule();
+        var (service, _, stored) = BuildService(existing);
+
+        var fullPayload = new GatherRule
+        {
+            RuleId = RuleId,
+            Title = "Collect BIOS Config v2",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS2",
+            Trigger = "interval",
+            IntervalSeconds = 120,
+            OutputEventType = "gather_bios_config",
+            Enabled = true,
+            // Edit flow sends createdAt from the client; a JSON-mode edit may omit it and
+            // default to UtcNow — either way the stored row must keep the original.
+            CreatedAt = DateTime.UtcNow,
+        };
+
+        var ok = await service.UpdateRuleAsync(TenantId, fullPayload);
+
+        Assert.True(ok);
+        var written = Assert.Single(stored);
+        Assert.Equal("Collect BIOS Config v2", written.Title);
+        Assert.Equal("HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS2", written.Target);
+        Assert.Equal(120, written.IntervalSeconds);
+        Assert.False(written.IsBuiltIn);
+        Assert.False(written.IsCommunity);
+        Assert.Equal(existing.CreatedAt, written.CreatedAt);
+    }
+
+    [Fact]
+    public async Task BuiltInRule_toggle_still_goes_through_RuleState_path()
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Loose);
+        repo.Setup(r => r.GetGatherRulesAsync("global")).ReturnsAsync(new List<GatherRule>
+        {
+            new() { RuleId = RuleId, IsBuiltIn = true, Title = "Built-in", Enabled = true }
+        });
+        repo.Setup(r => r.StoreRuleStateAsync(TenantId, RuleId, It.IsAny<RuleState>())).ReturnsAsync(true);
+        var service = new GatherRuleService(repo.Object, NullLogger<GatherRuleService>.Instance);
+
+        var ok = await service.UpdateRuleAsync(TenantId, new GatherRule { RuleId = RuleId, Enabled = false });
+
+        Assert.True(ok);
+        repo.Verify(r => r.StoreRuleStateAsync(TenantId, RuleId, It.Is<RuleState>(s => !s.Enabled)), Times.Once);
+        repo.Verify(r => r.StoreGatherRuleAsync(It.IsAny<GatherRule>(), It.IsAny<string>()), Times.Never);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/HealthCheckServiceAgentBinariesTests.cs

@@ -0,0 +1,107 @@
+using System.Collections.Generic;
+using System.Net;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Functions.Tests.GraphResolution;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Service-level tests for the Agent Binaries HealthCheck card. The check probes the
+/// canonical download alias (download.autopilotmonitor.com) AND the legacy blob keepalive
+/// account: alias failure is unhealthy (new installs break), legacy failure is only a
+/// warning (existing customers break until they migrate to the alias).
+/// </summary>
+public class HealthCheckServiceAgentBinariesTests
+{
+    private const string AliasHost = "download.autopilotmonitor.com";
+    private const string LegacyHost = "autopilotmonitor.blob.core.windows.net";
+
+    [Fact]
+    public async Task Check_AllEndpointsAvailable_ReportsHealthyWithoutUrlDetails()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.OK, "")
+            .When(LegacyHost, HttpStatusCode.OK, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("Agent Binaries", check.Name);
+        Assert.Equal("healthy", check.Status);
+        Assert.Contains("download alias", check.Message);
+        Assert.Null(check.Details);
+        // Both hosts must actually have been probed (ZIP + PS1 each).
+        Assert.Equal(2, handler.Requests.FindAll(u => u.Contains(AliasHost)).Count);
+        Assert.Equal(2, handler.Requests.FindAll(u => u.Contains(LegacyHost)).Count);
+    }
+
+    [Fact]
+    public async Task Check_WithEndpointUrls_SurfacesAliasAndLegacyUrlsInDetails()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.OK, "")
+            .When(LegacyHost, HttpStatusCode.OK, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: true);
+
+        Assert.NotNull(check.Details);
+        Assert.Equal("https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip", check.Details!["Agent ZIP"]);
+        Assert.Equal("https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1", check.Details["Bootstrap script"]);
+        Assert.Equal("https://autopilotmonitor.blob.core.windows.net/agent", check.Details["Legacy blob (keepalive)"]);
+    }
+
+    [Fact]
+    public async Task Check_LegacyBlobMissing_ReportsWarningNamingTheLegacyEndpoint()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.OK, "")
+            .When(LegacyHost, HttpStatusCode.NotFound, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("warning", check.Status);
+        Assert.Contains("legacy", check.Message, System.StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("404", check.Message);
+    }
+
+    [Fact]
+    public async Task Check_AliasMissing_ReportsUnhealthy()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.NotFound, "")
+            .When(LegacyHost, HttpStatusCode.OK, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("unhealthy", check.Status);
+        Assert.Contains("download alias", check.Message);
+    }
+
+    [Fact]
+    public async Task Check_EndpointsUnreachable_ReportsUnhealthy()
+    {
+        // Un-scripted URLs make the stub throw — models a connection failure.
+        var check = await BuildService(new StubHttpMessageHandler()).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("unhealthy", check.Status);
+        Assert.Contains("unreachable", check.Message);
+    }
+
+    private static HealthCheckService BuildService(StubHttpMessageHandler handler)
+    {
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>())
+            .Build();
+
+        return new HealthCheckService(
+            NullLogger<HealthCheckService>.Instance,
+            adminConfigService: null!,
+            httpClientFactory: new StubHttpClientFactory(handler),
+            metricsReader: null!,
+            poisonQueueProbe: null!,
+            configuration: config);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/HealthCheckServiceMcpServerTests.cs

@@ -53,6 +53,29 @@ public class HealthCheckServiceMcpServerTests
         Assert.DoesNotContain("http", check.Message, System.StringComparison.OrdinalIgnoreCase);
     }
 
+    [Fact]
+    public async Task Check_WithEndpointUrl_SurfacesServerUrlAlongsideVersion()
+    {
+        var svc = BuildService(HttpStatusCode.OK, "{\"status\":\"healthy\",\"version\":\"1.4.0\"}");
+
+        var check = await svc.CheckMcpServerAsync(includeEndpointUrl: true);
+
+        // The Version detail must merge into — not replace — the Server URL detail.
+        Assert.Equal("https://mcp.example.test", check.Details!["Server URL"]);
+        Assert.Equal("1.4.0", check.Details["Version"]);
+    }
+
+    [Fact]
+    public async Task Check_WithEndpointUrl_SurfacesServerUrlEvenWhenUnhealthy()
+    {
+        var svc = BuildService(HttpStatusCode.ServiceUnavailable, "");
+
+        var check = await svc.CheckMcpServerAsync(includeEndpointUrl: true);
+
+        Assert.Equal("unhealthy", check.Status);
+        Assert.Equal("https://mcp.example.test", check.Details!["Server URL"]);
+    }
+
     [Fact]
     public async Task Check_TimeoutOrConnectionFailure_ReportsWarningForColdStart()
     {

src/Backend/AutopilotMonitor.Functions.Tests/MaintenanceServiceSignalRQuotaTests.cs

@@ -3,7 +3,7 @@ using AutopilotMonitor.Functions.Services;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Tier-boundary + percent-math tests for the SignalR free-tier quota watcher.
+/// Tier-boundary + percent-math tests for the SignalR quota watcher.
 /// Mirrors the cert-expiry tests' approach: pure-function coverage of the
 /// boundary risks (off-by-one, floor vs ceil, zero-division). Full-service
 /// smoke tests would require constructing 16 dependencies; the percent +

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableConfigRepository.cs

@@ -582,7 +582,10 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
                 { "FeedbackMinTenantAgeDays", config.FeedbackMinTenantAgeDays },
                 { "FeedbackCooldownDays", config.FeedbackCooldownDays },
                 // MCP access control
-                { "McpAccessPolicy", config.McpAccessPolicy ?? "WhitelistOnly" }
+                { "McpAccessPolicy", config.McpAccessPolicy ?? "WhitelistOnly" },
+                // Agent endpoint migration (config-channel re-home)
+                { "AgentMigrateApiBaseUrl", config.AgentMigrateApiBaseUrl ?? string.Empty },
+                { "AgentMigrateTenantOverridesJson", config.AgentMigrateTenantOverridesJson ?? string.Empty }
             };
 
             return entity;
@@ -643,7 +646,10 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
                 FeedbackMinTenantAgeDays = entity.GetInt32("FeedbackMinTenantAgeDays") ?? 14,
                 FeedbackCooldownDays = entity.GetInt32("FeedbackCooldownDays") ?? 60,
                 // MCP access control
-                McpAccessPolicy = entity.GetString("McpAccessPolicy") ?? "WhitelistOnly"
+                McpAccessPolicy = entity.GetString("McpAccessPolicy") ?? "WhitelistOnly",
+                // Agent endpoint migration (config-channel re-home)
+                AgentMigrateApiBaseUrl = entity.GetString("AgentMigrateApiBaseUrl") ?? string.Empty,
+                AgentMigrateTenantOverridesJson = entity.GetString("AgentMigrateTenantOverridesJson") ?? string.Empty
             };
         }
 

src/Backend/AutopilotMonitor.Functions/Functions/Admin/SignalRQuotaTimerFunction.cs

@@ -7,10 +7,11 @@ using Microsoft.Extensions.Logging;
 namespace AutopilotMonitor.Functions.Functions.Admin
 {
     /// <summary>
-    /// Timer-triggered watcher for the Azure SignalR Free-tier limits (20
-    /// concurrent connections / 20,000 messages per UTC day). Runs every full
-    /// hour and emits OpsEvents when the configured thresholds are crossed so
-    /// operators get a Telegram ping before clients start getting 429'd.
+    /// Timer-triggered watcher for the Azure SignalR plan limits (Standard S1
+    /// x1 unit: 1,000 concurrent connections / 1M messages per UTC day). Runs
+    /// every full hour and emits OpsEvents when the configured thresholds are
+    /// crossed so operators get a Telegram ping before clients start getting
+    /// 429'd or message overage is billed.
     ///
     /// Separate from the 2h MaintenanceFunction: the SignalR limits can be
     /// breached by a brief connection spike, so the cadence is tighter. Cost

src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs

@@ -157,6 +157,39 @@ namespace AutopilotMonitor.Functions.Functions.Config
             return (line.ZipSha256, line.ExeSha256);
         }
 
+        /// <summary>
+        /// Resolves the endpoint-migration target for a tenant: per-tenant override wins over
+        /// the global value; an override entry with an empty value pins the tenant (no
+        /// migration even while the global target is set — staged rollout). The winning value
+        /// is validated against <see cref="AutopilotMonitor.Shared.Services.AgentEndpointMigrationRules"/>;
+        /// invalid values resolve to null (fail-safe: better to strand an agent on the old
+        /// backend than to serve a broken or non-allowlisted URL).
+        /// </summary>
+        internal static string? ResolveMigrateTarget(
+            AutopilotMonitor.Shared.Models.AdminConfiguration adminConfig,
+            string tenantId,
+            out string? rejectedCandidate)
+        {
+            rejectedCandidate = null;
+            string? candidate = adminConfig.AgentMigrateApiBaseUrl;
+
+            var overrides = adminConfig.GetAgentMigrateTenantOverrides();
+            if (!string.IsNullOrEmpty(tenantId) && overrides.TryGetValue(tenantId, out var tenantTarget))
+                candidate = tenantTarget; // empty string = pinned, handled below
+
+            if (string.IsNullOrWhiteSpace(candidate))
+                return null;
+
+            if (AutopilotMonitor.Shared.Services.AgentEndpointMigrationRules
+                .TryNormalizeTarget(candidate, out var normalized))
+            {
+                return normalized;
+            }
+
+            rejectedCandidate = candidate;
+            return null;
+        }
+
         /// <summary>
         /// Core config logic: fetch tenant + admin config, gather rules, IME patterns.
         /// Called by both the cert-auth Run() method and the bootstrap wrapper.
@@ -215,10 +248,29 @@ namespace AutopilotMonitor.Functions.Functions.Config
             // so agent code is unchanged across all major lines.
             var (latestAgentSha256, latestAgentExeSha256) = SelectAgentHashesForClient(req, adminConfig);
 
+            // Endpoint migration on the control channel: serve the (validated) re-home target
+            // so agents still bound to this backend's compiled-in URL move themselves to the
+            // new deployment at their next start. LogWarning (not Information) because worker
+            // logs below Warning never reach App Insights — this line is the delivery evidence
+            // during a migration window.
+            var migrateTarget = ResolveMigrateTarget(adminConfig, tenantId, out var rejectedMigrateCandidate);
+            if (migrateTarget != null)
+            {
+                _logger.LogWarning(
+                    "AgentMigrateServed: tenant={TenantId} serial={Serial} agentVersion={AgentVersion} target={Target}",
+                    tenantId, serialNumberHeader, agentVersionHeader, migrateTarget);
+            }
+            else if (rejectedMigrateCandidate != null)
+            {
+                _logger.LogWarning(
+                    "AgentMigrateRejected: configured migration target failed validation and is NOT served. tenant={TenantId} candidate={Candidate}",
+                    tenantId, rejectedMigrateCandidate);
+            }
+
             var response = req.CreateResponse(HttpStatusCode.OK);
             await response.WriteAsJsonAsync(new AgentConfigResponse
             {
-                ConfigVersion = 32, // V2 OOBE-console / Shift+F10 detection portal toggle (EnableConsoleBypassDetection; tenant-scoped, default ON / opt-out; gates ConsoleBypass host + ConsolePrefetchScanner)
+                ConfigVersion = 34, // Gather rule phase scoping (ActivePhases/ActiveFromPhase) + EmitMode on_change anti-spam
                 UploadIntervalSeconds = 10,
                 SelfDestructOnComplete = tenantConfig.SelfDestructOnComplete ?? true,
                 KeepLogFile = tenantConfig.KeepLogFile ?? false,
@@ -262,6 +314,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
                 DeviceBlocked = killVerdict.IsBlocked,
                 DeviceKillSignal = killVerdict.IsKill,
                 UnblockAt = killVerdict.UnblockAt,
+                MigrateToApiBaseUrl = migrateTarget,
             });
 
             return response;

src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/HealthCheckFunction.cs

@@ -102,17 +102,19 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
 
             // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
 
-            // Perform comprehensive health checks
-            var healthCheckResult = await _healthCheckService.PerformAllChecksAsync();
-
-            // SignalR Quota check exposes the subscription/resource-group path of the
-            // backing SignalR resource, and Poison Queues exposes internal async-worker
-            // queue topology — restrict both to Global Admins. Non-GA callers
-            // (Tenant Admins, Operators) get the rest of the report unchanged.
+            // SignalR Quota exposes the subscription/resource-group path of the backing
+            // SignalR resource, Poison Queues exposes internal async-worker queue topology,
+            // and endpoint URLs in the check details expose infrastructure hostnames —
+            // restrict all of that to Global Admins. Non-GA callers (Tenant Admins,
+            // Operators) get the rest of the report unchanged.
             // The route is registered as AuthenticatedUser, so PolicyEnforcementMiddleware
             // does NOT compute IsGlobalAdmin; resolve it directly via GlobalAdminService.
             var requestCtx = context.GetRequestContext();
             var isGlobalAdmin = await _globalAdminService.IsGlobalAdminAsync(requestCtx.UserPrincipalName);
+
+            // Perform comprehensive health checks (endpoint URLs only for Global Admins)
+            var healthCheckResult = await _healthCheckService.PerformAllChecksAsync(includeEndpointUrls: isGlobalAdmin);
+
             var visibleChecks = isGlobalAdmin
                 ? healthCheckResult.Checks
                 : healthCheckResult.Checks
@@ -146,10 +148,14 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
         /// </summary>
         [Function("McpHealthCheck")]
         public async Task<HttpResponseData> GetMcpHealthCheck(
-            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "health/mcp")] HttpRequestData req)
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "health/mcp")] HttpRequestData req,
+            FunctionContext context)
         {
             // Authentication enforced by PolicyEnforcementMiddleware (AuthenticatedUser).
-            var check = await _healthCheckService.CheckMcpServerAsync();
+            // The MCP server URL is infrastructure topology — include it only for Global Admins.
+            var requestCtx = context.GetRequestContext();
+            var isGlobalAdmin = await _globalAdminService.IsGlobalAdminAsync(requestCtx.UserPrincipalName);
+            var check = await _healthCheckService.CheckMcpServerAsync(includeEndpointUrl: isGlobalAdmin);
 
             var response = req.CreateResponse(HttpStatusCode.OK);
             await response.WriteAsJsonAsync(new

src/Backend/AutopilotMonitor.Functions/Functions/Rules/GatherRulesFunction.cs

@@ -64,6 +64,14 @@ namespace AutopilotMonitor.Functions.Functions.Rules
                 return badRequest;
             }
 
+            var scopeError = ValidateScopeAndEmitMode(rule);
+            if (scopeError != null)
+            {
+                var badRequest = req.CreateResponse(HttpStatusCode.BadRequest);
+                await badRequest.WriteAsJsonAsync(new { success = false, message = scopeError });
+                return badRequest;
+            }
+
             try
             {
                 var success = await _ruleService.CreateRuleAsync(tenantId, rule);
@@ -108,12 +116,71 @@ namespace AutopilotMonitor.Functions.Functions.Rules
 
             rule.RuleId = ruleId;
 
+            var scopeError = ValidateScopeAndEmitMode(rule);
+            if (scopeError != null)
+            {
+                var badRequest = req.CreateResponse(HttpStatusCode.BadRequest);
+                await badRequest.WriteAsJsonAsync(new { success = false, message = scopeError });
+                return badRequest;
+            }
+
             var success = await _ruleService.UpdateRuleAsync(tenantId, rule);
             var response = req.CreateResponse(success ? HttpStatusCode.OK : HttpStatusCode.InternalServerError);
             await response.WriteAsJsonAsync(new { success, message = success ? "Rule updated" : "Failed to update rule" });
             return response;
         }
 
+        /// <summary>
+        /// Selectable phase-scope tokens: the <see cref="EnrollmentPhase"/> enum NAMES from
+        /// Start(0) through Complete(7). Explicit name list (not Enum.TryParse) so numeric
+        /// tokens ("4") and the non-selectable Unknown/Failed members are rejected — the
+        /// canonical vocabulary the agent, schema, and portal share.
+        /// </summary>
+        private static readonly HashSet<string> ValidScopePhases = new(StringComparer.OrdinalIgnoreCase)
+        {
+            nameof(EnrollmentPhase.Start),
+            nameof(EnrollmentPhase.DevicePreparation),
+            nameof(EnrollmentPhase.DeviceSetup),
+            nameof(EnrollmentPhase.AppsDevice),
+            nameof(EnrollmentPhase.AccountSetup),
+            nameof(EnrollmentPhase.AppsUser),
+            nameof(EnrollmentPhase.FinalizingSetup),
+            nameof(EnrollmentPhase.Complete),
+        };
+
+        /// <summary>
+        /// Validates the phase-scope + emit-mode fields on create/update.
+        /// Returns an error message for a 400 response, or null when valid.
+        /// Toggle-style partial payloads carry none of these fields and pass through.
+        /// </summary>
+        internal static string? ValidateScopeAndEmitMode(GatherRule rule)
+        {
+            var hasActivePhases = rule.ActivePhases != null && rule.ActivePhases.Count > 0;
+            var hasFromPhase = !string.IsNullOrEmpty(rule.ActiveFromPhase);
+
+            if (hasActivePhases && hasFromPhase)
+                return "activePhases and activeFromPhase are mutually exclusive — set only one.";
+
+            if (hasActivePhases)
+            {
+                foreach (var phase in rule.ActivePhases!)
+                {
+                    if (string.IsNullOrEmpty(phase) || !ValidScopePhases.Contains(phase))
+                        return $"Invalid phase '{phase}' in activePhases. Valid phases: {string.Join(", ", ValidScopePhases)}.";
+                }
+            }
+
+            if (hasFromPhase && !ValidScopePhases.Contains(rule.ActiveFromPhase!))
+                return $"Invalid activeFromPhase '{rule.ActiveFromPhase}'. Valid phases: {string.Join(", ", ValidScopePhases)}.";
+
+            if (!string.IsNullOrEmpty(rule.EmitMode)
+                && !string.Equals(rule.EmitMode, "always", StringComparison.OrdinalIgnoreCase)
+                && !string.Equals(rule.EmitMode, "on_change", StringComparison.OrdinalIgnoreCase))
+                return "emitMode must be \"always\" or \"on_change\".";
+
+            return null;
+        }
+
         [Function("DeleteGatherRule")]
         public async Task<HttpResponseData> DeleteRule(
             [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "rules/gather/{ruleId}")] HttpRequestData req,

src/Backend/AutopilotMonitor.Functions/Services/GatherRuleService.cs

@@ -151,10 +151,38 @@ namespace AutopilotMonitor.Functions.Services
                 return await _ruleRepo.StoreRuleStateAsync(tenantId, rule.RuleId, new RuleState { Enabled = rule.Enabled });
             }
 
+            // Custom rule. The portal toggle PUTs only { enabled, isBuiltIn, isCommunity } —
+            // full-storing that payload would wipe Title/Target/Trigger/Parameters. Merge
+            // toggle-style partials into the existing row; full payloads (edit flow) replace
+            // the row but keep the original CreatedAt.
+            var existing = (await _ruleRepo.GetGatherRulesAsync(tenantId))
+                .FirstOrDefault(r => r.RuleId == rule.RuleId && !r.IsBuiltIn && !r.IsCommunity);
+
+            var isTogglePartial = string.IsNullOrEmpty(rule.Title)
+                && string.IsNullOrEmpty(rule.CollectorType)
+                && string.IsNullOrEmpty(rule.Target);
+
+            if (isTogglePartial)
+            {
+                if (existing == null)
+                {
+                    _logger.LogWarning(
+                        "Toggle-style partial update for unknown custom gather rule {RuleId} (tenant {TenantId}); nothing to update",
+                        rule.RuleId, tenantId);
+                    return false;
+                }
+
+                existing.Enabled = rule.Enabled;
+                existing.UpdatedAt = DateTime.UtcNow;
+                return await _ruleRepo.StoreGatherRuleAsync(existing, tenantId);
+            }
+
             // Ensure custom rules keep correct flags (the incoming payload may
             // omit them, causing them to default to IsBuiltIn=true in the model).
             rule.IsBuiltIn = false;
             rule.IsCommunity = false;
+            if (existing != null)
+                rule.CreatedAt = existing.CreatedAt;
             rule.UpdatedAt = DateTime.UtcNow;
             return await _ruleRepo.StoreGatherRuleAsync(rule, tenantId);
         }
@@ -413,7 +441,22 @@ namespace AutopilotMonitor.Functions.Services
                 && a.Title == b.Title
                 && a.CollectorType == b.CollectorType
                 && a.Trigger == b.Trigger
-                && a.TriggerPhase == b.TriggerPhase;
+                && a.TriggerPhase == b.TriggerPhase
+                && ActivePhasesEquivalent(a.ActivePhases, b.ActivePhases)
+                && a.ActiveFromPhase == b.ActiveFromPhase
+                && a.EmitMode == b.EmitMode;
+        }
+
+        /// <summary>
+        /// Null-tolerant ordered comparison for <see cref="GatherRule.ActivePhases"/>:
+        /// null and empty are both "unrestricted" and therefore equivalent, so pre-existing
+        /// DB rows (absent column → null) never diff against seeds (also null) — no reseed churn.
+        /// </summary>
+        private static bool ActivePhasesEquivalent(List<string>? a, List<string>? b)
+        {
+            var left = a ?? new List<string>();
+            var right = b ?? new List<string>();
+            return left.SequenceEqual(right, StringComparer.Ordinal);
         }
     }
 }

src/Backend/AutopilotMonitor.Functions/Services/HealthCheckService.cs

@@ -34,9 +34,12 @@ public class HealthCheckService
     }
 
     /// <summary>
-    /// Performs all health checks and returns the results
+    /// Performs all health checks and returns the results.
+    /// <paramref name="includeEndpointUrls"/> adds the probed/backing endpoint URLs to the
+    /// per-check details — infrastructure topology, so callers must only enable it for
+    /// Global Admins.
     /// </summary>
-    public async Task<HealthCheckResult> PerformAllChecksAsync()
+    public async Task<HealthCheckResult> PerformAllChecksAsync(bool includeEndpointUrls = false)
     {
         var result = new HealthCheckResult
         {
@@ -50,9 +53,9 @@ public class HealthCheckService
         // one slow check. It is exposed via its own endpoint (GET health/mcp) that the
         // frontend fetches independently and folds into the card grid incrementally.
         var checks = await Task.WhenAll(
-            CheckStorageBackendAsync(),
-            CheckProcessingBackendAsync(),
-            CheckAgentBinariesAsync(),
+            CheckStorageBackendAsync(includeEndpointUrls),
+            CheckProcessingBackendAsync(includeEndpointUrls),
+            CheckAgentBinariesAsync(includeEndpointUrls),
             CheckSignalRQuotaAsync(),
             CheckPoisonQueuesAsync()
         );
@@ -73,7 +76,7 @@ public class HealthCheckService
     /// <summary>
     /// Checks Azure Table Storage connectivity by querying the admin configuration table
     /// </summary>
-    private async Task<HealthCheck> CheckStorageBackendAsync()
+    private async Task<HealthCheck> CheckStorageBackendAsync(bool includeEndpointUrls)
     {
         var check = new HealthCheck
         {
@@ -97,29 +100,62 @@ public class HealthCheckService
             _logger.LogError(ex, "Storage backend health check failed");
         }
 
+        if (includeEndpointUrls)
+        {
+            // Same resolution order as TableStorageService: account name (Managed Identity)
+            // is the production path, connection string is the local-dev fallback.
+            var accountName = _configuration["AzureStorageAccountName"];
+            check.Details = new Dictionary<string, object>
+            {
+                ["Table endpoint"] = string.IsNullOrWhiteSpace(accountName)
+                    ? "connection string (local dev)"
+                    : $"https://{accountName}.table.core.windows.net"
+            };
+        }
+
         return check;
     }
 
     /// <summary>
     /// Checks that the Azure Functions host is running
     /// </summary>
-    private static Task<HealthCheck> CheckProcessingBackendAsync()
+    private static Task<HealthCheck> CheckProcessingBackendAsync(bool includeEndpointUrls)
     {
         var uptime = DateTime.UtcNow - System.Diagnostics.Process.GetCurrentProcess().StartTime.ToUniversalTime();
 
-        return Task.FromResult(new HealthCheck
+        var check = new HealthCheck
         {
             Name = "Processing Backend",
             Description = "Application host process",
             Status = "healthy",
             Message = $"Host running (uptime: {(int)uptime.TotalMinutes}m {uptime.Seconds}s)"
-        });
+        };
+
+        if (includeEndpointUrls)
+        {
+            // WEBSITE_HOSTNAME is stamped by App Service and reflects the host actually
+            // serving this process — no hardcoded URL to go stale after a migration.
+            var hostname = Environment.GetEnvironmentVariable("WEBSITE_HOSTNAME");
+            if (!string.IsNullOrWhiteSpace(hostname))
+            {
+                check.Details = new Dictionary<string, object>
+                {
+                    ["API endpoint"] = $"https://{hostname}"
+                };
+            }
+        }
+
+        return Task.FromResult(check);
     }
 
     /// <summary>
-    /// Checks that the agent binaries (ZIP) and bootstrap script (PS1) are reachable in blob storage
+    /// Checks that the agent binaries (ZIP) and bootstrap script (PS1) are reachable on the
+    /// canonical download alias (Front Door → current blob origin) AND on the legacy blob
+    /// keepalive account that already-deployed customer bootstrap scripts still use.
+    /// Alias failure is unhealthy (new installs break); legacy failure is a warning
+    /// (existing customers break until they migrate to the alias).
     /// </summary>
-    private async Task<HealthCheck> CheckAgentBinariesAsync()
+    internal async Task<HealthCheck> CheckAgentBinariesAsync(bool includeEndpointUrls)
     {
         var check = new HealthCheck
         {
@@ -127,8 +163,20 @@ public class HealthCheckService
             Description = "Agent download package availability"
         };
 
-        var zipUrl = $"{Constants.AgentBlobBaseUrl}/{Constants.AgentZipFileName}";
-        var ps1Url = $"{Constants.AgentBlobBaseUrl}/Install-AutopilotMonitor.ps1";
+        var aliasZipUrl = $"{Constants.AgentDownloadBaseUrl}/{Constants.AgentZipFileName}";
+        var aliasPs1Url = $"{Constants.AgentDownloadBaseUrl}/{Constants.BootstrapScriptName}";
+        var legacyZipUrl = $"{Constants.AgentBlobBaseUrl}/{Constants.AgentZipFileName}";
+        var legacyPs1Url = $"{Constants.AgentBlobBaseUrl}/{Constants.BootstrapScriptName}";
+
+        if (includeEndpointUrls)
+        {
+            check.Details = new Dictionary<string, object>
+            {
+                ["Agent ZIP"] = aliasZipUrl,
+                ["Bootstrap script"] = aliasPs1Url,
+                ["Legacy blob (keepalive)"] = Constants.AgentBlobBaseUrl
+            };
+        }
 
         try
         {
@@ -138,40 +186,48 @@ public class HealthCheckService
             var sw = System.Diagnostics.Stopwatch.StartNew();
 
             // HEAD requests to check availability without downloading
-            var zipRequest = new HttpRequestMessage(HttpMethod.Head, zipUrl);
-            var ps1Request = new HttpRequestMessage(HttpMethod.Head, ps1Url);
-
             var results = await Task.WhenAll(
-                client.SendAsync(zipRequest),
-                client.SendAsync(ps1Request)
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, aliasZipUrl)),
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, aliasPs1Url)),
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, legacyZipUrl)),
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, legacyPs1Url))
             );
 
             sw.Stop();
 
-            var zipResponse = results[0];
-            var ps1Response = results[1];
+            var aliasZipOk = results[0].IsSuccessStatusCode;
+            var aliasPs1Ok = results[1].IsSuccessStatusCode;
+            var legacyZipOk = results[2].IsSuccessStatusCode;
+            var legacyPs1Ok = results[3].IsSuccessStatusCode;
 
-            var zipOk = zipResponse.IsSuccessStatusCode;
-            var ps1Ok = ps1Response.IsSuccessStatusCode;
+            var issues = new List<string>();
+            if (!aliasZipOk) issues.Add($"Agent ZIP (download alias): {(int)results[0].StatusCode}");
+            if (!aliasPs1Ok) issues.Add($"Bootstrap script (download alias): {(int)results[1].StatusCode}");
+            if (!legacyZipOk) issues.Add($"Agent ZIP (legacy blob): {(int)results[2].StatusCode}");
+            if (!legacyPs1Ok) issues.Add($"Bootstrap script (legacy blob): {(int)results[3].StatusCode}");
 
-            if (zipOk && ps1Ok)
+            if (issues.Count == 0)
             {
                 check.Status = "healthy";
-                check.Message = $"Agent package and bootstrap script available ({sw.ElapsedMilliseconds}ms)";
+                check.Message = $"Agent package and bootstrap script available via download alias + legacy blob ({sw.ElapsedMilliseconds}ms)";
+            }
+            else if (aliasZipOk && aliasPs1Ok)
+            {
+                // Alias intact, legacy keepalive degraded — existing customer bootstrap
+                // scripts still download from the legacy account until they migrate.
+                check.Status = "warning";
+                check.Message = $"Download alias OK, but legacy keepalive degraded — {string.Join(", ", issues)}";
             }
             else
             {
                 check.Status = "unhealthy";
-                var issues = new List<string>();
-                if (!zipOk) issues.Add($"Agent ZIP: {(int)zipResponse.StatusCode}");
-                if (!ps1Ok) issues.Add($"Bootstrap script: {(int)ps1Response.StatusCode}");
                 check.Message = $"Missing: {string.Join(", ", issues)}";
             }
         }
         catch (Exception ex)
         {
             check.Status = "unhealthy";
-            check.Message = $"Blob storage unreachable: {ex.Message}";
+            check.Message = $"Agent download endpoints unreachable: {ex.Message}";
             _logger.LogError(ex, "Agent binaries health check failed");
         }
 
@@ -182,7 +238,8 @@ public class HealthCheckService
     /// Probes the MCP server's public <c>/health</c> endpoint (which sits in front of the
     /// <c>/mcp</c> access guard, so no auth is required) and surfaces reachability + the
     /// deployed MCP build version. Visible to all authenticated users, so the server URL is
-    /// deliberately NOT included in the message or details.
+    /// only included in the details when <paramref name="includeEndpointUrl"/> is set —
+    /// callers must only enable it for Global Admins.
     /// <para>
     /// The Container App runs with minReplicas=0 and scales to zero on idle. Azure Container
     /// Apps holds an inbound request while it activates a cold replica, so this probe doubles
@@ -193,7 +250,7 @@ public class HealthCheckService
     /// the blocking all-checks batch, so the dashboard never waits on the wake.
     /// </para>
     /// </summary>
-    internal async Task<HealthCheck> CheckMcpServerAsync()
+    internal async Task<HealthCheck> CheckMcpServerAsync(bool includeEndpointUrl = false)
     {
         var check = new HealthCheck
         {
@@ -203,6 +260,11 @@ public class HealthCheckService
 
         var baseUrl = (_configuration["McpServerUrl"] ?? Constants.McpServerBaseUrl).TrimEnd('/');
         var healthUrl = $"{baseUrl}/health";
+
+        if (includeEndpointUrl)
+        {
+            check.Details = new Dictionary<string, object> { ["Server URL"] = baseUrl };
+        }
         var timeoutSeconds = ParsePositiveInt("McpServerHealthTimeoutSeconds", 30);
 
         // A cold start that takes longer than this is treated as a successful wake rather
@@ -233,7 +295,8 @@ public class HealthCheckService
                 : $"MCP server reachable ({sw.ElapsedMilliseconds}ms)";
             if (!string.IsNullOrWhiteSpace(version))
             {
-                check.Details = new Dictionary<string, object> { ["Version"] = version };
+                check.Details ??= new Dictionary<string, object>();
+                check.Details["Version"] = version;
             }
         }
         catch (Exception ex) when (ex is TaskCanceledException or OperationCanceledException or HttpRequestException)
@@ -290,7 +353,7 @@ public class HealthCheckService
         var check = new HealthCheck
         {
             Name = "SignalR Quota",
-            Description = "Free-tier connection + daily message usage"
+            Description = "Connection + daily message usage vs. plan limits"
         };
 
         var resourceId = _configuration["SignalRResourceId"];
@@ -302,9 +365,9 @@ public class HealthCheckService
         }
 
         var connectionLimit = ParsePositiveInt(
-            "SignalRFreeTierConnectionLimit", MaintenanceService.DefaultSignalRConnectionLimit);
+            "SignalRConnectionLimit", MaintenanceService.DefaultSignalRConnectionLimit);
         var messageLimit = ParsePositiveLong(
-            "SignalRFreeTierDailyMessageLimit", MaintenanceService.DefaultSignalRDailyMessageLimit);
+            "SignalRDailyMessageLimit", MaintenanceService.DefaultSignalRDailyMessageLimit);
 
         var nowUtc = DateTimeOffset.UtcNow;
         var startOfDayUtc = new DateTimeOffset(nowUtc.UtcDateTime.Date, TimeSpan.Zero);
@@ -372,9 +435,9 @@ public class HealthCheckService
 
         check.Message = worstTier switch
         {
-            MaintenanceService.SignalRQuotaTier.Critical => "Free-tier limit nearly saturated — scale to Standard before clients get 429'd",
-            MaintenanceService.SignalRQuotaTier.Warning => "Approaching free-tier limit — consider scaling to Standard",
-            _ => "Within free-tier limits"
+            MaintenanceService.SignalRQuotaTier.Critical => "Plan limit nearly saturated — add SignalR units before clients get 429'd",
+            MaintenanceService.SignalRQuotaTier.Warning => "Approaching plan limit — consider adding SignalR units",
+            _ => "Within plan limits"
         };
         check.Details = details;
         return check;

src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.Aggregation.cs

@@ -554,52 +554,53 @@ namespace AutopilotMonitor.Functions.Services
         }
 
         /// <summary>
-        /// Verifies that agent binaries and bootstrap script are available on blob storage.
+        /// Verifies that agent binaries and bootstrap script are available on the canonical
+        /// download alias (Front Door → current blob origin) AND on the legacy blob keepalive
+        /// account that already-deployed customer bootstrap scripts still use.
         /// Records an OpsEvent for each missing item so Global Admins see it in the dashboard.
         /// </summary>
         private async Task CheckAgentBlobStorageAsync()
         {
-            _logger.LogInformation("Checking agent blob storage availability...");
+            _logger.LogInformation("Checking agent download endpoint availability...");
 
-            var zipUrl = $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/{AutopilotMonitor.Shared.Constants.AgentZipFileName}";
-            var ps1Url = $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/Install-AutopilotMonitor.ps1";
+            var probes = new (string Label, string Url)[]
+            {
+                ($"Agent ZIP ({AutopilotMonitor.Shared.Constants.AgentZipFileName}, download alias)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentDownloadBaseUrl}/{AutopilotMonitor.Shared.Constants.AgentZipFileName}"),
+                ($"Bootstrap script ({AutopilotMonitor.Shared.Constants.BootstrapScriptName}, download alias)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentDownloadBaseUrl}/{AutopilotMonitor.Shared.Constants.BootstrapScriptName}"),
+                ($"Agent ZIP ({AutopilotMonitor.Shared.Constants.AgentZipFileName}, legacy blob keepalive)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/{AutopilotMonitor.Shared.Constants.AgentZipFileName}"),
+                ($"Bootstrap script ({AutopilotMonitor.Shared.Constants.BootstrapScriptName}, legacy blob keepalive)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/{AutopilotMonitor.Shared.Constants.BootstrapScriptName}")
+            };
 
             try
             {
                 var client = _httpClientFactory.CreateClient();
                 client.Timeout = TimeSpan.FromSeconds(15);
 
-                var zipRequest = new HttpRequestMessage(HttpMethod.Head, zipUrl);
-                var ps1Request = new HttpRequestMessage(HttpMethod.Head, ps1Url);
-
                 var results = await Task.WhenAll(
-                    client.SendAsync(zipRequest),
-                    client.SendAsync(ps1Request)
+                    probes.Select(p => client.SendAsync(new HttpRequestMessage(HttpMethod.Head, p.Url)))
                 );
 
-                var zipResponse = results[0];
-                var ps1Response = results[1];
-
-                if (!zipResponse.IsSuccessStatusCode)
+                var allOk = true;
+                for (var i = 0; i < probes.Length; i++)
                 {
-                    _logger.LogError("Agent ZIP not available on blob storage: HTTP {StatusCode}", (int)zipResponse.StatusCode);
-                    await _opsEventService.RecordBlobStorageMissingAsync("Agent ZIP (AutopilotMonitor-Agent.zip)", (int)zipResponse.StatusCode);
+                    if (results[i].IsSuccessStatusCode) continue;
+                    allOk = false;
+                    _logger.LogError("{Item} not available: HTTP {StatusCode}", probes[i].Label, (int)results[i].StatusCode);
+                    await _opsEventService.RecordBlobStorageMissingAsync(probes[i].Label, (int)results[i].StatusCode);
                 }
 
-                if (!ps1Response.IsSuccessStatusCode)
+                if (allOk)
                 {
-                    _logger.LogError("Bootstrap script not available on blob storage: HTTP {StatusCode}", (int)ps1Response.StatusCode);
-                    await _opsEventService.RecordBlobStorageMissingAsync("Bootstrap script (Install-AutopilotMonitor.ps1)", (int)ps1Response.StatusCode);
-                }
-
-                if (zipResponse.IsSuccessStatusCode && ps1Response.IsSuccessStatusCode)
-                {
-                    _logger.LogInformation("Agent blob storage check passed: all binaries available");
+                    _logger.LogInformation("Agent download endpoint check passed: all binaries available on alias + legacy blob");
                 }
             }
             catch (Exception ex)
             {
-                _logger.LogError(ex, "Agent blob storage check failed — storage unreachable");
+                _logger.LogError(ex, "Agent download endpoint check failed — endpoints unreachable");
                 await _opsEventService.RecordBlobStorageUnreachableAsync(ex.Message);
             }
         }

src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.SignalRQuota.cs

@@ -9,11 +9,13 @@ using Microsoft.Extensions.Logging;
 namespace AutopilotMonitor.Functions.Services
 {
     /// <summary>
-    /// SignalR Free-tier quota watcher. Reads ConnectionCount (max over the last
-    /// hour) and MessageCount (total since UTC midnight) from Azure Monitor and
-    /// emits tiered OpsEvents when either approaches the documented Free-tier
-    /// caps - 20 concurrent connections and 20,000 messages per day. The
-    /// operator can then scale to Standard before clients get 429'd.
+    /// SignalR quota watcher. Reads ConnectionCount (max over the last hour)
+    /// and MessageCount (total since UTC midnight) from Azure Monitor and
+    /// emits tiered OpsEvents when either approaches the plan caps - on
+    /// Standard S1 that is 1,000 concurrent connections per unit (hard limit,
+    /// excess connections are rejected) and 1M messages per unit per day
+    /// (included quota; overage is billed, not throttled). The operator can
+    /// then add units before clients get 429'd or overage costs accumulate.
     ///
     /// Globally scoped (TenantId = null) - SignalR is one shared resource for
     /// the whole Function App, not a per-tenant concern.
@@ -25,12 +27,12 @@ namespace AutopilotMonitor.Functions.Services
         internal const int SignalRQuotaCriticalPercent = 95;
         internal const int SignalRQuotaWarningPercent = 80;
 
-        // Default Free-tier caps as documented by Microsoft. Overridable via
-        // app settings so an operator who has scaled to a paid tier can re-target
-        // the watcher without a code change (or disable it by setting the cap
-        // very high).
-        internal const int DefaultSignalRConnectionLimit = 20;
-        internal const long DefaultSignalRDailyMessageLimit = 20_000;
+        // Default caps for Standard S1 with one unit, as documented by Microsoft.
+        // Overridable via app settings so an operator who adds units or changes
+        // tier can re-target the watcher without a code change (or disable it by
+        // setting the cap very high).
+        internal const int DefaultSignalRConnectionLimit = 1_000;
+        internal const long DefaultSignalRDailyMessageLimit = 1_000_000;
 
         // Dedup prefix - all SignalR EventTypes start with this, so the seen-index
         // can be built with a single Security-category read.
@@ -59,7 +61,7 @@ namespace AutopilotMonitor.Functions.Services
 
         /// <summary>
         /// Reads SignalR ConnectionCount + MessageCount metrics from Azure Monitor
-        /// and emits Warning/Error OpsEvents when the Free-tier limits are
+        /// and emits Warning/Error OpsEvents when the plan limits are
         /// approached. Dedup: one event per EventType per UTC day. Fail-soft -
         /// missing config or Azure Monitor errors yield a single log line, never
         /// a thrown exception.
@@ -75,9 +77,9 @@ namespace AutopilotMonitor.Functions.Services
             }
 
             var connectionLimit = ParseIntSetting(
-                "SignalRFreeTierConnectionLimit", DefaultSignalRConnectionLimit);
+                "SignalRConnectionLimit", DefaultSignalRConnectionLimit);
             var messageLimit = ParseLongSetting(
-                "SignalRFreeTierDailyMessageLimit", DefaultSignalRDailyMessageLimit);
+                "SignalRDailyMessageLimit", DefaultSignalRDailyMessageLimit);
 
             var seenToday = await BuildSignalRQuotaSeenIndexAsync();
 

src/Backend/AutopilotMonitor.Functions/Services/OpsEventService.cs

@@ -310,25 +310,25 @@ namespace AutopilotMonitor.Functions.Services
 
         public Task RecordSignalRConnectionsHighAsync(int observed, int limit, int percent, string resourceId)
             => WriteAsync(OpsEventCategory.Security, "SignalRConnectionsHigh", OpsEventSeverity.Warning,
-                $"SignalR concurrent connections at {percent}% of free-tier limit ({observed}/{limit}) - watch for 429s; consider scaling to Standard before saturation",
+                $"SignalR concurrent connections at {percent}% of plan limit ({observed}/{limit}) - watch for 429s; consider adding units before saturation",
                 null, "System.Monitoring",
                 new { metric = "ConnectionCount", aggregation = "Maximum", windowMinutes = 60, observed, limit, percent, resourceId });
 
         public Task RecordSignalRConnectionsCriticalAsync(int observed, int limit, int percent, string resourceId)
             => WriteAsync(OpsEventCategory.Security, "SignalRConnectionsCritical", OpsEventSeverity.Error,
-                $"CRITICAL: SignalR concurrent connections at {percent}% of free-tier limit ({observed}/{limit}) - new client connections will be 429'd at 100%; scale to Standard now",
+                $"CRITICAL: SignalR concurrent connections at {percent}% of plan limit ({observed}/{limit}) - new client connections will be 429'd at 100%; add units now",
                 null, "System.Monitoring",
                 new { metric = "ConnectionCount", aggregation = "Maximum", windowMinutes = 60, observed, limit, percent, resourceId });
 
         public Task RecordSignalRMessagesHighAsync(long observed, long limit, int percent, string resourceId)
             => WriteAsync(OpsEventCategory.Security, "SignalRMessagesHigh", OpsEventSeverity.Warning,
-                $"SignalR daily message count at {percent}% of free-tier limit ({observed}/{limit}) - quota resets at 00:00 UTC; consider scaling if pattern persists",
+                $"SignalR daily message count at {percent}% of included plan quota ({observed}/{limit}) - resets at 00:00 UTC; overage is billed per extra million messages",
                 null, "System.Monitoring",
                 new { metric = "MessageCount", aggregation = "Total", windowDay = "UTC", observed, limit, percent, resourceId });
 
         public Task RecordSignalRMessagesCriticalAsync(long observed, long limit, int percent, string resourceId)
             => WriteAsync(OpsEventCategory.Security, "SignalRMessagesCritical", OpsEventSeverity.Error,
-                $"CRITICAL: SignalR daily message count at {percent}% of free-tier limit ({observed}/{limit}) - hub will throttle at 100% until 00:00 UTC reset; scale to Standard now",
+                $"CRITICAL: SignalR daily message count at {percent}% of included plan quota ({observed}/{limit}) - overage beyond 100% is billed per extra million messages; review traffic or add units",
                 null, "System.Monitoring",
                 new { metric = "MessageCount", aggregation = "Total", windowDay = "UTC", observed, limit, percent, resourceId });
 

src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Rules.cs

@@ -158,6 +158,9 @@ namespace AutopilotMonitor.Functions.Services
                     ["IntervalSeconds"] = rule.IntervalSeconds,
                     ["TriggerPhase"] = rule.TriggerPhase ?? string.Empty,
                     ["TriggerEventType"] = rule.TriggerEventType ?? string.Empty,
+                    ["ActivePhasesJson"] = JsonConvert.SerializeObject(rule.ActivePhases ?? new List<string>()),
+                    ["ActiveFromPhase"] = rule.ActiveFromPhase ?? string.Empty,
+                    ["EmitMode"] = rule.EmitMode ?? string.Empty,
                     ["OutputEventType"] = rule.OutputEventType ?? string.Empty,
                     ["OutputSeverity"] = rule.OutputSeverity ?? "Info",
                     ["TagsJson"] = JsonConvert.SerializeObject(rule.Tags ?? new string[0]),
@@ -222,7 +225,9 @@ namespace AutopilotMonitor.Functions.Services
             }
         }
 
-        private GatherRule MapToGatherRule(TableEntity entity)
+        // Internal (not private) so the Store↔Map roundtrip is testable per the
+        // table-serialization rule: every model field must appear in BOTH directions.
+        internal GatherRule MapToGatherRule(TableEntity entity)
         {
             return new GatherRule
             {
@@ -244,6 +249,9 @@ namespace AutopilotMonitor.Functions.Services
                 IntervalSeconds = entity.GetInt32("IntervalSeconds"),
                 TriggerPhase = entity.GetString("TriggerPhase") ?? string.Empty,
                 TriggerEventType = entity.GetString("TriggerEventType") ?? string.Empty,
+                ActivePhases = MapActivePhases(entity.GetString("ActivePhasesJson")),
+                ActiveFromPhase = string.IsNullOrEmpty(entity.GetString("ActiveFromPhase")) ? null : entity.GetString("ActiveFromPhase"),
+                EmitMode = string.IsNullOrEmpty(entity.GetString("EmitMode")) ? null : entity.GetString("EmitMode"),
                 OutputEventType = entity.GetString("OutputEventType") ?? string.Empty,
                 OutputSeverity = entity.GetString("OutputSeverity") ?? "Info",
                 Tags = DeserializeJsonArray(entity.GetString("TagsJson")),
@@ -252,6 +260,17 @@ namespace AutopilotMonitor.Functions.Services
             };
         }
 
+        /// <summary>
+        /// Absent column (pre-existing rows) and the stored-empty "[]" both map to null —
+        /// null and empty are the same "unrestricted" state on <see cref="GatherRule.ActivePhases"/>,
+        /// and null keeps <see cref="GatherRuleService.ContentEquivalent"/> reseed-stable.
+        /// </summary>
+        private List<string>? MapActivePhases(string? json)
+        {
+            var phases = DeserializeJson<List<string>>(json);
+            return phases.Count == 0 ? null : phases;
+        }
+
         // ===== RULE STATES METHODS =====
 
         /// <summary>

src/Backend/AutopilotMonitor.Functions/local.settings.json.template

@@ -6,9 +6,9 @@
     "AzureTableStorageConnectionString": "UseDevelopmentStorage=true",
     "AzureBlobStorageConnectionString": "UseDevelopmentStorage=true",
 
-    "// SignalR free-tier quota watcher": "Optional. Set to the full Azure resource id of the SignalR Service to enable hourly OpsEvents when the 20-connections / 20k-messages-per-day free-tier limits are approached. Function App's managed identity needs 'Monitoring Reader' on this resource. Leave unset to skip the watcher.",
+    "// SignalR quota watcher": "Optional. Set to the full Azure resource id of the SignalR Service to enable hourly OpsEvents when the plan limits are approached (defaults: Standard S1 x1 unit = 1000 connections / 1M messages per day; override the limits when adding units or changing tier). Function App's managed identity needs 'Monitoring Reader' on this resource. Leave unset to skip the watcher.",
     "SignalRResourceId": "",
-    "SignalRFreeTierConnectionLimit": "20",
-    "SignalRFreeTierDailyMessageLimit": "20000"
+    "SignalRConnectionLimit": "1000",
+    "SignalRDailyMessageLimit": "1000000"
   }
 }

src/Shared/AutopilotMonitor.Shared/Constants.cs

@@ -73,19 +73,32 @@ namespace AutopilotMonitor.Shared
         public const string ApiBaseUrl = "https://autopilotmonitor-api-eu.azurewebsites.net";
 
         /// <summary>
-        /// Public base URL of the MCP server Container App (no trailing slash, no /mcp suffix).
-        /// Used by the backend health check to probe <c>{McpServerBaseUrl}/health</c>. The
-        /// Container App runs with minReplicas=0, so the first probe after idle may incur a
-        /// cold start. Overridable via the <c>McpServerUrl</c> app setting (e.g. for dev).
+        /// Public base URL of the MCP server (no trailing slash, no /mcp suffix). Stable custom
+        /// domain in front of the Container App — survives region/environment moves, unlike the
+        /// generated *.azurecontainerapps.io FQDN. Used by the backend health check to probe
+        /// <c>{McpServerBaseUrl}/health</c>. The Container App runs with minReplicas=0, so the
+        /// first probe after idle may incur a cold start. Overridable via the
+        /// <c>McpServerUrl</c> app setting (e.g. for dev).
         /// </summary>
-        public const string McpServerBaseUrl = "https://autopilotmonitor-mcp.kindwave-58b4b547.westeurope.azurecontainerapps.io";
+        public const string McpServerBaseUrl = "https://mcp.autopilotmonitor.com";
 
         // -----------------------------------------------------------------------
         // Agent self-update
         // -----------------------------------------------------------------------
 
         /// <summary>
-        /// Base URL for agent binaries in Azure Blob Storage (public read)
+        /// Canonical public base URL for agent binaries: Front Door alias in front of the
+        /// current blob origin (autopilotmonitoreu, container "agent"). Storage-account moves
+        /// happen behind this name without touching customers. New bootstrap scripts and all
+        /// availability probes use this URL.
+        /// </summary>
+        public const string AgentDownloadBaseUrl = "https://download.autopilotmonitor.com/agent";
+
+        /// <summary>
+        /// LEGACY base URL for agent binaries: the pre-migration storage account, kept alive
+        /// (dual-push on every release) because bootstrap scripts already deployed in customer
+        /// Intune tenants still download from it. Remove only after the customer migration to
+        /// <see cref="AgentDownloadBaseUrl"/> is complete and the legacy account is torn down.
         /// </summary>
         public const string AgentBlobBaseUrl = "https://autopilotmonitor.blob.core.windows.net/agent";
 

src/Shared/AutopilotMonitor.Shared/Models/Config/AdminConfiguration.cs

@@ -324,6 +324,57 @@ namespace AutopilotMonitor.Shared.Models
             }
         }
 
+        // ===== AGENT ENDPOINT MIGRATION (config-channel re-home) =====
+        // The agent's API base URL is compiled into the binary (no custom domain possible in
+        // front of the API — mTLS breaks behind a proxy, Flex custom-domain TLS is broken).
+        // These settings let the OLD backend re-home agents to a NEW base URL via the
+        // agent/config response during a backend or per-tenant region move. Values are
+        // validated against AgentEndpointMigrationRules before being served; invalid values
+        // are logged and ignored (fail-safe: no migration).
+
+        /// <summary>
+        /// Global migration target served to ALL agents as
+        /// <c>AgentConfigResponse.MigrateToApiBaseUrl</c> (e.g.
+        /// "https://autopilotmonitor-api-us.azurewebsites.net"). Empty = no global migration.
+        /// Set this on the backend being ABANDONED; clear it once the migration window closes.
+        /// Per-tenant overrides in <see cref="AgentMigrateTenantOverridesJson"/> win over this.
+        /// </summary>
+        public string AgentMigrateApiBaseUrl { get; set; } = string.Empty;
+
+        /// <summary>
+        /// JSON object mapping tenantId → migration target URL for per-tenant moves (e.g. one
+        /// tenant relocating EU→US). An entry with an EMPTY string value pins that tenant to
+        /// the current backend even while <see cref="AgentMigrateApiBaseUrl"/> is set (staged
+        /// rollout). Example:
+        /// <c>{"11111111-...": "https://autopilotmonitor-api-us.azurewebsites.net", "22222222-...": ""}</c>
+        /// </summary>
+        public string AgentMigrateTenantOverridesJson { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Returns the deserialized per-tenant migration overrides (case-insensitive tenant
+        /// keys). Falls back to an empty map for null/empty/invalid JSON so a malformed value
+        /// degrades to "global setting applies" instead of failing config serving.
+        /// </summary>
+        public Dictionary<string, string> GetAgentMigrateTenantOverrides()
+        {
+            var empty = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (string.IsNullOrWhiteSpace(AgentMigrateTenantOverridesJson))
+                return empty;
+            try
+            {
+                var parsed = JsonSerializer.Deserialize<Dictionary<string, string>>(
+                    AgentMigrateTenantOverridesJson,
+                    new JsonSerializerOptions { PropertyNameCaseInsensitive = true });
+                return parsed == null
+                    ? empty
+                    : new Dictionary<string, string>(parsed, StringComparer.OrdinalIgnoreCase);
+            }
+            catch
+            {
+                return empty;
+            }
+        }
+
         // ===== MODERN DEPLOYMENT NOISE SUPPRESSION =====
 
         /// <summary>

src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs

@@ -231,6 +231,18 @@ namespace AutopilotMonitor.Shared.Models
         /// null = indefinite (or kill).
         /// </summary>
         public System.DateTime? UnblockAt { get; set; }
+
+        /// <summary>
+        /// Endpoint migration on the control channel: when set, the agent abandons its
+        /// compiled-in API base URL and re-runs backend-client construction + config fetch
+        /// against this URL (backend move without a custom domain in front of the API, or a
+        /// per-tenant region move). Honoured only from a LIVE fetch (the on-disk cache strips
+        /// the field on write and read), validated against
+        /// <c>AgentEndpointMigrationRules</c> on both sides, single hop (the re-fetched
+        /// config cannot chain another migration), and a kill signal always wins over it.
+        /// Old binaries ignore the field. null = no migration.
+        /// </summary>
+        public string? MigrateToApiBaseUrl { get; set; }
     }
 
     /// <summary>

src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs

@@ -128,6 +128,38 @@ namespace AutopilotMonitor.Shared.Models
         /// </summary>
         public string TriggerEventType { get; set; } = default!;
 
+        /// <summary>
+        /// Restricts the rule to run only while the current enrollment phase is one of these
+        /// phases. Canonical tokens are the <see cref="EnrollmentPhase"/> enum names
+        /// ("Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup",
+        /// "AppsUser", "FinalizingSetup", "Complete"); "Unknown" and "Failed" are rejected
+        /// by backend validation. Null or empty = unrestricted (runs in every phase —
+        /// legacy behavior). Mutually exclusive with <see cref="ActiveFromPhase"/>;
+        /// if both are set the agent defensively prefers this list.
+        /// Applies to ALL trigger types. Before the first phase signal of a session,
+        /// scoped rules are inactive.
+        /// </summary>
+        public List<string>? ActivePhases { get; set; }
+
+        /// <summary>
+        /// Activates the rule once the enrollment phase first reaches this phase
+        /// (ordinal comparison on <see cref="EnrollmentPhase"/>, ignoring Unknown/Failed),
+        /// then keeps it active for the rest of the session (sticky latch — including
+        /// through Failed). Canonical tokens as in <see cref="ActivePhases"/>.
+        /// Null = unrestricted. Mutually exclusive with <see cref="ActivePhases"/>.
+        /// </summary>
+        public string? ActiveFromPhase { get; set; }
+
+        /// <summary>
+        /// Emit behavior for collected results:
+        /// null / "always" = emit on every collection (legacy behavior);
+        /// "on_change" = poll on the trigger cadence but emit only when the collected
+        /// result differs from the last emitted one. The first in-scope result always
+        /// emits; the suppressed poll count is carried on the next emitted event
+        /// (suppressedPolls / suppressedSinceUtc in the event data).
+        /// </summary>
+        public string? EmitMode { get; set; }
+
         // ===== OUTPUT =====
 
         /// <summary>

src/Shared/AutopilotMonitor.Shared/Services/AgentEndpointMigrationRules.cs

@@ -0,0 +1,100 @@
+using System;
+
+namespace AutopilotMonitor.Shared.Services
+{
+    /// <summary>
+    /// Validation rules for the config-channel agent endpoint migration target
+    /// (<c>AgentConfigResponse.MigrateToApiBaseUrl</c>). Single source of truth used by BOTH
+    /// sides — the backend refuses to serve an invalid target, the agent refuses to honour
+    /// one — so a misconfigured admin value or a tampered response can never re-home agents
+    /// to an arbitrary host (defence in depth, same philosophy as the kill-switch hardening).
+    /// </summary>
+    public static class AgentEndpointMigrationRules
+    {
+        /// <summary>
+        /// Host suffixes a migration target may resolve to. Deliberately narrow: the platform
+        /// only ever runs its API on Azure Functions default hostnames (a custom domain in
+        /// front of the API is impossible — mTLS client-cert auth does not survive a proxy,
+        /// and Flex Consumption custom-domain TLS is broken). Extend here if that ever changes;
+        /// old agent builds keep their compiled-in list, so plan one release of lead time.
+        /// </summary>
+        public static readonly string[] AllowedHostSuffixes = { ".azurewebsites.net" };
+
+        /// <summary>Defensive cap — a legitimate Functions hostname URL is far shorter.</summary>
+        public const int MaxTargetLength = 200;
+
+        /// <summary>
+        /// Validates <paramref name="candidate"/> as a migration target and returns the
+        /// normalized base URL (<c>https://{lowercase-host}</c>, no trailing slash) on success.
+        /// Rules: absolute https URI, default port, no userinfo/path/query/fragment, host
+        /// matching <see cref="AllowedHostSuffixes"/>.
+        /// </summary>
+        public static bool TryNormalizeTarget(string candidate, out string normalized)
+        {
+            normalized = null;
+
+            if (string.IsNullOrWhiteSpace(candidate) || candidate.Length > MaxTargetLength)
+                return false;
+
+            if (!Uri.TryCreate(candidate.Trim(), UriKind.Absolute, out var uri))
+                return false;
+
+            if (!string.Equals(uri.Scheme, Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase))
+                return false;
+
+            if (!uri.IsDefaultPort)
+                return false;
+
+            if (!string.IsNullOrEmpty(uri.UserInfo))
+                return false;
+
+            // Base URL only — endpoint paths are appended by the agent's clients.
+            if (uri.AbsolutePath != "/" || !string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))
+                return false;
+
+            var host = uri.Host;
+            var allowed = false;
+            foreach (var suffix in AllowedHostSuffixes)
+            {
+                // Suffix match must sit on a label boundary and leave a non-empty prefix:
+                // "evil-azurewebsites.net" and ".azurewebsites.net" itself are both rejected.
+                if (host.Length > suffix.Length
+                    && host.EndsWith(suffix, StringComparison.OrdinalIgnoreCase))
+                {
+                    allowed = true;
+                    break;
+                }
+            }
+            if (!allowed)
+                return false;
+
+            normalized = "https://" + host.ToLowerInvariant();
+            return true;
+        }
+
+        /// <summary>
+        /// <c>true</c> when <paramref name="candidate"/> is a valid target that actually
+        /// differs from <paramref name="currentBaseUrl"/> (both compared in normalized form —
+        /// serving the agent its own current URL is a no-op, not a migration).
+        /// </summary>
+        public static bool IsEffectiveMigration(string candidate, string currentBaseUrl, out string normalizedTarget)
+        {
+            normalizedTarget = null;
+
+            if (!TryNormalizeTarget(candidate, out var target))
+                return false;
+
+            // The current base URL may not itself pass the allowlist (dev --api-url override);
+            // fall back to a plain trim-and-lower comparison in that case.
+            var currentNormalized = TryNormalizeTarget(currentBaseUrl, out var normCurrent)
+                ? normCurrent
+                : (currentBaseUrl ?? string.Empty).Trim().TrimEnd('/').ToLowerInvariant();
+
+            if (string.Equals(target, currentNormalized, StringComparison.OrdinalIgnoreCase))
+                return false;
+
+            normalizedTarget = target;
+            return true;
+        }
+    }
+}

src/Web/autopilot-monitor-web/app/admin/AdminConfigContext.tsx

@@ -26,6 +26,10 @@ interface AdminConfigContextValue {
   setGlobalAdminRateLimit: (value: number) => void;
   platformStatsBlobSasUrl: string;
   setPlatformStatsBlobSasUrl: (value: string) => void;
+  agentMigrateApiBaseUrl: string;
+  setAgentMigrateApiBaseUrl: (value: string) => void;
+  agentMigrateTenantOverridesJson: string;
+  setAgentMigrateTenantOverridesJson: (value: string) => void;
   collectorIdleTimeoutMinutes: number;
   setCollectorIdleTimeoutMinutes: (value: number) => void;
   desktopDetectorNoCandidateTimeoutMinutes: number;
@@ -130,6 +134,8 @@ export function AdminConfigProvider({ children }: { children: React.ReactNode })
   const [userRateLimit, setUserRateLimit] = useState(120);
   const [globalAdminRateLimit, setGlobalAdminRateLimit] = useState(600);
   const [platformStatsBlobSasUrl, setPlatformStatsBlobSasUrl] = useState("");
+  const [agentMigrateApiBaseUrl, setAgentMigrateApiBaseUrl] = useState("");
+  const [agentMigrateTenantOverridesJson, setAgentMigrateTenantOverridesJson] = useState("");
   const [collectorIdleTimeoutMinutes, setCollectorIdleTimeoutMinutes] = useState(15);
   const [desktopDetectorNoCandidateTimeoutMinutes, setDesktopDetectorNoCandidateTimeoutMinutes] = useState(10);
   const [maxSessionWindowHours, setMaxSessionWindowHours] = useState(24);
@@ -191,6 +197,8 @@ export function AdminConfigProvider({ children }: { children: React.ReactNode })
         setUserRateLimit(data.userRateLimitRequestsPerMinute ?? 120);
         setGlobalAdminRateLimit(data.globalAdminRateLimitRequestsPerMinute ?? 600);
         setPlatformStatsBlobSasUrl(data.platformStatsBlobSasUrl ?? "");
+        setAgentMigrateApiBaseUrl(data.agentMigrateApiBaseUrl ?? "");
+        setAgentMigrateTenantOverridesJson(data.agentMigrateTenantOverridesJson ?? "");
         setCollectorIdleTimeoutMinutes(data.collectorIdleTimeoutMinutes ?? 15);
         setDesktopDetectorNoCandidateTimeoutMinutes(data.desktopDetectorNoCandidateTimeoutMinutes ?? 10);
         setMaxSessionWindowHours(data.maxSessionWindowHours ?? 24);
@@ -296,6 +304,8 @@ export function AdminConfigProvider({ children }: { children: React.ReactNode })
         userRateLimitRequestsPerMinute: userRateLimit,
         globalAdminRateLimitRequestsPerMinute: globalAdminRateLimit,
         platformStatsBlobSasUrl: platformStatsBlobSasUrl.trim(),
+        agentMigrateApiBaseUrl: agentMigrateApiBaseUrl.trim(),
+        agentMigrateTenantOverridesJson: agentMigrateTenantOverridesJson.trim(),
         collectorIdleTimeoutMinutes,
         desktopDetectorNoCandidateTimeoutMinutes,
         maxSessionWindowHours,
@@ -332,7 +342,7 @@ export function AdminConfigProvider({ children }: { children: React.ReactNode })
     } finally {
       setSavingConfig(false);
     }
-  }, [isGlobalAdmin, adminConfig, globalRateLimit, userRateLimit, globalAdminRateLimit, platformStatsBlobSasUrl, collectorIdleTimeoutMinutes, desktopDetectorNoCandidateTimeoutMinutes, maxSessionWindowHours, maintenanceBlockDurationHours, opsEventRetentionDays, slaNotificationCooldownHours, allowAgentDowngrade, modernDeploymentHarmlessEventIds, enableIndexDualWrite, sessionDeletionKillSwitch, getAccessToken]);
+  }, [isGlobalAdmin, adminConfig, globalRateLimit, userRateLimit, globalAdminRateLimit, platformStatsBlobSasUrl, agentMigrateApiBaseUrl, agentMigrateTenantOverridesJson, collectorIdleTimeoutMinutes, desktopDetectorNoCandidateTimeoutMinutes, maxSessionWindowHours, maintenanceBlockDurationHours, opsEventRetentionDays, slaNotificationCooldownHours, allowAgentDowngrade, modernDeploymentHarmlessEventIds, enableIndexDualWrite, sessionDeletionKillSwitch, getAccessToken]);
 
   // Reset admin config
   const handleResetAdminConfig = useCallback(() => {
@@ -341,6 +351,8 @@ export function AdminConfigProvider({ children }: { children: React.ReactNode })
     setUserRateLimit(adminConfig.userRateLimitRequestsPerMinute ?? 120);
     setGlobalAdminRateLimit(adminConfig.globalAdminRateLimitRequestsPerMinute ?? 600);
     setPlatformStatsBlobSasUrl(adminConfig.platformStatsBlobSasUrl ?? "");
+    setAgentMigrateApiBaseUrl(adminConfig.agentMigrateApiBaseUrl ?? "");
+    setAgentMigrateTenantOverridesJson(adminConfig.agentMigrateTenantOverridesJson ?? "");
     setCollectorIdleTimeoutMinutes(adminConfig.collectorIdleTimeoutMinutes ?? 15);
     setDesktopDetectorNoCandidateTimeoutMinutes(adminConfig.desktopDetectorNoCandidateTimeoutMinutes ?? 10);
     setMaxSessionWindowHours(adminConfig.maxSessionWindowHours ?? 24);
@@ -485,6 +497,8 @@ export function AdminConfigProvider({ children }: { children: React.ReactNode })
       userRateLimit, setUserRateLimit,
       globalAdminRateLimit, setGlobalAdminRateLimit,
       platformStatsBlobSasUrl, setPlatformStatsBlobSasUrl,
+      agentMigrateApiBaseUrl, setAgentMigrateApiBaseUrl,
+      agentMigrateTenantOverridesJson, setAgentMigrateTenantOverridesJson,
       collectorIdleTimeoutMinutes, setCollectorIdleTimeoutMinutes,
       desktopDetectorNoCandidateTimeoutMinutes, setDesktopDetectorNoCandidateTimeoutMinutes,
       maxSessionWindowHours, setMaxSessionWindowHours,

src/Web/autopilot-monitor-web/app/admin/components/AdminConfigSettingsSection.tsx

@@ -14,6 +14,10 @@ interface AdminConfigSettingsSectionProps {
   setGlobalAdminRateLimit: (value: number) => void;
   platformStatsBlobSasUrl: string;
   setPlatformStatsBlobSasUrl: (value: string) => void;
+  agentMigrateApiBaseUrl: string;
+  setAgentMigrateApiBaseUrl: (value: string) => void;
+  agentMigrateTenantOverridesJson: string;
+  setAgentMigrateTenantOverridesJson: (value: string) => void;
   collectorIdleTimeoutMinutes: number;
   setCollectorIdleTimeoutMinutes: (value: number) => void;
   desktopDetectorNoCandidateTimeoutMinutes: number;
@@ -44,6 +48,10 @@ export function AdminConfigSettingsSection({
   setGlobalAdminRateLimit,
   platformStatsBlobSasUrl,
   setPlatformStatsBlobSasUrl,
+  agentMigrateApiBaseUrl,
+  setAgentMigrateApiBaseUrl,
+  agentMigrateTenantOverridesJson,
+  setAgentMigrateTenantOverridesJson,
   collectorIdleTimeoutMinutes,
   setCollectorIdleTimeoutMinutes,
   desktopDetectorNoCandidateTimeoutMinutes,
@@ -155,6 +163,43 @@ export function AdminConfigSettingsSection({
               </label>
             </div>
 
+            <div>
+              <label className="block">
+                <span className="text-indigo-900 dark:text-indigo-100 font-medium">Agent Endpoint Migration Target (Global)</span>
+                <p className="text-sm text-indigo-800 dark:text-gray-300 mb-2">
+                  When set, this backend serves the URL as <code className="text-xs bg-indigo-100 dark:bg-indigo-900 dark:text-indigo-200 px-1 rounded">MigrateToApiBaseUrl</code> on
+                  the agent config channel and agents re-home themselves to the new API at their next start.
+                  Only <code className="text-xs bg-indigo-100 dark:bg-indigo-900 dark:text-indigo-200 px-1 rounded">https://*.azurewebsites.net</code> base
+                  URLs are accepted (validated server- AND agent-side). Set this on the backend being <strong>abandoned</strong>; clear it after the migration window.
+                </p>
+                <input
+                  type="url"
+                  value={agentMigrateApiBaseUrl}
+                  onChange={(e) => setAgentMigrateApiBaseUrl(e.target.value)}
+                  placeholder="https://autopilotmonitor-api-us.azurewebsites.net"
+                  className="mt-1 block w-full px-4 py-2 border border-indigo-300 dark:border-indigo-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 placeholder-gray-400 dark:placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors font-mono text-sm"
+                />
+              </label>
+            </div>
+
+            <div>
+              <label className="block">
+                <span className="text-indigo-900 dark:text-indigo-100 font-medium">Agent Endpoint Migration &mdash; Per-Tenant Overrides (JSON)</span>
+                <p className="text-sm text-indigo-800 dark:text-gray-300 mb-2">
+                  JSON object mapping tenantId to a target URL for per-tenant region moves (e.g. one tenant EU&rarr;US).
+                  An entry with an <strong>empty string</strong> value pins that tenant to this backend even while the global target above is set (staged rollout).
+                  Overrides win over the global target.
+                </p>
+                <textarea
+                  value={agentMigrateTenantOverridesJson}
+                  onChange={(e) => setAgentMigrateTenantOverridesJson(e.target.value)}
+                  placeholder='{"11111111-2222-3333-4444-555555555555": "https://autopilotmonitor-api-us.azurewebsites.net", "66666666-7777-8888-9999-000000000000": ""}'
+                  rows={3}
+                  className="mt-1 block w-full px-4 py-2 border border-indigo-300 dark:border-indigo-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 placeholder-gray-400 dark:placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors font-mono text-sm"
+                />
+              </label>
+            </div>
+
             <div>
               <label className="block">
                 <span className="text-indigo-900 dark:text-indigo-100 font-medium">Collector Idle Timeout (Minutes)</span>

src/Web/autopilot-monitor-web/app/admin/settings/sections/SectionGlobalSettings.tsx

@@ -11,6 +11,8 @@ export function SectionGlobalSettings() {
     userRateLimit, setUserRateLimit,
     globalAdminRateLimit, setGlobalAdminRateLimit,
     platformStatsBlobSasUrl, setPlatformStatsBlobSasUrl,
+    agentMigrateApiBaseUrl, setAgentMigrateApiBaseUrl,
+    agentMigrateTenantOverridesJson, setAgentMigrateTenantOverridesJson,
     collectorIdleTimeoutMinutes, setCollectorIdleTimeoutMinutes,
     desktopDetectorNoCandidateTimeoutMinutes, setDesktopDetectorNoCandidateTimeoutMinutes,
     slaNotificationCooldownHours, setSlaNotificationCooldownHours,
@@ -36,6 +38,10 @@ export function SectionGlobalSettings() {
         setGlobalAdminRateLimit={setGlobalAdminRateLimit}
         platformStatsBlobSasUrl={platformStatsBlobSasUrl}
         setPlatformStatsBlobSasUrl={setPlatformStatsBlobSasUrl}
+        agentMigrateApiBaseUrl={agentMigrateApiBaseUrl}
+        setAgentMigrateApiBaseUrl={setAgentMigrateApiBaseUrl}
+        agentMigrateTenantOverridesJson={agentMigrateTenantOverridesJson}
+        setAgentMigrateTenantOverridesJson={setAgentMigrateTenantOverridesJson}
         collectorIdleTimeoutMinutes={collectorIdleTimeoutMinutes}
         setCollectorIdleTimeoutMinutes={setCollectorIdleTimeoutMinutes}
         desktopDetectorNoCandidateTimeoutMinutes={desktopDetectorNoCandidateTimeoutMinutes}

src/Web/autopilot-monitor-web/app/apple-icon.tsx

@@ -1,7 +1,5 @@
 import { ImageResponse } from "next/og";
 
-export const runtime = "edge";
-
 export const size = { width: 180, height: 180 };
 export const contentType = "image/png";
 

src/Web/autopilot-monitor-web/app/dashboard/components/TipOfTheDay.tsx

@@ -14,7 +14,7 @@ const tips = [
   "Share the Progress Portal link with your team \u2014 anyone can check enrollment status by serial number.",
   "Missing an event in your sessions? Use Gather Rules to collect it.",
   "Analyze Rules are continuously refined \u2014 analysis results may shift as rules improve. This is normal.",
-  "Check Known Issues in the docs for external changes (e.g.\u00a0Microsoft updates) that may affect your data.",
+  "Check Service Announcements in the docs for external changes (e.g.\u00a0Microsoft updates) that may affect your data.",
   "Check the Intune bootstrap script (Install-AutopilotMonitor.ps1) from time to time \u2014 a newer version may be available in the repository.",
   "Spotted a session with the wrong status? Use Report Session to flag it to the team.",
 ];

src/Web/autopilot-monitor-web/app/dashboard/page.tsx

@@ -284,32 +284,6 @@ function HomeContent() {
       {/* Main content */}
       <main className={mainClassName}>
         <div className="px-4 sm:px-0">
-          {/* Scheduled maintenance banner — TEMPORARY, remove after 2026-07-20 */}
-          <div className="mb-4 bg-amber-50 border border-amber-300 rounded-lg px-4 py-3 flex items-start gap-3 dark:bg-amber-950/30 dark:border-amber-700/50">
-            <svg className="w-4 h-4 text-amber-500 mt-0.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-              <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
-            </svg>
-            <p className="text-sm text-amber-800 dark:text-amber-300">
-              <span className="font-semibold">Scheduled infrastructure maintenance.</span>{" "}
-              The platform is <span className="font-medium">not available</span> this weekend, from{" "}
-              <span className="font-medium">Sat 18 Jul, 00:00</span> until{" "}
-              <span className="font-medium">Mon 20 Jul, 00:00 CEST (UTC+2)</span> (expected).{" "}
-              The portal cannot be reached and the ingestion API is offline. Agents continue collecting
-              locally and re-sync once the platform is back online — no enrollment data is lost.
-              If the work finishes early, the platform will come back sooner; the completion will be
-              announced here and in the{" "}
-              <a
-                href="https://docs.autopilotmonitor.com/troubleshooting/service-announcements"
-                target="_blank"
-                rel="noopener noreferrer"
-                className="underline font-medium hover:text-amber-600 dark:hover:text-amber-200"
-              >
-                Service Announcements
-              </a>
-              .
-            </p>
-          </div>
-
           {/* Feedback & bug report banner */}
           <div className="mb-4 bg-blue-50 border border-blue-300 rounded-lg px-4 py-3 flex items-start gap-3 dark:bg-blue-950/30 dark:border-blue-700/50">
             <svg className="w-4 h-4 text-blue-500 mt-0.5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -334,7 +308,7 @@ function HomeContent() {
                 rel="noopener noreferrer"
                 className="underline font-medium hover:text-blue-600 dark:hover:text-blue-200"
               >
-                Known Issues
+                Service Announcements
               </a>
               .{" "}
               Feedback or bug report?{" "}

src/Web/autopilot-monitor-web/app/gather-rules/components/GatherRuleCard.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useMemo, useState } from "react";
-import { GatherRule, NewRuleForm, CATEGORY_COLORS, COLLECTOR_TYPE_LABELS, EMPTY_FORM, formatTrigger } from "../types";
+import { GatherRule, NewRuleForm, CATEGORY_COLORS, COLLECTOR_TYPE_LABELS, EMPTY_FORM, formatTrigger, formatGatherPhase, withDerivedScopeMode } from "../types";
 import { GatherRuleFormFields } from "./GatherRuleFormFields";
 import { FormJsonToggle, JsonModeToggleButtons, ReadOnlyJsonView } from "@/components/rules/FormJsonToggle";
 import { validateGatherRuleTarget } from "@/utils/guardValidation";
@@ -301,6 +301,19 @@ export function GatherRuleCard({
                     on event: <code className="px-1 bg-gray-200 rounded text-xs">{rule.triggerEventType}</code>
                   </span>
                 )}
+                {rule.activePhases && rule.activePhases.length > 0 && (
+                  <span className="text-gray-500">
+                    · during {rule.activePhases.map(formatGatherPhase).join(", ")}
+                  </span>
+                )}
+                {!rule.activePhases?.length && rule.activeFromPhase && (
+                  <span className="text-gray-500">
+                    · from {formatGatherPhase(rule.activeFromPhase)}
+                  </span>
+                )}
+                {rule.emitMode === "on_change" && (
+                  <span className="text-gray-500">· emit on change</span>
+                )}
               </div>
             </div>
           </div>
@@ -430,7 +443,7 @@ export function GatherRuleCard({
                 if (jsonModeEdit) {
                   try {
                     const parsed = JSON.parse(jsonText) as NewRuleForm;
-                    onSaveEdit(rule, { ...editForm, ...parsed });
+                    onSaveEdit(rule, withDerivedScopeMode({ ...editForm, ...parsed }));
                   } catch (e) {
                     // jsonError is handled by parent
                   }

src/Web/autopilot-monitor-web/app/gather-rules/components/GatherRuleFormFields.tsx

@@ -10,6 +10,8 @@ import {
   SEVERITIES,
   TARGET_PLACEHOLDERS,
   TARGET_HINTS,
+  GATHER_PHASES,
+  EMIT_MODES,
   formatTrigger,
 } from "../types";
 import { KNOWN_EVENT_TYPES, findEventType } from "../eventTypes";
@@ -426,14 +428,20 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
       {form.trigger === "phase_change" && (
         <div>
           <label className="block text-sm font-medium text-gray-700 mb-1">Trigger Phase</label>
-          <input
-            type="text"
+          <select
             value={form.triggerPhase}
             onChange={(e) => setForm({ ...form, triggerPhase: e.target.value })}
-            placeholder="e.g., DeviceESP, AccountESP, DevicePreparation"
-            autoComplete="off"
-            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
-          />
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            <option value="">Any phase change</option>
+            {form.triggerPhase && !GATHER_PHASES.some((p) => p.value === form.triggerPhase) && (
+              <option value={form.triggerPhase}>{form.triggerPhase} (legacy value)</option>
+            )}
+            {GATHER_PHASES.map((p) => (
+              <option key={p.value} value={p.value}>{p.label}</option>
+            ))}
+          </select>
+          <p className="text-xs text-gray-400 mt-1">Run this rule when the enrollment reaches this phase. &quot;Any phase change&quot; fires once per phase transition.</p>
         </div>
       )}
 
@@ -472,6 +480,89 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
         </div>
       )}
 
+      {/* Row: Active During (phase scope) + Emit Mode */}
+      <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Active During</label>
+          <select
+            value={form.scopeMode}
+            onChange={(e) => {
+              const scopeMode = e.target.value as NewRuleForm["scopeMode"];
+              // Keep the form state consistent: only the fields of the selected mode survive.
+              setForm({
+                ...form,
+                scopeMode,
+                activePhases: scopeMode === "during" ? form.activePhases : [],
+                activeFromPhase: scopeMode === "from" ? form.activeFromPhase : "",
+              });
+            }}
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            <option value="always">All phases (always)</option>
+            <option value="during">Only during specific phases</option>
+            <option value="from">From a phase onwards</option>
+          </select>
+          <p className="text-xs text-gray-400 mt-1">Restrict when this rule runs. Outside its scope the rule is idle — interval rules stop polling, triggers are ignored.</p>
+        </div>
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Emit Mode</label>
+          <select
+            value={form.emitMode}
+            onChange={(e) => setForm({ ...form, emitMode: e.target.value })}
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            {EMIT_MODES.map((m) => (
+              <option key={m.value} value={m.value}>{m.label}</option>
+            ))}
+          </select>
+          <p className="text-xs text-gray-400 mt-1">On change: polls on the trigger cadence but only emits an event when the collected result changes. The first collection always emits.</p>
+        </div>
+      </div>
+
+      {form.scopeMode === "during" && (
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Active Phases</label>
+          <div className="grid grid-cols-2 sm:grid-cols-4 gap-2">
+            {GATHER_PHASES.map((p) => (
+              <label key={p.value} className="flex items-center space-x-2 text-sm text-gray-700 cursor-pointer">
+                <input
+                  type="checkbox"
+                  checked={form.activePhases.includes(p.value)}
+                  onChange={(e) =>
+                    setForm({
+                      ...form,
+                      activePhases: e.target.checked
+                        ? [...form.activePhases, p.value]
+                        : form.activePhases.filter((x) => x !== p.value),
+                    })
+                  }
+                  className="rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                />
+                <span>{p.label}</span>
+              </label>
+            ))}
+          </div>
+          <p className="text-xs text-gray-400 mt-1">The rule runs only while the enrollment is in one of the selected phases. No selection = all phases.</p>
+        </div>
+      )}
+
+      {form.scopeMode === "from" && (
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Active From Phase</label>
+          <select
+            value={form.activeFromPhase}
+            onChange={(e) => setForm({ ...form, activeFromPhase: e.target.value })}
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            <option value="">Select a phase…</option>
+            {GATHER_PHASES.map((p) => (
+              <option key={p.value} value={p.value}>{p.label}</option>
+            ))}
+          </select>
+          <p className="text-xs text-gray-400 mt-1">Once the enrollment reaches this phase the rule activates and stays active for the rest of the session. No selection = all phases.</p>
+        </div>
+      )}
+
       {/* Row 3: Output Event Type, Output Severity */}
       <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
         <div>

src/Web/autopilot-monitor-web/app/gather-rules/page.tsx

@@ -16,7 +16,7 @@ import { FormJsonToggle, JsonModeToggleButtons } from "@/components/rules/FormJs
 import { useAuthenticatedFetch, useNotificationMessages, useGlobalAdminScope } from "@/hooks";
 import { GlobalAdminBanner, globalAdminSubtitle } from "@/components/GlobalAdminBanner";
 import { TenantScopeSelector } from "@/components/TenantScopeSelector";
-import { GatherRule, NewRuleForm, EMPTY_FORM, CATEGORY_COLORS } from "./types";
+import { GatherRule, NewRuleForm, EMPTY_FORM, CATEGORY_COLORS, withDerivedScopeMode } from "./types";
 import { GatherRuleFormFields } from "./components/GatherRuleFormFields";
 import { GatherRuleCard } from "./components/GatherRuleCard";
 
@@ -211,6 +211,9 @@ export default function GatherRulesPage() {
       intervalSeconds: form.trigger === "interval" ? form.intervalSeconds : null,
       triggerPhase: form.trigger === "phase_change" ? form.triggerPhase : null,
       triggerEventType: form.trigger === "on_event" ? form.triggerEventType : null,
+      activePhases: form.scopeMode === "during" && form.activePhases.length > 0 ? form.activePhases : null,
+      activeFromPhase: form.scopeMode === "from" && form.activeFromPhase ? form.activeFromPhase : null,
+      emitMode: form.emitMode || null,
       outputEventType: form.outputEventType,
       outputSeverity: form.outputSeverity,
     };
@@ -265,6 +268,12 @@ export default function GatherRulesPage() {
       intervalSeconds: rule.intervalSeconds || 60,
       triggerPhase: rule.triggerPhase || "",
       triggerEventType: rule.triggerEventType || "",
+      scopeMode: rule.activePhases?.length ? "during" : rule.activeFromPhase ? "from" : "always",
+      activePhases: rule.activePhases || [],
+      activeFromPhase: rule.activeFromPhase || "",
+      // Existing rules without the field keep today's behavior ("always") — the on_change
+      // default applies to NEW rules only.
+      emitMode: rule.emitMode === "on_change" ? "on_change" : "always",
       outputEventType: rule.outputEventType,
       outputSeverity: rule.outputSeverity,
     });
@@ -289,12 +298,17 @@ export default function GatherRulesPage() {
       intervalSeconds: form.trigger === "interval" ? form.intervalSeconds : null,
       triggerPhase: form.trigger === "phase_change" ? form.triggerPhase : null,
       triggerEventType: form.trigger === "on_event" ? form.triggerEventType : null,
+      activePhases: form.scopeMode === "during" && form.activePhases.length > 0 ? form.activePhases : null,
+      activeFromPhase: form.scopeMode === "from" && form.activeFromPhase ? form.activeFromPhase : null,
+      emitMode: form.emitMode || null,
       outputEventType: form.outputEventType,
       outputSeverity: form.outputSeverity,
       version: bumpVersion(rule.version),
       enabled: rule.enabled,
       author: rule.author,
       createdAt: rule.createdAt,
+      // Same wipe class as the toggle bug: the full-replace PUT must carry tags or they vanish.
+      tags: rule.tags ?? [],
       isBuiltIn: rule.isBuiltIn ?? false,
       isCommunity: rule.isCommunity ?? false,
     };
@@ -505,7 +519,9 @@ export default function GatherRulesPage() {
                         try {
                           const parsed = JSON.parse(jsonText) as NewRuleForm;
                           if (!parsed.ruleId && !parsed.title) throw new Error("JSON must include at least ruleId and title");
-                          setNewRule({ ...EMPTY_FORM, ...parsed });
+                          // Rule-shaped JSON carries activePhases/activeFromPhase but no scopeMode
+                          // — derive it so the scope fields survive into the create payload.
+                          setNewRule(withDerivedScopeMode({ ...EMPTY_FORM, ...parsed }));
                           setJsonModeCreate(false);
                           setJsonError(null);
                         } catch (e) {
@@ -538,7 +554,7 @@ export default function GatherRulesPage() {
                             try {
                               const parsed = JSON.parse(jsonText) as NewRuleForm;
                               setJsonError(null);
-                              handleCreateRule({ ...EMPTY_FORM, ...parsed });
+                              handleCreateRule(withDerivedScopeMode({ ...EMPTY_FORM, ...parsed }));
                             } catch (e) {
                               setJsonError(e instanceof Error ? e.message : "Invalid JSON");
                             }
@@ -619,7 +635,7 @@ export default function GatherRulesPage() {
                         try {
                           const parsed = JSON.parse(jsonText) as NewRuleForm;
                           if (!parsed.title) throw new Error("JSON must include title");
-                          setEditForm({ ...editForm, ...parsed });
+                          setEditForm(withDerivedScopeMode({ ...editForm, ...parsed }));
                           setJsonModeEdit(false);
                           setJsonError(null);
                         } catch (e) {

src/Web/autopilot-monitor-web/app/gather-rules/types.ts

@@ -15,6 +15,9 @@ export interface GatherRule {
   intervalSeconds: number | null;
   triggerPhase: string | null;
   triggerEventType: string | null;
+  activePhases?: string[] | null;
+  activeFromPhase?: string | null;
+  emitMode?: string | null;
   outputEventType: string;
   outputSeverity: string;
   tags: string[];
@@ -48,6 +51,10 @@ export interface NewRuleForm {
   intervalSeconds: number;
   triggerPhase: string;
   triggerEventType: string;
+  scopeMode: "always" | "during" | "from";
+  activePhases: string[];
+  activeFromPhase: string;
+  emitMode: string;
   outputEventType: string;
   outputSeverity: string;
 }
@@ -57,6 +64,30 @@ export const COLLECTOR_TYPES = ["registry", "eventlog", "wmi", "file", "command_
 export const TRIGGERS = ["startup", "phase_change", "interval", "on_event"] as const;
 export const SEVERITIES = ["info", "warning", "error", "critical"] as const;
 
+// Canonical phase-scope tokens: the backend EnrollmentPhase enum NAMES from Start(0) through
+// Complete(7) — Unknown/Failed are not selectable. Local mirror (like eventTypes.ts); display
+// labels are gather-rule-specific, deliberately NOT reusing phaseConstants.ts timeline names.
+export const GATHER_PHASES: ReadonlyArray<{ value: string; label: string }> = [
+  { value: "Start", label: "Start" },
+  { value: "DevicePreparation", label: "Device Preparation" },
+  { value: "DeviceSetup", label: "Device Setup" },
+  { value: "AppsDevice", label: "Apps (Device)" },
+  { value: "AccountSetup", label: "Account Setup" },
+  { value: "AppsUser", label: "Apps (User)" },
+  { value: "FinalizingSetup", label: "Finalizing Setup" },
+  { value: "Complete", label: "Complete" },
+];
+
+export const EMIT_MODES: ReadonlyArray<{ value: string; label: string }> = [
+  { value: "always", label: "Always (emit every collection)" },
+  { value: "on_change", label: "On change (emit only when the result changes)" },
+];
+
+/** Display label for a phase-scope token; falls back to the raw token for unknown values. */
+export function formatGatherPhase(token: string): string {
+  return GATHER_PHASES.find((p) => p.value === token)?.label ?? token;
+}
+
 export const CATEGORY_COLORS: Record<string, { bg: string; text: string }> = {
   network: { bg: "bg-blue-100", text: "text-blue-700" },
   identity: { bg: "bg-purple-100", text: "text-purple-700" },
@@ -126,6 +157,11 @@ export const EMPTY_FORM: NewRuleForm = {
   intervalSeconds: 60,
   triggerPhase: "",
   triggerEventType: "",
+  scopeMode: "always",
+  activePhases: [],
+  activeFromPhase: "",
+  // New rules default to on_change (anti-spam); existing rules load as "always" in startEditing.
+  emitMode: "on_change",
   outputEventType: "",
   outputSeverity: "info",
 };
@@ -137,3 +173,19 @@ export function formatTrigger(trigger: string) {
     default: return trigger.charAt(0).toUpperCase() + trigger.slice(1);
   }
 }
+
+/**
+ * Normalizes a form object after JSON-mode merges. Pasted JSON is usually rule-shaped
+ * (activePhases/activeFromPhase/emitMode, no scopeMode key), so the UI-only scopeMode must
+ * be derived from the data — otherwise the create/save payload would silently drop the
+ * scope fields. Also coerces null/unknown emitMode values to the "always" select option.
+ */
+export function withDerivedScopeMode(form: NewRuleForm): NewRuleForm {
+  const activePhases = (Array.isArray(form.activePhases) ? form.activePhases : [])
+    .filter((p): p is string => typeof p === "string" && p.length > 0);
+  const activeFromPhase = typeof form.activeFromPhase === "string" ? form.activeFromPhase : "";
+  const scopeMode: NewRuleForm["scopeMode"] =
+    activePhases.length > 0 ? "during" : activeFromPhase ? "from" : "always";
+  const emitMode = form.emitMode === "on_change" ? "on_change" : "always";
+  return { ...form, activePhases, activeFromPhase, scopeMode, emitMode };
+}

src/Web/autopilot-monitor-web/app/health-check/page.tsx

@@ -302,7 +302,7 @@ export default function HealthCheckPage() {
                       </div>
                       <div>
                         <h3 className="text-lg font-semibold text-gray-900 dark:text-white">Live Updates</h3>
-                        <p className="text-xs text-gray-500 dark:text-gray-400">Real-time event hub (Private Preview: 20 concurrent clients)</p>
+                        <p className="text-xs text-gray-500 dark:text-gray-400">Real-time event hub</p>
                       </div>
                     </div>
                     <span className={`inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium ${colors.badge}`}>
@@ -341,7 +341,7 @@ export default function HealthCheckPage() {
                     )}
                     {groupJoinTest === 'failed' && (
                       <p className="mt-2 text-xs text-red-600">
-                        Group join failed — likely hit the 20 concurrent client limit
+                        Group join failed — check your connection and try again
                       </p>
                     )}
                   </div>

src/Web/autopilot-monitor-web/app/opengraph-image.tsx

@@ -1,7 +1,5 @@
 import { ImageResponse } from "next/og";
 
-export const runtime = "edge";
-
 export const alt = "AutopilotMonitor – Real-Time Windows Enrollment Monitoring";
 export const size = { width: 1200, height: 630 };
 export const contentType = "image/png";

src/Web/autopilot-monitor-web/app/page.tsx

@@ -111,26 +111,6 @@ export default function LandingPage() {
 
       <PublicSiteNavbar showSectionLinks={true} />
 
-      {/* Scheduled maintenance notice — TEMPORARY, remove after 2026-07-20 */}
-      <div className="border-b border-amber-300 bg-amber-100/80 px-4 py-2 text-center">
-        <p className="inline-flex flex-wrap items-center justify-center gap-1.5 text-xs text-amber-900 sm:text-sm">
-          <svg className="h-4 w-4 shrink-0 text-amber-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
-          </svg>
-          <span>
-            <span className="font-semibold">Scheduled infrastructure maintenance:</span> platform not available Sat 18 Jul – Mon 20 Jul, 00:00 CEST (UTC+2).{" "}
-            <a
-              href="https://docs.autopilotmonitor.com/troubleshooting/service-announcements"
-              target="_blank"
-              rel="noopener noreferrer"
-              className="underline font-medium hover:text-amber-700"
-            >
-              Details
-            </a>
-          </span>
-        </p>
-      </div>
-
       {/* Hero Section */}
       <div className="pt-20 pb-20 px-6">
         <div className="max-w-7xl mx-auto">

src/Web/autopilot-monitor-web/app/twitter-image.tsx

@@ -1,3 +1 @@
 export { default, alt, size, contentType } from "./opengraph-image";
-
-export const runtime = "edge";

src/Web/autopilot-monitor-web/components/Navbar.tsx

@@ -510,7 +510,7 @@ export default function Navbar() {
                     <svg className="w-4 h-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
                       <path strokeLinecap="round" strokeLinejoin="round" d="M12 9v2m0 4h.01M10.29 3.86L1.82 18a2 2 0 001.71 3h16.94a2 2 0 001.71-3L13.71 3.86a2 2 0 00-3.42 0z" />
                     </svg>
-                    <span>Known Issues</span>
+                    <span>Service Announcements</span>
                   </a>
 
                   <div className="border-t border-gray-100 my-1"></div>
@@ -689,7 +689,7 @@ export default function Navbar() {
                       </a>
                       <a href="https://docs.autopilotmonitor.com/troubleshooting/service-announcements" target="_blank" rel="noopener noreferrer" className="w-full flex items-center gap-2.5 px-3 py-2 text-sm text-gray-700 dark:text-gray-200 hover:bg-gray-50 dark:hover:bg-gray-700 transition-colors" onClick={() => { setShowOverflow(false); setOverflowSubmenu(null); }}>
                         <svg className="w-4 h-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}><path strokeLinecap="round" strokeLinejoin="round" d="M12 9v2m0 4h.01M10.29 3.86L1.82 18a2 2 0 001.71 3h16.94a2 2 0 001.71-3L13.71 3.86a2 2 0 00-3.42 0z" /></svg>
-                        <span>Known Issues</span>
+                        <span>Service Announcements</span>
                       </a>
                       <div className="border-t border-gray-100 dark:border-gray-700 my-1"></div>
                       <Link href="/privacy" className="w-full flex items-center gap-2.5 px-3 py-2 text-sm text-gray-700 dark:text-gray-200 hover:bg-gray-50 dark:hover:bg-gray-700 transition-colors" onClick={() => { setShowOverflow(false); setOverflowSubmenu(null); }}>

src/Web/autopilot-monitor-web/package-lock.json

@@ -2851,13 +2851,16 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.19",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
-      "integrity": "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==",
+      "version": "2.10.43",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.43.tgz",
+      "integrity": "sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/binary-extensions": {
@@ -3002,9 +3005,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001769",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001769.tgz",
-      "integrity": "sha512-BCfFL1sHijQlBGWBMuJyhZUhzo7wer5sVj9hqekB/7xn0Ypy+pER/edCYQm4exbXj4WiySGp40P8UuTh6w1srg==",
+      "version": "1.0.30001806",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz",
+      "integrity": "sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==",
       "funding": [
         {
           "type": "opencollective",

src/Web/autopilot-monitor-web/types/adminConfig.ts

@@ -9,6 +9,17 @@ export interface AdminConfiguration {
   /** Per-user (portal/JWT) rate limit for Global Admins. Default 600. */
   globalAdminRateLimitRequestsPerMinute?: number;
   platformStatsBlobSasUrl?: string;
+  /**
+   * Agent endpoint migration: global re-home target served to agents as
+   * `MigrateToApiBaseUrl` on the config channel (e.g. "https://autopilotmonitor-api-us.azurewebsites.net").
+   * Empty = no migration. Set on the backend being ABANDONED during a move.
+   */
+  agentMigrateApiBaseUrl?: string;
+  /**
+   * JSON object tenantId → target URL for per-tenant moves; an empty-string value
+   * pins that tenant (no migration) even while the global target is set.
+   */
+  agentMigrateTenantOverridesJson?: string;
   collectorIdleTimeoutMinutes?: number;
   desktopDetectorNoCandidateTimeoutMinutes?: number;
   excessiveEventCountThreshold?: number;