docs: gather-rule phase scoping + emit-on-change concept doc (OKF)

New rules/ section in the knowledge bundle: semantics table, from-phase latch
behavior (never via Failed, sticky through it), on_change x emitOnlyIfExists
composition, restart re-emit, no-phase-signal caveat, old-agent degradation,
and the prerequisite toggle-wipe fix. Index + log updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/index.md

@@ -19,6 +19,10 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Build Counter Blob](agent/build-counter-blob.md) - How agent build numbers are minted: shared counter blob with ETag-CAS so local and CI builds never collide; CI additionally attests build provenance (Sigstore).
 * [Agent Endpoint Migration](agent/endpoint-migration.md) - How the backend re-homes agents to a new API base URL via the config channel (backend move or per-tenant region move): live-fetch-only, allowlist-validated on both sides, one hop, kill wins.
 
+# Rules
+
+* [Gather Rule Phase Scoping & Emit-on-Change](rules/gather-rule-phase-scoping.md) - Restricting gather rules to enrollment phases (activePhases / activeFromPhase sticky latch) and emitMode "on_change" result-dedup — the anti-spam pair for interval rules.
+
 # Security & Identity
 
 * [MCP OAuth Flow](mcp-oauth-flow.md) - Who authenticates where when connecting an AI client to the MCP server; two identities, three parties plus Entra ID.

docs/log.md

@@ -1,5 +1,9 @@
 # Log
 
+## 2026-07-20
+
+* **Creation**: Added `rules/gather-rule-phase-scoping.md` (new `rules/` section) — gather rules gain `activePhases` (run only during listed phases), `activeFromPhase` (sticky latch from a phase onwards, never via Failed) and `emitMode: "on_change"` (canonical-hash result dedup with `suppressedPolls` observability), ConfigVersion 34. Includes the prerequisite backend fix: the custom-rule toggle PUT no longer wipes the stored rule definition (partial-merge in `GatherRuleService.UpdateRuleAsync`).
+
 ## 2026-07-18
 
 * **Creation**: Added `agent/endpoint-migration.md` — config-channel agent re-home (`MigrateToApiBaseUrl` on `GET agent/config`, ConfigVersion 33): backend or per-tenant API-URL moves without DNS indirection (impossible due to mTLS/Flex-TLS). Live-fetch-only with cache strip, `AgentEndpointMigrationRules` allowlist validated on both sides, one hop, kill-switch wins. Built as the lesson from the 2026-07-18 WEU→GWC cutover, which hard-cut all in-flight agents.

docs/rules/gather-rule-phase-scoping.md

@@ -0,0 +1,97 @@
+---
+type: Concept
+title: Gather Rule Phase Scoping & Emit-on-Change
+description: How gather rules are restricted to enrollment phases (activePhases / activeFromPhase) and how emitMode "on_change" suppresses repeated identical results — the anti-spam pair for interval rules.
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs
+tags:
+  - agent
+  - backend
+  - gather-rules
+  - config
+timestamp: 2026-07-20T00:00:00+02:00
+---
+
+# Problem
+
+Interval gather rules (e.g. a registry poll every 60 s) ran during **all** enrollment phases
+and emitted an event on **every** tick — including `exists=false` events while the target key
+did not exist yet. A rule needed only from Account Setup onwards produced hundreds of
+identical noise events per session and wasted collector runs.
+
+# Schema
+
+Three opt-in fields on `GatherRule` (Shared model, `rules/schema/gather-rule.schema.json`,
+delivered to the agent via `GET agent/config`; ConfigVersion 34). Absent fields = legacy
+behavior — full back-compat.
+
+| Field | Type | Semantics |
+|---|---|---|
+| `activePhases` | `string[]` \| null | Rule runs only while the current phase is in the list. Null/empty = unrestricted. |
+| `activeFromPhase` | `string` \| null | Sticky latch: activates when the phase first reaches the threshold, then stays active for the rest of the session — including through `Failed`. Null = unrestricted. |
+| `emitMode` | `"always"` \| `"on_change"` \| null | `on_change`: poll on the trigger cadence, emit only when the collected result changes. Null/`always` = emit every collection (legacy). |
+
+Canonical phase tokens are the `EnrollmentPhase` enum **names** `Start`(0) …`Complete`(7).
+Backend validation (`GatherRulesFunction.ValidateScopeAndEmitMode`) rejects `Unknown`/`Failed`,
+numeric tokens, unknown emit modes, and both scope fields set at once (400). The agent
+defensively prefers `activePhases` if both arrive anyway.
+
+# Scope semantics (agent, `GatherRuleExecutor`)
+
+* Scope applies to **all trigger types**:
+  * `interval` — timers keep running; an out-of-scope tick is a free early-return (no
+    start/stop lifecycle races on phase transitions).
+  * `startup` — a scoped startup rule not yet in scope at `UpdateRules` is **deferred**: it
+    runs exactly once from `OnPhaseChanged` when its scope activates (same
+    `_startupRulesExecuted` dedup; it is not part of the `WaitForStartupRules` latch).
+  * `phase_change` — evaluated against the **new** phase; the scope gate runs before the
+    per-(rule, phase) dedup so an out-of-scope pass does not consume the execution slot.
+  * `on_event` — gated by the current phase.
+* **Before the first phase signal** of a session (`_currentPhase == Unknown`) scoped rules are
+  inactive. Sessions that never produce phase signals never run them (documented behavior).
+* **From-phase latch**: activates when `phase != Unknown && phase != Failed && (int)phase >=
+  (int)fromPhase`. `Failed=99` would ordinal-satisfy every threshold, hence the explicit
+  exclusion — but once latched, a rule stays active through `Failed`. A config refresh that
+  delivers a from-phase rule after its threshold passed latches it immediately.
+* `--run-gather-rules` (diagnostic CLI) sets `IgnorePhaseScope = true` — no phase context
+  exists there, scoped rules execute unconditionally (log line marks the bypass).
+
+# Emit-on-change semantics
+
+* The collector result dict is canonically hashed (keys ordinal-sorted at every nesting
+  level, invariant value formatting, SHA-256) **before** `ruleId`/`ruleTitle` injection.
+* First in-scope non-empty result always emits — on an absent registry key that first
+  `exists=false` event *is* the visible "we're polling now" indicator.
+* Unchanged results increment a per-rule suppression counter; the next emitted event carries
+  `suppressedPolls` + `suppressedSinceUtc` in its `Data` so the gap is observable.
+* Composition with `emitOnlyIfExists=true` (collector-level): a miss returns an empty dict —
+  no emit AND no hash update. Result: zero noise while absent, one event on appearance, then
+  only on change.
+* State is in-memory and survives `UpdateRules` config refreshes; an agent restart causes at
+  most one re-emit per rule (acceptable under the per-enrollment lifecycle).
+* Volatile collectors (eventlog timestamps, logparser positions) degrade `on_change` to
+  `always` — every poll hashes differently. The option stays visible for them since some
+  outputs are stable; this is documented, not hidden.
+
+# Portal & delivery
+
+* Create form defaults new rules to `emitMode: "on_change"`; existing rules load as
+  `always`. The scope UI is a three-way mode (always / during phases / from phase) backed by
+  a canonical `GATHER_PHASES` list — the same list replaced the free-text `triggerPhase`
+  input, whose placeholder used to suggest invalid tokens.
+* The custom-rule toggle PUT (`{enabled, isBuiltIn, isCommunity}`) previously full-replaced
+  the stored rule and wiped Title/Target/Trigger — `GatherRuleService.UpdateRuleAsync` now
+  merges toggle-style partials (empty Title/CollectorType/Target) into the existing row and
+  preserves `CreatedAt` on full edits. This fix is a prerequisite: without it every toggle
+  would silently clear the new fields.
+* Old agents (Newtonsoft) ignore unknown config properties: scoped rules run everywhere,
+  `emitMode` is ignored — graceful degradation until the fleet rolls forward.
+* `ContentEquivalent` treats null and empty `activePhases` as equal, so pre-existing DB rows
+  (absent columns → null) never diff against seeds — no reseed churn.
+
+# Citations
+
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs` — scope gates, latch, canonical hash
+* `src/Backend/AutopilotMonitor.Functions/Functions/Rules/GatherRulesFunction.cs` — `ValidateScopeAndEmitMode`
+* `src/Backend/AutopilotMonitor.Functions/Services/GatherRuleService.cs` — partial-PUT merge, `ContentEquivalent`
+* `src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs` — field contracts
+* Tests: `GatherRuleExecutorPhaseScopeTests`, `GatherRuleExecutorEmitModeTests` (agent); `GatherRuleUpdatePartialMergeTests`, `GatherRuleScopeFieldsTests` (backend)

rules/schema/gather-rule.schema.json

@@ -96,6 +96,24 @@
           "type": "string",
           "description": "Event type to trigger on (only used when trigger = \"on_event\")."
         },
+        "activePhases": {
+          "type": "array",
+          "description": "Run the rule only while the current enrollment phase is one of these phases (EnrollmentPhase enum names). Empty/absent = unrestricted. Mutually exclusive with activeFromPhase.",
+          "items": {
+            "type": "string",
+            "enum": ["Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup", "AppsUser", "FinalizingSetup", "Complete"]
+          }
+        },
+        "activeFromPhase": {
+          "type": "string",
+          "description": "Activate the rule once the enrollment phase first reaches this phase, then keep it active for the rest of the session (sticky latch). Absent = unrestricted. Mutually exclusive with activePhases.",
+          "enum": ["Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup", "AppsUser", "FinalizingSetup", "Complete"]
+        },
+        "emitMode": {
+          "type": "string",
+          "description": "Emit behavior: \"always\" (default — emit on every collection) or \"on_change\" (poll on the trigger cadence but emit only when the collected result changes; the first in-scope result always emits).",
+          "enum": ["always", "on_change"]
+        },
         "outputEventType": {
           "type": "string",
           "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorEmitModeTests.cs

@@ -0,0 +1,249 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// EmitMode "on_change" on <see cref="GatherRuleExecutor"/>: poll on the trigger cadence but
+    /// emit only when the collected result changes. The dedup state machine is asserted
+    /// synchronously via the internal <c>ShouldEmitOnChange</c> / <c>ComputeCanonicalHash</c>
+    /// (no timer races); the ExecuteRule wiring (hash-before-injection, empty-result no-op,
+    /// emitOnlyIfExists composition) through the public startup path.
+    /// </summary>
+    [Collection("SerialThreading")] // startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorEmitModeTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_7e3a1f4b-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorEmitModeTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private int EventCount { get { lock (_eventsGate) return _events.Count; } }
+
+        private EnrollmentEvent SingleEvent()
+        {
+            lock (_eventsGate) return Assert.Single(_events);
+        }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                if (EventCount >= count) return true;
+                Thread.Sleep(25);
+            }
+            return EventCount >= count;
+        }
+
+        private static GatherRule OnChangeRule(string id = "GATHER-OC-001") => new GatherRule
+        {
+            RuleId = id,
+            Title = id,
+            CollectorType = "registry",
+            Target = AbsentPath,
+            Trigger = "interval",
+            IntervalSeconds = 3600,
+            OutputEventType = "gather_test",
+            Enabled = true,
+            EmitMode = "on_change",
+        };
+
+        private static Dictionary<string, object> Result(params (string Key, object Value)[] pairs)
+        {
+            var d = new Dictionary<string, object>();
+            foreach (var (key, value) in pairs) d[key] = value;
+            return d;
+        }
+
+        // ── on_change state machine (synchronous) ──────────────────────────
+
+        [Fact]
+        public void FirstResult_AlwaysEmits_ThenUnchangedIsSuppressed_ThenChangeReemits()
+        {
+            var rule = OnChangeRule();
+
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));   // first
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));  // unchanged
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));  // unchanged
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", true), ("Version", "1")))); // changed
+        }
+
+        [Fact]
+        public void EmitAfterSuppressionStreak_CarriesSuppressedPollCount_AndResets()
+        {
+            var rule = OnChangeRule();
+
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+
+            var changed = Result(("exists", true));
+            Assert.True(_executor.ShouldEmitOnChange(rule, changed));
+            Assert.Equal(3, changed["suppressedPolls"]);
+            Assert.True(changed.ContainsKey("suppressedSinceUtc"));
+
+            // Counter must reset: the next change emits without a suppression payload.
+            var changedAgain = Result(("exists", false));
+            Assert.True(_executor.ShouldEmitOnChange(rule, changedAgain));
+            Assert.False(changedAgain.ContainsKey("suppressedPolls"));
+            Assert.False(changedAgain.ContainsKey("suppressedSinceUtc"));
+        }
+
+        [Fact]
+        public void SuppressionState_IsIsolatedPerRule()
+        {
+            var ruleA = OnChangeRule("GATHER-OC-A");
+            var ruleB = OnChangeRule("GATHER-OC-B");
+            var payload = Result(("exists", false));
+
+            Assert.True(_executor.ShouldEmitOnChange(ruleA, new Dictionary<string, object>(payload)));
+            // Same content, different rule: B has no hash yet — must emit.
+            Assert.True(_executor.ShouldEmitOnChange(ruleB, new Dictionary<string, object>(payload)));
+            Assert.False(_executor.ShouldEmitOnChange(ruleA, new Dictionary<string, object>(payload)));
+            Assert.False(_executor.ShouldEmitOnChange(ruleB, new Dictionary<string, object>(payload)));
+        }
+
+        [Fact]
+        public void DedupState_SurvivesUpdateRulesRefresh()
+        {
+            var rule = OnChangeRule();
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+
+            // Config refresh mid-session must not reset the last-emitted hash (that would
+            // re-emit an unchanged result on every refresh).
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.False(_executor.ShouldEmitOnChange(rule, Result(("exists", false))));
+        }
+
+        // ── Canonical hashing ──────────────────────────────────────────────
+
+        [Fact]
+        public void CanonicalHash_IsKeyOrderInsensitive()
+        {
+            var a = new Dictionary<string, object> { ["alpha"] = 1, ["beta"] = "x" };
+            var b = new Dictionary<string, object> { ["beta"] = "x", ["alpha"] = 1 };
+
+            Assert.Equal(
+                GatherRuleExecutor.ComputeCanonicalHash(a),
+                GatherRuleExecutor.ComputeCanonicalHash(b));
+        }
+
+        [Fact]
+        public void CanonicalHash_DetectsValueChanges_IncludingNested()
+        {
+            var baseline = new Dictionary<string, object>
+            {
+                ["exists"] = true,
+                ["entries"] = new List<object> { new Dictionary<string, object> { ["id"] = 1 } },
+            };
+            var changedScalar = new Dictionary<string, object>
+            {
+                ["exists"] = false,
+                ["entries"] = new List<object> { new Dictionary<string, object> { ["id"] = 1 } },
+            };
+            var changedNested = new Dictionary<string, object>
+            {
+                ["exists"] = true,
+                ["entries"] = new List<object> { new Dictionary<string, object> { ["id"] = 2 } },
+            };
+
+            var baseHash = GatherRuleExecutor.ComputeCanonicalHash(baseline);
+            Assert.NotEqual(baseHash, GatherRuleExecutor.ComputeCanonicalHash(changedScalar));
+            Assert.NotEqual(baseHash, GatherRuleExecutor.ComputeCanonicalHash(changedNested));
+        }
+
+        [Fact]
+        public void CanonicalHash_DistinguishesTypeShapes()
+        {
+            // "1" (string) vs 1 (int) and null vs "<null>"-like strings must not collide.
+            Assert.NotEqual(
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = "1" }),
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = 1 }));
+            Assert.NotEqual(
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = null }),
+                GatherRuleExecutor.ComputeCanonicalHash(new Dictionary<string, object> { ["v"] = "<null>" }));
+        }
+
+        // ── ExecuteRule wiring (async via startup path) ────────────────────
+
+        [Fact]
+        public void AlwaysMode_EmitsEveryCollection()
+        {
+            // EmitMode absent (legacy) — repeated identical results all emit. Two executions of
+            // the same collector via two rules sharing the target prove no dedup is applied.
+            var rule1 = OnChangeRule("GATHER-AL-1"); rule1.EmitMode = null; rule1.Trigger = "startup";
+            var rule2 = OnChangeRule("GATHER-AL-2"); rule2.EmitMode = null; rule2.Trigger = "startup";
+
+            _executor.UpdateRules(new List<GatherRule> { rule1, rule2 });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(2));
+        }
+
+        [Fact]
+        public void OnChange_FirstInScopePoll_EmitsExistsFalse_AsPollingIndicator()
+        {
+            // The first result on an absent key IS the visible "we're polling now" indicator.
+            var rule = OnChangeRule();
+            rule.Trigger = "startup";
+
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            var evt = SingleEvent();
+            Assert.Equal(false, evt.Data["exists"]);
+            Assert.Equal("GATHER-OC-001", evt.Data["ruleId"]); // injection happened after hashing
+        }
+
+        [Fact]
+        public void OnChange_ComposedWithEmitOnlyIfExists_EmptyResultDoesNotTouchHashState()
+        {
+            // emitOnlyIfExists miss → empty result → no emit AND no hash update: the eventual
+            // first real result must still count as "first emit".
+            var rule = OnChangeRule();
+            rule.Trigger = "startup";
+            rule.Parameters = new Dictionary<string, string> { ["emitOnlyIfExists"] = "true" };
+
+            _executor.UpdateRules(new List<GatherRule> { rule });
+            Assert.True(_executor.WaitForStartupRules(30));
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount); // zero noise while the key is absent
+
+            // When the key appears (simulated via the state machine), the result emits as first.
+            Assert.True(_executor.ShouldEmitOnChange(rule, Result(("exists", true), ("Version", "1"))));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorPhaseScopeTests.cs

@@ -0,0 +1,326 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// Phase scoping on <see cref="GatherRuleExecutor"/> (ActivePhases / ActiveFromPhase):
+    /// the scope matrix is asserted synchronously via the internal <c>IsRuleInScope</c>
+    /// (no timer races); the trigger-path wiring (deferred startup, phase_change / on_event
+    /// gating) is asserted through the public API with positive event waits.
+    /// Rules use the absent-registry-path pattern from
+    /// <see cref="RegistryCollectorEmitOnlyIfExistsTests"/> so no real system state is touched.
+    /// </summary>
+    [Collection("SerialThreading")] // deferred startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorPhaseScopeTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_5b1c8d2e-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorPhaseScopeTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                // Bypass the registry allowlist guard for the synthetic test path.
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private int EventCount { get { lock (_eventsGate) return _events.Count; } }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                if (EventCount >= count) return true;
+                Thread.Sleep(25);
+            }
+            return EventCount >= count;
+        }
+
+        /// <summary>Interval rule with a 1h period — the timer never ticks within a test run,
+        /// so these rules exist purely for synchronous scope-matrix assertions.</summary>
+        private static GatherRule ScopeProbeRule(string id, List<string> activePhases = null, string fromPhase = null)
+            => new GatherRule
+            {
+                RuleId = id,
+                Title = id,
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "interval",
+                IntervalSeconds = 3600,
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = activePhases,
+                ActiveFromPhase = fromPhase,
+            };
+
+        private static GatherRule StartupRule(string id, List<string> activePhases = null, string fromPhase = null)
+            => new GatherRule
+            {
+                RuleId = id,
+                Title = id,
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "startup",
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = activePhases,
+                ActiveFromPhase = fromPhase,
+            };
+
+        // ── Scope matrix (synchronous) ─────────────────────────────────────
+
+        [Fact]
+        public void UnscopedRule_IsInScope_EvenBeforeAnyPhaseSignal()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-000");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void ActivePhases_InactiveBeforeFirstPhaseSignal()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-001", activePhases: new List<string> { "AccountSetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.False(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void ActivePhases_ActiveDuringListedPhase_InactiveAfterLeaving()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-002", activePhases: new List<string> { "AccountSetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.False(_executor.IsRuleInScope(rule));
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            Assert.False(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void ActivePhases_MatchIsCaseInsensitive()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-003", activePhases: new List<string> { "accountsetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void FromPhase_LatchesAtThreshold_AndStaysSticky_IncludingThroughFailed()
+        {
+            var rule = ScopeProbeRule("GATHER-SCOPE-010", fromPhase: "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.False(_executor.IsRuleInScope(rule)); // threshold not reached
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(_executor.IsRuleInScope(rule)); // latched
+
+            _executor.OnPhaseChanged(EnrollmentPhase.Failed);
+            Assert.True(_executor.IsRuleInScope(rule)); // sticky through Failed
+        }
+
+        [Fact]
+        public void FromPhase_NoSpuriousActivationViaFailed()
+        {
+            // Failed=99 would ordinal-satisfy every threshold — it must never latch.
+            var rule = ScopeProbeRule("GATHER-SCOPE-011", fromPhase: "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.Failed);
+            Assert.False(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void FromPhase_LatchesWhenThresholdIsSkippedOver()
+        {
+            // The session may never report the exact threshold phase — a later phase latches too.
+            var rule = ScopeProbeRule("GATHER-SCOPE-012", fromPhase: "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.FinalizingSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void FromPhase_RuleDeliveredByRefreshAfterPhaseReached_LatchesImmediately()
+        {
+            _executor.UpdateRules(new List<GatherRule>());
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+
+            // Config refresh delivers a new from-phase rule whose threshold already passed.
+            var rule = ScopeProbeRule("GATHER-SCOPE-013", fromPhase: "DeviceSetup");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void BothFieldsSet_ActivePhasesWins()
+        {
+            // Backend validation rejects this shape; the agent defensively prefers ActivePhases.
+            var rule = ScopeProbeRule("GATHER-SCOPE-020",
+                activePhases: new List<string> { "DeviceSetup" }, fromPhase: "Start");
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.False(_executor.IsRuleInScope(rule)); // FromPhase(Start) would say yes — list wins
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.True(_executor.IsRuleInScope(rule));
+        }
+
+        [Fact]
+        public void IgnorePhaseScope_BypassesScope_WithoutPhaseContext()
+        {
+            _executor.IgnorePhaseScope = true;
+            var during = ScopeProbeRule("GATHER-SCOPE-030", activePhases: new List<string> { "AccountSetup" });
+            var from = ScopeProbeRule("GATHER-SCOPE-031", fromPhase: "Complete");
+            _executor.UpdateRules(new List<GatherRule> { during, from });
+
+            Assert.True(_executor.IsRuleInScope(during));
+            Assert.True(_executor.IsRuleInScope(from));
+        }
+
+        // ── Trigger-path wiring (async, positive waits) ────────────────────
+
+        [Fact]
+        public void UnscopedStartupRule_RunsImmediately()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule("GATHER-START-000") });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+        }
+
+        [Fact]
+        public void ScopedStartupRule_IsDeferred_ThenFiresExactlyOnce_WhenScopeActivates()
+        {
+            _executor.UpdateRules(new List<GatherRule>
+            {
+                StartupRule("GATHER-START-001", fromPhase: "AccountSetup")
+            });
+
+            // Not in scope at UpdateRules: nothing queued, latch trivially satisfied.
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(WaitForEventCount(1), "deferred startup rule should fire when its scope activates");
+
+            // Later phase changes must not re-fire it (dedup via _startupRulesExecuted).
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            _executor.OnPhaseChanged(EnrollmentPhase.FinalizingSetup);
+            Thread.Sleep(300);
+            Assert.Equal(1, EventCount);
+        }
+
+        [Fact]
+        public void PhaseChangeRule_OutOfScopePhase_DoesNotFire_InScopePhaseFires()
+        {
+            // TriggerPhase empty = fires on every phase change; scope narrows it to AccountSetup.
+            var rule = new GatherRule
+            {
+                RuleId = "GATHER-PC-001",
+                Title = "pc",
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "phase_change",
+                TriggerPhase = "",
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = new List<string> { "AccountSetup" },
+            };
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(WaitForEventCount(1));
+
+            // Same phase again: the (rule, phase) dedup slot is now consumed.
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Thread.Sleep(300);
+            Assert.Equal(1, EventCount);
+        }
+
+        [Fact]
+        public void OnEventRule_GatedByScope()
+        {
+            var rule = new GatherRule
+            {
+                RuleId = "GATHER-OE-001",
+                Title = "oe",
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "on_event",
+                TriggerEventType = "app_install_failed",
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = new List<string> { "AccountSetup" },
+            };
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnEvent("app_install_failed"); // no phase signal yet → out of scope
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnEvent("app_install_failed");
+            Assert.True(WaitForEventCount(1));
+        }
+
+        [Fact]
+        public void IgnorePhaseScope_ScopedStartupRule_RunsImmediately()
+        {
+            // The --run-gather-rules diagnostic path: scoped rules must execute unconditionally.
+            _executor.IgnorePhaseScope = true;
+            _executor.UpdateRules(new List<GatherRule>
+            {
+                StartupRule("GATHER-START-002", activePhases: new List<string> { "AccountSetup" })
+            });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs

@@ -1,6 +1,9 @@
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Linq;
+using System.Security.Cryptography;
+using System.Text;
 using System.Threading;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors;
@@ -28,6 +31,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         private readonly HashSet<string> _phaseRulesExecuted = new HashSet<string>();
         private CountdownEvent _startupRulesLatch;   // non-null only while startup rules are pending
 
+        // Phase-scope + emit-mode state (ActivePhases / ActiveFromPhase / EmitMode on GatherRule).
+        // Guarded by _scopeLock; collector work always runs outside the lock. The state deliberately
+        // survives UpdateRules config refreshes — an agent restart causes at most one re-emit per
+        // on_change rule (acceptable under the per-enrollment lifecycle).
+        private readonly object _scopeLock = new object();
+        private EnrollmentPhase _currentPhase = EnrollmentPhase.Unknown;
+        private readonly HashSet<string> _fromPhaseLatched = new HashSet<string>();
+        private readonly Dictionary<string, string> _lastEmittedHash = new Dictionary<string, string>();
+        private readonly Dictionary<string, (int Count, DateTime SinceUtc)> _suppressed =
+            new Dictionary<string, (int Count, DateTime SinceUtc)>();
+        private readonly HashSet<string> _scopeBypassLogged = new HashSet<string>();
+
+        /// <summary>
+        /// When true, phase scoping (ActivePhases / ActiveFromPhase) is bypassed and scoped rules
+        /// execute unconditionally. Used by the standalone <c>--run-gather-rules</c> diagnostic
+        /// mode, which has no enrollment phase context. EmitMode is unaffected.
+        /// </summary>
+        public bool IgnorePhaseScope { get; set; }
+
         /// <summary>
         /// When true, guardrails are relaxed: all registry, WMI, and command targets are allowed.
         /// File paths allow everything except C:\Users. Set from tenant configuration.
@@ -89,10 +111,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
             _activeRules = rules.Where(r => r.Enabled).ToList();
 
-            // Execute startup rules — track completion via CountdownEvent so callers can wait
-            var pendingStartup = _activeRules
-                .Where(r => r.Trigger == "startup" && !_startupRulesExecuted.Contains(r.RuleId))
-                .ToList();
+            // Execute startup rules — track completion via CountdownEvent so callers can wait.
+            // Scoped startup rules that are not yet in scope are deferred: they run once from
+            // OnPhaseChanged when their scope activates (same _startupRulesExecuted dedup — a
+            // rule runs either here or there, never both). Unscoped rules behave as before.
+            List<GatherRule> pendingStartup;
+            lock (_scopeLock)
+            {
+                // A config refresh may deliver new from-phase rules after their phase was
+                // already reached — evaluate latches against the current phase first.
+                EvaluateFromPhaseLatchesLocked();
+
+                pendingStartup = _activeRules
+                    .Where(r => r.Trigger == "startup" && !_startupRulesExecuted.Contains(r.RuleId))
+                    .Where(r => IsRuleInScopeLocked(r))
+                    .ToList();
+
+                foreach (var rule in pendingStartup)
+                {
+                    _startupRulesExecuted.Add(rule.RuleId);
+                }
+            }
 
             if (pendingStartup.Count > 0)
             {
@@ -101,7 +140,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                 foreach (var rule in pendingStartup)
                 {
-                    _startupRulesExecuted.Add(rule.RuleId);
                     ThreadPool.QueueUserWorkItem(_ =>
                     {
                         try   { ExecuteRule(rule); }
@@ -110,18 +148,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                 }
             }
 
-            // Set up interval timers
+            // Set up interval timers. Timers for scoped rules keep running while out of scope —
+            // the tick gate makes an out-of-scope tick a free no-op, avoiding start/stop
+            // lifecycle races on phase transitions.
             foreach (var rule in _activeRules.Where(r => r.Trigger == "interval" && r.IntervalSeconds.HasValue))
             {
-                var interval = TimeSpan.FromSeconds(rule.IntervalSeconds.Value);
+                var intervalRule = rule;
+                var interval = TimeSpan.FromSeconds(intervalRule.IntervalSeconds.Value);
                 var timer = new Timer(
-                    _ => ExecuteRule(rule),
+                    _ =>
+                    {
+                        if (!IsRuleInScope(intervalRule))
+                            return;
+                        ExecuteRule(intervalRule);
+                    },
                     null,
                     interval, // Initial delay = one interval
                     interval
                 );
-                _intervalTimers[rule.RuleId] = timer;
-                _logger.Info($"  Interval rule {rule.RuleId} scheduled every {rule.IntervalSeconds}s");
+                _intervalTimers[intervalRule.RuleId] = timer;
+                _logger.Info($"  Interval rule {intervalRule.RuleId} scheduled every {intervalRule.IntervalSeconds}s");
             }
 
             _logger.Info($"GatherRuleExecutor: {_activeRules.Count(r => r.Trigger == "startup")} startup, " +
@@ -135,11 +181,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         {
             var phaseName = newPhase.ToString();
 
+            // Update the phase + from-phase latches FIRST so deferred startup activation and
+            // the phase_change rules below all evaluate against the NEW phase.
+            List<GatherRule> deferredStartup;
+            lock (_scopeLock)
+            {
+                _currentPhase = newPhase;
+                EvaluateFromPhaseLatchesLocked();
+
+                deferredStartup = _activeRules
+                    .Where(r => r.Trigger == "startup" && HasPhaseScope(r)
+                                && !_startupRulesExecuted.Contains(r.RuleId)
+                                && IsRuleInScopeLocked(r))
+                    .ToList();
+
+                foreach (var rule in deferredStartup)
+                {
+                    _startupRulesExecuted.Add(rule.RuleId);
+                }
+            }
+
+            foreach (var rule in deferredStartup)
+            {
+                var deferredRule = rule;
+                _logger.Info($"Phase {phaseName} activated deferred startup rule {deferredRule.RuleId}");
+                ThreadPool.QueueUserWorkItem(_ => ExecuteRule(deferredRule));
+            }
+
             foreach (var rule in _activeRules.Where(r => r.Trigger == "phase_change"))
             {
                 if (string.IsNullOrEmpty(rule.TriggerPhase) ||
                     string.Equals(rule.TriggerPhase, phaseName, StringComparison.OrdinalIgnoreCase))
                 {
+                    // Scope gate BEFORE the dedup add — an out-of-scope pass must not consume
+                    // the once-per-(rule, phase) execution slot.
+                    if (!IsRuleInScope(rule))
+                        continue;
+
                     // Deduplicate: only fire once per (ruleId, phase) combination
                     var deduplicationKey = $"{rule.RuleId}|{phaseName}";
                     if (!_phaseRulesExecuted.Add(deduplicationKey))
@@ -163,6 +241,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             {
                 if (string.Equals(rule.TriggerEventType, eventType, StringComparison.OrdinalIgnoreCase))
                 {
+                    if (!IsRuleInScope(rule))
+                        continue;
+
                     _logger.Info($"Event triggered rule {rule.RuleId} (event: {eventType})");
                     ThreadPool.QueueUserWorkItem(_ => ExecuteRule(rule));
                 }
@@ -192,6 +273,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                 if (result.Count > 0)
                 {
+                    // EmitMode "on_change": hash the raw collector result (before ruleId/title
+                    // injection) and only emit when it differs from the last emitted one. An
+                    // empty result never reaches this point, so an emitOnlyIfExists miss neither
+                    // emits nor updates the hash — composing to "one event on appearance, then
+                    // only on change".
+                    if (IsOnChangeMode(rule) && !ShouldEmitOnChange(rule, result))
+                        return;
+
                     result["ruleId"] = rule.RuleId;
                     result["ruleTitle"] = rule.Title;
 
@@ -229,6 +318,199 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             }
         }
 
+        // ===== Phase scope (ActivePhases / ActiveFromPhase) =====
+
+        private static bool HasPhaseScope(GatherRule rule)
+        {
+            return (rule.ActivePhases != null && rule.ActivePhases.Count > 0)
+                || !string.IsNullOrEmpty(rule.ActiveFromPhase);
+        }
+
+        // Internal so the scope matrix is testable synchronously (no timer/ThreadPool races).
+        internal bool IsRuleInScope(GatherRule rule)
+        {
+            lock (_scopeLock)
+            {
+                return IsRuleInScopeLocked(rule);
+            }
+        }
+
+        private bool IsRuleInScopeLocked(GatherRule rule)
+        {
+            if (!HasPhaseScope(rule))
+                return true; // unscoped — legacy behavior
+
+            if (IgnorePhaseScope)
+            {
+                if (_scopeBypassLogged.Add(rule.RuleId))
+                    _logger.Info($"Gather rule {rule.RuleId}: phase scope ignored (diagnostic mode)");
+                return true;
+            }
+
+            // Both fields set is rejected by backend validation; defensively prefer ActivePhases.
+            if (rule.ActivePhases != null && rule.ActivePhases.Count > 0)
+            {
+                // No phase signal yet (or scope tokens that never match, e.g. "Unknown"):
+                // scoped rules stay inactive.
+                if (_currentPhase == EnrollmentPhase.Unknown)
+                    return false;
+
+                var phaseName = _currentPhase.ToString();
+                foreach (var phase in rule.ActivePhases)
+                {
+                    if (string.Equals(phase, phaseName, StringComparison.OrdinalIgnoreCase))
+                        return true;
+                }
+                return false;
+            }
+
+            return _fromPhaseLatched.Contains(rule.RuleId);
+        }
+
+        /// <summary>
+        /// Latches every from-phase rule whose threshold the current phase has reached.
+        /// Never latches on Unknown/Failed (Failed=99 would ordinal-satisfy every threshold);
+        /// once latched a rule stays active for the session — including through Failed.
+        /// Caller must hold <see cref="_scopeLock"/>.
+        /// </summary>
+        private void EvaluateFromPhaseLatchesLocked()
+        {
+            if (_currentPhase == EnrollmentPhase.Unknown || _currentPhase == EnrollmentPhase.Failed)
+                return;
+
+            foreach (var rule in _activeRules)
+            {
+                if (string.IsNullOrEmpty(rule.ActiveFromPhase)) continue;
+                if (rule.ActivePhases != null && rule.ActivePhases.Count > 0) continue; // ActivePhases wins
+                if (_fromPhaseLatched.Contains(rule.RuleId)) continue;
+
+                if (Enum.TryParse<EnrollmentPhase>(rule.ActiveFromPhase, ignoreCase: true, out var fromPhase)
+                    && fromPhase != EnrollmentPhase.Unknown
+                    && fromPhase != EnrollmentPhase.Failed
+                    && (int)_currentPhase >= (int)fromPhase)
+                {
+                    _fromPhaseLatched.Add(rule.RuleId);
+                    _logger.Info($"Gather rule {rule.RuleId}: from-phase scope latched at {_currentPhase} (activeFromPhase={rule.ActiveFromPhase})");
+                }
+            }
+        }
+
+        // ===== Emit mode (on_change) =====
+
+        private static bool IsOnChangeMode(GatherRule rule)
+        {
+            return string.Equals(rule.EmitMode, "on_change", StringComparison.OrdinalIgnoreCase);
+        }
+
+        /// <summary>
+        /// on_change decision for a non-empty collector result: true = emit (first result for the
+        /// rule, or the result changed), false = suppress. Hashes the result BEFORE ruleId/title
+        /// injection. On emit after a suppression streak, injects <c>suppressedPolls</c> and
+        /// <c>suppressedSinceUtc</c> into the result so the gap is observable.
+        /// Internal so the state machine is testable synchronously (no timer/ThreadPool races).
+        /// </summary>
+        internal bool ShouldEmitOnChange(GatherRule rule, Dictionary<string, object> result)
+        {
+            var hash = ComputeCanonicalHash(result);
+            bool emit;
+            lock (_scopeLock)
+            {
+                string lastHash;
+                if (_lastEmittedHash.TryGetValue(rule.RuleId, out lastHash) && lastHash == hash)
+                {
+                    (int Count, DateTime SinceUtc) streak;
+                    _suppressed[rule.RuleId] = _suppressed.TryGetValue(rule.RuleId, out streak)
+                        ? (streak.Count + 1, streak.SinceUtc)
+                        : (1, DateTime.UtcNow);
+                    emit = false;
+                }
+                else
+                {
+                    _lastEmittedHash[rule.RuleId] = hash;
+                    (int Count, DateTime SinceUtc) streak;
+                    if (_suppressed.TryGetValue(rule.RuleId, out streak) && streak.Count > 0)
+                    {
+                        result["suppressedPolls"] = streak.Count;
+                        result["suppressedSinceUtc"] = streak.SinceUtc.ToString("o", CultureInfo.InvariantCulture);
+                    }
+                    _suppressed.Remove(rule.RuleId);
+                    emit = true;
+                }
+            }
+
+            if (!emit)
+                _logger.Debug($"Gather rule {rule.RuleId}: result unchanged, emit suppressed (on_change)");
+            return emit;
+        }
+
+        /// <summary>
+        /// Canonical hash of a collector result: keys ordinal-sorted at every dictionary level,
+        /// values rendered with invariant formatting, then SHA-256. Internal for direct test
+        /// coverage of the canonicalization.
+        /// </summary>
+        internal static string ComputeCanonicalHash(Dictionary<string, object> result)
+        {
+            var sb = new StringBuilder();
+            AppendCanonicalValue(sb, result);
+            using (var sha = SHA256.Create())
+            {
+                var hashBytes = sha.ComputeHash(Encoding.UTF8.GetBytes(sb.ToString()));
+                return Convert.ToBase64String(hashBytes);
+            }
+        }
+
+        private static void AppendCanonicalValue(StringBuilder sb, object value)
+        {
+            if (value == null)
+            {
+                sb.Append("<null>");
+                return;
+            }
+
+            // string first — it is IEnumerable and must not be treated as a sequence
+            if (value is string str)
+            {
+                sb.Append('"').Append(str).Append('"');
+                return;
+            }
+
+            if (value is System.Collections.IDictionary dict)
+            {
+                sb.Append('{');
+                var keys = dict.Keys.Cast<object>()
+                    .Select(k => k?.ToString() ?? string.Empty)
+                    .OrderBy(k => k, StringComparer.Ordinal);
+                foreach (var key in keys)
+                {
+                    sb.Append(key).Append('=');
+                    AppendCanonicalValue(sb, dict[key]);
+                    sb.Append(';');
+                }
+                sb.Append('}');
+                return;
+            }
+
+            if (value is System.Collections.IEnumerable sequence)
+            {
+                sb.Append('[');
+                foreach (var item in sequence)
+                {
+                    AppendCanonicalValue(sb, item);
+                    sb.Append(';');
+                }
+                sb.Append(']');
+                return;
+            }
+
+            if (value is IFormattable formattable)
+            {
+                sb.Append(formattable.ToString(null, CultureInfo.InvariantCulture));
+                return;
+            }
+
+            sb.Append(value);
+        }
+
         private EventSeverity ParseSeverity(string severity)
         {
             return GatherRuleContext.ParseSeverity(severity);
@@ -245,7 +527,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
         /// <summary>
         /// Blocks until all startup rules that were queued by the most recent <see cref="UpdateRules"/>
-        /// call have finished executing, or the timeout elapses.
+        /// call have finished executing, or the timeout elapses. Deferred scoped startup rules
+        /// (waiting for their phase scope) are not part of the latch.
         /// Returns true if all rules completed within the timeout; false if timed out.
         /// </summary>
         public bool WaitForStartupRules(int timeoutSeconds = 120)

src/Agent/AutopilotMonitor.Agent.V2/Program.GatherRulesMode.cs

@@ -224,6 +224,11 @@ namespace AutopilotMonitor.Agent.V2
                     // Step 4 — run the executor and wait.
                     using (var executor = new GatherRuleExecutor(sessionId, tenantId, emitEvent, logger, config.ImeLogPathOverride))
                     {
+                        // Diagnostic mode has no enrollment phase context — scoped rules
+                        // (activePhases / activeFromPhase) execute unconditionally here.
+                        executor.IgnorePhaseScope = true;
+                        logger.Info("--run-gather-rules: phase scoping bypassed (no phase context in diagnostic mode).");
+
                         executor.UpdateRules(rules);
 
                         if (consoleMode) Console.WriteLine($"Running {startupRules.Count} rule(s)...");

src/Backend/AutopilotMonitor.Functions.Tests/GatherRuleScopeFieldsTests.cs

@@ -0,0 +1,283 @@
+using AutopilotMonitor.Functions.Functions.Rules;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Azure;
+using Azure.Data.Tables;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Covers the three gather-rule scope/emit fields (ActivePhases, ActiveFromPhase, EmitMode):
+/// Store↔Map table-serialization roundtrip (table-serialization rule: every model field in BOTH
+/// directions), legacy rows without the new columns, the <see cref="GatherRuleService.ContentEquivalent"/>
+/// null-tolerance (no reseed churn), and the create/update validation matrix in
+/// <see cref="GatherRulesFunction.ValidateScopeAndEmitMode"/>.
+/// </summary>
+public class GatherRuleScopeFieldsTests
+{
+    // ── Store ↔ Map roundtrip ──────────────────────────────────────────────
+
+    private static (TableStorageService service, Func<TableEntity?> lastUpserted) BuildStorageHarness()
+    {
+        TableEntity? captured = null;
+        var tableClient = new Mock<TableClient>();
+        tableClient
+            .Setup(c => c.UpsertEntityAsync(
+                It.IsAny<TableEntity>(), It.IsAny<TableUpdateMode>(), It.IsAny<CancellationToken>()))
+            .Returns<TableEntity, TableUpdateMode, CancellationToken>((e, _, _) =>
+            {
+                captured = e;
+                return Task.FromResult(new Mock<Response>().Object);
+            });
+
+        var serviceClient = new Mock<TableServiceClient>();
+        serviceClient.Setup(c => c.GetTableClient(It.IsAny<string>())).Returns(tableClient.Object);
+
+        var service = new TableStorageService(serviceClient.Object, NullLogger<TableStorageService>.Instance);
+        return (service, () => captured);
+    }
+
+    [Fact]
+    public async Task Roundtrip_ScopeFields_SurviveStoreAndMap()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-SCOPE-001",
+            Title = "Scoped rule",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Contoso",
+            Trigger = "interval",
+            IntervalSeconds = 60,
+            OutputEventType = "gather_scoped",
+            ActivePhases = new List<string> { "AccountSetup", "AppsUser" },
+            EmitMode = "on_change",
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.NotNull(mapped.ActivePhases);
+        Assert.Equal(new[] { "AccountSetup", "AppsUser" }, mapped.ActivePhases);
+        Assert.Null(mapped.ActiveFromPhase);
+        Assert.Equal("on_change", mapped.EmitMode);
+    }
+
+    [Fact]
+    public async Task Roundtrip_FromPhase_SurvivesStoreAndMap()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-SCOPE-002",
+            Title = "From-phase rule",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Contoso",
+            Trigger = "interval",
+            OutputEventType = "gather_scoped",
+            ActiveFromPhase = "AccountSetup",
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.Null(mapped.ActivePhases);
+        Assert.Equal("AccountSetup", mapped.ActiveFromPhase);
+        Assert.Null(mapped.EmitMode);
+    }
+
+    [Fact]
+    public async Task Roundtrip_NullScopeFields_StayNull()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-SCOPE-003",
+            Title = "Unscoped rule",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Contoso",
+            Trigger = "startup",
+            OutputEventType = "gather_plain",
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.Null(mapped.ActivePhases);
+        Assert.Null(mapped.ActiveFromPhase);
+        Assert.Null(mapped.EmitMode);
+    }
+
+    [Fact]
+    public void Map_LegacyRow_WithoutScopeColumns_DefaultsToNull()
+    {
+        var (service, _) = BuildStorageHarness();
+        // A row written before the scope fields existed: none of the new columns present.
+        var legacy = new TableEntity("global", "GATHER-LEGACY-001")
+        {
+            ["Title"] = "Legacy rule",
+            ["CollectorType"] = "registry",
+            ["Target"] = "HKLM\\SOFTWARE\\Contoso",
+            ["Trigger"] = "startup",
+            ["OutputEventType"] = "gather_legacy",
+        };
+
+        var mapped = service.MapToGatherRule(legacy);
+
+        Assert.Null(mapped.ActivePhases);
+        Assert.Null(mapped.ActiveFromPhase);
+        Assert.Null(mapped.EmitMode);
+    }
+
+    // ── ContentEquivalent ──────────────────────────────────────────────────
+
+    private static GatherRule BaseRule() => new()
+    {
+        RuleId = "GATHER-EQ-001",
+        Title = "Rule",
+        Description = "Desc",
+        Version = "1.0.0",
+        CollectorType = "registry",
+        Target = "HKLM\\SOFTWARE\\Contoso",
+        Trigger = "interval",
+        TriggerPhase = "",
+        OutputEventType = "gather_eq",
+    };
+
+    [Fact]
+    public void ContentEquivalent_NullAndEmptyActivePhases_AreEquivalent()
+    {
+        // Pre-existing DB rows map absent columns to null; seeds are also null — and an
+        // explicitly-empty list means the same "unrestricted". No reseed churn allowed.
+        var a = BaseRule();
+        var b = BaseRule();
+        b.ActivePhases = new List<string>();
+
+        Assert.True(GatherRuleService.ContentEquivalent(a, b));
+        Assert.True(GatherRuleService.ContentEquivalent(b, a));
+    }
+
+    [Fact]
+    public void ContentEquivalent_DetectsChangesInEachScopeField()
+    {
+        var baseline = BaseRule();
+
+        var phases = BaseRule();
+        phases.ActivePhases = new List<string> { "AccountSetup" };
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, phases));
+
+        var from = BaseRule();
+        from.ActiveFromPhase = "AccountSetup";
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, from));
+
+        var emit = BaseRule();
+        emit.EmitMode = "on_change";
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, emit));
+    }
+
+    [Fact]
+    public void ContentEquivalent_SameScopeFields_AreEquivalent()
+    {
+        var a = BaseRule();
+        a.ActivePhases = new List<string> { "DeviceSetup", "AccountSetup" };
+        a.EmitMode = "on_change";
+        var b = BaseRule();
+        b.ActivePhases = new List<string> { "DeviceSetup", "AccountSetup" };
+        b.EmitMode = "on_change";
+
+        Assert.True(GatherRuleService.ContentEquivalent(a, b));
+    }
+
+    // ── Validation ─────────────────────────────────────────────────────────
+
+    private static GatherRule ValidationRule(
+        List<string>? activePhases = null, string? activeFromPhase = null, string? emitMode = null) => new()
+    {
+        RuleId = "GATHER-VAL-001",
+        Title = "Rule",
+        CollectorType = "registry",
+        Target = "HKLM\\SOFTWARE\\Contoso",
+        Trigger = "interval",
+        OutputEventType = "gather_val",
+        ActivePhases = activePhases,
+        ActiveFromPhase = activeFromPhase,
+        EmitMode = emitMode,
+    };
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("Start")]
+    [InlineData("DevicePreparation")]
+    [InlineData("AccountSetup")]
+    [InlineData("Complete")]
+    [InlineData("accountsetup")] // case-insensitive
+    public void Validate_AcceptsValidFromPhase(string? fromPhase)
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(activeFromPhase: fromPhase)));
+    }
+
+    [Theory]
+    [InlineData("Unknown")]
+    [InlineData("Failed")]
+    [InlineData("4")]          // numeric enum value — canonical names only
+    [InlineData("DeviceESP")]  // the invalid token the old free-text UI suggested
+    public void Validate_RejectsInvalidFromPhase(string fromPhase)
+    {
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(activeFromPhase: fromPhase)));
+    }
+
+    [Fact]
+    public void Validate_AcceptsValidActivePhases_AndRejectsInvalidEntries()
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(
+            ValidationRule(activePhases: new List<string> { "DeviceSetup", "AppsDevice" })));
+
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(
+            ValidationRule(activePhases: new List<string> { "DeviceSetup", "Failed" })));
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(
+            ValidationRule(activePhases: new List<string> { "" })));
+    }
+
+    [Fact]
+    public void Validate_RejectsBothScopeFieldsSet()
+    {
+        var error = GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(
+            activePhases: new List<string> { "AccountSetup" }, activeFromPhase: "DeviceSetup"));
+
+        Assert.NotNull(error);
+        Assert.Contains("mutually exclusive", error);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("always")]
+    [InlineData("on_change")]
+    [InlineData("ON_CHANGE")] // case-insensitive
+    public void Validate_AcceptsValidEmitModes(string? emitMode)
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(emitMode: emitMode)));
+    }
+
+    [Fact]
+    public void Validate_RejectsUnknownEmitMode()
+    {
+        Assert.NotNull(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(emitMode: "sometimes")));
+    }
+
+    [Fact]
+    public void Validate_TogglePartialPayload_PassesThrough()
+    {
+        // The portal toggle sends only { enabled, isBuiltIn, isCommunity } — none of the
+        // scope fields — and must not be rejected.
+        var toggle = new GatherRule { RuleId = "GATHER-VAL-002", Enabled = false };
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(toggle));
+    }
+
+    [Fact]
+    public void Validate_EmptyActivePhasesList_IsUnrestricted_AndPasses()
+    {
+        Assert.Null(GatherRulesFunction.ValidateScopeAndEmitMode(ValidationRule(activePhases: new List<string>())));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GatherRuleUpdatePartialMergeTests.cs

@@ -0,0 +1,146 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the custom-rule partial-PUT fix on <see cref="GatherRuleService.UpdateRuleAsync"/>:
+/// the portal toggle PUTs only { enabled, isBuiltIn, isCommunity }, and full-storing that
+/// payload wiped Title/Target/Trigger/Parameters of the custom rule. Toggle-style partials
+/// (empty Title/CollectorType/Target) must merge Enabled into the existing row; full payloads
+/// (edit flow) must still replace the row but preserve the original CreatedAt.
+/// </summary>
+public class GatherRuleUpdatePartialMergeTests
+{
+    private const string TenantId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+    private const string RuleId = "GATHER-CUST-001";
+
+    private static GatherRule ExistingCustomRule() => new()
+    {
+        RuleId = RuleId,
+        Title = "Collect BIOS Config",
+        Description = "Reads the RealmJoin BIOS key",
+        Category = "device",
+        CollectorType = "registry",
+        Target = "HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS",
+        Parameters = new Dictionary<string, string> { ["valueName"] = "Version" },
+        Trigger = "interval",
+        IntervalSeconds = 60,
+        OutputEventType = "gather_bios_config",
+        Enabled = true,
+        IsBuiltIn = false,
+        IsCommunity = false,
+        CreatedAt = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc),
+        ActiveFromPhase = "AccountSetup",
+        EmitMode = "on_change",
+    };
+
+    private static (GatherRuleService service, Mock<IRuleRepository> repo, List<GatherRule> stored) BuildService(
+        GatherRule? existingTenantRule)
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Loose);
+        var stored = new List<GatherRule>();
+
+        repo.Setup(r => r.GetGatherRulesAsync("global")).ReturnsAsync(new List<GatherRule>());
+        repo.Setup(r => r.GetGatherRulesAsync(TenantId)).ReturnsAsync(
+            existingTenantRule == null ? new List<GatherRule>() : new List<GatherRule> { existingTenantRule });
+        repo.Setup(r => r.StoreGatherRuleAsync(It.IsAny<GatherRule>(), TenantId))
+            .Callback<GatherRule, string>((rule, _) => stored.Add(rule))
+            .ReturnsAsync(true);
+
+        return (new GatherRuleService(repo.Object, NullLogger<GatherRuleService>.Instance), repo, stored);
+    }
+
+    [Fact]
+    public async Task TogglePartial_merges_enabled_and_preserves_definition_fields()
+    {
+        var existing = ExistingCustomRule();
+        var (service, _, stored) = BuildService(existing);
+
+        // Exactly what the portal toggle sends: { enabled, isBuiltIn, isCommunity }.
+        var togglePayload = new GatherRule { RuleId = RuleId, Enabled = false, IsBuiltIn = false, IsCommunity = false };
+
+        var ok = await service.UpdateRuleAsync(TenantId, togglePayload);
+
+        Assert.True(ok);
+        var written = Assert.Single(stored);
+        Assert.False(written.Enabled);
+        Assert.Equal("Collect BIOS Config", written.Title);
+        Assert.Equal("HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS", written.Target);
+        Assert.Equal("registry", written.CollectorType);
+        Assert.Equal("interval", written.Trigger);
+        Assert.Equal(60, written.IntervalSeconds);
+        Assert.Equal("Version", written.Parameters["valueName"]);
+        Assert.Equal("AccountSetup", written.ActiveFromPhase);
+        Assert.Equal("on_change", written.EmitMode);
+        Assert.Equal(existing.CreatedAt, written.CreatedAt);
+    }
+
+    [Fact]
+    public async Task TogglePartial_for_unknown_custom_rule_fails_without_storing()
+    {
+        var (service, repo, stored) = BuildService(existingTenantRule: null);
+
+        var togglePayload = new GatherRule { RuleId = RuleId, Enabled = false, IsBuiltIn = false, IsCommunity = false };
+
+        var ok = await service.UpdateRuleAsync(TenantId, togglePayload);
+
+        Assert.False(ok);
+        Assert.Empty(stored);
+        repo.Verify(r => r.StoreGatherRuleAsync(It.IsAny<GatherRule>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task FullPayload_replaces_rule_but_preserves_original_CreatedAt()
+    {
+        var existing = ExistingCustomRule();
+        var (service, _, stored) = BuildService(existing);
+
+        var fullPayload = new GatherRule
+        {
+            RuleId = RuleId,
+            Title = "Collect BIOS Config v2",
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS2",
+            Trigger = "interval",
+            IntervalSeconds = 120,
+            OutputEventType = "gather_bios_config",
+            Enabled = true,
+            // Edit flow sends createdAt from the client; a JSON-mode edit may omit it and
+            // default to UtcNow — either way the stored row must keep the original.
+            CreatedAt = DateTime.UtcNow,
+        };
+
+        var ok = await service.UpdateRuleAsync(TenantId, fullPayload);
+
+        Assert.True(ok);
+        var written = Assert.Single(stored);
+        Assert.Equal("Collect BIOS Config v2", written.Title);
+        Assert.Equal("HKLM\\SOFTWARE\\RealmJoin\\Custom\\BIOS2", written.Target);
+        Assert.Equal(120, written.IntervalSeconds);
+        Assert.False(written.IsBuiltIn);
+        Assert.False(written.IsCommunity);
+        Assert.Equal(existing.CreatedAt, written.CreatedAt);
+    }
+
+    [Fact]
+    public async Task BuiltInRule_toggle_still_goes_through_RuleState_path()
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Loose);
+        repo.Setup(r => r.GetGatherRulesAsync("global")).ReturnsAsync(new List<GatherRule>
+        {
+            new() { RuleId = RuleId, IsBuiltIn = true, Title = "Built-in", Enabled = true }
+        });
+        repo.Setup(r => r.StoreRuleStateAsync(TenantId, RuleId, It.IsAny<RuleState>())).ReturnsAsync(true);
+        var service = new GatherRuleService(repo.Object, NullLogger<GatherRuleService>.Instance);
+
+        var ok = await service.UpdateRuleAsync(TenantId, new GatherRule { RuleId = RuleId, Enabled = false });
+
+        Assert.True(ok);
+        repo.Verify(r => r.StoreRuleStateAsync(TenantId, RuleId, It.Is<RuleState>(s => !s.Enabled)), Times.Once);
+        repo.Verify(r => r.StoreGatherRuleAsync(It.IsAny<GatherRule>(), It.IsAny<string>()), Times.Never);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/HealthCheckServiceAgentBinariesTests.cs

@@ -0,0 +1,107 @@
+using System.Collections.Generic;
+using System.Net;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Functions.Tests.GraphResolution;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Service-level tests for the Agent Binaries HealthCheck card. The check probes the
+/// canonical download alias (download.autopilotmonitor.com) AND the legacy blob keepalive
+/// account: alias failure is unhealthy (new installs break), legacy failure is only a
+/// warning (existing customers break until they migrate to the alias).
+/// </summary>
+public class HealthCheckServiceAgentBinariesTests
+{
+    private const string AliasHost = "download.autopilotmonitor.com";
+    private const string LegacyHost = "autopilotmonitor.blob.core.windows.net";
+
+    [Fact]
+    public async Task Check_AllEndpointsAvailable_ReportsHealthyWithoutUrlDetails()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.OK, "")
+            .When(LegacyHost, HttpStatusCode.OK, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("Agent Binaries", check.Name);
+        Assert.Equal("healthy", check.Status);
+        Assert.Contains("download alias", check.Message);
+        Assert.Null(check.Details);
+        // Both hosts must actually have been probed (ZIP + PS1 each).
+        Assert.Equal(2, handler.Requests.FindAll(u => u.Contains(AliasHost)).Count);
+        Assert.Equal(2, handler.Requests.FindAll(u => u.Contains(LegacyHost)).Count);
+    }
+
+    [Fact]
+    public async Task Check_WithEndpointUrls_SurfacesAliasAndLegacyUrlsInDetails()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.OK, "")
+            .When(LegacyHost, HttpStatusCode.OK, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: true);
+
+        Assert.NotNull(check.Details);
+        Assert.Equal("https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip", check.Details!["Agent ZIP"]);
+        Assert.Equal("https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1", check.Details["Bootstrap script"]);
+        Assert.Equal("https://autopilotmonitor.blob.core.windows.net/agent", check.Details["Legacy blob (keepalive)"]);
+    }
+
+    [Fact]
+    public async Task Check_LegacyBlobMissing_ReportsWarningNamingTheLegacyEndpoint()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.OK, "")
+            .When(LegacyHost, HttpStatusCode.NotFound, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("warning", check.Status);
+        Assert.Contains("legacy", check.Message, System.StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("404", check.Message);
+    }
+
+    [Fact]
+    public async Task Check_AliasMissing_ReportsUnhealthy()
+    {
+        var handler = new StubHttpMessageHandler()
+            .When(AliasHost, HttpStatusCode.NotFound, "")
+            .When(LegacyHost, HttpStatusCode.OK, "");
+
+        var check = await BuildService(handler).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("unhealthy", check.Status);
+        Assert.Contains("download alias", check.Message);
+    }
+
+    [Fact]
+    public async Task Check_EndpointsUnreachable_ReportsUnhealthy()
+    {
+        // Un-scripted URLs make the stub throw — models a connection failure.
+        var check = await BuildService(new StubHttpMessageHandler()).CheckAgentBinariesAsync(includeEndpointUrls: false);
+
+        Assert.Equal("unhealthy", check.Status);
+        Assert.Contains("unreachable", check.Message);
+    }
+
+    private static HealthCheckService BuildService(StubHttpMessageHandler handler)
+    {
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>())
+            .Build();
+
+        return new HealthCheckService(
+            NullLogger<HealthCheckService>.Instance,
+            adminConfigService: null!,
+            httpClientFactory: new StubHttpClientFactory(handler),
+            metricsReader: null!,
+            poisonQueueProbe: null!,
+            configuration: config);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/HealthCheckServiceMcpServerTests.cs

@@ -53,6 +53,29 @@ public class HealthCheckServiceMcpServerTests
         Assert.DoesNotContain("http", check.Message, System.StringComparison.OrdinalIgnoreCase);
     }
 
+    [Fact]
+    public async Task Check_WithEndpointUrl_SurfacesServerUrlAlongsideVersion()
+    {
+        var svc = BuildService(HttpStatusCode.OK, "{\"status\":\"healthy\",\"version\":\"1.4.0\"}");
+
+        var check = await svc.CheckMcpServerAsync(includeEndpointUrl: true);
+
+        // The Version detail must merge into — not replace — the Server URL detail.
+        Assert.Equal("https://mcp.example.test", check.Details!["Server URL"]);
+        Assert.Equal("1.4.0", check.Details["Version"]);
+    }
+
+    [Fact]
+    public async Task Check_WithEndpointUrl_SurfacesServerUrlEvenWhenUnhealthy()
+    {
+        var svc = BuildService(HttpStatusCode.ServiceUnavailable, "");
+
+        var check = await svc.CheckMcpServerAsync(includeEndpointUrl: true);
+
+        Assert.Equal("unhealthy", check.Status);
+        Assert.Equal("https://mcp.example.test", check.Details!["Server URL"]);
+    }
+
     [Fact]
     public async Task Check_TimeoutOrConnectionFailure_ReportsWarningForColdStart()
     {

src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs

@@ -270,7 +270,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
             var response = req.CreateResponse(HttpStatusCode.OK);
             await response.WriteAsJsonAsync(new AgentConfigResponse
             {
-                ConfigVersion = 33, // Agent endpoint migration on the config channel (MigrateToApiBaseUrl; live-fetch-only, allowlist-validated, one hop, kill wins)
+                ConfigVersion = 34, // Gather rule phase scoping (ActivePhases/ActiveFromPhase) + EmitMode on_change anti-spam
                 UploadIntervalSeconds = 10,
                 SelfDestructOnComplete = tenantConfig.SelfDestructOnComplete ?? true,
                 KeepLogFile = tenantConfig.KeepLogFile ?? false,
@@ -314,7 +314,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
                 DeviceBlocked = killVerdict.IsBlocked,
                 DeviceKillSignal = killVerdict.IsKill,
                 UnblockAt = killVerdict.UnblockAt,
-                MigrateToApiBaseUrl = migrateTarget!,
+                MigrateToApiBaseUrl = migrateTarget,
             });
 
             return response;

src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/HealthCheckFunction.cs

@@ -102,17 +102,19 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
 
             // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
 
-            // Perform comprehensive health checks
-            var healthCheckResult = await _healthCheckService.PerformAllChecksAsync();
-
-            // SignalR Quota check exposes the subscription/resource-group path of the
-            // backing SignalR resource, and Poison Queues exposes internal async-worker
-            // queue topology — restrict both to Global Admins. Non-GA callers
-            // (Tenant Admins, Operators) get the rest of the report unchanged.
+            // SignalR Quota exposes the subscription/resource-group path of the backing
+            // SignalR resource, Poison Queues exposes internal async-worker queue topology,
+            // and endpoint URLs in the check details expose infrastructure hostnames —
+            // restrict all of that to Global Admins. Non-GA callers (Tenant Admins,
+            // Operators) get the rest of the report unchanged.
             // The route is registered as AuthenticatedUser, so PolicyEnforcementMiddleware
             // does NOT compute IsGlobalAdmin; resolve it directly via GlobalAdminService.
             var requestCtx = context.GetRequestContext();
             var isGlobalAdmin = await _globalAdminService.IsGlobalAdminAsync(requestCtx.UserPrincipalName);
+
+            // Perform comprehensive health checks (endpoint URLs only for Global Admins)
+            var healthCheckResult = await _healthCheckService.PerformAllChecksAsync(includeEndpointUrls: isGlobalAdmin);
+
             var visibleChecks = isGlobalAdmin
                 ? healthCheckResult.Checks
                 : healthCheckResult.Checks
@@ -146,10 +148,14 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
         /// </summary>
         [Function("McpHealthCheck")]
         public async Task<HttpResponseData> GetMcpHealthCheck(
-            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "health/mcp")] HttpRequestData req)
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "health/mcp")] HttpRequestData req,
+            FunctionContext context)
         {
             // Authentication enforced by PolicyEnforcementMiddleware (AuthenticatedUser).
-            var check = await _healthCheckService.CheckMcpServerAsync();
+            // The MCP server URL is infrastructure topology — include it only for Global Admins.
+            var requestCtx = context.GetRequestContext();
+            var isGlobalAdmin = await _globalAdminService.IsGlobalAdminAsync(requestCtx.UserPrincipalName);
+            var check = await _healthCheckService.CheckMcpServerAsync(includeEndpointUrl: isGlobalAdmin);
 
             var response = req.CreateResponse(HttpStatusCode.OK);
             await response.WriteAsJsonAsync(new

src/Backend/AutopilotMonitor.Functions/Functions/Rules/GatherRulesFunction.cs

@@ -64,6 +64,14 @@ namespace AutopilotMonitor.Functions.Functions.Rules
                 return badRequest;
             }
 
+            var scopeError = ValidateScopeAndEmitMode(rule);
+            if (scopeError != null)
+            {
+                var badRequest = req.CreateResponse(HttpStatusCode.BadRequest);
+                await badRequest.WriteAsJsonAsync(new { success = false, message = scopeError });
+                return badRequest;
+            }
+
             try
             {
                 var success = await _ruleService.CreateRuleAsync(tenantId, rule);
@@ -108,12 +116,71 @@ namespace AutopilotMonitor.Functions.Functions.Rules
 
             rule.RuleId = ruleId;
 
+            var scopeError = ValidateScopeAndEmitMode(rule);
+            if (scopeError != null)
+            {
+                var badRequest = req.CreateResponse(HttpStatusCode.BadRequest);
+                await badRequest.WriteAsJsonAsync(new { success = false, message = scopeError });
+                return badRequest;
+            }
+
             var success = await _ruleService.UpdateRuleAsync(tenantId, rule);
             var response = req.CreateResponse(success ? HttpStatusCode.OK : HttpStatusCode.InternalServerError);
             await response.WriteAsJsonAsync(new { success, message = success ? "Rule updated" : "Failed to update rule" });
             return response;
         }
 
+        /// <summary>
+        /// Selectable phase-scope tokens: the <see cref="EnrollmentPhase"/> enum NAMES from
+        /// Start(0) through Complete(7). Explicit name list (not Enum.TryParse) so numeric
+        /// tokens ("4") and the non-selectable Unknown/Failed members are rejected — the
+        /// canonical vocabulary the agent, schema, and portal share.
+        /// </summary>
+        private static readonly HashSet<string> ValidScopePhases = new(StringComparer.OrdinalIgnoreCase)
+        {
+            nameof(EnrollmentPhase.Start),
+            nameof(EnrollmentPhase.DevicePreparation),
+            nameof(EnrollmentPhase.DeviceSetup),
+            nameof(EnrollmentPhase.AppsDevice),
+            nameof(EnrollmentPhase.AccountSetup),
+            nameof(EnrollmentPhase.AppsUser),
+            nameof(EnrollmentPhase.FinalizingSetup),
+            nameof(EnrollmentPhase.Complete),
+        };
+
+        /// <summary>
+        /// Validates the phase-scope + emit-mode fields on create/update.
+        /// Returns an error message for a 400 response, or null when valid.
+        /// Toggle-style partial payloads carry none of these fields and pass through.
+        /// </summary>
+        internal static string? ValidateScopeAndEmitMode(GatherRule rule)
+        {
+            var hasActivePhases = rule.ActivePhases != null && rule.ActivePhases.Count > 0;
+            var hasFromPhase = !string.IsNullOrEmpty(rule.ActiveFromPhase);
+
+            if (hasActivePhases && hasFromPhase)
+                return "activePhases and activeFromPhase are mutually exclusive — set only one.";
+
+            if (hasActivePhases)
+            {
+                foreach (var phase in rule.ActivePhases!)
+                {
+                    if (string.IsNullOrEmpty(phase) || !ValidScopePhases.Contains(phase))
+                        return $"Invalid phase '{phase}' in activePhases. Valid phases: {string.Join(", ", ValidScopePhases)}.";
+                }
+            }
+
+            if (hasFromPhase && !ValidScopePhases.Contains(rule.ActiveFromPhase!))
+                return $"Invalid activeFromPhase '{rule.ActiveFromPhase}'. Valid phases: {string.Join(", ", ValidScopePhases)}.";
+
+            if (!string.IsNullOrEmpty(rule.EmitMode)
+                && !string.Equals(rule.EmitMode, "always", StringComparison.OrdinalIgnoreCase)
+                && !string.Equals(rule.EmitMode, "on_change", StringComparison.OrdinalIgnoreCase))
+                return "emitMode must be \"always\" or \"on_change\".";
+
+            return null;
+        }
+
         [Function("DeleteGatherRule")]
         public async Task<HttpResponseData> DeleteRule(
             [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "rules/gather/{ruleId}")] HttpRequestData req,

src/Backend/AutopilotMonitor.Functions/Services/GatherRuleService.cs

@@ -151,10 +151,38 @@ namespace AutopilotMonitor.Functions.Services
                 return await _ruleRepo.StoreRuleStateAsync(tenantId, rule.RuleId, new RuleState { Enabled = rule.Enabled });
             }
 
+            // Custom rule. The portal toggle PUTs only { enabled, isBuiltIn, isCommunity } —
+            // full-storing that payload would wipe Title/Target/Trigger/Parameters. Merge
+            // toggle-style partials into the existing row; full payloads (edit flow) replace
+            // the row but keep the original CreatedAt.
+            var existing = (await _ruleRepo.GetGatherRulesAsync(tenantId))
+                .FirstOrDefault(r => r.RuleId == rule.RuleId && !r.IsBuiltIn && !r.IsCommunity);
+
+            var isTogglePartial = string.IsNullOrEmpty(rule.Title)
+                && string.IsNullOrEmpty(rule.CollectorType)
+                && string.IsNullOrEmpty(rule.Target);
+
+            if (isTogglePartial)
+            {
+                if (existing == null)
+                {
+                    _logger.LogWarning(
+                        "Toggle-style partial update for unknown custom gather rule {RuleId} (tenant {TenantId}); nothing to update",
+                        rule.RuleId, tenantId);
+                    return false;
+                }
+
+                existing.Enabled = rule.Enabled;
+                existing.UpdatedAt = DateTime.UtcNow;
+                return await _ruleRepo.StoreGatherRuleAsync(existing, tenantId);
+            }
+
             // Ensure custom rules keep correct flags (the incoming payload may
             // omit them, causing them to default to IsBuiltIn=true in the model).
             rule.IsBuiltIn = false;
             rule.IsCommunity = false;
+            if (existing != null)
+                rule.CreatedAt = existing.CreatedAt;
             rule.UpdatedAt = DateTime.UtcNow;
             return await _ruleRepo.StoreGatherRuleAsync(rule, tenantId);
         }
@@ -413,7 +441,22 @@ namespace AutopilotMonitor.Functions.Services
                 && a.Title == b.Title
                 && a.CollectorType == b.CollectorType
                 && a.Trigger == b.Trigger
-                && a.TriggerPhase == b.TriggerPhase;
+                && a.TriggerPhase == b.TriggerPhase
+                && ActivePhasesEquivalent(a.ActivePhases, b.ActivePhases)
+                && a.ActiveFromPhase == b.ActiveFromPhase
+                && a.EmitMode == b.EmitMode;
+        }
+
+        /// <summary>
+        /// Null-tolerant ordered comparison for <see cref="GatherRule.ActivePhases"/>:
+        /// null and empty are both "unrestricted" and therefore equivalent, so pre-existing
+        /// DB rows (absent column → null) never diff against seeds (also null) — no reseed churn.
+        /// </summary>
+        private static bool ActivePhasesEquivalent(List<string>? a, List<string>? b)
+        {
+            var left = a ?? new List<string>();
+            var right = b ?? new List<string>();
+            return left.SequenceEqual(right, StringComparer.Ordinal);
         }
     }
 }

src/Backend/AutopilotMonitor.Functions/Services/HealthCheckService.cs

@@ -34,9 +34,12 @@ public class HealthCheckService
     }
 
     /// <summary>
-    /// Performs all health checks and returns the results
+    /// Performs all health checks and returns the results.
+    /// <paramref name="includeEndpointUrls"/> adds the probed/backing endpoint URLs to the
+    /// per-check details — infrastructure topology, so callers must only enable it for
+    /// Global Admins.
     /// </summary>
-    public async Task<HealthCheckResult> PerformAllChecksAsync()
+    public async Task<HealthCheckResult> PerformAllChecksAsync(bool includeEndpointUrls = false)
     {
         var result = new HealthCheckResult
         {
@@ -50,9 +53,9 @@ public class HealthCheckService
         // one slow check. It is exposed via its own endpoint (GET health/mcp) that the
         // frontend fetches independently and folds into the card grid incrementally.
         var checks = await Task.WhenAll(
-            CheckStorageBackendAsync(),
-            CheckProcessingBackendAsync(),
-            CheckAgentBinariesAsync(),
+            CheckStorageBackendAsync(includeEndpointUrls),
+            CheckProcessingBackendAsync(includeEndpointUrls),
+            CheckAgentBinariesAsync(includeEndpointUrls),
             CheckSignalRQuotaAsync(),
             CheckPoisonQueuesAsync()
         );
@@ -73,7 +76,7 @@ public class HealthCheckService
     /// <summary>
     /// Checks Azure Table Storage connectivity by querying the admin configuration table
     /// </summary>
-    private async Task<HealthCheck> CheckStorageBackendAsync()
+    private async Task<HealthCheck> CheckStorageBackendAsync(bool includeEndpointUrls)
     {
         var check = new HealthCheck
         {
@@ -97,29 +100,62 @@ public class HealthCheckService
             _logger.LogError(ex, "Storage backend health check failed");
         }
 
+        if (includeEndpointUrls)
+        {
+            // Same resolution order as TableStorageService: account name (Managed Identity)
+            // is the production path, connection string is the local-dev fallback.
+            var accountName = _configuration["AzureStorageAccountName"];
+            check.Details = new Dictionary<string, object>
+            {
+                ["Table endpoint"] = string.IsNullOrWhiteSpace(accountName)
+                    ? "connection string (local dev)"
+                    : $"https://{accountName}.table.core.windows.net"
+            };
+        }
+
         return check;
     }
 
     /// <summary>
     /// Checks that the Azure Functions host is running
     /// </summary>
-    private static Task<HealthCheck> CheckProcessingBackendAsync()
+    private static Task<HealthCheck> CheckProcessingBackendAsync(bool includeEndpointUrls)
     {
         var uptime = DateTime.UtcNow - System.Diagnostics.Process.GetCurrentProcess().StartTime.ToUniversalTime();
 
-        return Task.FromResult(new HealthCheck
+        var check = new HealthCheck
         {
             Name = "Processing Backend",
             Description = "Application host process",
             Status = "healthy",
             Message = $"Host running (uptime: {(int)uptime.TotalMinutes}m {uptime.Seconds}s)"
-        });
+        };
+
+        if (includeEndpointUrls)
+        {
+            // WEBSITE_HOSTNAME is stamped by App Service and reflects the host actually
+            // serving this process — no hardcoded URL to go stale after a migration.
+            var hostname = Environment.GetEnvironmentVariable("WEBSITE_HOSTNAME");
+            if (!string.IsNullOrWhiteSpace(hostname))
+            {
+                check.Details = new Dictionary<string, object>
+                {
+                    ["API endpoint"] = $"https://{hostname}"
+                };
+            }
+        }
+
+        return Task.FromResult(check);
     }
 
     /// <summary>
-    /// Checks that the agent binaries (ZIP) and bootstrap script (PS1) are reachable in blob storage
+    /// Checks that the agent binaries (ZIP) and bootstrap script (PS1) are reachable on the
+    /// canonical download alias (Front Door → current blob origin) AND on the legacy blob
+    /// keepalive account that already-deployed customer bootstrap scripts still use.
+    /// Alias failure is unhealthy (new installs break); legacy failure is a warning
+    /// (existing customers break until they migrate to the alias).
     /// </summary>
-    private async Task<HealthCheck> CheckAgentBinariesAsync()
+    internal async Task<HealthCheck> CheckAgentBinariesAsync(bool includeEndpointUrls)
     {
         var check = new HealthCheck
         {
@@ -127,8 +163,20 @@ public class HealthCheckService
             Description = "Agent download package availability"
         };
 
-        var zipUrl = $"{Constants.AgentBlobBaseUrl}/{Constants.AgentZipFileName}";
-        var ps1Url = $"{Constants.AgentBlobBaseUrl}/Install-AutopilotMonitor.ps1";
+        var aliasZipUrl = $"{Constants.AgentDownloadBaseUrl}/{Constants.AgentZipFileName}";
+        var aliasPs1Url = $"{Constants.AgentDownloadBaseUrl}/{Constants.BootstrapScriptName}";
+        var legacyZipUrl = $"{Constants.AgentBlobBaseUrl}/{Constants.AgentZipFileName}";
+        var legacyPs1Url = $"{Constants.AgentBlobBaseUrl}/{Constants.BootstrapScriptName}";
+
+        if (includeEndpointUrls)
+        {
+            check.Details = new Dictionary<string, object>
+            {
+                ["Agent ZIP"] = aliasZipUrl,
+                ["Bootstrap script"] = aliasPs1Url,
+                ["Legacy blob (keepalive)"] = Constants.AgentBlobBaseUrl
+            };
+        }
 
         try
         {
@@ -138,40 +186,48 @@ public class HealthCheckService
             var sw = System.Diagnostics.Stopwatch.StartNew();
 
             // HEAD requests to check availability without downloading
-            var zipRequest = new HttpRequestMessage(HttpMethod.Head, zipUrl);
-            var ps1Request = new HttpRequestMessage(HttpMethod.Head, ps1Url);
-
             var results = await Task.WhenAll(
-                client.SendAsync(zipRequest),
-                client.SendAsync(ps1Request)
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, aliasZipUrl)),
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, aliasPs1Url)),
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, legacyZipUrl)),
+                client.SendAsync(new HttpRequestMessage(HttpMethod.Head, legacyPs1Url))
             );
 
             sw.Stop();
 
-            var zipResponse = results[0];
-            var ps1Response = results[1];
+            var aliasZipOk = results[0].IsSuccessStatusCode;
+            var aliasPs1Ok = results[1].IsSuccessStatusCode;
+            var legacyZipOk = results[2].IsSuccessStatusCode;
+            var legacyPs1Ok = results[3].IsSuccessStatusCode;
 
-            var zipOk = zipResponse.IsSuccessStatusCode;
-            var ps1Ok = ps1Response.IsSuccessStatusCode;
+            var issues = new List<string>();
+            if (!aliasZipOk) issues.Add($"Agent ZIP (download alias): {(int)results[0].StatusCode}");
+            if (!aliasPs1Ok) issues.Add($"Bootstrap script (download alias): {(int)results[1].StatusCode}");
+            if (!legacyZipOk) issues.Add($"Agent ZIP (legacy blob): {(int)results[2].StatusCode}");
+            if (!legacyPs1Ok) issues.Add($"Bootstrap script (legacy blob): {(int)results[3].StatusCode}");
 
-            if (zipOk && ps1Ok)
+            if (issues.Count == 0)
             {
                 check.Status = "healthy";
-                check.Message = $"Agent package and bootstrap script available ({sw.ElapsedMilliseconds}ms)";
+                check.Message = $"Agent package and bootstrap script available via download alias + legacy blob ({sw.ElapsedMilliseconds}ms)";
+            }
+            else if (aliasZipOk && aliasPs1Ok)
+            {
+                // Alias intact, legacy keepalive degraded — existing customer bootstrap
+                // scripts still download from the legacy account until they migrate.
+                check.Status = "warning";
+                check.Message = $"Download alias OK, but legacy keepalive degraded — {string.Join(", ", issues)}";
             }
             else
             {
                 check.Status = "unhealthy";
-                var issues = new List<string>();
-                if (!zipOk) issues.Add($"Agent ZIP: {(int)zipResponse.StatusCode}");
-                if (!ps1Ok) issues.Add($"Bootstrap script: {(int)ps1Response.StatusCode}");
                 check.Message = $"Missing: {string.Join(", ", issues)}";
             }
         }
         catch (Exception ex)
         {
             check.Status = "unhealthy";
-            check.Message = $"Blob storage unreachable: {ex.Message}";
+            check.Message = $"Agent download endpoints unreachable: {ex.Message}";
             _logger.LogError(ex, "Agent binaries health check failed");
         }
 
@@ -182,7 +238,8 @@ public class HealthCheckService
     /// Probes the MCP server's public <c>/health</c> endpoint (which sits in front of the
     /// <c>/mcp</c> access guard, so no auth is required) and surfaces reachability + the
     /// deployed MCP build version. Visible to all authenticated users, so the server URL is
-    /// deliberately NOT included in the message or details.
+    /// only included in the details when <paramref name="includeEndpointUrl"/> is set —
+    /// callers must only enable it for Global Admins.
     /// <para>
     /// The Container App runs with minReplicas=0 and scales to zero on idle. Azure Container
     /// Apps holds an inbound request while it activates a cold replica, so this probe doubles
@@ -193,7 +250,7 @@ public class HealthCheckService
     /// the blocking all-checks batch, so the dashboard never waits on the wake.
     /// </para>
     /// </summary>
-    internal async Task<HealthCheck> CheckMcpServerAsync()
+    internal async Task<HealthCheck> CheckMcpServerAsync(bool includeEndpointUrl = false)
     {
         var check = new HealthCheck
         {
@@ -203,6 +260,11 @@ public class HealthCheckService
 
         var baseUrl = (_configuration["McpServerUrl"] ?? Constants.McpServerBaseUrl).TrimEnd('/');
         var healthUrl = $"{baseUrl}/health";
+
+        if (includeEndpointUrl)
+        {
+            check.Details = new Dictionary<string, object> { ["Server URL"] = baseUrl };
+        }
         var timeoutSeconds = ParsePositiveInt("McpServerHealthTimeoutSeconds", 30);
 
         // A cold start that takes longer than this is treated as a successful wake rather
@@ -233,7 +295,8 @@ public class HealthCheckService
                 : $"MCP server reachable ({sw.ElapsedMilliseconds}ms)";
             if (!string.IsNullOrWhiteSpace(version))
             {
-                check.Details = new Dictionary<string, object> { ["Version"] = version };
+                check.Details ??= new Dictionary<string, object>();
+                check.Details["Version"] = version;
             }
         }
         catch (Exception ex) when (ex is TaskCanceledException or OperationCanceledException or HttpRequestException)

src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.Aggregation.cs

@@ -554,52 +554,53 @@ namespace AutopilotMonitor.Functions.Services
         }
 
         /// <summary>
-        /// Verifies that agent binaries and bootstrap script are available on blob storage.
+        /// Verifies that agent binaries and bootstrap script are available on the canonical
+        /// download alias (Front Door → current blob origin) AND on the legacy blob keepalive
+        /// account that already-deployed customer bootstrap scripts still use.
         /// Records an OpsEvent for each missing item so Global Admins see it in the dashboard.
         /// </summary>
         private async Task CheckAgentBlobStorageAsync()
         {
-            _logger.LogInformation("Checking agent blob storage availability...");
+            _logger.LogInformation("Checking agent download endpoint availability...");
 
-            var zipUrl = $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/{AutopilotMonitor.Shared.Constants.AgentZipFileName}";
-            var ps1Url = $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/Install-AutopilotMonitor.ps1";
+            var probes = new (string Label, string Url)[]
+            {
+                ($"Agent ZIP ({AutopilotMonitor.Shared.Constants.AgentZipFileName}, download alias)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentDownloadBaseUrl}/{AutopilotMonitor.Shared.Constants.AgentZipFileName}"),
+                ($"Bootstrap script ({AutopilotMonitor.Shared.Constants.BootstrapScriptName}, download alias)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentDownloadBaseUrl}/{AutopilotMonitor.Shared.Constants.BootstrapScriptName}"),
+                ($"Agent ZIP ({AutopilotMonitor.Shared.Constants.AgentZipFileName}, legacy blob keepalive)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/{AutopilotMonitor.Shared.Constants.AgentZipFileName}"),
+                ($"Bootstrap script ({AutopilotMonitor.Shared.Constants.BootstrapScriptName}, legacy blob keepalive)",
+                    $"{AutopilotMonitor.Shared.Constants.AgentBlobBaseUrl}/{AutopilotMonitor.Shared.Constants.BootstrapScriptName}")
+            };
 
             try
             {
                 var client = _httpClientFactory.CreateClient();
                 client.Timeout = TimeSpan.FromSeconds(15);
 
-                var zipRequest = new HttpRequestMessage(HttpMethod.Head, zipUrl);
-                var ps1Request = new HttpRequestMessage(HttpMethod.Head, ps1Url);
-
                 var results = await Task.WhenAll(
-                    client.SendAsync(zipRequest),
-                    client.SendAsync(ps1Request)
+                    probes.Select(p => client.SendAsync(new HttpRequestMessage(HttpMethod.Head, p.Url)))
                 );
 
-                var zipResponse = results[0];
-                var ps1Response = results[1];
-
-                if (!zipResponse.IsSuccessStatusCode)
+                var allOk = true;
+                for (var i = 0; i < probes.Length; i++)
                 {
-                    _logger.LogError("Agent ZIP not available on blob storage: HTTP {StatusCode}", (int)zipResponse.StatusCode);
-                    await _opsEventService.RecordBlobStorageMissingAsync("Agent ZIP (AutopilotMonitor-Agent.zip)", (int)zipResponse.StatusCode);
+                    if (results[i].IsSuccessStatusCode) continue;
+                    allOk = false;
+                    _logger.LogError("{Item} not available: HTTP {StatusCode}", probes[i].Label, (int)results[i].StatusCode);
+                    await _opsEventService.RecordBlobStorageMissingAsync(probes[i].Label, (int)results[i].StatusCode);
                 }
 
-                if (!ps1Response.IsSuccessStatusCode)
+                if (allOk)
                 {
-                    _logger.LogError("Bootstrap script not available on blob storage: HTTP {StatusCode}", (int)ps1Response.StatusCode);
-                    await _opsEventService.RecordBlobStorageMissingAsync("Bootstrap script (Install-AutopilotMonitor.ps1)", (int)ps1Response.StatusCode);
-                }
-
-                if (zipResponse.IsSuccessStatusCode && ps1Response.IsSuccessStatusCode)
-                {
-                    _logger.LogInformation("Agent blob storage check passed: all binaries available");
+                    _logger.LogInformation("Agent download endpoint check passed: all binaries available on alias + legacy blob");
                 }
             }
             catch (Exception ex)
             {
-                _logger.LogError(ex, "Agent blob storage check failed — storage unreachable");
+                _logger.LogError(ex, "Agent download endpoint check failed — endpoints unreachable");
                 await _opsEventService.RecordBlobStorageUnreachableAsync(ex.Message);
             }
         }

src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Rules.cs

@@ -158,6 +158,9 @@ namespace AutopilotMonitor.Functions.Services
                     ["IntervalSeconds"] = rule.IntervalSeconds,
                     ["TriggerPhase"] = rule.TriggerPhase ?? string.Empty,
                     ["TriggerEventType"] = rule.TriggerEventType ?? string.Empty,
+                    ["ActivePhasesJson"] = JsonConvert.SerializeObject(rule.ActivePhases ?? new List<string>()),
+                    ["ActiveFromPhase"] = rule.ActiveFromPhase ?? string.Empty,
+                    ["EmitMode"] = rule.EmitMode ?? string.Empty,
                     ["OutputEventType"] = rule.OutputEventType ?? string.Empty,
                     ["OutputSeverity"] = rule.OutputSeverity ?? "Info",
                     ["TagsJson"] = JsonConvert.SerializeObject(rule.Tags ?? new string[0]),
@@ -222,7 +225,9 @@ namespace AutopilotMonitor.Functions.Services
             }
         }
 
-        private GatherRule MapToGatherRule(TableEntity entity)
+        // Internal (not private) so the Store↔Map roundtrip is testable per the
+        // table-serialization rule: every model field must appear in BOTH directions.
+        internal GatherRule MapToGatherRule(TableEntity entity)
         {
             return new GatherRule
             {
@@ -244,6 +249,9 @@ namespace AutopilotMonitor.Functions.Services
                 IntervalSeconds = entity.GetInt32("IntervalSeconds"),
                 TriggerPhase = entity.GetString("TriggerPhase") ?? string.Empty,
                 TriggerEventType = entity.GetString("TriggerEventType") ?? string.Empty,
+                ActivePhases = MapActivePhases(entity.GetString("ActivePhasesJson")),
+                ActiveFromPhase = string.IsNullOrEmpty(entity.GetString("ActiveFromPhase")) ? null : entity.GetString("ActiveFromPhase"),
+                EmitMode = string.IsNullOrEmpty(entity.GetString("EmitMode")) ? null : entity.GetString("EmitMode"),
                 OutputEventType = entity.GetString("OutputEventType") ?? string.Empty,
                 OutputSeverity = entity.GetString("OutputSeverity") ?? "Info",
                 Tags = DeserializeJsonArray(entity.GetString("TagsJson")),
@@ -252,6 +260,17 @@ namespace AutopilotMonitor.Functions.Services
             };
         }
 
+        /// <summary>
+        /// Absent column (pre-existing rows) and the stored-empty "[]" both map to null —
+        /// null and empty are the same "unrestricted" state on <see cref="GatherRule.ActivePhases"/>,
+        /// and null keeps <see cref="GatherRuleService.ContentEquivalent"/> reseed-stable.
+        /// </summary>
+        private List<string>? MapActivePhases(string? json)
+        {
+            var phases = DeserializeJson<List<string>>(json);
+            return phases.Count == 0 ? null : phases;
+        }
+
         // ===== RULE STATES METHODS =====
 
         /// <summary>

src/Shared/AutopilotMonitor.Shared/Constants.cs

@@ -73,19 +73,32 @@ namespace AutopilotMonitor.Shared
         public const string ApiBaseUrl = "https://autopilotmonitor-api-eu.azurewebsites.net";
 
         /// <summary>
-        /// Public base URL of the MCP server Container App (no trailing slash, no /mcp suffix).
-        /// Used by the backend health check to probe <c>{McpServerBaseUrl}/health</c>. The
-        /// Container App runs with minReplicas=0, so the first probe after idle may incur a
-        /// cold start. Overridable via the <c>McpServerUrl</c> app setting (e.g. for dev).
+        /// Public base URL of the MCP server (no trailing slash, no /mcp suffix). Stable custom
+        /// domain in front of the Container App — survives region/environment moves, unlike the
+        /// generated *.azurecontainerapps.io FQDN. Used by the backend health check to probe
+        /// <c>{McpServerBaseUrl}/health</c>. The Container App runs with minReplicas=0, so the
+        /// first probe after idle may incur a cold start. Overridable via the
+        /// <c>McpServerUrl</c> app setting (e.g. for dev).
         /// </summary>
-        public const string McpServerBaseUrl = "https://autopilotmonitor-mcp.kindwave-58b4b547.westeurope.azurecontainerapps.io";
+        public const string McpServerBaseUrl = "https://mcp.autopilotmonitor.com";
 
         // -----------------------------------------------------------------------
         // Agent self-update
         // -----------------------------------------------------------------------
 
         /// <summary>
-        /// Base URL for agent binaries in Azure Blob Storage (public read)
+        /// Canonical public base URL for agent binaries: Front Door alias in front of the
+        /// current blob origin (autopilotmonitoreu, container "agent"). Storage-account moves
+        /// happen behind this name without touching customers. New bootstrap scripts and all
+        /// availability probes use this URL.
+        /// </summary>
+        public const string AgentDownloadBaseUrl = "https://download.autopilotmonitor.com/agent";
+
+        /// <summary>
+        /// LEGACY base URL for agent binaries: the pre-migration storage account, kept alive
+        /// (dual-push on every release) because bootstrap scripts already deployed in customer
+        /// Intune tenants still download from it. Remove only after the customer migration to
+        /// <see cref="AgentDownloadBaseUrl"/> is complete and the legacy account is torn down.
         /// </summary>
         public const string AgentBlobBaseUrl = "https://autopilotmonitor.blob.core.windows.net/agent";
 

src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs

@@ -242,7 +242,7 @@ namespace AutopilotMonitor.Shared.Models
         /// config cannot chain another migration), and a kill signal always wins over it.
         /// Old binaries ignore the field. null = no migration.
         /// </summary>
-        public string MigrateToApiBaseUrl { get; set; }
+        public string? MigrateToApiBaseUrl { get; set; }
     }
 
     /// <summary>

src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs

@@ -128,6 +128,38 @@ namespace AutopilotMonitor.Shared.Models
         /// </summary>
         public string TriggerEventType { get; set; } = default!;
 
+        /// <summary>
+        /// Restricts the rule to run only while the current enrollment phase is one of these
+        /// phases. Canonical tokens are the <see cref="EnrollmentPhase"/> enum names
+        /// ("Start", "DevicePreparation", "DeviceSetup", "AppsDevice", "AccountSetup",
+        /// "AppsUser", "FinalizingSetup", "Complete"); "Unknown" and "Failed" are rejected
+        /// by backend validation. Null or empty = unrestricted (runs in every phase —
+        /// legacy behavior). Mutually exclusive with <see cref="ActiveFromPhase"/>;
+        /// if both are set the agent defensively prefers this list.
+        /// Applies to ALL trigger types. Before the first phase signal of a session,
+        /// scoped rules are inactive.
+        /// </summary>
+        public List<string>? ActivePhases { get; set; }
+
+        /// <summary>
+        /// Activates the rule once the enrollment phase first reaches this phase
+        /// (ordinal comparison on <see cref="EnrollmentPhase"/>, ignoring Unknown/Failed),
+        /// then keeps it active for the rest of the session (sticky latch — including
+        /// through Failed). Canonical tokens as in <see cref="ActivePhases"/>.
+        /// Null = unrestricted. Mutually exclusive with <see cref="ActivePhases"/>.
+        /// </summary>
+        public string? ActiveFromPhase { get; set; }
+
+        /// <summary>
+        /// Emit behavior for collected results:
+        /// null / "always" = emit on every collection (legacy behavior);
+        /// "on_change" = poll on the trigger cadence but emit only when the collected
+        /// result differs from the last emitted one. The first in-scope result always
+        /// emits; the suppressed poll count is carried on the next emitted event
+        /// (suppressedPolls / suppressedSinceUtc in the event data).
+        /// </summary>
+        public string? EmitMode { get; set; }
+
         // ===== OUTPUT =====
 
         /// <summary>

src/Web/autopilot-monitor-web/app/gather-rules/components/GatherRuleCard.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useMemo, useState } from "react";
-import { GatherRule, NewRuleForm, CATEGORY_COLORS, COLLECTOR_TYPE_LABELS, EMPTY_FORM, formatTrigger } from "../types";
+import { GatherRule, NewRuleForm, CATEGORY_COLORS, COLLECTOR_TYPE_LABELS, EMPTY_FORM, formatTrigger, formatGatherPhase, withDerivedScopeMode } from "../types";
 import { GatherRuleFormFields } from "./GatherRuleFormFields";
 import { FormJsonToggle, JsonModeToggleButtons, ReadOnlyJsonView } from "@/components/rules/FormJsonToggle";
 import { validateGatherRuleTarget } from "@/utils/guardValidation";
@@ -301,6 +301,19 @@ export function GatherRuleCard({
                     on event: <code className="px-1 bg-gray-200 rounded text-xs">{rule.triggerEventType}</code>
                   </span>
                 )}
+                {rule.activePhases && rule.activePhases.length > 0 && (
+                  <span className="text-gray-500">
+                    · during {rule.activePhases.map(formatGatherPhase).join(", ")}
+                  </span>
+                )}
+                {!rule.activePhases?.length && rule.activeFromPhase && (
+                  <span className="text-gray-500">
+                    · from {formatGatherPhase(rule.activeFromPhase)}
+                  </span>
+                )}
+                {rule.emitMode === "on_change" && (
+                  <span className="text-gray-500">· emit on change</span>
+                )}
               </div>
             </div>
           </div>
@@ -430,7 +443,7 @@ export function GatherRuleCard({
                 if (jsonModeEdit) {
                   try {
                     const parsed = JSON.parse(jsonText) as NewRuleForm;
-                    onSaveEdit(rule, { ...editForm, ...parsed });
+                    onSaveEdit(rule, withDerivedScopeMode({ ...editForm, ...parsed }));
                   } catch (e) {
                     // jsonError is handled by parent
                   }

src/Web/autopilot-monitor-web/app/gather-rules/components/GatherRuleFormFields.tsx

@@ -10,6 +10,8 @@ import {
   SEVERITIES,
   TARGET_PLACEHOLDERS,
   TARGET_HINTS,
+  GATHER_PHASES,
+  EMIT_MODES,
   formatTrigger,
 } from "../types";
 import { KNOWN_EVENT_TYPES, findEventType } from "../eventTypes";
@@ -426,14 +428,20 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
       {form.trigger === "phase_change" && (
         <div>
           <label className="block text-sm font-medium text-gray-700 mb-1">Trigger Phase</label>
-          <input
-            type="text"
+          <select
             value={form.triggerPhase}
             onChange={(e) => setForm({ ...form, triggerPhase: e.target.value })}
-            placeholder="e.g., DeviceESP, AccountESP, DevicePreparation"
-            autoComplete="off"
-            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 placeholder-gray-500 focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
-          />
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            <option value="">Any phase change</option>
+            {form.triggerPhase && !GATHER_PHASES.some((p) => p.value === form.triggerPhase) && (
+              <option value={form.triggerPhase}>{form.triggerPhase} (legacy value)</option>
+            )}
+            {GATHER_PHASES.map((p) => (
+              <option key={p.value} value={p.value}>{p.label}</option>
+            ))}
+          </select>
+          <p className="text-xs text-gray-400 mt-1">Run this rule when the enrollment reaches this phase. &quot;Any phase change&quot; fires once per phase transition.</p>
         </div>
       )}
 
@@ -472,6 +480,89 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
         </div>
       )}
 
+      {/* Row: Active During (phase scope) + Emit Mode */}
+      <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Active During</label>
+          <select
+            value={form.scopeMode}
+            onChange={(e) => {
+              const scopeMode = e.target.value as NewRuleForm["scopeMode"];
+              // Keep the form state consistent: only the fields of the selected mode survive.
+              setForm({
+                ...form,
+                scopeMode,
+                activePhases: scopeMode === "during" ? form.activePhases : [],
+                activeFromPhase: scopeMode === "from" ? form.activeFromPhase : "",
+              });
+            }}
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            <option value="always">All phases (always)</option>
+            <option value="during">Only during specific phases</option>
+            <option value="from">From a phase onwards</option>
+          </select>
+          <p className="text-xs text-gray-400 mt-1">Restrict when this rule runs. Outside its scope the rule is idle — interval rules stop polling, triggers are ignored.</p>
+        </div>
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Emit Mode</label>
+          <select
+            value={form.emitMode}
+            onChange={(e) => setForm({ ...form, emitMode: e.target.value })}
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            {EMIT_MODES.map((m) => (
+              <option key={m.value} value={m.value}>{m.label}</option>
+            ))}
+          </select>
+          <p className="text-xs text-gray-400 mt-1">On change: polls on the trigger cadence but only emits an event when the collected result changes. The first collection always emits.</p>
+        </div>
+      </div>
+
+      {form.scopeMode === "during" && (
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Active Phases</label>
+          <div className="grid grid-cols-2 sm:grid-cols-4 gap-2">
+            {GATHER_PHASES.map((p) => (
+              <label key={p.value} className="flex items-center space-x-2 text-sm text-gray-700 cursor-pointer">
+                <input
+                  type="checkbox"
+                  checked={form.activePhases.includes(p.value)}
+                  onChange={(e) =>
+                    setForm({
+                      ...form,
+                      activePhases: e.target.checked
+                        ? [...form.activePhases, p.value]
+                        : form.activePhases.filter((x) => x !== p.value),
+                    })
+                  }
+                  className="rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                />
+                <span>{p.label}</span>
+              </label>
+            ))}
+          </div>
+          <p className="text-xs text-gray-400 mt-1">The rule runs only while the enrollment is in one of the selected phases. No selection = all phases.</p>
+        </div>
+      )}
+
+      {form.scopeMode === "from" && (
+        <div>
+          <label className="block text-sm font-medium text-gray-700 mb-1">Active From Phase</label>
+          <select
+            value={form.activeFromPhase}
+            onChange={(e) => setForm({ ...form, activeFromPhase: e.target.value })}
+            className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
+          >
+            <option value="">Select a phase…</option>
+            {GATHER_PHASES.map((p) => (
+              <option key={p.value} value={p.value}>{p.label}</option>
+            ))}
+          </select>
+          <p className="text-xs text-gray-400 mt-1">Once the enrollment reaches this phase the rule activates and stays active for the rest of the session. No selection = all phases.</p>
+        </div>
+      )}
+
       {/* Row 3: Output Event Type, Output Severity */}
       <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
         <div>

src/Web/autopilot-monitor-web/app/gather-rules/page.tsx

@@ -16,7 +16,7 @@ import { FormJsonToggle, JsonModeToggleButtons } from "@/components/rules/FormJs
 import { useAuthenticatedFetch, useNotificationMessages, useGlobalAdminScope } from "@/hooks";
 import { GlobalAdminBanner, globalAdminSubtitle } from "@/components/GlobalAdminBanner";
 import { TenantScopeSelector } from "@/components/TenantScopeSelector";
-import { GatherRule, NewRuleForm, EMPTY_FORM, CATEGORY_COLORS } from "./types";
+import { GatherRule, NewRuleForm, EMPTY_FORM, CATEGORY_COLORS, withDerivedScopeMode } from "./types";
 import { GatherRuleFormFields } from "./components/GatherRuleFormFields";
 import { GatherRuleCard } from "./components/GatherRuleCard";
 
@@ -211,6 +211,9 @@ export default function GatherRulesPage() {
       intervalSeconds: form.trigger === "interval" ? form.intervalSeconds : null,
       triggerPhase: form.trigger === "phase_change" ? form.triggerPhase : null,
       triggerEventType: form.trigger === "on_event" ? form.triggerEventType : null,
+      activePhases: form.scopeMode === "during" && form.activePhases.length > 0 ? form.activePhases : null,
+      activeFromPhase: form.scopeMode === "from" && form.activeFromPhase ? form.activeFromPhase : null,
+      emitMode: form.emitMode || null,
       outputEventType: form.outputEventType,
       outputSeverity: form.outputSeverity,
     };
@@ -265,6 +268,12 @@ export default function GatherRulesPage() {
       intervalSeconds: rule.intervalSeconds || 60,
       triggerPhase: rule.triggerPhase || "",
       triggerEventType: rule.triggerEventType || "",
+      scopeMode: rule.activePhases?.length ? "during" : rule.activeFromPhase ? "from" : "always",
+      activePhases: rule.activePhases || [],
+      activeFromPhase: rule.activeFromPhase || "",
+      // Existing rules without the field keep today's behavior ("always") — the on_change
+      // default applies to NEW rules only.
+      emitMode: rule.emitMode === "on_change" ? "on_change" : "always",
       outputEventType: rule.outputEventType,
       outputSeverity: rule.outputSeverity,
     });
@@ -289,12 +298,17 @@ export default function GatherRulesPage() {
       intervalSeconds: form.trigger === "interval" ? form.intervalSeconds : null,
       triggerPhase: form.trigger === "phase_change" ? form.triggerPhase : null,
       triggerEventType: form.trigger === "on_event" ? form.triggerEventType : null,
+      activePhases: form.scopeMode === "during" && form.activePhases.length > 0 ? form.activePhases : null,
+      activeFromPhase: form.scopeMode === "from" && form.activeFromPhase ? form.activeFromPhase : null,
+      emitMode: form.emitMode || null,
       outputEventType: form.outputEventType,
       outputSeverity: form.outputSeverity,
       version: bumpVersion(rule.version),
       enabled: rule.enabled,
       author: rule.author,
       createdAt: rule.createdAt,
+      // Same wipe class as the toggle bug: the full-replace PUT must carry tags or they vanish.
+      tags: rule.tags ?? [],
       isBuiltIn: rule.isBuiltIn ?? false,
       isCommunity: rule.isCommunity ?? false,
     };
@@ -505,7 +519,9 @@ export default function GatherRulesPage() {
                         try {
                           const parsed = JSON.parse(jsonText) as NewRuleForm;
                           if (!parsed.ruleId && !parsed.title) throw new Error("JSON must include at least ruleId and title");
-                          setNewRule({ ...EMPTY_FORM, ...parsed });
+                          // Rule-shaped JSON carries activePhases/activeFromPhase but no scopeMode
+                          // — derive it so the scope fields survive into the create payload.
+                          setNewRule(withDerivedScopeMode({ ...EMPTY_FORM, ...parsed }));
                           setJsonModeCreate(false);
                           setJsonError(null);
                         } catch (e) {
@@ -538,7 +554,7 @@ export default function GatherRulesPage() {
                             try {
                               const parsed = JSON.parse(jsonText) as NewRuleForm;
                               setJsonError(null);
-                              handleCreateRule({ ...EMPTY_FORM, ...parsed });
+                              handleCreateRule(withDerivedScopeMode({ ...EMPTY_FORM, ...parsed }));
                             } catch (e) {
                               setJsonError(e instanceof Error ? e.message : "Invalid JSON");
                             }
@@ -619,7 +635,7 @@ export default function GatherRulesPage() {
                         try {
                           const parsed = JSON.parse(jsonText) as NewRuleForm;
                           if (!parsed.title) throw new Error("JSON must include title");
-                          setEditForm({ ...editForm, ...parsed });
+                          setEditForm(withDerivedScopeMode({ ...editForm, ...parsed }));
                           setJsonModeEdit(false);
                           setJsonError(null);
                         } catch (e) {

src/Web/autopilot-monitor-web/app/gather-rules/types.ts

@@ -15,6 +15,9 @@ export interface GatherRule {
   intervalSeconds: number | null;
   triggerPhase: string | null;
   triggerEventType: string | null;
+  activePhases?: string[] | null;
+  activeFromPhase?: string | null;
+  emitMode?: string | null;
   outputEventType: string;
   outputSeverity: string;
   tags: string[];
@@ -48,6 +51,10 @@ export interface NewRuleForm {
   intervalSeconds: number;
   triggerPhase: string;
   triggerEventType: string;
+  scopeMode: "always" | "during" | "from";
+  activePhases: string[];
+  activeFromPhase: string;
+  emitMode: string;
   outputEventType: string;
   outputSeverity: string;
 }
@@ -57,6 +64,30 @@ export const COLLECTOR_TYPES = ["registry", "eventlog", "wmi", "file", "command_
 export const TRIGGERS = ["startup", "phase_change", "interval", "on_event"] as const;
 export const SEVERITIES = ["info", "warning", "error", "critical"] as const;
 
+// Canonical phase-scope tokens: the backend EnrollmentPhase enum NAMES from Start(0) through
+// Complete(7) — Unknown/Failed are not selectable. Local mirror (like eventTypes.ts); display
+// labels are gather-rule-specific, deliberately NOT reusing phaseConstants.ts timeline names.
+export const GATHER_PHASES: ReadonlyArray<{ value: string; label: string }> = [
+  { value: "Start", label: "Start" },
+  { value: "DevicePreparation", label: "Device Preparation" },
+  { value: "DeviceSetup", label: "Device Setup" },
+  { value: "AppsDevice", label: "Apps (Device)" },
+  { value: "AccountSetup", label: "Account Setup" },
+  { value: "AppsUser", label: "Apps (User)" },
+  { value: "FinalizingSetup", label: "Finalizing Setup" },
+  { value: "Complete", label: "Complete" },
+];
+
+export const EMIT_MODES: ReadonlyArray<{ value: string; label: string }> = [
+  { value: "always", label: "Always (emit every collection)" },
+  { value: "on_change", label: "On change (emit only when the result changes)" },
+];
+
+/** Display label for a phase-scope token; falls back to the raw token for unknown values. */
+export function formatGatherPhase(token: string): string {
+  return GATHER_PHASES.find((p) => p.value === token)?.label ?? token;
+}
+
 export const CATEGORY_COLORS: Record<string, { bg: string; text: string }> = {
   network: { bg: "bg-blue-100", text: "text-blue-700" },
   identity: { bg: "bg-purple-100", text: "text-purple-700" },
@@ -126,6 +157,11 @@ export const EMPTY_FORM: NewRuleForm = {
   intervalSeconds: 60,
   triggerPhase: "",
   triggerEventType: "",
+  scopeMode: "always",
+  activePhases: [],
+  activeFromPhase: "",
+  // New rules default to on_change (anti-spam); existing rules load as "always" in startEditing.
+  emitMode: "on_change",
   outputEventType: "",
   outputSeverity: "info",
 };
@@ -137,3 +173,19 @@ export function formatTrigger(trigger: string) {
     default: return trigger.charAt(0).toUpperCase() + trigger.slice(1);
   }
 }
+
+/**
+ * Normalizes a form object after JSON-mode merges. Pasted JSON is usually rule-shaped
+ * (activePhases/activeFromPhase/emitMode, no scopeMode key), so the UI-only scopeMode must
+ * be derived from the data — otherwise the create/save payload would silently drop the
+ * scope fields. Also coerces null/unknown emitMode values to the "always" select option.
+ */
+export function withDerivedScopeMode(form: NewRuleForm): NewRuleForm {
+  const activePhases = (Array.isArray(form.activePhases) ? form.activePhases : [])
+    .filter((p): p is string => typeof p === "string" && p.length > 0);
+  const activeFromPhase = typeof form.activeFromPhase === "string" ? form.activeFromPhase : "";
+  const scopeMode: NewRuleForm["scopeMode"] =
+    activePhases.length > 0 ? "during" : activeFromPhase ? "from" : "always";
+  const emitMode = form.emitMode === "on_change" ? "on_change" : "always";
+  return { ...form, activePhases, activeFromPhase, scopeMode, emitMode };
+}