command update

IME patterns: repair drift found by decompiled-source audit (IME 1.97 Dec-25)
Audit vs decompiled IME 1.97.107: ~55/79 patterns verified verbatim, but several were broken or dead against the current V3 pipeline. Fixes: - IME-ESP-TRACK-STATUS: drop trailing anchor (line grew ' with name: <n>.') - HS-COMPLIANCE: tolerate both 'remdiation' typo and corrected wording; new HS-COMPLIANCE-POST for the reworded post-detection line - IME-DETECTION-RESULT: capture DetectedDifferentVersion (ordered first) - IME-ENFORCEMENT-SUCCESS: unpin OldValue (Error/PendingReboot/null paths) - IME-ERROR-REPORT: allow unquoted null OldValue on first write - Disable 11 dead patterns (emitters removed with IME's old V1/V2 pipeline; IME-DETECTED-OLD additionally collided with IME-SKIP-INSTALL-DETECTED) New signals (existing actions, tailed files only): - IME-ESP-APP-REGISTERED + IME-CACHE-MISS as app-name sources (replacing dead IME-UPDATE-NAME-1/2/3) - IME-WINGET-ERROR (WinGet failures were invisible) - IME-EXITCODE-MAPPED-FAILED (normal mapped-exit-code failure path) - IME-STOP-SIGNAL (service stop != OS shutdown) - IME-RESTART-STOP-PROCESSING (reboot-gated processing abort) Backend seed diff now also compares Enabled + Parameters - enable/disable flips and parameter changes previously never propagated to the table. All exact wordings verified against decompiled source; regex smoke-tested via validate-ime-patterns.py (engine=regex, 75/75 compiled, all new patterns fire on synthetic lines with the exact IME format strings). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-10-25 21:19:38 +00:00 · 2026-08-17 21:44:26 +02:00 · 2026-08-17 21:33:37 +02:00 · 2026-08-17 21:28:43 +02:00 · 2026-08-17 20:35:37 +02:00
31 changed files with 455 additions and 121 deletions
@@ -4,12 +4,23 @@
    {
      "patternId": "HS-COMPLIANCE",
      "category": "always",
-      "pattern": "\\[HS\\] the (?<part>pre|post)-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+      "pattern": "\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
      "action": "healthScriptDetectionResult",
      "parameters": {
        "scriptType": "remediation"
      },
-      "description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring).",
+      "description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring). Tolerates both Microsoft's historical typo 'remdiation' and a future corrected 'remediation'. NOTE: IME 1.97 (Dec 2025) no longer emits the post- variant of this line; the post case is covered by HS-COMPLIANCE-POST.",
+      "enabled": true
+    },
+    {
+      "patternId": "HS-COMPLIANCE-POST",
+      "category": "always",
+      "pattern": "\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+      "action": "healthScriptDetectionResult",
+      "parameters": {
+        "scriptType": "remediation"
+      },
+      "description": "Post-remediation detection result, current wording. IME 1.97 (Dec 2025) replaced the old '[HS] the post-remdiation detection script compliance result for ...' line (still covered by HS-COMPLIANCE for older logs) with '[HS] the post detection script result for <guid> is <True|False>' (ScriptProcessorV2.cs:721). The literal word 'post' in the line is captured as the part group so the handler classifies it as the post-detection phase.",
      "enabled": true
    },
    {
@@ -139,6 +150,14 @@
      "description": "Captures the install attempt number for the current app. IME logs 'Execute retry 0' for the first attempt and increments on each retry. Reported as attempt+1 so retry 0 becomes AttemptNumber=1 (human-friendly: first attempt).",
      "enabled": true
    },
+    {
+      "patternId": "IME-CACHE-MISS",
+      "category": "always",
+      "pattern": "\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
+      "action": "updateName",
+      "description": "Captures 'Content cache miss for app (id = <guid>, name = <name>), start downloading...' (ContentManager.cs) as a secondary app-name source. Fires right before a real download begins, so it resolves names for exactly the apps that will produce download/install activity — a redundancy for IME-POLICIES-based naming after IME retired the old name-bearing processing lines.",
+      "enabled": true
+    },
    {
      "patternId": "IME-DECRYPT-FAILED",
      "category": "currentPhase",
@@ -168,15 +187,15 @@
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Detected app {GUID} ",
      "action": "updateStateInstalled",
-      "description": "Detects when an app is detected as installed (old log format).",
-      "enabled": true
+      "description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app <guid> ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).",
+      "enabled": false
    },
    {
      "patternId": "IME-DETECTION-RESULT",
      "category": "always",
-      "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>Detected|NotDetected)",
+      "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
      "action": "captureDetectionResult",
-      "description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
+      "description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not, 'DetectedDifferentVersion' means a different version was found (supersedence / WinGet version mismatch). DetectedDifferentVersion must come first in the alternation so the unanchored regex does not mis-capture its 'Detected' prefix. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
      "enabled": true
    },
    {
@@ -217,9 +236,9 @@
    {
      "patternId": "IME-ENFORCEMENT-SUCCESS",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
+      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":(?:\"\"\\w+\"\"|null),\"\"NewValue\"\":\"\"Success\"\"",
      "action": "updateStateInstalled",
-      "description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
+      "description": "Detects when an app's enforcement state transitions to Success in an Execution state report delta. OldValue is deliberately unpinned: besides InProgressDownloadCompleted it can be Error (retry succeeding in a later check-in), InProgressPendingReboot (post-reboot completion) or null (first write) — the previously pinned InProgressDownloadCompleted missed those legitimate success paths (IME 1.97 audit 2026-08-17).",
      "enabled": true
    },
    {
@@ -266,12 +285,12 @@
    {
      "patternId": "IME-ERROR-REPORT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
+      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":(?:\"\"(?<from>\\w+)\"\"|null),\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
      "action": "updateStateError",
      "parameters": {
        "checkTo": "true"
      },
-      "description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
+      "description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state. OldValue may be the unquoted JSON literal null on the first-ever write of a reporting state — transitions straight from the initial state (e.g. first write directly to an error state) would otherwise be invisible (IME 1.97 audit 2026-08-17).",
      "enabled": true
    },
    {
@@ -293,6 +312,14 @@
      "description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
      "enabled": true
    },
+    {
+      "patternId": "IME-ESP-APP-REGISTERED",
+      "category": "always",
+      "pattern": "\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
+      "action": "updateName",
+      "description": "Captures the ESP tracked-app registration line ('App <guid> has been registered[ for user <id>]. App name: <name>', EspManager.cs) as an app-name source. Primary replacement for the retired IME-UPDATE-NAME-1/2/3 whose emitters were removed with IME's old V1/V2 processing pipeline; also documents exactly which apps IME registered for ESP tracking. Category 'always' so names resolve even before the first ApplicationPoller EspPhase line is seen.",
+      "enabled": true
+    },
    {
      "patternId": "IME-ESP-PHASE",
      "category": "always",
@@ -304,9 +331,9 @@
    {
      "patternId": "IME-ESP-TRACK-STATUS",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
+      "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
      "action": "espTrackStatus",
-      "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
+      "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app. No trailing anchor: IME 1.97 (Dec 2025) appends ' with name: <appName>.' after the GUID (EspManager.cs), which broke the previous '\\.' suffix. 'from' can be the literal string 'null' on first tracking.",
      "enabled": true
    },
    {
@@ -320,6 +347,17 @@
      "description": "Captures the installer exit code (lpExitCode) for the current app.",
      "enabled": true
    },
+    {
+      "patternId": "IME-EXITCODE-MAPPED-FAILED",
+      "category": "currentPhase",
+      "pattern": "\\[Win32App\\] lpExitCode is defined as Failed$",
+      "action": "updateStateError",
+      "parameters": {
+        "useCurrentApp": "true"
+      },
+      "description": "Marks the current app as failed when its exit code maps to Failed via the admin-defined return-code table ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs). This is the NORMAL mapped-exit-code outcome; the previously matched 'Setting enforcementState as ... Error' line only fires on the rare no-mapping fallback path. The numeric exit code is captured separately by IME-EXITCODE, which precedes this line.",
+      "enabled": true
+    },
    {
      "patternId": "IME-HRESULT",
      "category": "currentPhase",
@@ -422,6 +460,17 @@
      "description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
      "enabled": true
    },
+    {
+      "patternId": "IME-RESTART-STOP-PROCESSING",
+      "category": "currentPhase",
+      "pattern": "\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
+      "action": "updateStatePostponed",
+      "parameters": {
+        "useCurrentApp": "true"
+      },
+      "description": "Detects IME aborting app processing because an app requires a restart ('A restart is required to continue processing apps. Stop processing.', SideCarV3AppProcessor.cs). Postpones the current app: remaining apps do nothing until after the reboot, which previously looked like an unexplained stall mid-ESP.",
+      "enabled": true
+    },
    {
      "patternId": "IME-SESSION-CHANGE",
      "category": "always",
@@ -435,24 +484,24 @@
      "category": "always",
      "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
      "action": "setCurrentApp",
-      "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
-      "enabled": true
+      "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-SET-CURRENT-2",
      "category": "always",
      "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
      "action": "setCurrentApp",
-      "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
-      "enabled": true
+      "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-SET-CURRENT-3",
      "category": "always",
      "pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
      "action": "setCurrentApp",
-      "description": "Detects the start of app presentation step in IME, setting the app as current.",
-      "enabled": true
+      "description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-SET-CURRENT-4",
@@ -478,24 +527,24 @@
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
      "action": "updateStateSkipped",
-      "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
-      "enabled": true
+      "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-SKIP-DEPENDENCY-DETECT",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
      "action": "updateStateSkipped",
-      "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
-      "enabled": true
+      "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-SKIP-DETECTED",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
      "action": "updateStateSkipped",
-      "description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
-      "enabled": true
+      "description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-SKIP-FILTERS",
@@ -529,8 +578,8 @@
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
      "action": "updateStateSkipped",
-      "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
-      "enabled": true
+      "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-STARTED",
@@ -540,6 +589,17 @@
      "description": "Detects when the Intune Management Extension (IME) agent starts up.",
      "enabled": true
    },
+    {
+      "patternId": "IME-STOP-SIGNAL",
+      "category": "currentPhase",
+      "pattern": "EMS Agent received stop signal",
+      "action": "updateStatePostponed",
+      "parameters": {
+        "useCurrentApp": "true"
+      },
+      "description": "Detects an IME service stop ('EMS Agent received stop signal', EmsAgentService.OnStop) — fired on manual restarts and agent-updater restarts, unlike the OS-shutdown-only 'shutdown signal' line matched by IME-SHUTDOWN. Postpones the current app installation, mirroring IME-SHUTDOWN semantics.",
+      "enabled": true
+    },
    {
      "patternId": "IME-SUBGRAPH",
      "category": "currentPhase",
@@ -564,24 +624,24 @@
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
      "action": "updateName",
-      "description": "Captures the app name from ExecManager processing log (old format: name before id).",
-      "enabled": true
+      "description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-UPDATE-NAME-2",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
      "action": "updateName",
-      "description": "Captures the app name from ProcessAppWithDependencies log entry.",
-      "enabled": true
+      "description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-UPDATE-NAME-3",
      "category": "currentPhase",
      "pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
      "action": "updateName",
-      "description": "Captures the app name from the Processing app log entry.",
-      "enabled": true
+      "description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+      "enabled": false
    },
    {
      "patternId": "IME-USER-SESSION-COMPLETED",
@@ -607,6 +667,14 @@
      "description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
      "enabled": true
    },
+    {
+      "patternId": "IME-WINGET-ERROR",
+      "category": "currentPhase",
+      "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Error",
+      "action": "updateStateError",
+      "description": "Marks a WinGet (new Store) app as failed when its operation progress reports phase Error (WinGetOperationInstallPhase: Downloading/Installing/Queued/Finished/Error). Before this pattern only the Installing phase was matched, so WinGet failures never surfaced as app errors (IME 1.97 audit 2026-08-17).",
+      "enabled": true
+    },
    {
      "patternId": "IME-WINGET-INSTALLING-1",
      "category": "currentPhase",
@@ -0,0 +1,10 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "HS-COMPLIANCE-POST",
+  "category": "always",
+  "pattern": "\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+  "action": "healthScriptDetectionResult",
+  "parameters": { "scriptType": "remediation" },
+  "description": "Post-remediation detection result, current wording. IME 1.97 (Dec 2025) replaced the old '[HS] the post-remdiation detection script compliance result for ...' line (still covered by HS-COMPLIANCE for older logs) with '[HS] the post detection script result for <guid> is <True|False>' (ScriptProcessorV2.cs:721). The literal word 'post' in the line is captured as the part group so the handler classifies it as the post-detection phase.",
+  "enabled": true
+}
@@ -2,9 +2,9 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-COMPLIANCE",
  "category": "always",
-  "pattern": "\\[HS\\] the (?<part>pre|post)-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+  "pattern": "\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
  "action": "healthScriptDetectionResult",
  "parameters": { "scriptType": "remediation" },
-  "description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring).",
+  "description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring). Tolerates both Microsoft's historical typo 'remdiation' and a future corrected 'remediation'. NOTE: IME 1.97 (Dec 2025) no longer emits the post- variant of this line; the post case is covered by HS-COMPLIANCE-POST.",
  "enabled": true
 }
@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-CACHE-MISS",
+  "category": "always",
+  "pattern": "\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
+  "action": "updateName",
+  "description": "Captures 'Content cache miss for app (id = <guid>, name = <name>), start downloading...' (ContentManager.cs) as a secondary app-name source. Fires right before a real download begins, so it resolves names for exactly the apps that will produce download/install activity — a redundancy for IME-POLICIES-based naming after IME retired the old name-bearing processing lines.",
+  "enabled": true
+}
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] Detected app {GUID} ",
  "action": "updateStateInstalled",
-  "description": "Detects when an app is detected as installed (old log format).",
-  "enabled": true
+  "description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app <guid> ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).",
+  "enabled": false
 }
@@ -2,8 +2,8 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DETECTION-RESULT",
  "category": "always",
-  "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>Detected|NotDetected)",
+  "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
  "action": "captureDetectionResult",
-  "description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
+  "description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not, 'DetectedDifferentVersion' means a different version was found (supersedence / WinGet version mismatch). DetectedDifferentVersion must come first in the alternation so the unanchored regex does not mis-capture its 'Detected' prefix. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
  "enabled": true
 }
@@ -2,8 +2,8 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ENFORCEMENT-SUCCESS",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"InProgressDownloadCompleted\"\",\"\"NewValue\"\":\"\"Success\"\"",
+  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":(?:\"\"\\w+\"\"|null),\"\"NewValue\"\":\"\"Success\"\"",
  "action": "updateStateInstalled",
-  "description": "Detects when an app's enforcement state transitions from InProgressDownloadCompleted to Success.",
+  "description": "Detects when an app's enforcement state transitions to Success in an Execution state report delta. OldValue is deliberately unpinned: besides InProgressDownloadCompleted it can be Error (retry succeeding in a later check-in), InProgressPendingReboot (post-reboot completion) or null (first write) — the previously pinned InProgressDownloadCompleted missed those legitimate success paths (IME 1.97 audit 2026-08-17).",
  "enabled": true
 }
@@ -2,9 +2,9 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-REPORT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":\"\"(?<from>\\w+)\"\",\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
+  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"\"EnforcementState\"\":\\{\"\"OldValue\"\":(?:\"\"(?<from>\\w+)\"\"|null),\"\"NewValue\"\":\"\"(?<to>\\w+)\"\"",
  "action": "updateStateError",
  "parameters": { "checkTo": "true" },
-  "description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state.",
+  "description": "Captures enforcement state transitions via ReportingManager. Only triggers error when 'to' value indicates an error state. OldValue may be the unquoted JSON literal null on the first-ever write of a reporting state — transitions straight from the initial state (e.g. first write directly to an error state) would otherwise be invisible (IME 1.97 audit 2026-08-17).",
  "enabled": true
 }
@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-ESP-APP-REGISTERED",
+  "category": "always",
+  "pattern": "\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
+  "action": "updateName",
+  "description": "Captures the ESP tracked-app registration line ('App <guid> has been registered[ for user <id>]. App name: <name>', EspManager.cs) as an app-name source. Primary replacement for the retired IME-UPDATE-NAME-1/2/3 whose emitters were removed with IME's old V1/V2 processing pipeline; also documents exactly which apps IME registered for ESP tracking. Category 'always' so names resolve even before the first ApplicationPoller EspPhase line is seen.",
+  "enabled": true
+}
@@ -2,8 +2,8 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ESP-TRACK-STATUS",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}\\.",
+  "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
  "action": "espTrackStatus",
-  "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app.",
+  "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app. No trailing anchor: IME 1.97 (Dec 2025) appends ' with name: <appName>.' after the GUID (EspManager.cs), which broke the previous '\\.' suffix. 'from' can be the literal string 'null' on first tracking.",
  "enabled": true
 }
@@ -0,0 +1,10 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-EXITCODE-MAPPED-FAILED",
+  "category": "currentPhase",
+  "pattern": "\\[Win32App\\] lpExitCode is defined as Failed$",
+  "action": "updateStateError",
+  "parameters": { "useCurrentApp": "true" },
+  "description": "Marks the current app as failed when its exit code maps to Failed via the admin-defined return-code table ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs). This is the NORMAL mapped-exit-code outcome; the previously matched 'Setting enforcementState as ... Error' line only fires on the rare no-mapping fallback path. The numeric exit code is captured separately by IME-EXITCODE, which precedes this line.",
+  "enabled": true
+}
@@ -0,0 +1,10 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-RESTART-STOP-PROCESSING",
+  "category": "currentPhase",
+  "pattern": "\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
+  "action": "updateStatePostponed",
+  "parameters": { "useCurrentApp": "true" },
+  "description": "Detects IME aborting app processing because an app requires a restart ('A restart is required to continue processing apps. Stop processing.', SideCarV3AppProcessor.cs). Postpones the current app: remaining apps do nothing until after the reboot, which previously looked like an unexplained stall mid-ESP.",
+  "enabled": true
+}
@@ -4,6 +4,6 @@
  "category": "always",
  "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
  "action": "setCurrentApp",
-  "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app.",
-  "enabled": true
+  "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "always",
  "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
  "action": "setCurrentApp",
-  "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current.",
-  "enabled": true
+  "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "always",
  "pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
  "action": "setCurrentApp",
-  "description": "Detects the start of app presentation step in IME, setting the app as current.",
-  "enabled": true
+  "description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
  "action": "updateStateSkipped",
-  "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads).",
-  "enabled": true
+  "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
  "action": "updateStateSkipped",
-  "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed).",
-  "enabled": true
+  "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
  "action": "updateStateSkipped",
-  "description": "Detects when an already-detected app is skipped for further processing steps (old log format).",
-  "enabled": true
+  "description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
  "action": "updateStateSkipped",
-  "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format).",
-  "enabled": true
+  "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -0,0 +1,10 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-STOP-SIGNAL",
+  "category": "currentPhase",
+  "pattern": "EMS Agent received stop signal",
+  "action": "updateStatePostponed",
+  "parameters": { "useCurrentApp": "true" },
+  "description": "Detects an IME service stop ('EMS Agent received stop signal', EmsAgentService.OnStop) — fired on manual restarts and agent-updater restarts, unlike the OS-shutdown-only 'shutdown signal' line matched by IME-SHUTDOWN. Postpones the current app installation, mirroring IME-SHUTDOWN semantics.",
+  "enabled": true
+}
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
  "action": "updateName",
-  "description": "Captures the app name from ExecManager processing log (old format: name before id).",
-  "enabled": true
+  "description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
  "action": "updateName",
-  "description": "Captures the app name from ProcessAppWithDependencies log entry.",
-  "enabled": true
+  "description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -4,6 +4,6 @@
  "category": "currentPhase",
  "pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
  "action": "updateName",
-  "description": "Captures the app name from the Processing app log entry.",
-  "enabled": true
+  "description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
+  "enabled": false
 }
@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-WINGET-ERROR",
+  "category": "currentPhase",
+  "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Error",
+  "action": "updateStateError",
+  "description": "Marks a WinGet (new Store) app as failed when its operation progress reports phase Error (WinGetOperationInstallPhase: Downloading/Installing/Queued/Finished/Error). Before this pattern only the Installing phase was matched, so WinGet failures never surfaced as app errors (IME 1.97 audit 2026-08-17).",
+  "enabled": true
+}
@@ -525,40 +525,69 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                        continue;
                    }

-                    if (length > tracker.Budget.MaxSingleFileBytes)
+                    // Active event-log channels hold their .evtx exclusively locked — a raw
+                    // FileStream open fails with a sharing violation. Export the channel via
+                    // wevtutil instead and stream the export (deleted below). Session a11102f4:
+                    // the tenant-configured BootstrapperAgent channel never made it into the ZIP.
+                    string streamSource = file;
+                    string tempExport = null;
+                    if (file.EndsWith(".evtx", StringComparison.OrdinalIgnoreCase))
                    {
-                        _logger.Warning($"Skipping oversized file ({length} bytes > {tracker.Budget.MaxSingleFileBytes} cap): {file}");
-                        tracker.RecordSkip(file, "size", length);
-                        continue;
-                    }
-                    if (tracker.WouldExceedCount())
-                    {
-                        _logger.Warning($"Skipping file (file-count cap {tracker.Budget.MaxFileCount} reached): {file}");
-                        tracker.RecordSkip(file, "count", length);
-                        continue;
-                    }
-                    if (tracker.WouldExceedTotal(length))
-                    {
-                        _logger.Warning($"Skipping file (total-bytes cap {tracker.Budget.MaxTotalUncompressedBytes} reached): {file}");
-                        tracker.RecordSkip(file, "total", length);
-                        continue;
+                        tempExport = TryExportEventLogChannel(file);
+                        if (tempExport == null)
+                        {
+                            tracker.RecordSkip(file, "evtx-export", length);
+                            continue;
+                        }
+                        streamSource = tempExport;
+                        try { length = new FileInfo(tempExport).Length; }
+                        catch { /* keep original length estimate */ }
                    }

-                    // Preserve subfolder structure in the ZIP when includeSubfolders is enabled
-                    var relativePath = file.Substring(sourceFolder.Length).TrimStart(Path.DirectorySeparatorChar);
-                    var entryName = $"{zipFolder}/{relativePath.Replace(Path.DirectorySeparatorChar, '/')}";
-
-                    var entry = archive.CreateEntry(entryName, CompressionLevel.Optimal);
-                    // Stream directly from disk into the entry — no per-file MemoryStream/byte[]
-                    // copy. FileShare.ReadWrite avoids locking conflicts with active log writers.
-                    using (var fs = new FileStream(file, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
-                    using (var entryStream = entry.Open())
+                    try
                    {
-                        fs.CopyTo(entryStream);
-                    }
+                        if (length > tracker.Budget.MaxSingleFileBytes)
+                        {
+                            _logger.Warning($"Skipping oversized file ({length} bytes > {tracker.Budget.MaxSingleFileBytes} cap): {file}");
+                            tracker.RecordSkip(file, "size", length);
+                            continue;
+                        }
+                        if (tracker.WouldExceedCount())
+                        {
+                            _logger.Warning($"Skipping file (file-count cap {tracker.Budget.MaxFileCount} reached): {file}");
+                            tracker.RecordSkip(file, "count", length);
+                            continue;
+                        }
+                        if (tracker.WouldExceedTotal(length))
+                        {
+                            _logger.Warning($"Skipping file (total-bytes cap {tracker.Budget.MaxTotalUncompressedBytes} reached): {file}");
+                            tracker.RecordSkip(file, "total", length);
+                            continue;
+                        }

-                    tracker.RecordIncluded(length);
-                    _logger.Debug($"Added to diagnostics package: {entryName} ({length / 1024} KB)");
+                        // Preserve subfolder structure in the ZIP when includeSubfolders is enabled
+                        var relativePath = file.Substring(sourceFolder.Length).TrimStart(Path.DirectorySeparatorChar);
+                        var entryName = $"{zipFolder}/{relativePath.Replace(Path.DirectorySeparatorChar, '/')}";
+
+                        var entry = archive.CreateEntry(entryName, CompressionLevel.Optimal);
+                        // Stream directly from disk into the entry — no per-file MemoryStream/byte[]
+                        // copy. FileShare.ReadWrite avoids locking conflicts with active log writers.
+                        using (var fs = new FileStream(streamSource, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+                        using (var entryStream = entry.Open())
+                        {
+                            fs.CopyTo(entryStream);
+                        }
+
+                        tracker.RecordIncluded(length);
+                        _logger.Debug($"Added to diagnostics package: {entryName} ({length / 1024} KB)");
+                    }
+                    finally
+                    {
+                        if (tempExport != null)
+                        {
+                            try { File.Delete(tempExport); } catch { }
+                        }
+                    }
                }
                catch (Exception ex)
                {
@@ -567,6 +596,59 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
            }
        }

+        /// <summary>
+        /// Exports the event-log channel behind a winevt .evtx file to a temp copy via
+        /// <c>wevtutil epl</c>. Channel name is derived from the file name (%4 decodes to '/',
+        /// e.g. "Microsoft-Autopilot-BootstrapperAgent%4BootstrapperAgentServiceLogProvider.evtx"
+        /// → "Microsoft-Autopilot-BootstrapperAgent/BootstrapperAgentServiceLogProvider").
+        /// Returns the temp file path (caller deletes) or null when the export failed.
+        /// </summary>
+        private string TryExportEventLogChannel(string evtxPath)
+        {
+            string tempPath = null;
+            try
+            {
+                var channel = Path.GetFileNameWithoutExtension(evtxPath).Replace("%4", "/");
+                tempPath = Path.Combine(Path.GetTempPath(), $"am-evtx-{Guid.NewGuid():N}.evtx");
+                var psi = new System.Diagnostics.ProcessStartInfo
+                {
+                    FileName = Path.Combine(Environment.SystemDirectory, "wevtutil.exe"),
+                    Arguments = $"epl \"{channel}\" \"{tempPath}\" /ow:true",
+                    UseShellExecute = false,
+                    CreateNoWindow = true,
+                    RedirectStandardError = true,
+                };
+                using (var process = System.Diagnostics.Process.Start(psi))
+                {
+                    if (process == null) return null;
+                    if (!process.WaitForExit(30000))
+                    {
+                        try { process.Kill(); } catch { }
+                        _logger.Warning($"wevtutil export timed out for channel '{channel}'.");
+                        try { File.Delete(tempPath); } catch { }
+                        return null;
+                    }
+                    if (process.ExitCode != 0)
+                    {
+                        var stderr = process.StandardError.ReadToEnd();
+                        _logger.Warning($"wevtutil export failed for channel '{channel}' (exit {process.ExitCode}): {stderr}");
+                        try { File.Delete(tempPath); } catch { }
+                        return null;
+                    }
+                }
+                return File.Exists(tempPath) ? tempPath : null;
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"Event log export failed for {evtxPath}: {ex.Message}");
+                if (tempPath != null)
+                {
+                    try { File.Delete(tempPath); } catch { }
+                }
+                return null;
+            }
+        }
+
        private static void WriteTruncatedMarker(ZipArchive archive, BudgetTracker tracker)
        {
            var sb = new StringBuilder();
@@ -156,7 +156,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
        /// </summary>
        private (string enrollmentType, bool isHybridJoin, int? autopilotMode) CollectAutopilotProfile()
        {
-            var detectedType = "v1";
+            // Single source of truth for the rail classification — the SAME detector the
+            // session registration uses (incl. the WDP DevicePreparation subkey probe). The
+            // previous inline CloudAssigned*-only re-implementation kept reporting "v1" on
+            // Device Preparation devices while the session row already said "v2" (a11102f4).
+            var (detectedType, detectionRule) = AutopilotMonitor.Agent.V2.Core.Security.EnrollmentRegistryDetector.DetectEnrollmentTypeWithRule();
            var isHybridJoin = false;
            int? detectedAutopilotMode = null;

@@ -188,20 +192,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
                            }
                        }

-                        // Extract key values for enrollment type detection
-                        var deviceReg = data.ContainsKey("CloudAssignedDeviceRegistration")
-                            ? data["CloudAssignedDeviceRegistration"]?.ToString()
-                            : null;
-                        var espEnabled = data.ContainsKey("CloudAssignedEspEnabled")
-                            ? data["CloudAssignedEspEnabled"]?.ToString()
-                            : null;
-
-                        // Determine enrollment type: WDP if DeviceRegistration=2 or ESP explicitly disabled
-                        if (deviceReg == "2" || espEnabled == "0")
-                            detectedType = "v2";
-                        else
-                            detectedType = "v1";
-
                        // --- Interpret AutopilotMode (profile capability, not live state) ---
                        // 0 = User Driven, 1 = Self Deploying, 2 = Pre-Provisioning (White Glove)
                        var autopilotModeStr = data.ContainsKey("AutopilotMode")
@@ -377,11 +367,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
                        { "enrollmentType", detectedType },
                        { "CloudAssignedDeviceRegistration", data.ContainsKey("CloudAssignedDeviceRegistration") ? data["CloudAssignedDeviceRegistration"] : "n/a" },
                        { "CloudAssignedEspEnabled", data.ContainsKey("CloudAssignedEspEnabled") ? data["CloudAssignedEspEnabled"] : "n/a" },
-                        { "detectionRule", detectedType == "v2"
-                            ? (data.ContainsKey("CloudAssignedDeviceRegistration") && data["CloudAssignedDeviceRegistration"]?.ToString() == "2"
-                                ? "CloudAssignedDeviceRegistration=2"
-                                : "CloudAssignedEspEnabled=0")
-                            : "default (no v2 indicators)" }
+                        { "detectionRule", detectionRule }
                    });

                _logger.Info($"EnrollmentTracker: enrollment type detected: {detectedType}");
@@ -186,7 +186,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
        /// Defaults to <c>"v1"</c> on any error so a flaky registry does not misclassify a
        /// classic session as WDP.
        /// </summary>
-        public static string DetectEnrollmentType()
+        public static string DetectEnrollmentType() => DetectEnrollmentTypeWithRule().enrollmentType;
+
+        /// <summary>
+        /// Same as <see cref="DetectEnrollmentType"/> but also returns WHICH rule fired, so the
+        /// enrollment_type_detected event can name its evidence instead of re-implementing the
+        /// detection (the duplicate inline logic in DeviceInfoCollector missed the WDP subkey
+        /// rule and kept reporting "v1" on Device Preparation devices — session a11102f4).
+        /// </summary>
+        public static (string enrollmentType, string detectionRule) DetectEnrollmentTypeWithRule()
        {
            try
            {
@@ -194,25 +202,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
                    AutopilotSettingsKey + @"\DevicePreparation\BootstrapperAgent"))
                {
                    var executionContext = wdpKey?.GetValue("ExecutionContext")?.ToString();
-                    if (!string.IsNullOrEmpty(executionContext)) return "v2";
+                    if (!string.IsNullOrEmpty(executionContext))
+                        return ("v2", @"DevicePreparation\BootstrapperAgent\ExecutionContext present");
                }

                using (var key = Registry.LocalMachine.OpenSubKey(AutopilotSettingsKey))
                {
-                    if (key == null) return "v1";
+                    if (key == null) return ("v1", "AutopilotSettings key missing");

                    var deviceReg = key.GetValue("CloudAssignedDeviceRegistration")?.ToString();
-                    if (deviceReg == "2") return "v2";
+                    if (deviceReg == "2") return ("v2", "CloudAssignedDeviceRegistration=2");

                    var espEnabled = key.GetValue("CloudAssignedEspEnabled")?.ToString();
-                    if (espEnabled == "0") return "v2";
+                    if (espEnabled == "0") return ("v2", "CloudAssignedEspEnabled=0");
                }
            }
            catch
            {
                // Fall through to v1 default.
            }
-            return "v1";
+            return ("v1", "default (no v2 indicators)");
        }
    }
 }
@@ -0,0 +1,53 @@
+# Invoke-BootstrapDownload.ps1 - thin runner embedded in the Bootstrap MSI.
+#
+# The MSI is only a delivery vehicle (MDM LOB channel installs earlier than the IME
+# script/app batches during Autopilot Device Preparation). This runner downloads the
+# CURRENT Install-AutopilotMonitor.ps1 from the download endpoint and executes it, so
+# every piece of real bootstrap logic (guards, relax rules, agent download) stays
+# server-updatable without re-shipping the MSI.
+#
+# Fail-soft by design: the runner always exits 0 so a transient network failure never
+# marks the LOB install as failed; diagnostics go to msi-bootstrap.log.
+# ASCII only - no special characters in this file.
+
+$ErrorActionPreference = 'Stop'
+$baseDir = Join-Path $env:ProgramData 'AutopilotMonitor'
+$logDir  = Join-Path $baseDir 'Logs'
+New-Item -ItemType Directory -Force -Path $logDir | Out-Null
+$log = Join-Path $logDir 'msi-bootstrap.log'
+
+function Write-Log([string]$message) {
+    Add-Content -Path $log -Value ("[{0}] {1}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $message)
+}
+
+try {
+    Write-Log "MSI bootstrap runner started (user=$env:USERNAME, pid=$PID)."
+
+    if (Test-Path 'HKLM:\SOFTWARE\AutopilotMonitor\Deployed') {
+        Write-Log 'Deployed marker present - skipping, another channel already installed the agent.'
+        exit 0
+    }
+
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    $url  = 'https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1'
+    $dest = Join-Path $baseDir 'Install-AutopilotMonitor.ps1'
+
+    for ($attempt = 1; $attempt -le 3; $attempt++) {
+        try {
+            Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $dest
+            break
+        } catch {
+            Write-Log "Download attempt $attempt failed: $_"
+            if ($attempt -eq 3) { throw }
+            Start-Sleep -Seconds 10
+        }
+    }
+
+    Write-Log "Bootstrap script downloaded to $dest - executing."
+    & $dest *>> $log
+    Write-Log "Bootstrap script finished (exit code $LASTEXITCODE)."
+    exit 0
+} catch {
+    Write-Log ("MSI bootstrap runner failed: " + ($_ | Out-String))
+    exit 0
+}
@@ -0,0 +1,54 @@
+<!--
+  Autopilot Monitor Bootstrap MSI - thin MDM LOB delivery vehicle for WDP (Autopilot v2).
+
+  LOB MSIs are installed by the OMA-DM stack (EnterpriseDesktopAppManagement CSP) during
+  the first MDM sync, i.e. BEFORE/parallel to the Device Preparation SLDM app batch -
+  earlier than any IME-delivered script (Batch 2) or Win32 app can run. The MSI itself
+  carries no bootstrap logic: it installs one runner script and executes it once. The
+  runner downloads the CURRENT server-hosted Install-AutopilotMonitor.ps1, keeping all
+  real logic updatable without re-shipping the MSI.
+
+  Build: wix build Package.wxs -arch x64 -o bin\AutopilotMonitor-Bootstrap.msi
+-->
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="Autopilot Monitor Bootstrap"
+           Manufacturer="Autopilot Monitor"
+           Version="1.0.0"
+           UpgradeCode="1fbe5515-d346-445c-b8b8-14ee79f97522"
+           Scope="perMachine"
+           Compressed="yes">
+
+    <MajorUpgrade DowngradeErrorMessage="A newer version of Autopilot Monitor Bootstrap is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <StandardDirectory Id="CommonAppDataFolder">
+      <Directory Id="CompanyFolder" Name="AutopilotMonitor">
+        <Directory Id="INSTALLFOLDER" Name="Msi" />
+      </Directory>
+    </StandardDirectory>
+
+    <ComponentGroup Id="MainComponents" Directory="INSTALLFOLDER">
+      <Component Id="RunnerScript" Guid="8c8e8962-719f-458b-b291-dd99d3f1dc30">
+        <File Id="RunnerPs1" Source="Invoke-BootstrapDownload.ps1" KeyPath="yes" />
+      </Component>
+    </ComponentGroup>
+
+    <Feature Id="Main" Level="1">
+      <ComponentGroupRef Id="MainComponents" />
+    </Feature>
+
+    <!-- Deferred + no-impersonate: runs as SYSTEM after files land. Return=ignore keeps
+         the LOB install green even if the runner hits a transient error (the runner is
+         additionally fail-soft itself); diagnostics live in msi-bootstrap.log. -->
+    <CustomAction Id="RunBootstrap"
+                  Directory="INSTALLFOLDER"
+                  ExeCommand="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -ExecutionPolicy Bypass -File &quot;[INSTALLFOLDER]Invoke-BootstrapDownload.ps1&quot;"
+                  Execute="deferred"
+                  Impersonate="no"
+                  Return="ignore" />
+
+    <InstallExecuteSequence>
+      <Custom Action="RunBootstrap" After="InstallFiles" Condition="NOT Installed" />
+    </InstallExecuteSequence>
+  </Package>
+</Wix>
@@ -199,7 +199,9 @@ namespace AutopilotMonitor.Functions.Services
                    if (existingLookup.TryGetValue(pattern.PatternId, out var existing))
                    {
                        if (existing.Pattern != pattern.Pattern || existing.Action != pattern.Action
-                            || existing.Category != pattern.Category || existing.Description != pattern.Description)
+                            || existing.Category != pattern.Category || existing.Description != pattern.Description
+                            || existing.Enabled != pattern.Enabled
+                            || !ParametersEqual(existing.Parameters, pattern.Parameters))
                        {
                            await _ruleRepo.StoreImeLogPatternAsync(pattern, "global");
                            updated++;
@@ -220,5 +222,18 @@ namespace AutopilotMonitor.Functions.Services

            _seeded = true;
        }
+
+        private static bool ParametersEqual(Dictionary<string, string>? a, Dictionary<string, string>? b)
+        {
+            if ((a?.Count ?? 0) != (b?.Count ?? 0)) return false;
+            if (a == null || b == null) return true;
+
+            foreach (var kv in a)
+            {
+                if (!b.TryGetValue(kv.Key, out var value) || value != kv.Value) return false;
+            }
+
+            return true;
+        }
    }
 }
Author	SHA1	Message	Date
Oliver Kieselbach	0ffcb2fde2	command update	2026-08-17 21:44:26 +02:00
Oliver Kieselbach	a3089753d3	IME patterns: repair drift found by decompiled-source audit (IME 1.97 Dec-25) Audit vs decompiled IME 1.97.107: ~55/79 patterns verified verbatim, but several were broken or dead against the current V3 pipeline. Fixes: - IME-ESP-TRACK-STATUS: drop trailing anchor (line grew ' with name: <n>.') - HS-COMPLIANCE: tolerate both 'remdiation' typo and corrected wording; new HS-COMPLIANCE-POST for the reworded post-detection line - IME-DETECTION-RESULT: capture DetectedDifferentVersion (ordered first) - IME-ENFORCEMENT-SUCCESS: unpin OldValue (Error/PendingReboot/null paths) - IME-ERROR-REPORT: allow unquoted null OldValue on first write - Disable 11 dead patterns (emitters removed with IME's old V1/V2 pipeline; IME-DETECTED-OLD additionally collided with IME-SKIP-INSTALL-DETECTED) New signals (existing actions, tailed files only): - IME-ESP-APP-REGISTERED + IME-CACHE-MISS as app-name sources (replacing dead IME-UPDATE-NAME-1/2/3) - IME-WINGET-ERROR (WinGet failures were invisible) - IME-EXITCODE-MAPPED-FAILED (normal mapped-exit-code failure path) - IME-STOP-SIGNAL (service stop != OS shutdown) - IME-RESTART-STOP-PROCESSING (reboot-gated processing abort) Backend seed diff now also compares Enabled + Parameters - enable/disable flips and parameter changes previously never propagated to the table. All exact wordings verified against decompiled source; regex smoke-tested via validate-ime-patterns.py (engine=regex, 75/75 compiled, all new patterns fire on synthetic lines with the exact IME format strings). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-17 21:33:37 +02:00
Oliver Kieselbach	26cbc897c5	WDP: unify enrollment_type_detected with detector + export locked evtx Two fixes from the a11102f4 diag analysis: - enrollment_type_detected re-implemented the old CloudAssigned*-only detection and kept reporting "Autopilot v1 (Classic ESP)" on WDP devices while the session row already said v2. DeviceInfoCollector now uses EnrollmentRegistryDetector.DetectEnrollmentTypeWithRule() - the same detector as registration - and the event names the rule that fired. - Tenant-configured .evtx paths never made it into the diagnostics ZIP: active event-log channels hold their file exclusively locked. The package service now exports the channel via wevtutil epl (channel name derived from the %4-encoded file name) and streams the temp export. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-17 21:28:43 +02:00
Oliver Kieselbach	c88629dcf2	Bootstrap MSI: thin MDM LOB delivery vehicle for WDP WDP batch order is fixed (User -> SLDM/MDM apps -> Scripts -> Win32Apps), so a WDP-policy script can never observe the app phase live, and a hard Batch-1 failure leaves zero visibility. LOB MSIs install via OMA-DM during the first sync - before the SLDM batch - making them the earliest delivery channel. The MSI carries no logic: it installs one fail-soft runner script that downloads and executes the CURRENT server-hosted Install-AutopilotMonitor.ps1, so all real bootstrap logic stays updatable without re-shipping the MSI. Skips via the Deployed regkey when another channel won the race. Build: wix build Package.wxs -arch x64 (WiX 5). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-17 20:35:37 +02:00