test(agent): thread-safe FakeSignalIngressSink (parked-tripwire CI flake)

Timer-thread Post() appended to a bare List while the test polled it in a
SpinWait foreach -> 'Collection was modified' (run 32644425162, no assert
text). Posted now returns a locked snapshot.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/agent/cmtrace-time-resolution.md

@@ -0,0 +1,127 @@
+---
+type: concept
+title: CMTrace Time Resolution — Per-Line Self-Anchoring
+description: How the agent converts bias-less CMTrace local times to UTC without trusting any process's timezone belief — each provably fresh line anchors its own offset against the agent clock on the 15-minute grid; everything not provably fresh falls back uniformly and says so.
+resource: src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime
+tags: [agent, ime, cmtrace, timestamps, timezone, calibration, provenance]
+timestamp: 2026-08-20
+---
+
+# Problem
+
+A CMTrace line carries local time and no offset — IME 1.104 writes `DateTime.Now.TimeOfDay`
+in both of its trace listeners. Converting such a line with the reader's own
+`TimeZoneInfo.Local` silently assumes the writing and reading processes agree on the zone.
+They do not: each caches its zone at process start and follows neither a later `tzutil` nor
+a Windows auto-timezone change. The error is `Offset_writer − Offset_reader` — zero only
+when both believe the same thing, right or wrong. Field measurement over 11,068 sessions
+found 26 sessions with a real error, from +1 h to −17 h.
+
+Two designs failed before this one:
+
+* **Fix the reader's belief** (`TimeZoneInfo.ClearCachedData`, live OS offset): makes the
+  agent isolated-correct and thereby breaks the majority of sessions, where two equally
+  stale beliefs cancel.
+* **One measured offset per file** (agent 2.0.1410, reverted in `04b1a7c6`): a single log
+  file holds lines from multiple writer *eras*. `AgentExecutor.log` is written by
+  short-lived child processes whose zone belief flips per process — interleaved in one
+  file, and flipping *back* (fixture:
+  `tests/fixtures/cmtrace-logs/agentexecutor-two-writer-eras-v1.cmtrace`). Any cross-line
+  anchor — per file, or nearest-in-write-order — applies one era's offset to the other
+  era's lines. In the field this shifted `script_started` events by −9 h against their
+  correct completions.
+
+# Schema
+
+The resolution rule, in order:
+
+1. **Writer-declared bias** (`+480` suffix): authoritative, used as-is. Never a calibration
+   anchor — it needs no measurement and must not overwrite one.
+2. **Per-line self-anchoring** — only for lines read in a *provably fresh* pass:
+
+   ```
+   offset_line = round((local − agentUtcNow) / 15 min) · 15 min
+   lineUtc     = local − offset_line
+   ```
+
+   Every real UTC offset is a whole multiple of 15 minutes, so the rounding absorbs poll
+   and flush latency. No cross-line state exists, so interleaved eras resolve line by
+   line — the property the fixture test pins. The line's own timestamp still contributes
+   sub-poll precision and ordering (two lines 6 ms apart stay 6 ms apart; a plain
+   `occurredAt = now` could not do that). Guards: grid residual ≤ 2 min, offset within
+   UTC−12 … UTC+14.
+3. **Uniform reader-zone fallback** for everything else: wrong in absolute terms whenever
+   the writer held a different belief, but *self-consistent* — both ends of a duration are
+   wrong by the same amount, so derived durations stay right. The revert's core lesson:
+   partially corrected is strictly worse than uniformly wrong.
+
+**Freshness** is what makes rule 2 sound, and it is strict:
+
+* Every poll look at a file stamps `LastCheckedUtc` (`LogFilePositionTracker.MarkChecked`),
+  including "no new data" and an empty first sight — so a file first seen empty
+  (`AgentExecutor.log` appearing mid-enrollment) anchors from its very first content.
+* A pass's lines are fresh only if the file was previously observed *in this process* and
+  the gap since the last look is ≤ `FreshLineMaxAge` (30 s — far above the 100 ms poll,
+  far below the 13-minute zone where a line's *age* could round onto the offset grid).
+* A restart-restored position bookmark deliberately carries **no** freshness: the first
+  pass after a restart reads downtime backlog and must never anchor.
+
+**Provenance** (`sourceOffsetOrigin` in event DataJson): `bias` | `line-anchored` |
+`reader-zone-fallback` (plus retired `calibrated` from 2.0.1410 events). The applied
+offset is always recorded (`sourceOffsetMinutes`), the raw local time too
+(`sourceLocalTs`), so any event can be re-derived later. The per-*file* measurement still
+runs, purely observationally (`measuredWriterOffsetMinutes`, Info log when it disagrees
+with the process zone).
+
+# Constraints
+
+* An anchored line resolves to `now ± 2 min` *by construction*. The accepted edge: a
+  freshly written line carrying a **replayed** old timestamp whose age is exactly
+  N×15 min ± 2 min anchors to ≈now instead of its replayed past — bounded error, and
+  sub-24 h replays are treated as current by the historic-replay guard anyway.
+* Snapshot readers (`StallProbeCollector`, `LogParserCollector`) cannot tail and therefore
+  cannot prove freshness — they stay on the marked fallback. This is a documented limit,
+  not an omission; sharing the per-file measurement with them would re-apply exactly what
+  the revert removed.
+* Mixed pairs remain possible across a restart (start resolved from backlog fallback,
+  completion line-anchored) and are recognizable via provenance.
+
+# Backend regression tripwire
+
+The backend watches for the failure mode this design eliminates. On every terminal ingest
+batch, the counter reconcile's existing event-partition scan additionally collects
+`Δ = ReceivedAt − OccurredUtc` per event, split by `Source == "ImeLogTracker"` versus the
+rest (`CmTraceSkewTripwire`, hooked in `EventIngestProcessor`). If
+`median(Δ_IME) − median(Δ_other)` is a clean 15-minute multiple (residual < 2 min — the
+same constants as the anchoring grid guard above) with ≥ 20 samples over ≥ 3 distinct
+upload batches per side, a `CmTraceTimeSkewRegression` ops event fires (category Agent,
+warning), carrying all numbers plus the session's `sourceOffsetOrigin` histogram.
+Bias-dominated sessions are suppressed (writer-declared offsets cannot be an anchoring
+regression); `measuredWriterOffsetMinutes` is never consulted (sticky after era
+flip-backs). Kill switch: app setting `CmTraceSkewTripwireDisabled`. Goal state: the event
+never fires — any hit is an anchoring case the per-line design misses, or a detector bug.
+
+Device-clock problems (the customer-actionable cousin) are covered separately by the
+`clock_skew` analyze condition behind `ANALYZE-DEV-008`, which excludes IME-derived events
+precisely so an anchoring regression can never surface as a customer finding.
+
+# Citations
+
+* `CmTraceOffsetCalibrator.TryMeasureOffset` — the pure grid measurement, shared by
+  anchoring and the observational per-file path.
+* `CmTraceSkewTripwire` + `CmTraceSkewTripwireTests` — the backend tripwire above.
+* `RuleEngine.ConditionEvaluators.EvaluateClockSkewCondition` + `RuleEngineClockSkewTests`
+  — the customer-facing device-clock metrics (batch-median frames, spool-spread filter,
+  plateau step detection, end-state persistence).
+* `ImeLogTracker.LogProcessing.cs` `ResolveEntryUtc` — the resolution order above.
+* `ImeLogTrackerLineAnchoringTests` — resolves-to-T across writer beliefs, interleaved
+  eras in one chunk, freshness boundaries (first sight, empty first sight, poll gap,
+  restart restore), the grid-replay edge, and the field fixture replayed at production
+  poll cadence.
+* `CmTraceCalibratorFileIsolationTests` — pins per-file isolation of the observational
+  measurement (session e9753578 logged a cross-file pairing the committed code could not
+  be shown to produce; the mechanism remains open, the resolution path is immune by
+  design, and `CalibrateFrom` logs the anchor timestamp as a tripwire).
+* `tasks/todo.md` (2026-08-20) — full evidence trail: field measurements, the revert,
+  the two-writer-era fixture, and the disproven foreign-binary hypothesis (the SHA
+  mismatch was the known release race against the 5-minute AdminConfiguration cache).

docs/agent/decision-engine.md

@@ -143,11 +143,29 @@ advisory backstop. All routes converge on `CompleteThroughFinalizingOrDefer`:
    first-deployment window 100/101 for 200/210 without 110 — the RJ ESP was aborted,
    typically by an interactive logon reclassifying the run as secondary-user; emits
    the `realmjoin_first_deployment_incomplete` Warning, session 224b2087), and
-   `Timeout` (hard 60-min deadline). The abort rule reads the *persisted*
+   `Timeout` (60-min deadline from detection). The abort rule reads the *persisted*
    `RealmJoinFacts.LastDeploymentPhase` (updated by the typed `RealmJoinPhaseChanged`
    signal), so it survives agent restarts — the `RealmJoinDetected` replay path
    evaluates it too. A first observation of 210 does **not** release (RJ may have
    completed before agent boot and deploy afterwards).
+
+   **Activity-based timeout extension** (report 55e6afd61c9d — a large RJ package
+   catalog outlived the 60-min window mid-install): when the timeout deadline fires
+   while the first deployment is demonstrably active — `LastDeploymentPhase` 100/101
+   *and* deployment activity (`RealmJoinPhaseChanged` or a package observation, tracked
+   in `RealmJoinFacts.LastActivityUtc`; the phase captured at detection deliberately
+   does not count) within the last 60 min — the handler re-arms the deadline to
+   `lastActivity + 60 min` instead of timing out, emitting an Info
+   `realmjoin_timeout_extended` event. Re-arms clamp to an absolute cap of
+   **detection + 4 h**. Package activity is only observable at package *completion*
+   (RJ writes the registry subkey when the install finishes), so a single install
+   that is registry-silent for over 60 min still times out — the eventual
+   `realmjoin_timeout` carries a `reason` payload (`hard_timeout` / `inactivity` /
+   `absolute_cap`) telling the three shapes apart. A stale fire of an older deadline
+   incarnation (armed due later than the fire time; `OccurredAtUtc = DueAtUtc` per
+   scheduler contract) dead-ends as `realmjoin_timeout_stale_superseded_by_rearm`.
+   The idle case (detected, no deployment activity ever) times out at 60 min
+   unchanged, and phase 200/210 activity never extends.
 2. `Finalizing` stage + ~5 s `FinalizingGrace` deadline.
 3. Grace fires → `Completed`, `EnrollmentComplete` outcome, `enrollment_complete`
    timeline event with full audit payload.

docs/agent/diagnostics-package.md

@@ -0,0 +1,147 @@
+---
+type: concept
+title: Diagnostics Package
+description: What the agent's diagnostics ZIP contains and why — the built-in section catalog shared with the portal, the RealmJoin and Device Preparation collection gates, the configured-path guards, caps, and the package manifest.
+resource: agent
+tags: [diagnostics, realmjoin, device-preparation, guardrails, portal]
+timestamp: 2026-08-23
+---
+
+# Schema
+
+The diagnostics package is the agent's last-resort support artifact: a ZIP built in memory
+by `DiagnosticsPackageService.BuildArchiveBytes` and uploaded through a short-lived SAS
+URL at the end of a session, at the WhiteGlove seal (`Always` mode) or on a server-requested
+on-demand collection ([server actions](../backend/server-actions-on-demand-diagnostics.md)).
+
+## Archive layout
+
+```
+sessioninfo.txt                 session/tenant/device/outcome, hardware via WMI
+<built-in sections>             catalog order, see below
+AdditionalLogs/<last folder>/   admin-configured paths (global ∪ tenant)
+package-manifest.txt            every packaging decision (always written)
+_TRUNCATED.txt                  only when a cap skipped something
+```
+
+## The built-in catalog is the single source of truth
+
+Everything the package collects **before** any configured path is data, not code paths:
+`DiagnosticsBuiltInSections.All` in Shared (`Models/Diagnostics/DiagnosticsBuiltInSections.cs`).
+The agent iterates it in order; the backend serves the same list to the portal
+(`GET /api/diagnostics/paths`, MemberRead) so what administrators see is exactly what the
+agent does. There is no second copy to drift.
+
+| Id | ZIP folder | Source (unexpanded) | Patterns | Recursive | Condition |
+| --- | --- | --- | --- | --- | --- |
+| AgentLogs | `AgentLogs` | `%ProgramData%\AutopilotMonitor\Logs` | log patterns | no | Always |
+| ImeLogs | `ImeLogs` | `%ProgramData%\Microsoft\IntuneManagementExtension\Logs` | log patterns | no | Always |
+| ImeBootstrapperEventLog | `ImeLogs` | `C:\Windows\System32\winevt\Logs` | `BootstrapperAgentServiceLogProvider.evtx` | no | DevicePreparation |
+| AgentState | `AgentState` | `%ProgramData%\AutopilotMonitor\State` | log patterns + `*.complete`, `*.marker` | yes | Always |
+| AgentSpool | `AgentSpool` | `%ProgramData%\AutopilotMonitor\Spool` | `*.jsonl`, `*.json` | no | Always |
+| AgentMarkers | `AgentMarkers` | `%ProgramData%\AutopilotMonitor` | `*.complete`, `*.marker` | no | Always |
+| RealmJoinWindows | `RealmJoinLogs/Windows` | `C:\Windows\Logs` | `realmjoin*.log` | no | RealmJoinWatcher |
+| RealmJoinPackages | `RealmJoinLogs/Windows/RealmJoin` | `C:\Windows\Logs\RealmJoin` | `*.log` | yes | RealmJoinWatcher |
+| RealmJoinChoco | `RealmJoinLogs/Choco` | `%ProgramData%\RealmJoin\choco\logs` | `*.log` | yes | RealmJoinWatcher |
+| RealmJoinUserTray | `RealmJoinLogs/User` | `%LOGGED_ON_USER_PROFILE%\AppData\Local\RealmJoin` | `tray*.log` | no | RealmJoinWatcher |
+| RealmJoinUserLogs | `RealmJoinLogs/User/Logs` | `%LOGGED_ON_USER_PROFILE%\AppData\Local\RealmJoin\Logs` | `*.log` | yes | RealmJoinWatcher |
+
+"Log patterns" = `*.log *.txt *.json *.jsonl *.etl *.evtx *.xml *.csv *.cab`. The five
+`Always` sections are the historical layout (PR1-B forensics) and are lock-tested in order;
+the RealmJoin ZIP layout mirrors the disk (`C:\Windows\Logs\{realmjoin*.log, RealmJoin\…}` →
+`RealmJoinLogs/Windows/…`, `%LOCALAPPDATA%\RealmJoin\{tray*.log, Logs\…}` →
+`RealmJoinLogs/User/…`), so a flat section and a tree section never produce the same entry
+name. Two sections may share a ZIP folder only when they read different source folders
+(`ImeLogs` + the bootstrapper evtx) — `(ZipFolder, SourceFolder)` pairs are unique.
+
+### Conditions
+
+`DiagnosticsSectionCondition` is evaluated by the agent (`IsSectionActive`, pure) against its
+effective configuration and the enrollment scenario; unknown values fail closed.
+
+* **RealmJoinWatcher** — the tenant's RealmJoin Watcher toggle
+  (`AnalyzerConfiguration.EnableRealmJoinWatcher`). The package service only sees
+  `AgentConfiguration`, so `RemoteConfigMerger` mirrors that one Analyzers knob onto
+  `AgentConfiguration.EnableRealmJoinWatcher` (the RealmJoin host keeps reading the remote
+  block). Deliberately NOT additionally gated on the compile-time `RealmJoinTrackingEnabled`
+  kill switch: if the live watcher is ever disabled, the logs become more useful, not less.
+  No ConfigVersion bump — no new wire field.
+* **DevicePreparation** — `EnrollmentRegistryDetector.IsDeterministicDevicePreparation()`,
+  the same deterministic `DevicePreparation\BootstrapperAgent\ExecutionContext` marker every
+  other WDP gate keys on ([WDP scenario gates](wdp-scenario-gates.md)); CloudAssigned*
+  fallback rules count as Classic. The probe is a registry read, evaluated once per build
+  (`SCENARIO: devicePreparation=… realmJoinWatcher=…` in the manifest); a probe failure is
+  treated as Classic and logged — the evtx export is skipped, never the package. The channel
+  is exclusively locked while active, so the existing `wevtutil epl` export path
+  (`ResolveChannelForEvtxFile`, field case 2026-08-17) handles it.
+
+Inactive sections are never silent: `BUILT-IN SKIPPED (RealmJoin Watcher disabled): <Id>`,
+`BUILT-IN SKIPPED (not a Device Preparation enrollment): <Id>`,
+`BUILT-IN SKIPPED (no user session for token): <Id> '<source>'` (the
+`%LOGGED_ON_USER_PROFILE%` token resolves via `UserProfileResolver` only once an
+interactive user exists — identical to configured paths). Active ones log
+`BUILT-IN: <Id> -> folder='…' zip='…' recursive=…` followed by the per-pattern
+`ADDED / NO MATCH / FOLDER MISSING` lines.
+
+## Built-ins bypass the configured-path guards — on purpose
+
+`DiagnosticsPathGuards` ([gather-rule guardrails](../rules/gather-rule-guardrails.md))
+validates **admin-typed** paths: allowlisted prefixes, wildcard only in the last segment,
+`C:\Users` blocked except the token's `AppData\Local|Roaming`. The catalog is reviewed code,
+exactly like the five sections that never went through the guard before — and
+`%ProgramData%\RealmJoin` is not on the allowlist at all. What does apply to every section:
+the reparse-point skip (files and directories), the `.evtx` channel export, and the caps
+(100 MB per file, 500 MB total, 5000 files) tracked globally across sections by
+`BudgetTracker`, with every skip recorded in the manifest and `_TRUNCATED.txt`.
+
+## Configured paths: global ∪ tenant
+
+`GetAgentConfigFunction.MergeDiagnosticsLogPaths` sends global paths (Global Admin,
+`AdminConfiguration.DiagnosticsGlobalLogPathsJson`) first, then tenant paths
+(`TenantConfiguration.DiagnosticsLogPathsJson`), dropping blank entries and collapsing
+duplicates (trimmed, case-insensitive) onto the first occurrence — a path present in both
+lists used to produce duplicate ZIP entry names. The agent keys each entry's ZIP folder on
+the last directory name (`AdditionalLogs/<folder>`), so two configured paths ending in a
+same-named folder share one ZIP folder.
+
+## Portal surfaces
+
+* Global Admin → Settings → Diagnostics Log Paths: the built-in catalog (collapsed, read-only,
+  neutral condition pills) above the editable global list; add-row first.
+* Tenant → Settings → Agent → Diagnostics Package: built-in catalog (header carries the
+  tenant's persisted RealmJoin Watcher state, RealmJoin rows show on/off), the global paths
+  read-only, then the tenant's own entries; every role with a tenant membership can read the
+  catalog (the route is MemberRead, JWT-scoped). One line per entry (`DiagnosticsPathRow`),
+  full values in tooltips.
+
+## Test seams
+
+* `DiagnosticsPackageService` internal ctor: the five historical folder overrides map onto
+  catalog ids; `sectionFolderOverrides` covers any other section; `devicePreparationProbe`
+  replaces the registry read (seam callers default to "not WDP", so existing rigs never touch
+  the registry). `UserProfileResolver.SetForTesting(path|null)` / `Reset()` drive the token.
+* Catalog invariants live in the backend test project (`DiagnosticsBuiltInSectionsTests`),
+  because Shared has no test project.
+
+# Examples
+
+A RealmJoin tenant (watcher on) with a signed-in user: `RealmJoinLogs/Windows/realmjoin.log`,
+`RealmJoinLogs/Windows/RealmJoin/Packages/<pkg>/<timestamp>_install.log`,
+`RealmJoinLogs/Choco/<pkg>/<timestamp>_install.log`, `RealmJoinLogs/User/tray.log`,
+`RealmJoinLogs/User/Logs/RjImeHost.log`. The same tenant's package collected before the
+desktop: the two `User` sections appear as `BUILT-IN SKIPPED (no user session for token)`.
+A Classic enrollment: `BUILT-IN SKIPPED (not a Device Preparation enrollment):
+ImeBootstrapperEventLog`. A tenant that had added
+`%LOGGED_ON_USER_PROFILE%\AppData\Local\RealmJoin\Logs\*.log` manually keeps working — the
+files simply appear twice (`AdditionalLogs/Logs/…` and `RealmJoinLogs/User/Logs/…`) until the
+entry is removed.
+
+# Citations
+
+* `src/Shared/AutopilotMonitor.Shared/Models/Diagnostics/DiagnosticsBuiltInSections.cs` — the catalog
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/DiagnosticsPackageService.cs` — `BuildArchiveBytes`, `AddBuiltInSection`, `IsSectionActive`, caps, evtx export
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/RemoteConfigMerger.cs` — `EnableRealmJoinWatcher` mirror
+* `src/Backend/AutopilotMonitor.Functions/Functions/Diagnostics/GetDiagnosticsPathsFunction.cs` — `GET diagnostics/paths`
+* `src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs` — `MergeDiagnosticsLogPaths`
+* `src/Web/autopilot-monitor-web/components/diagnostics/` — `DiagnosticsPathRow`, `BuiltInSectionsList`, `builtInSectionDisplay`
+* Tests: `DiagnosticsPackageServiceTests` (RealmJoin on/off, no user session, bootstrapper evtx, probe failure), `DiagnosticsBuiltInSectionsTests`, `GetDiagnosticsPathsPayloadTests`, `GetAgentConfigFunctionTests.MergeDiagnosticsLogPaths_*`

docs/agent/do-group-id-auto-set.md

@@ -0,0 +1,113 @@
+---
+type: Concept
+title: DO GroupId Auto-Set — Delivery Optimization peering group from a network fingerprint
+description: EnableDoGroupIdAutoSet (ConfigVersion 40) makes the agent set the DOGroupId policy value to a deterministic GUID derived from the default gateway's IPv4 address and MAC (RealmJoin-compatible byte layout), so devices on the same local network form one DO peering group during enrollment; foreign DOGroupId/DOGroupIdSource policies always win.
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/DoGroupIdService.cs
+tags:
+  - agent
+  - delivery-optimization
+  - network
+  - tenant-configuration
+timestamp: 2026-08-21T00:00:00+02:00
+---
+
+# DO GroupId Auto-Set
+
+## Schema
+
+### The problem
+
+With Delivery Optimization download mode Group (2), peering is scoped by GroupId. When no
+GroupId is configured, Windows derives it from AD site → authenticated domain SID → Entra
+tenant ID — for a cloud-native tenant that means **one tenant-wide group**, so "peers on
+the same network" degrades to "peers anywhere in the tenant" and DO's cloud service has to
+match them by public IP. A GroupId derived from the local network makes the group exactly
+"devices behind the same gateway" — including branch offices behind NAT. RealmJoin ships
+this as its network-fingerprint GroupId; our agent is on the device even earlier (during
+ESP, when the big app downloads actually happen), so it can seed the same value for
+Autopilot enrollments.
+
+### The setting
+
+`TenantConfiguration.EnableDoGroupIdAutoSet` (`bool?`, default null→false), served as
+`AgentConfigResponse.EnableDoGroupIdAutoSet` — **ConfigVersion 40**. Portal: Settings →
+Agent → Settings, toggle "Set Delivery Optimization Group ID", stored via the usual
+tenant-config roundtrip (`TableConfigRepository` Store+Map). Also shown in the admin
+tenant-config report. `RemoteConfigMerger` maps the bool 1:1; it survives the offline
+config cache like every plain feature flag.
+
+The agent does NOT configure `DODownloadMode` — the fingerprint GroupId only has an
+effect when the tenant already deploys download mode Group (2) via Intune/GPO.
+
+### The fingerprint
+
+`DoGroupIdService.ComputeGroupId(ipv4Bytes, macBytes)` builds a 16-byte GUID:
+
+```
+{101,48,6} + {0,0,0} + {ip[1], 0, ip[2], ip[3]} + mac[0..5]   →  new Guid(byte[16])
+```
+
+Gateway discovery reuses the shared `NetworkInterfaceLocator` heuristic (Up, not
+Loopback/Tunnel, non-0.0.0.0 gateway; IPv4 gateway required), the gateway MAC comes from
+`ArpNativeMethods` (`iphlpapi!SendARP`). The byte layout — including the IP shuffle and
+the zero padding — is **RealmJoin-compatible and must never change**: devices managed by
+RealmJoin on the same network compute the identical GUID and peer with ours. The registry
+value is written as `Guid.ToString()` (braceless lowercase), identical to RealmJoin's
+`SetValue(name, Guid)` string form. Deliberate divergence from RealmJoin: **no
+random-GUID fallback** — a random per-device ID would isolate the device in a one-member
+group, which is worse than the OS default grouping, so no gateway/no MAC means skip.
+
+### Ownership + conflict rules (never fight a foreign policy)
+
+Target: `HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DOGroupId`
+(64-bit registry view — the Policies store is WOW64-redirected; key paths reused from
+`DoThrottlePolicyReader`). Only this GPO-store value is written; the legacy pre-1607
+`GroupId` value name is intentionally not.
+
+Skip conditions (Info event with `skipReason`, nothing written):
+
+| skipReason | Meaning |
+|---|---|
+| `no_ipv4_gateway` | No active interface with an IPv4 default gateway |
+| `arp_failed` | Gateway MAC could not be resolved via SendARP |
+| `group_id_source_policy` | `DOGroupIdSource` configured in GPO or MDM store (dynamic group source wins) |
+| `mdm_policy_present` | `DOGroupId` managed via the Policy CSP store (Intune owns it) |
+| `foreign_value_present` | Existing GPO value neither matches the computed GUID nor the one we last wrote |
+
+Ownership is tracked through the `StartupEventGate` fingerprint for the
+`do_group_id_auto_set` key: `written:<guid>` records the GUID we last wrote, so after a
+gateway change the agent recognizes its own stale value and updates it — while a value
+written by anyone else is never overwritten (`DecideAction`: empty→write, equal→no-op,
+ours→update, else→skip; unparseable existing values count as foreign). Every write is
+verified by readback.
+
+### The event
+
+One `do_group_id_auto_set` event per outcome change (Source `StartupEnvironmentProbes`,
+gated on the fingerprint — unchanged reruns across reboots stay silent; errors never
+latch, so each failing start keeps its retry trail). Severity: Info for
+success/skip, Warning for errors. Data: `groupId`, `previousValue`, `gatewayIp`,
+`gatewayMac`, `written`, `skipped`, `skipReason`, `success`, `error`.
+
+## Examples
+
+First boot on a network with gateway `192.168.178.1` / MAC `00-11-22-33-44-55`:
+
+```
+do_group_id_auto_set (Info): Delivery Optimization GroupId set to
+00063065-0000-00a8-b201-001122334455 (gateway 192.168.178.1)
+```
+
+Tenant already deploys a DO GroupId via Intune:
+
+```
+do_group_id_auto_set (Info): Delivery Optimization GroupId not set: mdm_policy_present
+```
+
+## Citations
+
+* Service (fingerprint, ownership, write+readback): `../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/DoGroupIdService.cs`
+* ARP interop: `../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/ArpNativeMethods.cs`
+* Probe wiring + event + fingerprint dedup: `../../src/Agent/AutopilotMonitor.Agent.V2.Core/Runtime/StartupEnvironmentProbes.cs`
+* Backend serve + ConfigVersion: `../../src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs`
+* DO policy stores (key paths, Registry64 rationale): `../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/DoThrottlePolicyReader.cs`

docs/agent/index.md

@@ -5,8 +5,12 @@ How the on-device agent works:
 * [Runtime Overview](overview.md) - lifecycle (install → boot guards → runtime → termination), collector hosts, the single-rail event pipeline to the backend, config & kill switch, on-disk layout.
 * [Decision Engine](decision-engine.md) - the pure-reducer state machine (DecisionCore): signals, state, effects, the A/B/C completion arms, invariants, threading.
 * [Logs, Persistence & Crash Recovery](logs-and-persistence.md) - every persisted file and why it exists; signal log vs spool; snapshot/journal; the replay-based recovery flow and quarantine.
+* [Diagnostics Package](diagnostics-package.md) - what the diagnostics ZIP contains: the built-in section catalog shared with the portal (Shared `DiagnosticsBuiltInSections`, served by GET diagnostics/paths), the RealmJoin Watcher and Device Preparation collection gates, why built-ins bypass the configured-path guards, global ∪ tenant path dedup, caps and the package manifest.
 * [Hello Wizard Un-Skip](hello-wizard-unskip.md) - why a single "WHfB disabled" policy read never decides completion: the HelloWizardStarted signal (prevention + cure) and the HelloTracker confirmation second read.
 * [Autopilot ZTD Diagnostics](autopilot-ztd-diagnostics.md) - Windows' own diagnostic surfaces for the profile-download flow: ModernDeployment event IDs (807/815/164/...), the Diagnostics\Autopilot registry key, deployment-service endpoints, and the known-issue error-code map.
 * [MDM Reboot Coalescing](mdm-reboot-coalescing.md) - attributing the mid-ESP coalesced reboot ("second sign-in") to the device-assigned policy URIs that forced it: aggregated 2800 observations (neutral, flush-time watermark) + ANALYZE-ESP-005 gated on an actually-observed reboot.
+* [Power-State Watcher](power-state-watcher.md) - live AC↔battery transitions and 50/30/15% downward threshold crossings via a WMI push subscription (no polling): power_state_change semantics (latch/debounce/cap, never armed without a battery) and the single-condition analyze rules ANALYZE-DEV-009/-010 on top.
+* [DO GroupId Auto-Set](do-group-id-auto-set.md) - the optional Delivery Optimization peering-group seed: deterministic GUID from default gateway IPv4 + MAC (RealmJoin-compatible), written to the DOGroupId policy value with readback, ownership-tracked so foreign Intune/GPO values are never overwritten; skip reasons and the do_group_id_auto_set event.
+* [System Timeline Watcher](system-timeline-watcher.md) - clock steps (system_clock_changed: oldTime/newTime/timeDeltaMs/process, micro-slew floor) and completed sleep episodes (system_sleep_episode: sleep/hibernate/Modern Standby with authoritative enteredAt/exitedAt) from one System-channel EventLogWatcher with pre-agent backfill; feeds the web clock-set jump cause, the standby duration note, time-attribution SleepSpans and ANALYZE-DEV-012.
 
 Reading order for newcomers: overview → decision engine → persistence.

docs/agent/power-state-watcher.md

@@ -0,0 +1,106 @@
+---
+type: Concept
+title: Power-State Watcher — live AC/battery transitions and threshold events during enrollment
+description: How the agent observes AC↔battery switches and downward battery-threshold crossings mid-enrollment via a WMI push subscription (no polling), the power_state_change event semantics (transition field, 50/30/15 ladder, latch/debounce/cap), and the two analyze rules on top (ANALYZE-DEV-009/-010).
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/PowerStateWatcherHost.cs
+tags:
+  - agent
+  - power
+  - battery
+  - collector
+  - wmi
+  - analyze-rules
+timestamp: 2026-08-21T00:00:00+02:00
+---
+
+# Power-State Watcher
+
+The startup probe (`power_state_check`, one-shot from `StartupEnvironmentProbes` via
+`PowerStateProbe`/`GetSystemPowerStatus`) only captures the power state at agent start. A
+device unplugged mid-enrollment — or draining its battery across a multi-hour ESP — was
+invisible. The watcher closes that gap **event-driven, with zero polling**.
+
+# Mechanism
+
+- `PowerStateWatcherHost` (`Orchestration/Hosts`) arms a WMI event subscription with a
+  two-step chain:
+  1. `SELECT * FROM Win32_PowerManagementEvent WHERE EventCode = 10` (PBT_APMPOWERSTATUSCHANGE:
+     true kernel push, fires on AC↔DC switches and battery-percentage steps).
+  2. **Fallback** `SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance
+     ISA 'Win32_Battery'` — required because on Windows 11 24H2/25H2 (observed on builds
+     26200 and 26220, session 161b838c) the `MS_Power_Management_Event_Provider` is still
+     registered in the repository but its activation fails with `WBEM_E_NOT_FOUND`: the
+     legacy push provider no longer loads on exactly the OS builds new devices enroll with.
+     The WITHIN sampling runs inside WinMgmt (one Win32_Battery snapshot every 30 s), not in
+     the agent; worst-case detection latency ≈ 35 s incl. debounce. `collector_degraded`
+     (`watcher_arm_failed`) is emitted only when BOTH attempts fail; the agent log's arm
+     line names the active mode.
+
+  Either way the arriving event's payload is ignored — each arrival re-probes via the
+  existing `PowerStateProbe.Probe()` (cheap P/Invoke).
+- Snapshots are diffed by the pure `PowerStateTransitionTracker`
+  (`Monitoring/Enrollment/SystemSignals`), which decides what to emit. The host only owns
+  WMI, a 5 s trailing-edge debounce timer (dock-flap AC→battery→AC inside the window
+  collapses to a no-diff) and the emit path (`InformationalEventPost`, single rail).
+- **No battery / probe error ⇒ WMI is never armed** — desktops and VMs pay nothing. WMI
+  arming runs on a background thread (WinMgmt can hang in OOBE; `ConsoleBypassWatcher`
+  precedent); an arm failure emits one `collector_degraded` (`watcher_arm_failed`).
+- Registered as a plain always-on peripheral host after `NetworkChangeHost`, deliberately
+  NOT under `PeriodicCollectorLifecycleHost`: it is push-based (zero idle cost) and must be
+  alive precisely when the device idles on battery. Kill-switch:
+  `Collectors.EnablePowerStateWatcher` (default true, compile-time default like the other
+  collector toggles; ConfigVersion 38).
+
+# Event: power_state_change
+
+`data.transition` discriminates three shapes (payload always carries `onAcPower`,
+`batteryPercent`, `isCharging`, `batteryLifeMinutes`; unknowns as `"unknown"`):
+
+| transition | Severity | Immediate | Notes |
+|---|---|---|---|
+| `ac_to_battery` | Warning | yes | one per accepted edge |
+| `battery_to_ac` | Info | no | recovery |
+| `threshold_crossed` | Info (50) / Warning (30) / Error (15) | 30+15 only | extra field `thresholdPercent` |
+
+Threshold semantics (tracker):
+
+- Ladder 50/30/15, evaluated only while ON battery; **each level latches once per agent
+  lifetime** (charge-up + re-drain does not re-emit — no plug-cycle alarm spam).
+- A multi-level jump emits only the LOWEST newly-crossed level (60%→10% ⇒ one `15` event).
+- Entering battery power already below a level counts as crossing it; the arm-time baseline
+  does too — an enrollment STARTING at 12% battery emits its `thresholdPercent: 15` event
+  immediately (the analyze rule would otherwise never see sessions that began low).
+- Lifetime emission cap 20 (storm backstop against a flapping dock / dying battery
+  controller); the host logs one warning when it engages.
+
+Backend/agent hygiene: `power_state_change` is classified as non-activity on both sides —
+`SignalActivityClassifier.NonActivityEventTypes` (agent: must not reset the
+PeriodicCollectorLifecycleHost/StallProbeHost idle clocks) and
+`EventIngestProcessor.IsPeriodicOrStallEvent` (backend: must not heal a Stalled session —
+battery drain is not enrollment progress).
+
+# Analyze Rules
+
+- **ANALYZE-DEV-009** (high): battery crossed 15% while on battery — matches the
+  agent-stamped `thresholdPercent equals 15`.
+- **ANALYZE-DEV-010** (warning): AC→battery switch — matches `transition equals
+  ac_to_battery`.
+- Both: `evaluateOn: ["enrollment_end", "whiteglove_sealed", "on_event:power_state_change"]`
+  (live interim finding + terminal finalization), `markSessionAsFailedDefault: false`.
+- Both are deliberately **single-required-condition**: `event_data` conditions scan events
+  independently (no same-instance join), so a two-condition rule (e.g. `transition ==
+  threshold_crossed AND batteryPercent < 15`) could false-positive across two different
+  power events. `thresholdPercent` exists only on threshold events and its value pins the
+  ladder level, so one condition fully identifies the instance.
+- `{{token}}` caveat: `AddDataFieldsToEvidence` whitelists only generic identifiers
+  (appId/errorCode/…), so `{{batteryPercent}}` would render literally. DEV-009 interpolates
+  `{{thresholdPercent}}` (the matched condition's own dataField); the exact percentage lives
+  on the linked event in the timeline.
+
+# Citations
+
+- `src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/PowerStateWatcherHost.cs`
+- `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/PowerStateTransitionTracker.cs`
+- `src/Agent/AutopilotMonitor.Agent.V2.Core/Runtime/PowerStateProbe.cs` (probe, unchanged)
+- `rules/analyze/ANALYZE-DEV-009.json`, `rules/analyze/ANALYZE-DEV-010.json`
+- [analyze-rule-triggers](../rules/analyze-rule-triggers.md) (interim-trigger design; the WG battery rule was its motivating case)

docs/agent/system-timeline-watcher.md

@@ -0,0 +1,110 @@
+---
+type: Concept
+title: System Timeline Watcher — clock steps and sleep episodes from the System event log
+description: How the agent turns two enrollment blind spots into timeline ground truth via one EventLogWatcher on the System channel — system_clock_changed (Kernel-General 1, oldTime/newTime/timeDeltaMs/process) and system_sleep_episode (Power-Troubleshooter 1 classic sleep/hibernate, Kernel-Power 507 Modern Standby) — including backfill of pre-agent records, the payload-times-are-authoritative rule, SleepSpans in time attribution, the web clock-set jump cause, and ANALYZE-DEV-012.
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/SystemTimelineTracker.cs
+tags:
+  - agent
+  - eventlog
+  - time
+  - clock-skew
+  - standby
+  - collector
+  - time-attribution
+  - analyze-rules
+timestamp: 2026-08-21T00:00:00+02:00
+---
+
+# System Timeline Watcher
+
+Two things silently distort every session timeline and its wall-clock duration:
+
+1. **The OS clock gets stepped** — classically w32time correcting a wrong BIOS clock early
+   in OOBE, but also tzutil/MDM actions. Before this watcher the jump was only *inferred*
+   (TimeJumpBadge, `clock_skew`/DEV-008); Windows records the ground truth.
+2. **The device sleeps mid-enrollment** — the timeline shows an unexplained gap, the
+   duration looks inflated, and nothing says "the device was simply asleep for 56 minutes".
+
+`SystemTimelineTracker` (hosted by `SystemTimelineWatcherHost`, config flag
+`Collectors.EnableSystemTimelineWatcher`, ConfigVersion 39) subscribes to the **System**
+channel with one provider-qualified XPath and forwards both facts as events.
+
+# Sources and events
+
+| Source (System channel) | Emitted event | Key payload |
+|---|---|---|
+| `Microsoft-Windows-Kernel-General` EventID 1 | `system_clock_changed` | `oldTime`, `newTime` (ISO-8601), signed `timeDeltaMs`, `reason`/`reasonText` (1=`application_set`, 2=`hardware_clock_sync`), `processName`/`processId` |
+| `Microsoft-Windows-Power-Troubleshooter` EventID 1 | `system_sleep_episode` | `kind`=`sleep`/`hibernate` (EffectiveState 5 ⇒ hibernate), `enteredAt`=SleepTime, `exitedAt`=WakeTime, `durationSeconds`, `wakeSourceType`/`wakeSourceText` |
+| `Microsoft-Windows-Kernel-Power` EventID 507 | `system_sleep_episode` | `kind`=`modern_standby`, `exitedAt`=TimeCreated, `enteredAt`=exit − DurationInUs, `durationSeconds` (scenario), `sleepDurationSeconds` (real sleep), `reason`, `onAcPower`, `batteryRemainingCapacityOnExit` |
+
+**506 is deliberately not consumed.** 507 carries the full episode; pairing 506/507 would
+need an orphan-tolerant state machine across agent restarts for zero information gain — an
+episode without a 507 never completed and would not be emitted under any design.
+
+# Thresholds (constants, not knobs)
+
+- `MinClockDeltaMs = 2000` — w32time logs Kernel-General 1 for routine **1 ms micro-slews**
+  (verified live, several per hour); only genuine steps are emitted. Suppressed records are
+  still claimed by the dedup watermark.
+- `ClockDeltaWarningMs = 5 min` — larger steps are Warning + immediate upload (can break
+  token/cert validation windows; matches the web TimeJumpBadge threshold).
+- `MinSleepDurationSeconds = 60` — **Modern Standby only**: every screen-off scenario logs a
+  506/507 pair, including seconds-long ones with `SleepDurationInUs 0` (`SleepEntered=false`);
+  the single duration gate suppresses both. Classic Power-Troubleshooter episodes have no
+  floor — they only exist for genuinely completed S3/S4 transitions.
+
+# Payload times are authoritative
+
+The decisive clock correction happens exactly when the device clock is untrustworthy, and
+the backend clamps implausible event timestamps (±168 h/24 h) to server time. Every semantic
+instant therefore travels as an explicit ISO-8601 payload field (`oldTime`/`newTime`,
+`enteredAt`/`exitedAt`); consumers must never read the event's own `Timestamp` for these.
+The event `Timestamp` is set to the record's TimeCreated (WindowsUpdateTracker backfill
+convention) so rows land where the wake/step happened.
+
+# Backfill and dedup
+
+Template: `WindowsUpdateTracker`. `LoadWatermark → arm watcher → backfill` with lookback
+`SystemEventBackfillLookbackMinutes` (default 1440 = 24 h; 0 disables). The System .evtx
+persists across OOBE reboots, so the pre-agent w32time correction and pre-agent standby
+episodes are recovered with `backfilled=true`. Cross-restart dedup via RecordId watermark
+(`system-timeline-watermark.json` in the state directory) plus an intra-run `HashSet` —
+deliberately **not** a high-water mark, which would drop exactly the older, never-emitted
+pre-agent records (the live watcher arms before the backfill scan).
+
+# Non-activity classification (both sides)
+
+Both event types are environment observation, not enrollment progress:
+`SignalActivityClassifier.NonActivityEventTypes` (agent — must not reset idle/stall clocks)
+and `EventIngestProcessor.IsPeriodicOrStallEvent` (backend — a device that slept through its
+stall must stay Stalled).
+
+# Consumers
+
+- **Web timeline** (`EventTimeline.tsx`): badge blocks for both events; the TimeJumpBadge
+  gains the ground-truth cause `clock-set` — `classifyTimeJump` receives the session's
+  `system_clock_changed` deltas and matches a backward display step against a backward clock
+  set within max(60 s, 20 %) (`lib/timeProvenance.ts`).
+- **Duration story** (`SessionInfoCard` via `useSessionDerivedData.standbySeconds`): the
+  wall-clock duration deliberately keeps the pause (the enrollment really took that long);
+  a `· 🌙 56m standby` note explains it. Episodes are dedup'd on `enteredAt`.
+- **Time attribution** (`TimeAttributionCalculator.BuildSleepSpans`, AttributionVersion 3):
+  `SleepSpan`s mirror `RebootSpan`s — cross-cutting annotations clipped to the observation
+  windows (a WhiteGlove-pause episode contributes only its in-window flanks), never a slice
+  of the wall-clock partition. Persisted as `SleepSeconds`/`SleepSpansJson`; rendered as the
+  standby chip in `TimeAttributionLane`.
+- **ANALYZE-DEV-012** (info, `trigger: single`, `on_event:system_sleep_episode`): fires once
+  per session for episodes ≥ 5 min. Deliberately the ONLY new rule: clock issues already
+  have DEV-008 (`clock_skew`) — a second clock rule would double-report the same action item
+  (user decision 2026-08-21); clock steps stay timeline ground truth with badges instead.
+
+# Citations
+
+- `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/SystemTimelineTracker.cs`
+- `src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/SystemTimelineWatcherHost.cs`
+- `src/Backend/AutopilotMonitor.Functions/Helpers/TimeAttributionCalculator.cs` (`BuildSleepSpans`)
+- `src/Web/autopilot-monitor-web/lib/timeProvenance.ts` (`clock-set`, `findExplainingClockChange`)
+- `rules/analyze/ANALYZE-DEV-012.json`
+- Live payload evidence (2026-08-21, Win11 26220): Kernel-General 1 with `TimeDeltaInMs=1`
+  micro-slews; Kernel-Power 507 with `SleepDurationInUs=2324095807`; Power-Troubleshooter 1
+  with `SleepTime`/`WakeTime` across a hibernate.

docs/backend/app-install-duration-attempt.md

@@ -0,0 +1,82 @@
+---
+type: concept
+title: Attempt-Scoped App Install Durations
+description: AppInstallSummary.DurationSeconds measures the status-defining (last) install attempt via a LastAttemptStartedAt max-fold anchor — replacing the first-observation-to-last-terminal span that billed multi-pass IME processing gaps to trivial apps; time attribution counts the union of active attempt segments.
+resource: src/Backend/AutopilotMonitor.Functions/Services/EventIngestProcessor.AppInstall.cs
+tags: [backend, agent, ingest, app-installs, metrics, time-attribution, durations]
+timestamp: 2026-08-21
+---
+
+# Problem
+
+The IME processes the ESP app list in multiple passes: a device-ESP evaluation pass can
+touch an app (often ending `Skipped`) long before the real install runs in a later pass.
+`AppInstallSummary` is keyed by `{SessionId}_{AppName}` and folded from ALL of the app's
+events, so `DurationSeconds = last terminal − first observation` spanned those passes.
+Field case (session `44862cd3`, "Set TimeZone"): evaluation pass 09:16, real install
+10:22:58 → 10:23:21 — reported 4002 s for a 23-second install. Fleet averages, the
+Slowest-Apps ranking, p95s, and the version-regression radar all inherited the inflation;
+the rule engine's `app_install_duration` (already attempt-scoped) contradicted the
+dashboard for the same install.
+
+# Schema
+
+Three durable anchors on the row — each with a distinct, non-interchangeable job:
+
+| Column | Fold | Role |
+|---|---|---|
+| `StartedAt` | min (earliest wins) | First observation. Server-side window/bucket filter of every AppInstallSummaries scan and the radar's version-ordering key. Never re-anchored. |
+| `LastAttemptStartedAt` | **max** (in-batch and in `ReconcileAppInstallSummaryWithExisting`) | Anchor of `DurationSeconds`. Null = sentinel (row predates 2026-08, or no start observed) → duration falls back to the historical `StartedAt` span. Replay of an older batch can never regress it. |
+| `InstallPassCount` | additive, guarded by `LastAttemptStartedAt` monotonicity (a batch whose newest start is not newer than the stored anchor adds 0) | Explains "finished long after first seen" (web ×N chip); 2+ is normal. |
+
+`DurationSeconds = CompletedAt − LastAttemptStartedAt`, computed at the terminal event and
+re-derived in one central reconcile site covering in-order and Q4 out-of-order batches.
+A `LastAttemptStartedAt` newer than `CompletedAt` means a fresh pass is in flight — the
+completed attempt's stored duration stands (the 0 value omits the column; Merge preserves).
+`DownloadDurationSeconds` pairs the latest `app_download_started` with the NEXT
+`app_install_started` (attempt-scoped, in-batch). The full span stays derivable as
+`CompletedAt − StartedAt` — deliberately not a column.
+
+Weaker-terminal guard (both in-batch and cross-batch): `app_install_completed` with
+state `Skipped`/`Postponed` never overrides an `Installed`/`Error` terminal, nor its
+`CompletedAt`/`DurationSeconds` — mirroring the long-pinned `app_install_skipped` rule.
+
+# Consumers
+
+* **Fleet metrics / apps dashboard / PDF** (`MetricsMath`, `AppsAnalyticsHelper`): values
+  drop to attempt scale; labels say "install time (final attempt)". The 6 h
+  `MaxPlausibleInstallDurationSeconds` gate remains (an attempt longer than the agent's
+  lifetime is still unobservable).
+* **AppVersionRegressionRadar**: cutover gate in `MeasuredAppGroups` — only rows with
+  `LastAttemptStartedAt` enter the duration population, on BOTH comparison sides. A mixed
+  population would mask real regressions and falsely re-arm active episodes for up to the
+  35-day horizon. `MinMeasuredInstalls` keeps it silent until enough post-cutover rows
+  exist. Thresholds (2.0× / 300 s) were tuned on span data — re-evaluate ~4 weeks after
+  rollout.
+* **Time attribution** (`TimeAttributionCalculator.BuildBlockingAppIntervals`):
+  sequence-ordered start→terminal pairing yields one segment per pass/attempt. Per-app
+  seconds = SUM of clamped segments (failed attempts and evaluation passes count — they
+  occupied the path); occupancy merges the segments, never the per-app hulls; hull
+  endpoints remain first-start→last-terminal for display and what-if. Deliberately
+  BROADER than the metrics duration: active time across all passes vs. final attempt.
+* **Agent payloads** (`AppInstallTiming` / `ImeLogTrackerAdapter.UpdateAppTiming`): a
+  terminal→active transition re-arms BOTH endpoints, so event `durationSeconds` also
+  describes the attempt (needs the agent release carrying this change).
+* **Rule engine** `app_install_duration`: was already attempt-scoped — now consistent.
+
+# Rollout
+
+No backfill (user decision, analog to the CMTrace legacy): pre-cutover rows keep span
+values, so time-series charts step down visibly at the changeover (documented in the
+public platform changelog). Sentinel-gated columns follow the standard chain:
+`BuildAppInstallSummaryEntity` + `MapToAppInstallSummary` + `AppsDashboardProjection`
+(the only projection whose consumers read the new columns).
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Services/EventIngestProcessor.AppInstall.cs` — fold + weaker-terminal guard + attempt pairing
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Metrics.cs` — reconcile max-fold, pass-count guard, central duration recompute
+* `src/Backend/AutopilotMonitor.Functions/Helpers/AppVersionRegressionRadar.cs` — cutover gate
+* `src/Backend/AutopilotMonitor.Functions/Helpers/TimeAttributionCalculator.cs` — per-pass segments + occupancy
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/SignalAdapters/ImeLogTrackerAdapter.cs` — payload timing re-arm
+* Tests: `AppInstallTerminalStateAndReconcileTests`, `EventTimestampValidationTests`, `AppVersionRegressionRadarTests`, `TimeAttributionCalculatorTests`

docs/backend/device-journeys.md

@@ -78,7 +78,8 @@ Durations shown for attempts are the sessions' authoritative `DurationSeconds` v
   completed journeys, first-time-right count, attempt histogram, junk-serial exclusion
   count, `JourneyVersion`. A journey buckets on the StartedAt date of its completing
   success session (the platform's StartedAt-date convention; late terminals converge via
-  the sweep). All counts are **additive**, so a window rate is the ratio of summed daily
+  the sweep, which slices the tick's shared projected window scan — see
+  `time-attribution.md`). All counts are **additive**, so a window rate is the ratio of summed daily
   rows — there is no rolling-window row (unlike the median-based time-attribution
   aggregates, which cannot merge). 180-day retention. Rows exist below the ≥20 UI gate
   on purpose (the UI needs the n for "insufficient data (n=…)").

docs/backend/plan-downgrade-retention-grace.md

@@ -0,0 +1,93 @@
+---
+type: concept
+title: Plan Downgrade Policy & the Retention Grace Period
+description: What happens when a tenant loses Pro (explicit downgrade or trial expiry) — every entitlement gates read-time and reversibly, except retention, which gets a 30-day grace before the Community cap starts hard-deleting; the anchor model, the ops events, and the deliberate non-grace of everything else.
+resource: backend
+tags: [plan, edition, downgrade, retention, grace-period, trial, entitlements]
+timestamp: 2026-08-22
+---
+
+# Schema
+
+## The downgrade model: gate, don't destroy
+
+Edition is resolved at READ time (`FeatureEntitlementCatalog.ResolveEdition`): Pro ⇔
+permanent tier `pro`/legacy `enterprise` OR an active trial. A plan mutation is a single
+field write (`PATCH config/{tenantId}/plan`, GA-only) — there is no downgrade event
+handler, no cascade. On Pro → Community every entitlement simply gates on the next read
+(≤ ~5 min config cache):
+
+* **Unrestricted Mode** — effective value flips false; the GA on-request flag and the
+  tenant toggle survive untouched (inert). Re-upgrade restores it verbatim.
+* **Delegated (MSP) admin** — scope suppressed at the home-tenant gate
+  (`DelegatedAdminService.ApplyHomeTenantGateAsync`); grant rows / tenant groups /
+  assignments are never touched. Resurrects on re-upgrade.
+* **OOBE bootstrap** — endpoints 403/404 unless the additive GA per-tenant flag
+  (`BootstrapTokenEnabled`) is set; `BootstrapSessions` rows are kept.
+* **Rate limits / MCP quota** — pure computed-at-read floors/plan names.
+
+**Retention is the one exception**: the retention sweep (12-hourly
+`SessionDeletionMaintenance` → `SessionRetentionFanoutService`) hard-deletes sessions
+older than `GetEffectiveRetentionDays` = `min(stored DataRetentionDays, edition cap)`.
+Without protection, a downgrade (or trial expiry) with stored retention 365 would start
+irreversibly cascade-deleting the 90–365-day band on the next tick.
+
+## The retention grace period (30 days)
+
+`FeatureEntitlementCatalog.RetentionDowngradeGraceDays = 30`. For 30 days after losing
+Pro, `GetEffectiveRetentionDays` keeps clamping to the **Pro** cap (365); only after the
+grace does the Community cap (90) bite. The stored `DataRetentionDays` is never rewritten.
+`days <= 0` (GA-only "infinite") short-circuits before any cap — those tenants are never
+swept, grace or not.
+
+**Anchor** — "when was Pro lost" (`TenantEntitlementService.GetRetentionGraceEndUtc`,
+returns null while effectively Pro; grace end = latest anchor + 30d):
+
+* **Explicit downgrade**: `TenantConfiguration.ProDowngradedUtc` (backend-only field, no
+  agent ConfigVersion impact), maintained exclusively by the plan endpoint's pure mutation
+  core `PlanManagementFunction.ApplyPlanChanges`. Stamped when the EFFECTIVE edition
+  (before vs. after, same `nowUtc`) transitions Pro → Community — this covers both a
+  planTier downgrade and a GA explicitly ending a trial (`trialExpiresUtc: null`, where
+  the trial timestamp disappears and could not anchor). Cleared on any transition back to
+  effectively Pro (PATCH pro, trial grant, self-service trial start), so a re-upgrade also
+  resets the grace clock.
+* **Trial expiry**: no write happens — the stored `TrialExpiresUtc` itself is the anchor
+  (read-time, like edition resolution). A planTier downgrade under a still-active trial
+  deliberately does NOT stamp: the edition is still Pro, and the later trial expiry
+  anchors the grace then.
+
+The field is on the patch-endpoint `BaseDeniedFields` and `RevertProtectedFields` lists
+(a config revert must not time-travel the anchor) and roundtrips the table-serialization
+contract (Store+Map + roundtrip tests). Legacy rows read null → no anchor → no grace,
+which is correct: no tenant had been downgraded before the feature existed.
+
+## Ops visibility (dual-registered event types)
+
+* `TenantPlanDowngraded` (Warning) — emitted by the PATCH handler on an effective
+  Pro→Community transition; carries `retentionGraceEndsUtc` + stored retention days. The
+  response body also returns `retentionGraceEndsUtc`.
+* `TenantRetentionGraceExpiring` / `TenantRetentionGraceEnded` (Warning) — emitted by the
+  daily `TrialExpirySweepFunction` (03:30 UTC) with the same stateless window mechanics as
+  the trial events (≤3-day heads-up re-fired daily; ended once via the 24h look-back), and
+  ONLY when data is actually at risk: stored `DataRetentionDays` above the Community cap
+  (0 = infinite ⇒ never). Re-upgraded tenants go silent automatically (grace resolves null).
+
+All three are registered in the web `OPS_EVENT_TYPES` catalog (OpsAlertRulesSection.tsx)
+so Telegram alert rules can route them.
+
+## Deliberate non-goals
+
+* No grace for Unrestricted/MSP/bootstrap/limits — reversible gates need none.
+* The retention WRITE cap (`TenantConfigValidation`) does not honor the grace: during the
+  grace a tenant admin cannot SET a value above the Community cap. The grace protects
+  existing data; new writes follow the new plan.
+* The feature-flags endpoint keeps publishing the plain edition cap
+  (`retentionCapDays`) — it feeds the settings input maximum, which is the write cap.
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Services/TenantEntitlementService.cs` — grace + effective retention
+* `src/Backend/AutopilotMonitor.Functions/Functions/Config/PlanManagementFunction.cs` — `ApplyPlanChanges` anchor lifecycle
+* `src/Backend/AutopilotMonitor.Functions/Functions/Maintenance/TrialExpirySweepFunction.cs` — grace event windows
+* `src/Backend/AutopilotMonitor.Functions/Services/Deletion/SessionRetentionFanoutService.cs` — enforcement point
+* Tests: `TenantEntitlementServiceTests`, `PlanManagementTransitionTests`, `TrialExpirySweepFunctionTests`, `SessionRetentionFanoutServiceTests`, `TenantConfigTableSerializationTests`

docs/backend/send-time-frame-separation.md

@@ -0,0 +1,84 @@
+---
+type: concept
+title: Send-Time Frame Separation (X-Send-Time-Utc)
+description: One device-clock send timestamp per upload batch splits ReceivedAt − OccurredUtc into pure spool delay and pure device-vs-server clock offset — turning clock diagnostics from median statistics into direct per-request measurement.
+resource: src/Backend/AutopilotMonitor.Functions/Functions/Ingest/IngestTelemetryFunction.cs
+tags: [backend, agent, ingest, timestamps, clock-skew, telemetry, provenance]
+timestamp: 2026-08-21
+---
+
+# Problem
+
+Events carry two time anchors: `OccurredUtc` (device clock at emission) and `ReceivedAt`
+(server clock at ingest). Their difference conflates two physically distinct phenomena:
+
+* **Spool delay** — the event waited offline or in retry backoff before upload. Expected,
+  harmless, minutes to hours.
+* **Device-vs-server clock offset** — the actual diagnostic signal.
+
+A uniform spool backlog (events emitted close together, uploaded after an outage) is
+indistinguishable from a clock offset in that delta; a draining backlog fakes a clock jump
+ramp. Every consumer had to filter this statistically (spread caps, plateau guards,
+persistence tests) — and the first field clock-jump measurement failed exactly on this
+ambiguity.
+
+# Schema
+
+The agent stamps one header per upload attempt (`BackendTelemetryUploader`):
+
+```
+X-Send-Time-Utc: <DateTime.UtcNow, ISO-8601 round-trip>
+```
+
+Per **attempt**, not per batch content: a retry after backoff is a new send moment. The
+ingest function parses it (`ParseSendTimeHeader`: round-trip parse, UTC-normalized, values
+before year 2000 rejected as garbage — deliberately **no upper clamp**, a future-dated
+send time IS the clock-error measurement), and `StampServerFields` writes it as `SentAt`
+onto every event of the request — server-stamped, request-level, never trusted per-event
+from the wire. Stored as the nullable `SentAt` column on Events (absent for pre-header
+agents), mapped back everywhere events are read, exposed as `sentAt` in the `fields=`
+projection and verbatim on the raw endpoints.
+
+The separation is then exact:
+
+```
+SentAt − OccurredUtc   = pure spool delay            (both device frame; offset cancels)
+ReceivedAt − SentAt    = network latency + clock offset   (the only frame crossing)
+```
+
+Network latency is seconds; anything beyond is device clock error, per request, no
+statistics required.
+
+# Consumers
+
+* **`clock_skew` analyze condition** (ANALYZE-DEV-008): batches whose events carry
+  `SentAt` measure the batch offset directly as `SentAt − ReceivedAt` — spool-immune by
+  construction, so the spread cap and the IME/clamped exclusions are unnecessary there
+  (no event timestamps are read at all; IME-only sessions become measurable). Batches
+  without `SentAt` keep the legacy per-event median + spread-cap path. Downstream logic
+  (stability check, plateau step detection, end-state persistence) is shared; evidence
+  carries `sentAtBatchCount`.
+* **`CmTraceSkewTripwire` deliberately unchanged**: `median(Δ_IME) − median(Δ_other)`
+  cancels the device clock offset as common mode — send time adds nothing to that
+  differential measurement.
+
+# Constraints
+
+* `SentAt` comes from the same device wall clock as the event timestamps — a clock jump
+  between emission and send lands in the spool-delay term. That is the intended place for
+  it to become visible, not a defect.
+* Signals and DecisionTransitions do not carry `SentAt` (no consumer); the header is
+  request-level, so extending them later is a storage-only change.
+* Fleet coverage grows with agent rollout; all analyses must treat `SentAt == null`
+  (legacy rows, old agents) as "legacy path", never as zero.
+
+# Citations
+
+* `BackendTelemetryUploader.UploadBatchAsync` — header stamping per attempt.
+* `IngestTelemetryFunction.ParseSendTimeHeader` + `IngestTelemetryFunctionTests` — parse
+  contract incl. the no-upper-clamp decision.
+* `EventIngestProcessor.StampServerFields` + `IngestCriticalPathTests` — server-side
+  stamping, forged per-event values overridden.
+* `RuleEngine.ConditionEvaluators.EvaluateClockSkewCondition` + `RuleEngineClockSkewTests`
+  — the two measurement paths (the backlog-alias test pair pins why SentAt exists).
+* `tasks/todo.md` P14 (2026-08-21) — decision trail incl. why the tripwire stays as is.

docs/backend/silent-session-classification.md

@@ -0,0 +1,110 @@
+---
+type: Concept
+title: Silent-Session Classification (Sweep, Max-Lifetime, Retro-Reconcile)
+description: How a session whose agent went silent gets its honest status — the two-stage maintenance sweep (2h Stalled marker, 5h timeout classification), the EnrollmentTimeoutClassifier rule order incl. the WhiteGlove Part-2 and self-deploying gates, which ingest paths share the classifier, and the admin retro-reconcile modes.
+resource: src/Backend/AutopilotMonitor.Functions/Services/EnrollmentTimeoutClassifier.cs
+tags:
+  - backend
+  - maintenance
+  - session-status
+  - classification
+  - whiteglove
+  - self-deploying
+timestamp: 2026-08-23T18:00:00+02:00
+---
+
+# Silent-Session Classification
+
+A session only ever becomes terminal through evidence. When the agent stops reporting
+(power-off, reboot without relaunch, Wi-Fi never re-associating, max-lifetime watchdog),
+the backend must decide the status from what it last saw — it never hard-fails a session
+for being silent. One pure function holds that decision,
+`EnrollmentTimeoutClassifier.ClassifyTimedOutSession`, and every silent-session path calls it
+so a session gets the same verdict regardless of which path noticed the silence first.
+
+# Schema
+
+## Inputs (`EspProvisioningRollup` + session flags)
+
+`ExtractRollup(events)` distills the event stream into facts: Device/Account Setup
+subcategory counts (incl. the 30s fallback-confirmed messages), `HasExplicitFailure`,
+`HasEnrollmentComplete` vs. `HasTerminalComplete` (the Part-1 `whiteglove_complete`),
+`HasAgentEmergencyBreak`, `DesktopArrived`, `HelloResolved`, `HelloPolicyDisabled`,
+`SkipUserEsp`, RealmJoin detection/resolution. Session-row flags are passed alongside:
+`IsPreProvisioned` + `ResumedAt` (WhiteGlove Part 2) and `IsSelfDeployingProfile`
+(registry-confirmed `CloudAssignedOobeConfig 0x20|0x40`, set at registration).
+
+## Rule order (first match wins)
+
+| # | Condition | Verdict |
+| --- | --- | --- |
+| 1 | `HasExplicitFailure` | Failed |
+| 1b | `IsWhiteGloveAwaitingUser`: pre-provisioned + resumed + Device Setup done + **no** user evidence since resume + no explicit failure/enrollment_complete | AwaitingUser within grace; Succeeded (honest WG reason) past grace |
+| 1c | `IsSelfDeployingProvisioned`: self-deploying profile + Device Setup done + no explicit failure | **Succeeded** (reconcile) — no grace, no AwaitingUser: the profile has no user phase |
+| 2 | Account Setup all-succeeded, or `enrollment_complete`, or `whiteglove_complete` on a **non-resumed** session | Succeeded |
+| 3 | `HasAgentEmergencyBreak` | Incomplete immediately (agent self-destructed, nothing can arrive) |
+| 4 | `DesktopArrived` + (Hello terminal, or Hello disabled + SkipUserEsp) | Succeeded (user provably finished) |
+| 5 | Device Setup done | AwaitingUser within grace, Incomplete past grace |
+| 6 | otherwise | Incomplete |
+
+Grace = `ResolveGraceHours(SessionGraceHours, AbsoluteMaxSessionHours)` (~51h default),
+measured from `ResumedAt ?? StartedAt`. Every Succeeded-reconcile reason carries the
+silence-transparency clause (`AppendReconcileTiming`: last agent contact, silence, verdict time).
+
+## Why rule 1c exists (kiosk tenant audit 2026-08-23)
+
+On a self-deploying profile Device ESP all-succeeded IS the enrollment's end; the agent's
+own SelfDeploying terminal only adds a 5-min confirmation window
+(`DecisionEngine.SelfDeploying.s_deviceOnlyEspDetectionWindow`). Tenant `aebdce78` (school,
+Wi-Fi ThinkBooks, a language-change app forcing a reboot right after Device ESP) lost that
+window on 836 of ~970 sessions in one week: the agent died 0–4 min after
+`DeviceSetup fallback_confirmed`, the reboot relaunch never registered (30s registration
+budget on a Wi-Fi link still associating), and rule 5 labeled finished kiosks
+"awaiting user / Account Setup 0/5" → Incomplete 51h later. Nobody signs in on these devices
+(prepared during the holidays, boxed, in service) — AwaitingUser was factually wrong and
+Incomplete turned a working rollout into a red wall. Other self-deploying tenants completed
+normally in the same window, so this is a classification gap, not a profile-wide agent bug.
+Agent-side companion fix: `SessionRegistrationHelper` now waits up to 15s for a network link
+and retries 6× (~62s backoff) instead of 5× (~30s).
+
+## Callers (all pass both gate inputs)
+
+| Path | File | Notes |
+| --- | --- | --- |
+| Sweep stage 1 (2h agent-silent marker) | `MaintenanceService.MarkStalledSessionsAsTimedOutAsync` | Default: InProgress → Stalled. Gates run BEFORE the Stalled write: `TryMarkWhiteGloveAwaitingUserAsync` (AwaitingUser) and `TryReconcileSelfDeployingAsync` (Succeeded). Only flagged sessions pay the event read. |
+| Sweep stage 2 (SessionTimeoutHours, 5h default) | same | InProgress/Stalled/AwaitingUser past the window and past the 2h silence cutoff → full classification; AwaitingUser within grace is skipped without an event read. |
+| Agent max-lifetime (`enrollment_failed`/max_lifetime, `agent_shutting_down`/max_lifetime) | `EventIngestProcessor.ApplyMaxLifetimeVerdictAsync` | Watchdog = "agent stopped waiting", not a verdict; classified from evidence. Pending sessions exempt. |
+| Late-telemetry reconcile | `EventIngestProcessor.TryLateTelemetryReconcileAsync` | Heal-only: applies a Succeeded verdict to Incomplete/AwaitingUser rows when straggler events arrive. |
+| Agent stall probe (`session_stalled`) | `EventIngestProcessor.TryMapStallToWhiteGloveAwaitingUserAsync` | Only the WG gate (1b); a stall probe on a self-deploying device with Device Setup done means the agent is alive and something else blocks — stays Stalled. |
+| Admin retro-reconcile | `LegacyReclassificationService` | Modes `legacy_timeouts`, `pending_orphans`, `self_deploying_silent` (Incomplete/AwaitingUser/Stalled rows with the profile flag, heal-only to Succeeded, admin-marked rows skipped). `POST /api/maintenance/reclassify-legacy?mode=…&dryRun=false&tenantId=…&maxSessions=…`, dry-run by default. |
+
+## Known gap (decided, not built)
+
+After max-lifetime the agent writes `enrollment-complete.marker` and self-destructs, so an
+AwaitingUser verdict from that path can never heal — it is a 51h countdown to Incomplete.
+The emergency-break path (rule 3) already terminalizes immediately; max-lifetime still goes
+through the grace window by design ("user simply absent"). Revisit if customers read
+AwaitingUser as "still possible".
+
+# Examples
+
+* Session `195593e2` (tenant aebdce78): `DeviceSetup 4/4` + `fallback_confirmed`, `AccountSetup 0/5`
+  (IME false positive), Hello disabled, SkipUser=True, silent after 13:01 → rule 1c →
+  Succeeded "self-deploying profile — Device Setup fully provisioned … agent went silent
+  before confirming completion. Agent last reported 2026-08-21 13:01 UTC …".
+* Same event shape on a user-driven profile → rule 5 → AwaitingUser (within grace) /
+  Incomplete (past grace). Guarded by
+  `Classify_same_stream_without_self_deploying_flag_keeps_user_phase_verdicts`.
+* fairstone WG Part 2 reseal-reboot, technician powers off at logon screen → rule 1b →
+  AwaitingUser; user unboxes days later → ingest completion heals to Succeeded.
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Services/EnrollmentTimeoutClassifier.cs` — rollup + rule order, `IsWhiteGloveAwaitingUser`, `IsSelfDeployingProvisioned`, reason helpers.
+* `src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.cs` — `MarkStalledSessionsAsTimedOutAsync`, `TryMarkWhiteGloveAwaitingUserAsync`, `TryReconcileSelfDeployingAsync`.
+* `src/Backend/AutopilotMonitor.Functions/Services/EventIngestProcessor.Classification.cs` — max-lifetime verdict, late-telemetry reconcile, stall mapping.
+* `src/Backend/AutopilotMonitor.Functions/Services/LegacyReclassificationService.cs`, `Functions/Admin/ReclassifyLegacySessionsFunction.cs` — retro modes.
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Maintenance.cs` — `GetAgentSilentSessionsAsync`, `GetStalledSessionsAsync`, `GetSelfDeployingSilentSessionsAsync`.
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Security/SessionRegistrationHelper.cs` — link wait + 6-attempt registration budget.
+* `src/Shared/AutopilotMonitor.DecisionCore/Engine/DecisionEngine.SelfDeploying.cs` — the agent-side 5-min SelfDeploying terminal window.
+* `src/Backend/AutopilotMonitor.Functions.Tests/EnrollmentTimeoutClassifierTests.cs` — rule coverage incl. the 2026-08-23 self-deploying block.

docs/backend/table-schema-sentinel.md

@@ -0,0 +1,67 @@
+---
+type: Concept
+title: Table Schema Sentinel (startup table initialization)
+description: Why a cold start no longer issues one CreateTableIfNotExists per registered table - a hash over TableNames.All stored in AdminConfiguration gates the full pass, the SessionsIndex backfill only runs after a full pass and behind a conditional-insert claim, and daily maintenance repairs out-of-band deletions.
+resource: /src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.cs
+tags:
+  - backend
+  - table-storage
+  - startup
+  - maintenance
+timestamp: 2026-08-23
+---
+
+# Schema
+
+## Problem
+
+`TableInitializerService` (hosted service) called `InitializeTablesAsync` on every process start, which issued `CreateTableIfNotExistsAsync` for every entry of `Constants.TableNames.All` (66 at the time of writing, DoP 8). Each call is a Create POST whose 409 is swallowed - on Flex Consumption with frequent cold starts that was ~9 serial round-trip waves before the first request. It was followed by a SessionsIndex emptiness query whose *error* path returned "empty", so a transient storage error triggered a full Sessions scan with serial upserts - on every scaled-out instance at once.
+
+## Sentinel
+
+* Row `AdminConfiguration` / PK `SchemaSentinel` / RK `tables`, property `TableSchemaHash` (+ `TableCount`, `UpdatedUtc`).
+* Value = `ComputeTableSchemaHash(TableNames.All)`: SHA-256 over the ordinal-sorted, newline-joined table names. Derived, never hand-maintained: adding a table to `TableNames.All` changes the hash by construction (`TableLifecycleBucketTests` already forces every constant into `All`).
+* `InitializeTablesAsync` (returns `bool fullPassRan`):
+  1. Point-read the sentinel. Match -> mark initialized, **zero** table calls, return `false`.
+  2. Missing / stale / unreadable (fresh storage has no AdminConfiguration table yet) -> `EnsureAllTablesAsync` (the old full pass), then upsert the sentinel **only if no table failed**, return `true`. A failed pass leaves `_tablesInitialized = false`, so the next call retries.
+* Scale-out: two instances that both see a stale sentinel both run the idempotent pass - harmless.
+
+## SessionsIndex backfill
+
+* Only evaluated when the full pass ran (`fullPassRan == true`): an empty index can only exist on fresh storage, which is exactly the case without a sentinel.
+* `IsSessionIndexEmptyAsync` now returns `false` on error (skip), not `true`.
+* `TryClaimSessionIndexBackfillAsync`: conditional `AddEntityAsync` on `SchemaSentinel` / `sessionIndexBackfill` - only the winner scans; 409 or any error -> skip. The manual maintenance backfill (`RunManualAsync`) remains the safety net.
+
+## Known gap and repair
+
+A table deleted out-of-band (cleanup skill, portal, tests) is not noticed at startup anymore. `IStorageInitializer.EnsureAllAsync` runs as the first step of the daily timer maintenance (`MaintenanceService.RunAllAsync`), recreating it within 24h. Storage helpers are fail-soft in the meantime.
+
+## Measuring it
+
+`StartupTelemetryService` (hosted service) emits two App Insights metrics on `IHostApplicationLifetime.ApplicationStarted` - i.e. after every hosted service finished `StartAsync`:
+
+* `BackendStartupMs` - process start (`Process.StartTime`) to host ready; includes runtime, DI and all hosted services.
+* `BackendTableInitMs` - the `InitializeTablesAsync` slice alone (`TableStorageService.LastInitialization`).
+
+Dimensions: `version`, `commit`, `tableInitFullPass`, `instance`. Metrics bypass adaptive sampling and the worker log level, so they arrive even though Information traces do not. The MCP server logs the same idea as one `{"type":"boot","readyMs":…}` stderr line per start (ContainerAppConsoleLogs_CL, see `.claude/commands/mcp-telemetry.md`).
+
+```kusto
+customMetrics
+| where name in ("BackendStartupMs", "BackendTableInitMs")
+| summarize p50 = percentile(value, 50), p95 = percentile(value, 95), n = count()
+  by name, version = tostring(customDimensions.version), fullPass = tostring(customDimensions.tableInitFullPass)
+```
+
+# Examples
+
+* Deploy that adds a table: first cold start after the deploy runs the full pass once (log: "Table schema sentinel missing or stale"), every later start logs "Table schema sentinel matches (...)".
+* Fresh storage account: sentinel read throws TableNotFound -> full pass -> index empty -> one instance claims and backfills.
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.cs` - sentinel, `InitializeTablesAsync`, `EnsureAllTablesAsync`, `TryClaimSessionIndexBackfillAsync`
+* `src/Backend/AutopilotMonitor.Functions/Services/TableInitializerService.cs` - startup gating
+* `src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.cs` - daily `EnsureAllTablesAsync`
+* `src/Backend/AutopilotMonitor.Functions/Services/StartupTelemetryService.cs` - `BackendStartupMs` / `BackendTableInitMs`
+* `src/McpServer/autopilot-monitor-mcp/src/index.ts` - `{"type":"boot"}` line
+* `src/Backend/AutopilotMonitor.Functions.Tests/TableSchemaSentinelTests.cs`, `StartupTelemetryServiceTests.cs`

docs/backend/tenant-activation-welcome-mail.md

@@ -4,7 +4,7 @@ title: Tenant Activation & the Once-Only Welcome Mail
 description: How a signup becomes an activated tenant (manual approve or auto-approve queue), and how the welcome mail is sent exactly once even though activation and the user-provided address race each other.
 resource: backend
 tags: [activation, auto-approve, welcome-email, preview-whitelist, race]
-timestamp: 2026-08-02
+timestamp: 2026-08-23
 ---
 
 # Schema
@@ -58,6 +58,46 @@ The Global-Admin resend endpoint (`POST /api/preview/send-welcome-email/{tenantI
 always sends (explicit intent) and consumes the marker best-effort so the automatic
 paths never duplicate afterwards.
 
+## Mail transport
+
+Both transactional mails (welcome, post-offboarding farewell) go through the
+provider-neutral `EmailService` (`IEmailService` for the welcome path,
+`IOffboardFarewellEmailSender` for the farewell path). The provider is an implementation
+detail confined to one private transport method plus the `Email:*` configuration
+section — a provider swap must not rename classes, DI registrations or callers.
+
+* Current provider: **Mailchimp Transactional (Mandrill)**, `POST {Email:Endpoint}`
+  (`messages/send`), API key in the JSON body, typed `HttpClient` with the shared
+  `ResiliencePolicies.Notification` retry policy (15 s timeout).
+* Settings (App Settings use `Email__Key`): `Email:ApiKey` (required — empty means every
+  send is a logged no-op, never an error), `Email:Endpoint`, `Email:FromAddress`
+  (default `noreply@autopilotmonitor.com`), `Email:FromName` (default `Autopilot Monitor`).
+* Result handling: per-recipient status `sent`/`queued`/`scheduled` = success;
+  `rejected`/`invalid` (with `reject_reason`), non-2xx or malformed bodies = warning.
+  Never throws — both callers rely on that fail-soft contract.
+* `track_opens`/`track_clicks` are explicitly `false` and `auto_text` is `true`: the provider
+  receives only the recipient address and the tenant domain, which is exactly the claim on
+  the privacy page and the trust data-flows page. Changing tracking = changing those pages.
+
+## Template overrides (operator-editable)
+
+Global Admins can replace either HTML body without a deployment (portal: Settings →
+Email Templates). `EmailTemplateService` resolves the body for every send: the stored
+override wins, otherwise the built-in `EmailTemplates.*`. Overrides live in the
+`PreviewConfig` table (partition `EmailTemplates`, row key `welcome` | `farewell`,
+properties `Html`, `UpdatedBy`, `UpdatedUtc`), cached 5 minutes, invalidated on save/reset.
+
+* The only placeholder is `{{domainName}}`; an empty domain renders as "your organization",
+  matching the built-ins. Subjects are not editable (pinned constants).
+* Limit 30 000 characters (Table string property cap is 32K UTF-16 chars).
+* The send path is fail-soft: a storage error falls back to the built-in body. The admin
+  read path is not — a broken store surfaces as an error instead of silently showing the
+  built-in.
+* Endpoints (all GlobalAdminOnly): `GET|PUT|DELETE /api/global/email-templates/{kind}` and
+  `POST /api/global/email-templates/{kind}/test`. The test send goes to the caller's tenant
+  contact address (activation notification email → `ContactEmail` → caller UPN) with the
+  caller's tenant domain, optionally with an unsaved draft body; provider tag `test`.
+
 # Examples
 
 * Auto-approve wins the race: approve at T+64 s finds no address → logs "deferred to the
@@ -73,3 +113,8 @@ paths never duplicate afterwards.
 * `src/Backend/AutopilotMonitor.Functions/Functions/Rules/PreviewWhitelistFunction.cs` — save-path trigger, GA resend
 * `src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableConfigRepository.cs` — conditional inserts (approved / welcome-email-sent)
 * `src/Backend/AutopilotMonitor.Functions.Tests/TenantApprovalServiceTests.cs` — ordering + dedup pins
+* `src/Backend/AutopilotMonitor.Functions/Services/EmailService.cs` — provider-neutral transport (Mandrill wire format, result handling, tracking off)
+* `src/Backend/AutopilotMonitor.Functions.Tests/EmailServiceTests.cs` — wire-format, fail-soft and gate-ordering pins
+* `src/Backend/AutopilotMonitor.Functions/Services/EmailTemplateService.cs` — override resolution, placeholder rendering, cache
+* `src/Backend/AutopilotMonitor.Functions/Functions/Admin/EmailTemplatesFunction.cs` — GA endpoints (read / override / reset / test send)
+* `src/Web/autopilot-monitor-web/app/admin/settings/sections/SectionEmailTemplates.tsx` — portal editor, preview frame, test send

docs/backend/time-attribution.md

@@ -105,6 +105,11 @@ the partition).
 * Self-healing 30-day maintenance sweep (2h tick): backfills missing breakdowns, folds
   late-terminating sessions into their StartedAt-date aggregates, and enforces version
   purity — a stale-version row whose events aged out counts as missing, never mixed.
+  Reads the tick's **shared window scan** (`MaintenanceService.LoadSweepWindowSessionsAsync`,
+  one projected 35-day cross-tenant drain via `MaintenanceSweepSessionProjection` that
+  also feeds the device-journey and verdict-calibration sweeps) — the StartedAt-only
+  filter is a full-table read in Table Storage, so it is done once per tick, not once per
+  sweep; `MaintenanceSweepProjectionEquivalenceTests` pins the column set.
 * `TimeAttributionAggregates` (PK = TenantId or `global`, RK = `{yyyy-MM-dd}|{class}` and
   `rolling30|{class}`): per enrollment class (`user_driven`, `whiteglove`, `self_deploying`,
   `device_preparation` — never mixed) median/p75/p90 per segment over the fixed six-segment

docs/backend/verdict-calibration.md

@@ -0,0 +1,164 @@
+---
+type: Concept
+title: Verdict Calibration (classifier thermometer)
+description: How every session status write declares its VerdictPath, how overriding a verdict preserves it as PriorStatus/PriorVerdictPath, how the daily calibration aggregate counts paths with the re-enrollment proxy and the correction stream, and how the drift radar (share / silence / evidence-gap) turns that into operator-only ops events.
+resource: src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.VerdictCalibration.cs
+tags:
+  - backend
+  - sessions
+  - classifier
+  - calibration
+  - regression-radar
+timestamp: 2026-08-23T18:00:00+02:00
+---
+
+# Verdict Calibration (classifier thermometer)
+
+A session's terminal status is written by ~20 code paths: the agent's own terminal events,
+the silence classifier (`EnrollmentTimeoutClassifier`, rules 1–6) reached via the
+maintenance sweep / the agent's max-lifetime shutdown / late-telemetry heal / retro
+reclassification, the analyze-rule engine, admin marks and session superseding. Verdict
+calibration makes every one of those paths **countable**, tracks how often a path's verdict
+was later **overridden**, attaches the delayed **re-enrollment proxy**, and raises an
+operator-only alarm when a path's share **drifts**. It is deterministic, fact-based tuning
+input for the rules — explicitly not a learned model, and never a customer-facing feature.
+
+# Schema
+
+## VerdictPath on the session row
+
+`SessionSummary.VerdictPath` (`VerdictPaths` vocabulary, `origin:detail`, append-only) is
+stamped by **every** status write — `UpdateSessionStatusAsync` takes it as a required
+parameter, `StoreSessionAsync` stamps `register:new` / `register:whiteglove_resume` and
+preserves an existing path through the re-registration Replace, `SetSessionPreProvisionedAsync`
+requires it whenever it writes a status. Unlike `FailureSource` (persisted only on `Failed`),
+the path survives for Incomplete, AwaitingUser, Stalled and Pending.
+
+| Origin | Paths |
+| --- | --- |
+| `agent` | `complete`, `complete_soft` (Continue-Anyway), `failed`, `esp_failure_fallback`, `gather_complete`, `whiteglove_pending`, `whiteglove_resumed`, `stall_probe`, `stall_heal` |
+| `ingest` | `wg_awaiting` (stall probe mapped to WhiteGlove AwaitingUser) |
+| `sweep` | `stalled`, `wg_awaiting`, `sd_reconcile`, `r{rule}` (stage-2 classifier) |
+| `maxlife` / `late` / `retro` | `r{rule}` (classifier via max-lifetime shutdown / late-telemetry heal / retro reclassification); `retro:sd_reconcile`, `retro:superseded` |
+| `register` | `new`, `whiteglove_resume`, `superseded` |
+| `rule` | `rule:{ruleId}` (analyze rule with MarkSessionAsFailed) |
+| `manual` | `failed`, `succeeded` |
+| `legacy` | read-side derivation only (`legacy:{rule}` when the rule is recoverable from the reason literal, `legacy:unknown` otherwise) — never written |
+
+Classifier rule ids (`ClassifierRules`): `r1`, `r1b_awaiting`, `r1b_succeeded`, `r1c`, `r2`,
+`r3`, `r4`, `r5_awaiting`, `r5_incomplete`, `r6`. `ClassifyTimedOutSession` returns
+`(Status, Reason, Rule)` so each `return` names its rule.
+
+## PriorStatus / PriorVerdictPath — the correction stream
+
+When a write replaces a prior **verdict** (existing status ∈ Succeeded/Failed/Incomplete/
+AwaitingUser with a stamped path, incoming status different), the storage seam preserves the
+pair (`TableStorageService.ComputePriorVerdict`, both the ETag path and the force path). A
+stall marker healing to InProgress, a same-status refresh, or an unstamped legacy row never
+sets it. Admin marks, late agent completions and retro reclassifications all flow through it.
+
+## Read-side derivation for pre-instrumentation rows
+
+`VerdictPathDerivation.Derive(session)` returns the stamped path verbatim, otherwise derives
+from `AdminMarkedAction`, `FailureSource`, `ReconcileReason` and `FailureReason` using the
+writers' fixed literals (classifier rule prefixes, the `max-lifetime watchdog` / `Retro-
+reclassified` suffixes, `Rule: `, `Superseded by session`, `Late completion report received`).
+Unambiguous rows get the real path (`agent:complete`, `manual:failed`, `rule:…`,
+`maxlife:r6`), ambiguous-but-rule-known rows `legacy:{rule}`, the rest `legacy:unknown`. No
+mass backfill: the aggregate counts derived rows with `DerivedCount` so the matrix shows
+history while flagging its weaker evidence. Tests pin the literals against the classifier
+output so a wording change fails loudly.
+
+## Daily aggregate — `VerdictCalibrationAggregates`
+
+PK = `TenantId` | `"global"`, RK = `yyyy-MM-dd` (session **StartedAt** date, like every daily
+aggregate). `VerdictCalibrationDailyAggregate { Version, SessionCount, TerminalSessionCount,
+Buckets[], ComputedAt }` with one bucket per (VerdictPath, Status):
+
+| Field | Meaning |
+| --- | --- |
+| `Count` / `DerivedCount` | sessions currently on the path; of those, derived read-side |
+| `Eligible7d` | terminal sessions whose end (`CompletedAt ?? LastEventAt ?? StartedAt`) lies ≥ 7 d before compute time |
+| `ReEnrolled7d` | of the eligible: the device's `DeviceHistories` chain shows the next terminal session starting < 7 d after this one's end |
+| `OverriddenByAdmin` / `OverriddenByLateCompletion` / `OverriddenOther` | sessions whose **PriorVerdictPath** is this bucket — attributed to the path that was overridden, so a bucket can carry overrides with `Count = 0` |
+
+`MaintenanceService.SweepVerdictCalibrationAsync` (2-hourly, after the device-journey sweep
+so the chains are fresh; manual maintenance parity; kill switch
+`VerdictCalibrationSweepDisabled`) slices the tick's shared projected window scan
+(`LoadSweepWindowSessionsAsync` — one 35-day cross-tenant drain feeds the time-attribution,
+device-journey and calibration sweeps plus the radar's tenant discovery; the StartedAt-only
+filter is a full-table read, so never per sweep), recomputes the rolling 30-day window whole (Replace),
+deletes stale date rows it did not regenerate, and the unbounded-tables cleanup applies the
+180-day retention. Sessions inside a deletion cascade are skipped; the table is regenerable
+and is wiped with the tenant on offboarding.
+
+## Read surfaces
+
+* `GET global/metrics/verdict-calibration?days=&tenantId=` (GlobalReadOrAdmin,
+  TenantScoping.QueryParam; `VerdictCalibrationResponse.Build`): per path — count, share of
+  all window sessions, derived count, eligible/re-enrolled with `reEnrollRatePct` **null below
+  20 eligible**, the three override counters, a today-anchored 7d-vs-28d share trend
+  (`window7`, `baseline28`, `lift` null without baseline) — plus totals, the trend basis and
+  the active `alerts[]`. Empty but well-formed before the first sweep.
+* MCP `get_verdict_calibration` (platform scope: GA + Global Reader). Same endpoint, LLM-shaped in
+  `verdict-calibration-shape.ts`: per-row `window7.sessions` / `baseline28.sessions` are dropped (the
+  denominators live once in `trend`), `reEnrollRatePct` / `lift` are always present (`null` = withheld),
+  and `minSharePct` / `top` trim the one-session tail — rows carrying overrides are never trimmed and
+  everything dropped is reported in `omitted`. The wire shape the admin page consumes is untouched.
+* Portal: Global Admin → Metrics → Verdict Calibration (`/admin/metrics/verdict-calibration`):
+  matrix grouped by origin, status pill, `derived n` gray pill, trend glyph (arrow only from
+  5 window hits and lift ≥ 2 / ≤ 0.5), re-enrollment rate or `— (n=…)`, overrides
+  `admin / late / other`, `↑ Drift` pill on rows with an active episode, and the active
+  episodes list.
+
+## Drift radar — `VerdictCalibrationRadar`
+
+Same statistics as the [rule regression radar](rule-regression-radar.md) (7-day window vs the
+prior 28 days, ≥ 5 window hits, ≥ 20 window sessions, lift ≥ 2, `MetricsMath.
+RateIncreaseSeparated`), anchored on yesterday, over every partition with rows (each tenant
+and `global`):
+
+| Kind | Signal | Re-arm |
+| --- | --- | --- |
+| `share_regression` | one **backend-decided** path's share of all sessions doubled (`sweep`/`maxlife`/`late`/`retro`/`rule`/`manual`/`ingest`; `agent:*` and `register:*` mirror customer workflow mix — first prod pass fired on `agent:whiteglove_pending` rollout weeks — and `legacy:*` is derived, all excluded) | share < 1.5× baseline, the path stops occurring, or the path is no longer eligible |
+| `silence_share_regression` | the `sweep:*` + `maxlife:*` share doubled — the backend had to decide more often because the agent went silent (a liveness signal, not a classifier one) | same |
+| `evidence_gap` | absolute: `r6` (pure fallthrough) decides ≥ 20 % of the window's classifier verdicts, ≥ 20 verdicts | < 15 % or < 20 verdicts |
+
+Episodes are tracker rows `verdictcalibration|{kind}|{path}|{status}` (register = `AddEntity`,
+409 = already burning, fail-closed; refresh carries `FirstNotifiedAt`; 30-day tracker
+retention re-arms long burners). A new episode fires **one** `VerdictCalibrationDrift` ops
+event (category Maintenance, Warning; dual-registered in the web `OPS_EVENT_TYPES`) — there
+is deliberately **no tenant bell**. Per-path findings on a tenant partition get the on-fire
+dimension correlation (`RuleRegressionRadar.ComputeDimensionConcentration` over the window's
+sessions whose derived path matches), reported with the shared wording contract "correlated,
+not necessarily causal"; group kinds and the global partition carry no dimension claim.
+Kill switch `VerdictCalibrationRadarDisabled`.
+
+# Examples
+
+* **Reading the thermometer (prod, 2026-08-23 hand analysis that motivated this):**
+  re-enrollment within 7 days after Succeeded 8.9 % (lab background), after Failed 24.3 %,
+  after Incomplete 10.6 % — Incomplete behaves like Succeeded, so rules 5/6 are probably too
+  cautious; the matrix now shows this per rule instead of per status.
+* **Correction stream:** a session swept to `sweep:r5_incomplete`, later completed by the
+  agent → row `agent:complete` with `PriorVerdictPath = sweep:r5_incomplete`; the aggregate
+  increments `OverriddenByLateCompletion` on the `sweep:r5_incomplete / Incomplete` bucket.
+  Four admin marks since launch were invisible before — now each one counts against the path
+  it corrected.
+* **Evidence gap:** a tenant whose agent build stopped emitting the Device Setup rollup line
+  drives its sweep verdicts into `r6`; the absolute gate fires at 20 % and names the
+  tenant — the fix is agent-side, the classifier is only the messenger.
+
+# Citations
+
+* `src/Shared/AutopilotMonitor.Shared/Models/VerdictPaths.cs` — vocabulary + `ClassifierRules`
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Sessions.cs` — `ComputePriorVerdict`, `ApplyVerdictPath`, re-registration preserve
+* `src/Backend/AutopilotMonitor.Functions/Helpers/VerdictPathDerivation.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.VerdictCalibration.cs` — sweep + `BuildVerdictCalibrationAggregates`
+* `src/Backend/AutopilotMonitor.Functions/Functions/Metrics/GetVerdictCalibrationFunction.cs`
+* `src/Backend/AutopilotMonitor.Functions/Helpers/VerdictCalibrationRadar.cs`, `Services/MaintenanceService.VerdictCalibrationRadar.cs`
+* `src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts` — `get_verdict_calibration`
+* `src/McpServer/autopilot-monitor-mcp/src/verdict-calibration-shape.ts` — LLM-facing response shaping (`minSharePct` / `top`, explicit nulls)
+* `src/Web/autopilot-monitor-web/app/admin/metrics/sections/SectionVerdictCalibration.tsx`
+* Tests: `VerdictPathTests`, `VerdictCalibrationTests`, `VerdictCalibrationRadarTests`
+* Related: [Silent-Session Classification](silent-session-classification.md), [Device Journeys](device-journeys.md), [Rule Regression Radar](rule-regression-radar.md)

docs/index.md

@@ -19,7 +19,7 @@ https://docs.autopilotmonitor.com (separate repository).
 
 # Agent
 
-* [V2 Agent](agent/index.md) - How the on-device agent works: [runtime overview](agent/overview.md), [decision engine](agent/decision-engine.md) (reducer, signals, completion arms), [logs & persistence](agent/logs-and-persistence.md) (signal log, snapshot, crash recovery), [Hello wizard un-skip](agent/hello-wizard-unskip.md) (why a single "WHfB disabled" read never decides completion), [Autopilot ZTD diagnostics](agent/autopilot-ztd-diagnostics.md) (event IDs, diagnostic registry, endpoints, error-code map).
+* [V2 Agent](agent/index.md) - How the on-device agent works: [runtime overview](agent/overview.md), [decision engine](agent/decision-engine.md) (reducer, signals, completion arms), [logs & persistence](agent/logs-and-persistence.md) (signal log, snapshot, crash recovery), [diagnostics package](agent/diagnostics-package.md) (built-in section catalog shared with the portal, RealmJoin/Device Preparation collection gates, caps, manifest), [Hello wizard un-skip](agent/hello-wizard-unskip.md) (why a single "WHfB disabled" read never decides completion), [Autopilot ZTD diagnostics](agent/autopilot-ztd-diagnostics.md) (event IDs, diagnostic registry, endpoints, error-code map).
 * [Build Counter Blob](agent/build-counter-blob.md) - How agent build numbers are minted: shared counter blob with ETag-CAS so local and CI builds never collide; CI additionally attests build provenance (Sigstore).
 * [Agent Endpoint Migration](agent/endpoint-migration.md) - How the backend re-homes agents to a new API base URL via the config channel (backend move or per-tenant region move): live-fetch-only, allowlist-validated on both sides, one hop, kill wins.
 * [Gather Rule Debug Log](agent/gather-rule-debug-log.md) - EnableGatherRuleDebugLog (ConfigVersion 36): the per-tenant local trace file that explains every gather-rule evaluation decision — scope skips, on_change suppression, empty collector results, logparser position/parse-mode outcomes — for rules that produce no timeline events.
@@ -27,8 +27,12 @@ https://docs.autopilotmonitor.com (separate repository).
 * [ESP Completion Starvation — the sits-d Cloud-PC complex](agent/post-reboot-completion-recovery.md) - Why a SkipUser=true flow (no user ESP page → no Shell-Core 62407, no AccountSetup registry) left the completion gate satisfied but never evaluated — five Cloud PCs idled six hours at "waiting on: hello_resolution" — and the fix: the observed skip stands in for the final-exit evidence in the IME user-session completion attempt. Plus the two adjacent defects fixed alongside: the edge-only user-apps-settled synthesis (now level-triggered) and the never-wired Shell-Core restart replay (now Hello-wizard-only, with the reasoning why a replayed 62407 must never reach the reducer).
 * [Secure Boot CA-2023 Detection](agent/secureboot-ca2023-detection.md) - Why ANALYZE-SEC-001 v3 reads the UEFI db/KEK variables directly instead of trusting the SecureBoot\Servicing registry, and how the one-sided uefiCa2023FirmwareConfirmed marker plus a not_exists precondition give absence-tolerant suppression across old and new agents.
 * [Continue-Anyway Observation Mode](agent/continue-anyway-observation.md) - EnableEspContinueAnywayObservation (ConfigVersion 37, operator-set): Device-phase ESP terminal failures on Continue-Anyway profiles get a bounded 60-min observation instead of an immediate hard fail; the DAD-validated real-user desktop + Hello gate detect the true end, the session completes Succeeded + EspSoftFailure (amber "with issues" badge), expiry un-defangs to the original esp_terminal_failure.
+* [CMTrace Time Resolution](agent/cmtrace-time-resolution.md) - Converting bias-less CMTrace local times to UTC without trusting any process's timezone belief: per-line self-anchoring on the 15-minute offset grid for provably fresh lines, uniform marked reader-zone fallback for backlog, and the provenance vocabulary (bias / line-anchored / reader-zone-fallback) that keeps every event re-derivable.
 * [Registry App-State Second Pillar](agent/registry-app-state-pillar.md) - IME's authoritative per-app state read straight from the registry (Win32Apps EnforcementStateMessage, EspTrackingWin32Apps, StatusServiceReports) via a snapshot-and-diff watcher; registry/log reconciliation doubles as the built-in IME log-pattern drift alarm.
 * [WDP Scenario Gates & Completion Backstop](agent/wdp-scenario-gates.md) - How the agent gates Autopilot/ESP-only machinery off on Windows Device Preparation sessions (deterministic ExecutionContext marker, fail-toward-Classic), which noise it suppresses (ZTD probe, esp_config unknown, ModernDeployment 100/417/418/1005, starved sweep), and the WDP completion model: High-confidence seed, desktop-based arm D, and the 30-min device_prep_completion backstop.
+* [Power-State Watcher](agent/power-state-watcher.md) - Live AC↔battery transitions and 50/30/15% downward battery-threshold crossings during enrollment via a WMI Win32_PowerManagementEvent push subscription (zero polling, never armed on battery-less devices): the power_state_change event (transition field, per-level lifetime latch, 5s debounce, emission cap) and the analyze rules ANALYZE-DEV-009 (battery <15%, high) / ANALYZE-DEV-010 (AC→battery, warning) with on_event interim triggers.
+* [System Timeline Watcher](agent/system-timeline-watcher.md) - Ground truth for two timeline blind spots from one System-channel EventLogWatcher with pre-agent backfill: system_clock_changed (Kernel-General 1 — oldTime/newTime/signed timeDeltaMs/reason/setting process; 2 s micro-slew floor, ≥5 min Warning+immediate) and system_sleep_episode (Power-Troubleshooter 1 sleep/hibernate + Kernel-Power 507 Modern Standby; authoritative enteredAt/exitedAt payload instants, 60 s Modern-Standby floor). Consumed by the TimeJumpBadge clock-set cause, the SessionInfoCard standby note, time-attribution SleepSpans (AttributionVersion 3) and ANALYZE-DEV-012.
+* [DO GroupId Auto-Set](agent/do-group-id-auto-set.md) - EnableDoGroupIdAutoSet (ConfigVersion 40): the agent seeds the Delivery Optimization DOGroupId policy with a deterministic network-fingerprint GUID (default gateway IPv4 + SendARP MAC, RealmJoin-compatible byte layout) so same-network devices form one DO peering group during ESP; ownership-tracked via the StartupEventGate fingerprint, foreign DOGroupId/DOGroupIdSource policies always win, no random-GUID fallback.
 * [ESP Policy-Provider Stall Detection](agent/esp-policy-provider-stall.md) - The EnrollmentStatusTracking CSP's no-timeout Setup/Apps wait is keyed to the Intune-registered "Sidecar" provider by NAME: co-management's "ConfigMgr" parks the user ESP at "Apps (Identifying)" for days even with TrackingPoliciesCreated=1 (issue #106); the always-on two-arm esp_policy_provider_stalled tripwire (provider_incomplete | sidecar_provider_missing) and the SOFTWARE\Microsoft\Windows\Autopilot gather-rule allowlist entry that surface it.
 
 # Rules
@@ -36,16 +40,23 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Gather Rule Phase Scoping, One-Shot Triggers & Emit-on-Change](rules/gather-rule-phase-scoping.md) - Restricting gather rules to enrollment phases (activePhases / activeFromPhase sticky latch), one-shot collection at a phase's start/end (phase_change / phase_exit), and emitMode "on_change" result-dedup.
 * [Gather Rule Guardrails](rules/gather-rule-guardrails.md) - Why the allowlists in rules/guardrails.json are enforced on the agent and nowhere else, which hard blocks survive unrestricted mode, and the rule that every collector must call a guard and emit security_warning on refusal.
 * [Rule Authoring Surface](rules/rule-authoring-surface.md) - How customer AIs author rules against the real contract: the baked MCP resources (guide/schemas/guardrails via combine.js), the MCP-local validate_rule pre-flight, and the side-effect-free POST rules/analyze/dryrun whose trace twin shares the production evaluators (parity + side-effect-freedom pinned by tests).
+* [Rule ID Namespace & Collision Guards](rules/rule-id-namespace.md) - Why rule identity is the human-readable ruleId (no GUIDs) with tenant isolation via Table Storage partitioning, the reserved built-in namespace (RuleIdPolicy), which collisions are possible (custom-vs-custom across tenants: allowed and harmless), and the guards keeping the global RuleStats aggregate catalog-only and the global partition inside the reserved namespace (combine.js, reseed, cross-tenant RuleState GC).
 * [Analyze Rule Evaluation Triggers](rules/analyze-rule-triggers.md) - Opt-in `evaluateOn` interim triggers (`whiteglove_sealed`, `on_event:<type>`) so rules can fire before a session is terminal, with RuleResults update-semantics (interim → finalize/resolve, NotifiedAt notification dedupe) replacing the permanent dedupe freeze, KO/stat suppression on interim runs, the ingest-side cached trigger registry, and the authoring lints that keep interim rules monotonic.
 
 # Backend
 
+* [Table Schema Sentinel](backend/table-schema-sentinel.md) - Startup no longer issues one CreateTableIfNotExists per table: a SHA-256 over TableNames.All in AdminConfiguration gates the full pass (derived, never hand-maintained), the SessionsIndex backfill runs only after a full pass behind a conditional-insert claim, and daily maintenance repairs out-of-band deletions.
 * [Business Timestamps](backend/business-timestamps.md) - Why the Azure Tables system Timestamp is never authoritative (migrations reset it), and the OccurredUtc + RowKey-decode compensation for AuditLogs/OpsEvents/Events after the 2026-07-18 migration.
+* [Send-Time Frame Separation](backend/send-time-frame-separation.md) - One device-clock send timestamp per upload batch (X-Send-Time-Utc → SentAt on Events) splits ReceivedAt − OccurredUtc into pure spool delay and pure device-vs-server clock offset; the clock_skew condition measures SentAt batches directly (spool-immune), the CMTrace tripwire deliberately stays on its differential math.
 * [OOBE Bootstrap go-Code Flow](backend/oobe-bootstrap-go-flow.md) - The bootstrap short-code lifecycle (portal-created session → `irm go.autopilotmonitor.com/CODE | iex` at Shift+F10 → GetBootstrapScriptFunction), the always-HTTP-200 text/plain contract, the two-line injection defense (GUID/URL/expiry validator + single-quoted PS literals, golden-pinned against the legacy TS template), and the per-IP rate-limit story behind Front Door.
+* [Silent-Session Classification](backend/silent-session-classification.md) - How a session whose agent went silent gets its honest status: the two-stage maintenance sweep (2h Stalled marker with the WhiteGlove Part-2 AwaitingUser gate and the self-deploying Succeeded gate, 5h timeout classification), the EnrollmentTimeoutClassifier rule order (explicit failure → WG Part 2 → self-deploying → completion evidence → emergency break → desktop+Hello → Device Setup/grace), the ingest paths sharing it (max-lifetime, late-telemetry heal, stall probe) and the admin retro-reconcile modes incl. self_deploying_silent.
 * [Device Journeys & First-Time-Right](backend/device-journeys.md) - How a device's terminal enrollment attempts are grouped into journeys (trim+casefold device key with junk-serial exclusion, first-success end, 30-day gap, WhiteGlove = one attempt), the DeviceHistories chain with its tombstone-driven deleted-session pruning, the additive daily FTR aggregates, and the banner/fleet/MCP surfaces.
 * [Enrollment Time Attribution](backend/time-attribution.md) - How a terminal session's authoritative wall clock (DurationSeconds, WhiteGlove pause excluded) is partitioned into named segments with an explicit unattributed remainder, ESP-blocking apps as positive evidence with "up to" what-if bounds, reboot spans from event gaps, and the breakdown/aggregate tables the sweep maintains.
+* [Attempt-Scoped App Install Durations](backend/app-install-duration-attempt.md) - AppInstallSummary.DurationSeconds = status-defining (last) install attempt via the LastAttemptStartedAt max-fold anchor instead of the first-observation→last-terminal span that billed multi-pass IME gaps to trivial apps; InstallPassCount, the weaker-terminal guard, the radar's cutover gate, and time attribution's union-of-attempt-segments occupancy.
 * [Rule Regression Radar](backend/rule-regression-radar.md) - How analyze-rule hit-rate regressions are detected (7-day window ≥2× the 28-day baseline with disjoint Wilson intervals), which suppressions keep the radar quiet (grace period, edit-in-window, kill switch), how alert episodes live in the ruleregression tracker keyspace with re-arm semantics, and the on-fire dimension correlation with its "correlated, not necessarily causal" wording contract.
+* [Verdict Calibration](backend/verdict-calibration.md) - How every session status write declares its VerdictPath (origin:detail vocabulary incl. classifier rule ids), how overriding a verdict preserves PriorStatus/PriorVerdictPath as the correction stream, the daily per-path calibration aggregate with the 7-day re-enrollment proxy and read-side legacy derivation, the GA endpoint / MCP tool / admin matrix, and the drift radar (share, silence-share, r6 evidence gap) with its operator-only ops events.
 * [App Version Duration Regression Radar](backend/app-version-regression-radar.md) - How app versions whose median install duration regressed vs. the previous version are detected (first-seen-ordered versions, median lift ≥2× plus a 5-minute absolute floor over measured installs only), how alert episodes live in the appversionregression tracker keyspace with drain/median re-arm semantics, and the bell/ops-event/analytics surfaces.
+* [Plan Downgrade Policy & the Retention Grace Period](backend/plan-downgrade-retention-grace.md) - What happens when a tenant loses Pro: every entitlement gates read-time and reversibly ("gate, don't destroy"), except retention — a 30-day grace keeps the Pro cap before the Community cap starts hard-deleting; the ProDowngradedUtc/trial-expiry anchor model, the TenantPlanDowngraded/RetentionGrace* ops events, and the deliberate non-grace of everything else.
 * [Tenant Activation & the Once-Only Welcome Mail](backend/tenant-activation-welcome-mail.md) - How a signup becomes an activated tenant (manual approve or the auto-approve queue), and the write-then-read + conditional-marker arbitration that sends the welcome mail exactly once even though activation and the user-typed notification address race each other.
 * [W365 Cloud PC Device Validation](backend/cloudpc-device-validation.md) - Why Cloud PCs can never pass the Autopilot serial lookup, and the cert-CN-bound CloudPc fallback validator: Subject CN (= Intune device id) matched against the tenant's Graph virtualEndpoint/cloudPCs inventory — admits exactly the service-provisioned Cloud PCs, nothing else.
 * [ServerActions & On-Demand Diagnostics](backend/server-actions-on-demand-diagnostics.md) - The queue-on-session, deliver-on-ingest action channel, the TenantAdminOrOperator tier with in-function per-type re-gating, the portal's Collect Logs flow (quick-config orders rotate_config before request_diagnostics), and the hosted-prefix sweep in the offboarding cascade.

docs/log.md

@@ -1,7 +1,48 @@
 # Log
 
+## 2026-08-23
+
+* **Update**: `backend/table-schema-sentinel.md` — "Measuring it": `StartupTelemetryService` emits `BackendStartupMs` (process start → ApplicationStarted) and `BackendTableInitMs` as App Insights custom metrics with version/commit/fullPass dimensions; the MCP server writes one `{"type":"boot","readyMs"}` stderr line per start (query in `.claude/commands/mcp-telemetry.md` §A2).
+* **New**: `backend/table-schema-sentinel.md` — startup table initialization gated by a schema sentinel (SHA-256 over `TableNames.All` in `AdminConfiguration`/`SchemaSentinel`/`tables`): matching sentinel ⇒ zero `CreateTableIfNotExists` calls on a cold start, missing/stale ⇒ one full pass + sentinel rewrite. SessionsIndex startup backfill only after a full pass, `IsSessionIndexEmptyAsync` no longer treats errors as "empty", conditional-insert claim so one scaled-out instance backfills. Daily maintenance runs `IStorageInitializer.EnsureAllAsync` to repair out-of-band table deletions.
+* **Update**: `backend/verdict-calibration.md` — MCP `get_verdict_calibration` response shaping: per-row trend denominators dropped, explicit nulls, `minSharePct` / `top` with an `omitted` report.
+* **Update**: `backend/verdict-calibration.md` — share-regression radar restricted to backend-decided paths; agent-declared/registration paths (customer workflow mix) and derived legacy paths no longer alert, stale episodes re-arm themselves.
+* **Update**: `backend/time-attribution.md`, `backend/device-journeys.md`, `backend/verdict-calibration.md` — the rolling maintenance sweeps (time attribution, device journeys, verdict calibration, calibration-radar discovery) now share ONE projected 35-day cross-tenant Sessions scan per tick (`LoadSweepWindowSessionsAsync` + `MaintenanceSweepSessionProjection`, pinned by `MaintenanceSweepProjectionEquivalenceTests`) instead of four full-table drains; each sweep slices its own window by StartedAt.
+* **New**: `backend/verdict-calibration.md` — the classifier thermometer: every status write now stamps `VerdictPath` (required parameter on `UpdateSessionStatusAsync`; `EnrollmentTimeoutClassifier` returns its rule id), overriding a verdict preserves `PriorStatus`/`PriorVerdictPath`, `VerdictPathDerivation` attributes pre-instrumentation rows read-side (`legacy:*` when ambiguous). New daily aggregate `VerdictCalibrationAggregates` (per-path count/derived/eligible7d/reEnrolled7d/overridden-by-admin|late|other, sweep after the device-journey pass, 180d retention), `GET global/metrics/verdict-calibration`, MCP `get_verdict_calibration`, admin metrics section, and the `VerdictCalibrationRadar` (share / silence-share / r6 evidence-gap episodes in the tracker keyspace `verdictcalibration|`, `VerdictCalibrationDrift` ops event, no tenant bell).
+* **New**: `backend/silent-session-classification.md` — one place for the silent-session verdict: `EnrollmentTimeoutClassifier` rule order incl. the new rule 1c `IsSelfDeployingProvisioned` (self-deploying profile + Device Setup all-succeeded + no explicit failure ⇒ Succeeded reconcile, no grace/AwaitingUser — kiosk tenant aebdce78 audit: 836 finished devices parked AwaitingUser/Incomplete), the sweep stage-1 gates (`TryMarkWhiteGloveAwaitingUserAsync`, new `TryReconcileSelfDeployingAsync`), the ingest callers (max-lifetime, late-telemetry heal, stall probe) and the new admin retro mode `self_deploying_silent` (`GetSelfDeployingSilentSessionsAsync`). Agent companion: `SessionRegistrationHelper` waits up to 15s for a network link and retries 6× (~62s) instead of 5× (~30s) so the reboot relaunch on Wi-Fi no longer exits 7 before the link is back.
+* **New**: `agent/diagnostics-package.md` — the diagnostics ZIP's built-in collection is now ONE catalog in Shared (`DiagnosticsBuiltInSections.All`): the agent iterates it in order and the backend serves the same list to the portal (`GET diagnostics/paths`, MemberRead), so what administrators see is exactly what the agent collects. New conditional sections: RealmJoin client/package/Chocolatey/per-user logs behind the tenant's RealmJoin Watcher toggle (mirrored onto `AgentConfiguration.EnableRealmJoinWatcher` by the merger) and the Device Preparation bootstrapper event log behind the deterministic WDP marker (probe once per build, fail toward Classic); every skip is a manifest line. Built-ins bypass `DiagnosticsPathGuards` by design (reviewed code, `%ProgramData%\RealmJoin` is not allowlisted); caps/reparse/evtx export still apply. `MergeDiagnosticsLogPaths` dedups global ∪ tenant paths. Portal: collapsed read-only catalog + one-line rows in both cards, tenant context dropped the GA-only global fetch.
+* **Update**: `rules/gather-rule-guardrails.md` — `DiagnosticsPathGuards` scope clarified: configured diagnostics paths only, never the built-in catalog.
+* **Update**: `backend/tenant-activation-welcome-mail.md` — new "Template overrides" section: Global Admins can replace the welcome/farewell HTML in the portal (Settings → Email Templates); `EmailTemplateService` resolves override-or-built-in per send (PreviewConfig table, partition `EmailTemplates`, 5-min cache, `{{domainName}}` placeholder, 30k limit, fail-soft send path), GA endpoints `global/email-templates/{kind}` (+`/test` to the caller's tenant contact address). Also: the mail header is image-free (CSS-drawn brand mark, gradient stripes and clip-path edge as progressive enhancement).
+
+## 2026-08-22
+
+* **Update**: `backend/tenant-activation-welcome-mail.md` — new "Mail transport" section: transactional mail now goes through the provider-neutral `EmailService` (`IEmailService` + `IOffboardFarewellEmailSender`) with the provider confined to one private transport method and the `Email:*` settings (`ApiKey`, `Endpoint`, `FromAddress`, `FromName`); current provider Mailchimp Transactional (Mandrill) replacing Resend (NuGet dropped, typed `HttpClient` + `ResiliencePolicies.Notification`). Result-array semantics (`sent`/`queued`/`scheduled` ok, `rejected`/`invalid` warn), open/click tracking explicitly off because the privacy/trust claim depends on it.
+
+* **New**: `backend/plan-downgrade-retention-grace.md` — plan downgrade policy: every Pro entitlement gates read-time and reversibly on downgrade ("gate, don't destroy"), except retention, which now gets a 30-day grace (`FeatureEntitlementCatalog.RetentionDowngradeGraceDays`) before the Community cap starts hard-deleting the 90–365-day band. Anchor model: `ProDowngradedUtc` stamped/cleared by the plan endpoint's pure `ApplyPlanChanges` core on EFFECTIVE-edition transitions (covers explicitly ended trials; planTier downgrade under an active trial deliberately doesn't stamp), trial expiry anchors read-time via `TrialExpiresUtc`. New Warning ops events `TenantPlanDowngraded` (PATCH handler) and `TenantRetentionGraceExpiring`/`TenantRetentionGraceEnded` (TrialExpirySweep window mechanics, only when stored retention exceeds the Community cap). Field is patch-denied + revert-protected; retention WRITE cap deliberately ignores the grace.
+
+## 2026-08-21
+
+* **New**: `agent/do-group-id-auto-set.md` — optional DO peering-group seed (`EnableDoGroupIdAutoSet`, default off, ConfigVersion 40): `DoGroupIdService` derives a deterministic GUID from the default gateway's IPv4 + SendARP MAC in RealmJoin's exact byte layout (cross-product peering) and writes `DOGroupId` in the 64-bit GPO Policies store with readback verification. Conservative by design: no random-GUID fallback (skip on missing gateway/MAC), `DOGroupIdSource`/MDM-managed values/foreign GPO values always win (skip reasons in the `do_group_id_auto_set` event), own stale values are recognized via the `written:<guid>` StartupEventGate fingerprint and updated after a gateway change. Gateway heuristic extracted into the shared `NetworkInterfaceLocator` (dedup of NetworkChangeDetector + DeviceInfoCollector copies).
+
+* **New**: `agent/system-timeline-watcher.md` — clock-step and sleep-episode ground truth from the System event log: one `EventLogWatcher` (Kernel-General 1, Power-Troubleshooter 1, Kernel-Power 507; 506 deliberately unconsumed) emits `system_clock_changed` (oldTime/newTime/signed timeDeltaMs/reason/process; 2 s micro-slew floor, ≥5 min = Warning+immediate) and `system_sleep_episode` (kind sleep/hibernate/modern_standby, authoritative `enteredAt`/`exitedAt` payload instants, 60 s Modern-Standby floor). WindowsUpdateTracker-style backfill (24 h default, `system-timeline-watermark.json`) recovers pre-agent records; ConfigVersion 39 (`Collectors.EnableSystemTimelineWatcher`). Consumers: TimeJumpBadge cause `clock-set` (ground truth beats inference), SessionInfoCard standby note next to the unchanged wall-clock duration, `SleepSpan`s in time attribution (AttributionVersion 3, RebootSpan clone), and ANALYZE-DEV-012 (info, single, ≥5 min episode; deliberately the only new rule — clock issues stay with DEV-008).
+
+* **New**: `agent/power-state-watcher.md` — live AC/battery observation during enrollment: `PowerStateWatcherHost` subscribes to the WMI push `Win32_PowerManagementEvent EventCode 10` (no polling; re-probes `GetSystemPowerStatus` per push, 5 s trailing-edge debounce, never armed on battery-less devices, `Collectors.EnablePowerStateWatcher` kill-switch, ConfigVersion 38). The pure `PowerStateTransitionTracker` emits `power_state_change` with `transition` = ac_to_battery (Warning, immediate) / battery_to_ac (Info) / threshold_crossed at 50/30/15% (each level latched once per lifetime, lowest-crossed-only on jumps, baseline-below-level covered, emission cap 20). Classified non-activity on both sides (SignalActivityClassifier + IsPeriodicOrStallEvent). New analyze rules ANALYZE-DEV-009 (thresholdPercent=15, high) and ANALYZE-DEV-010 (transition=ac_to_battery, warning), both with `on_event:power_state_change` interim triggers and deliberately single-required-condition (event_data conditions have no same-instance join).
+
+* **Update**: `rules/rule-id-namespace.md` — the export→paste round-trip is no longer lossy: the JSON editors now map rule-shaped exports into the form (`gatherRuleToForm` unflattens the nested gather `parameters` object, analyze `jsonToForm` maps `evaluateOn` onto the eval checkboxes; `tags` and the effective `markSessionAsFailed` carry into the created rule). Both editors still accept the serialized-form shape; edit-mode pastes merge, with an explicit `parameters`/`evaluateOn` winning over stale flat fields.
+
+* **New**: `rules/rule-id-namespace.md` — rule identity model: human-readable `ruleId` strings (no GUIDs), tenant isolation via Table Storage partitioning (`global` = built-in/community, tenantId = custom), the reserved built-in namespace from `RuleIdPolicy`, and the four collision guards: catalog-only global `RuleStats` aggregate (same-ID custom rules of unrelated tenants no longer sum into one `global_{ruleId}` row), combine.js duplicate/namespace fail, GitHub-reseed rejection of non-reserved IDs into the global partition, and the namespace gate on the cross-tenant RuleState GC.
+
+* **New**: `backend/app-install-duration-attempt.md` — attempt-scoped app install durations: `DurationSeconds` = status-defining (last) attempt anchored on the new max-folded `LastAttemptStartedAt` (StartedAt stays the earliest-wins window/version-ordering key; legacy rows without the anchor keep the span fallback); `InstallPassCount` with replay-guarded additive fold; weaker-terminal guard (completed-with-Skipped never overrides Installed/Error, in-batch and cross-batch); attempt-scoped `DownloadDurationSeconds` pairing; the version-regression radar's both-sides cutover gate; time attribution counts the union of per-pass active segments (occupancy merges segments, hulls stay for display/what-if); agent payload timing re-arms both endpoints on terminal→active. No backfill — pre-cutover rows keep span semantics.
+
+* **Update**: `agent/decision-engine.md` — activity-based RealmJoin timeout extension (report 55e6afd61c9d: a large RJ package catalog outlived the 60-min window mid-install — the timer arms at RJ-agent-MSI detection, so the first deployment had effectively ~44 min). When the `RealmJoinTimeout` deadline fires with `LastDeploymentPhase` 100/101 and deployment activity (phase change or package observation, persisted in `RealmJoinFacts.LastActivityUtc`; the detection-time phase capture deliberately excluded) inside the last 60 min, the deadline re-arms to `lastActivity + 60 min` (Info event `realmjoin_timeout_extended`), clamped at detection + 4 h. `realmjoin_timeout` now carries `reason` = `hard_timeout` / `inactivity` / `absolute_cap`; a fire of a superseded deadline incarnation dead-ends. Idle detection and phase-200/210 sessions keep the original 60-min behavior.
+
+* **New**: `backend/send-time-frame-separation.md` — P14: the agent stamps one device-clock send timestamp per upload attempt (`X-Send-Time-Utc`), the ingest function server-stamps it as `SentAt` on every event of the request. `SentAt − OccurredUtc` is pure spool delay, `ReceivedAt − SentAt` is network + device-vs-server clock offset — the two were indistinguishable before and had to be separated statistically. The `clock_skew` condition measures SentAt-carrying batches directly (spool-immune, no spread cap, IME-only sessions become measurable; evidence carries `sentAtBatchCount`), legacy batches keep the median path; the CMTrace tripwire deliberately stays on its differential math (common-mode clock offset cancels there).
+
 ## 2026-08-20
 
+* **Update**: `agent/cmtrace-time-resolution.md` — new "Backend regression tripwire" section: the P6 split. Operator side: `CmTraceSkewTripwire` piggybacks on the terminal counter reconcile's partition scan (`Δ = ReceivedAt − OccurredUtc` per source, 15-min grid + 2-min residual, ≥20 samples / ≥3 distinct batches per side, bias-dominated sessions suppressed, `measuredWriterOffsetMinutes` never consulted) and emits the `CmTraceTimeSkewRegression` ops event — goal state: never fires; kill switch `CmTraceSkewTripwireDisabled`. Customer side: new `clock_skew` analyze condition source (`skewMetric: clock_jump | sustained_offset`, threshold in seconds, batch-median frames with spool-spread filter, plateau step detection, end-state persistence, IME-derived events excluded) behind the new built-in `ANALYZE-DEV-008` (300 s = the Kerberos/Entra 5-minute skew boundary) — the during-enrollment complement of ANALYZE-DEV-007's one-shot NTP check. P5 (agent-side observability event) is subsumed by the tripwire.
+
+* **New**: `agent/cmtrace-time-resolution.md` — the era-aware answer to the CMTrace timezone skew: a bias-less line read in a provably fresh pass anchors its own UTC offset against the agent clock (15-minute grid, 2-minute residual), so interleaved writer eras in one file resolve line by line; everything not provably fresh keeps the uniform reader-zone fallback and says so via `sourceOffsetOrigin`. Freshness is a per-file `LastCheckedUtc` stamped on every poll look (empty first sights included) with a 30-second window, never restored across restarts. Replaces the reverted per-file offset application (04b1a7c6); the per-file measurement stays observational, now with the anchor timestamp logged as a tripwire for the still-unexplained e9753578 label/anchor crossing.
+
 * **Update**: `agent/post-reboot-completion-recovery.md` — retitled to "ESP Completion Starvation — the sits-d Cloud-PC complex" and reframed on the evidence: the reboot was a red herring. The five stuck Cloud PCs carried `SkipUserStatusPage=True` (read 10+ times across three agent processes, `True` every time) and Windows honoured it — no user ESP page, hence no Shell-Core 62407 and no AccountSetup provisioning registry, verified over a six-hour uninterrupted post-reboot run with the watcher armed. Arm B of `ShouldTransitionToAwaitingHello` was open from the bootstrap onward, but every evaluation site hangs off a signal a skip-user flow cannot produce, and the `AdvisoryCompletion` backstop arms exclusively from an `EspExiting` signal — an open gate nobody knocks on. Fix: `HandleImeUserSessionCompletedV1` accepts the observed skip in place of the final-exit evidence (`skipUserExitEquivalent`; anchor + genuine IME completion + real-user desktop stay mandatory, WDP excluded). The knock deliberately lives on the IME edge, not desktop arrival — ordering-robust against Fix 10's AccountSetup bounce-back and semantically "user-phase work finished" rather than mid-install. `ClassicSkipUserEspUserSessionCompletionTests` replays the real 8110e262 ordering end to end. Docs and comments no longer claim an ESP-exit recovery that does not exist (stray duplicate summary in `ShellCoreTracker`, `ImeLogHost` restore-callback comment); the residual `SkipUser=false` exit-in-downtime gap is named honestly and surfaced by `ANALYZE-ESP-005` via `session_stalled` instead of being patched with an unorderable replay.
 
 ## 2026-08-19

docs/rules/analyze-rule-triggers.md

@@ -98,7 +98,7 @@ Interim evaluation changes what a rule's conditions mean mid-flight. Three new l
 
 # Application to the Motivating Cases
 
-- WG battery rule (sits-d): `evaluateOn: ["enrollment_end", "whiteglove_sealed"]` — technician gets the channel alert at the bench; Part-2 terminal pass finalizes or resolves the finding.
+- WG battery rule (sits-d): shipped 2026-08-21 as ANALYZE-DEV-009 (battery below 15% while on battery) and ANALYZE-DEV-010 (AC→battery switch), both `evaluateOn: ["enrollment_end", "whiteglove_sealed", "on_event:power_state_change"]` on the live power watcher's `power_state_change` events (see `../agent/power-state-watcher.md`) — technician gets the channel alert at the bench; the terminal pass finalizes the finding. Both are deliberately single-required-condition rules: `event_data` conditions scan events independently (no same-instance join), so DEV-009 matches the agent-stamped `thresholdPercent` and DEV-010 matches `transition`.
 - Hybrid-affinity stuck (esa): ANALYZE-ID-004 gets `evaluateOn: ["enrollment_end", "on_event:hybrid_login_pending"]` — the second overdue-login event (threshold 65) produces a live finding on the still-InProgress session. ANALYZE-APP-015 stays `enrollment_end`-only until its conditions are hardened (lint 1).
 
 - Stuck after a forced mid-ESP reboot (sits-d Cloud PCs, 2026-08-19): `on_event:session_stalled` is the established trigger for the never-terminal stuck session. The agent emits `session_stalled` exactly once per session (60-minute stall probe), so the trigger is rare by construction and needs no throttle. Five Cloud PCs sat at `InProgress` with **zero findings** for hours — a mid-ESP reboot had killed the agent in `Stage=EspAccountSetup` — before the max-lifetime watchdog eventually terminalised them as `Incomplete`. ANALYZE-ESP-005 carries the trigger and fires on that stream at confidence 95 (verified against session `8110e262`): both its conditions (`mdm_policy_reboot_required.firstRebootUri` exists, `system_reboot_detected` count ≥ 1) are **monotonic** and it has no terminal preconditions, so lint 1 does not apply. ANALYZE-APP-016 is interim-safe for the same reason (`app_install_starved` count ≥ 1 only ever grows).

docs/rules/gather-rule-guardrails.md

@@ -31,6 +31,12 @@ item in `AutopilotMonitor.Agent.V2.Core.csproj`) and regenerated into the portal
 | `IsCommandAllowed` | `allowedCommands` | **exact** match, trimmed — never prefix |
 | `IsEventLogChannelAllowed` | `eventLogChannels` | prefix, boundary `/` or end |
 
+`DiagnosticsPathGuards.IsDiagnosticsPathAllowed` (allowlist `diagnosticsPathPrefixes`, a C#
+literal mirrored in the JSON) applies the same hard blocks and the same user-profile
+exception to **admin-configured diagnostics paths** only. The diagnostics package's built-in
+sections are reviewed code and never pass through it — see
+[Diagnostics Package](../agent/diagnostics-package.md).
+
 **Hard blocks live in code, not in the JSON**, so a parse error cannot lift them — on a
 parse failure the allowlists fall back to empty and everything is blocked (fail-closed),
 but the hard blocks must hold regardless of configuration:

docs/rules/rule-id-namespace.md

@@ -0,0 +1,47 @@
+---
+type: concept
+title: Rule ID Namespace & Collision Guards
+description: How gather/analyze rule identity is scoped (tenant partition vs global partition), why there are no GUIDs, which collisions are possible, and the guards that keep the reserved built-in namespace and the global RuleStats aggregate clean.
+resource: backend, rules
+tags: [rules, ruleid, namespace, collision, rulestats, tenant-isolation]
+timestamp: 2026-08-21
+---
+
+# Schema
+
+Rule identity is the human-readable `ruleId` string — there are no GUIDs, deliberately: the ID appears in logs, mails, notifications, RuleResults, the agent config payload, and docs, and tenant isolation is provided by Table Storage partitioning instead.
+
+| Store | PartitionKey | RowKey | Content |
+|---|---|---|---|
+| `GatherRules` / `AnalyzeRules` | `"global"` | ruleId | Built-in + community rules (shared, all tenants) |
+| `GatherRules` / `AnalyzeRules` | tenantId | ruleId | Custom rules (visible only to that tenant) |
+| `RuleStates` | tenantId | ruleId | Per-tenant enable/notify overrides — built-in/community rules ONLY (custom rules fold state into their own row) |
+| `RuleStats` | date | `{tenantId}_{ruleId}` and `global_{ruleId}` | Daily fire/eval telemetry; the global row is catalog-only (see guards) |
+
+Namespace split (`RuleIdPolicy.cs`, shared model):
+
+- **Reserved built-in namespace**: `(ANALYZE|GATHER)-<CATEGORY>-<NUMBER>` with `CATEGORY != CUSTOM`, case-insensitive, including currently unused numbers (gaps = retired rules that may return).
+- **Tenant namespace**: everything else — `ANALYZE-CUSTOM-NNN` (portal suggestion), `-CUSTOM` suffixes, org prefixes (`CONTOSO-WIFI-001`), freeform.
+
+# Collision model
+
+- **Custom vs built-in**: impossible via API — `CreateRuleAsync`/`UpdateRuleAsync` reject reserved IDs (409) and check existence against `global` ∪ own tenant partition. Legacy debris is neutralized at merge time: global wins, tenant copy dropped with a warning (pinned by `RuleMergeCollisionGuardTests`, motivated by the 5ca2b350 duplicate-key incident).
+- **Custom vs custom across tenants**: allowed and harmless — separate partitions, separate evaluation, separate RuleResults/tenant stats. Two tenants both using `ANALYZE-CUSTOM-101` never interact.
+- **JSON copy between tenants** (export → paste into create editor): goes through the same create path, so an ID already taken in the receiving tenant surfaces as 409 — the user renames. There is no bulk import endpoint. The JSON editors accept both shapes — a rule export and the serialized form — via `gatherRuleToForm` / `jsonToForm` (web `types.ts` of each rules page): nested gather `parameters` are unflattened, analyze `evaluateOn` maps onto the eval checkboxes, and `tags` plus the effective `markSessionAsFailed` survive the import.
+
+# Guards (all enforced, 2026-08-21)
+
+1. **Global RuleStats aggregate is catalog-only.** The `global_{ruleId}` row would otherwise sum same-ID custom rules of unrelated tenants (title/severity last-writer-wins). Analyze gates on `rule.IsBuiltIn || rule.IsCommunity` (`AnalyzeOnEnrollmentEndHandler`), gather gates on `RuleIdPolicy.IsReservedBuiltInId` (`EventIngestProcessor.RuleStats`) because agent events carry no flag — valid because custom rules can never occupy the reserved pattern.
+2. **Catalog build fails on namespace violations.** `rules/scripts/combine.js` rejects duplicate IDs (case-insensitive) and any gather/analyze built-in outside the reserved pattern; `BuiltInRuleCatalogPolicyTests` pins the same invariants on the embedded resource actually deployed.
+3. **GitHub reseed rejects non-reserved IDs** before writing to the `global` partition (`ReseedFromGitHubFunction`) — a seeded `*-CUSTOM-*` rule would silently shadow every tenant's same-ID custom rule at merge time.
+4. **Cross-tenant RuleState GC is namespace-gated.** `DeleteRuleStatesForRuleIdAcrossTenantsAsync` deletes by bare RowKey across all partitions; it now refuses non-reserved IDs with `failed=-1` (callers then skip the global catalog delete, same contract as enumeration failure).
+
+Invariant chain: schema pattern + combine.js + reseed guard ⇒ the `global` partition only ever contains reserved-pattern IDs ⇒ the pattern is a safe built-in/custom discriminator everywhere no `IsBuiltIn` flag is available.
+
+# Citations
+
+- `src/Shared/AutopilotMonitor.Shared/Models/Rules/RuleIdPolicy.cs` — reserved pattern + rationale
+- `src/Backend/AutopilotMonitor.Functions/Services/AnalyzeRuleService.cs`, `GatherRuleService.cs` — create/update guards, merge collision guard
+- `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Rules.cs` — key schemes, cross-tenant GC guard
+- `src/Backend/AutopilotMonitor.Functions.Tests/BuiltInRuleCatalogPolicyTests.cs`, `RuleIdReservationTests.cs`, `RuleMergeCollisionGuardTests.cs`
+- `rules/scripts/combine.js` — build-time namespace/duplicate guard

rules/analyze/ANALYZE-DEV-008.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-008",
+  "title": "Device Clock Wrong During Enrollment — Jump or Sustained Offset",
+  "description": "The device's clock changed by five or more minutes mid-session (clock jump) or ran five or more minutes off server time for the whole session (sustained offset), measured against the server receive frame of every uploaded event. Complements ANALYZE-DEV-007, which is a one-shot NTP check at agent startup and misses devices where NTP was unreachable or the clock changed later. IME-log-derived events are excluded from the measurement.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
+  "trigger": "single",
+  "baseConfidence": 60,
+  "confidenceThreshold": 50,
+  "conditions": [
+    {
+      "signal": "clock_jump",
+      "source": "clock_skew",
+      "skewMetric": "clock_jump",
+      "operator": "gte",
+      "value": "300",
+      "required": false
+    },
+    {
+      "signal": "sustained_offset",
+      "source": "clock_skew",
+      "skewMetric": "sustained_offset",
+      "operator": "gte",
+      "value": "300",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [],
+  "explanation": "This device's {{skewSummary}} (five-minute threshold). A clock that is off by five or more minutes breaks time-sensitive enrollment mechanisms: Kerberos tolerates at most 5 minutes of skew (Hybrid Join), Entra ID token validation allows about 5 minutes on token lifetimes, and freshly issued SCEP/PKCS certificates can be rejected as \"not yet valid\" when the clock is more than ~10 minutes behind the CA.\n\nUnlike ANALYZE-DEV-007 (a one-shot NTP comparison at agent startup), this finding is measured across the whole session against the server's receive time — it also catches devices where the NTP check could not run (UDP 123 blocked) or where the clock changed after startup (time sync correcting a wrong RTC, Windows auto-timezone, manual change).",
+  "remediation": [
+    {
+      "title": "Fix the device clock and time source",
+      "steps": [
+        "Check the BIOS/RTC clock and the CMOS battery if the wrong time recurs on the same hardware.",
+        "At OOBE, run 'w32tm /resync /force' (Shift+F10 command prompt) to sync with time.windows.com.",
+        "Ensure UDP port 123 to time.windows.com is open in the deployment network.",
+        "Review 'Set time automatically' and 'Set time zone automatically' behavior on the deployment image — automatic timezone changes mid-enrollment show up as clock jumps."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Windows Autopilot known issues — device provisioning can fail (clock skew)",
+      "url": "https://learn.microsoft.com/en-us/autopilot/known-issues"
+    },
+    {
+      "title": "Microsoft Learn: Windows Autopilot requirements — Networking (NTP)",
+      "url": "https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "clock-skew",
+    "clock-jump",
+    "time-sync",
+    "kerberos",
+    "certificates",
+    "known-issue"
+  ]
+}

rules/analyze/ANALYZE-DEV-009.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-009",
+  "title": "Battery Critically Low During Enrollment",
+  "description": "Detects that the device's battery dropped to 15% or less while enrolling on battery power (power_state_change threshold event from the agent's live power watcher). A device dying mid-enrollment leaves a half-provisioned state that typically needs a full reset; this rule surfaces the risk while there is still time to plug the device in. Uses a single required condition on the agent-stamped thresholdPercent field (the data field 'transition' on the event is unrelated to this rule's 'trigger' property).",
+  "severity": "high",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:power_state_change"
+  ],
+  "trigger": "single",
+  "baseConfidence": 90,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "battery_threshold_15",
+      "source": "event_data",
+      "eventType": "power_state_change",
+      "dataField": "thresholdPercent",
+      "operator": "equals",
+      "value": "15",
+      "required": true
+    }
+  ],
+  "explanation": "The device's battery fell below **{{thresholdPercent}}%** while the enrollment was running on battery power. If the battery drains completely mid-enrollment, the device is left in a half-provisioned state — apps, policies, or the user profile may be incomplete, and in most cases the device has to be reset and re-enrolled. The agent detected the threshold crossing live via a Windows power-status notification; the exact percentage at that moment is recorded on the matched power_state_change event in the session timeline.",
+  "remediation": [
+    {
+      "title": "Secure power for the running enrollment",
+      "steps": [
+        "Connect the device to AC power immediately — the enrollment continues normally once power is stable.",
+        "If the device shut down before completing, check whether the session reached the desktop; if not, reset the device (Autopilot reset or reimage) and re-enroll it plugged in.",
+        "For technician/White Glove flows, make AC power part of the bench checklist — pre-provisioning on battery is the most common source of this alert.",
+        "If this fires across many devices of one model, review that model's battery health (the hardware_spec event carries design vs. full-charge capacity)."
+      ]
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "power",
+    "battery",
+    "environment"
+  ]
+}

rules/analyze/ANALYZE-DEV-010.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-010",
+  "title": "Enrollment Switched From AC to Battery Power",
+  "description": "Detects that the device lost AC power and switched to battery while the enrollment was running (power_state_change event with transition ac_to_battery from the agent's live power watcher). Uses a single required condition so the match is pinned to one event instance; the event payload carries the battery percentage at the moment of the switch. The agent debounces power flapping (5s) so a brief unplug/replug does not produce this event.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:power_state_change"
+  ],
+  "trigger": "single",
+  "baseConfidence": 85,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "switched_to_battery",
+      "source": "event_data",
+      "eventType": "power_state_change",
+      "dataField": "transition",
+      "operator": "equals",
+      "value": "ac_to_battery",
+      "required": true
+    }
+  ],
+  "explanation": "The device switched from AC to battery power mid-enrollment. Enrollments are power-hungry — app downloads, Windows Update and disk encryption drain a battery quickly, and Windows may also throttle CPU and network on battery, slowing the enrollment down. The battery percentage at the moment of the switch is recorded on the matched power_state_change event in the session timeline; if the device stayed on battery, look there for subsequent threshold events (50/30/15%) — a later battery_to_ac event means power was restored.",
+  "remediation": [
+    {
+      "title": "Restore AC power",
+      "steps": [
+        "Reconnect the device to AC power; the enrollment continues normally.",
+        "Check the session timeline for a subsequent battery_to_ac event (power restored) or threshold_crossed events (battery draining) to judge urgency.",
+        "If this alert is frequent in a deployment area, check docking stations/USB-C hubs for loose power delivery — a flapping dock is a common cause.",
+        "Make 'plugged in during setup' part of the end-user/technician enrollment instructions."
+      ]
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "power",
+    "battery",
+    "environment"
+  ]
+}

rules/analyze/ANALYZE-DEV-012.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-012",
+  "title": "Device Entered Standby During Enrollment",
+  "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log — pre-agent episodes are backfilled). Uses a single required condition on the episode's durationSeconds so the match is pinned to one event instance and the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
+  "severity": "info",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:system_sleep_episode"
+  ],
+  "trigger": "single",
+  "baseConfidence": 90,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "slept_during_enrollment",
+      "source": "event_data",
+      "eventType": "system_sleep_episode",
+      "dataField": "durationSeconds",
+      "operator": "gte",
+      "value": "300",
+      "required": true
+    }
+  ],
+  "explanation": "The device was asleep for {{durationSeconds}} seconds during the enrollment window. Nothing progresses while the device sleeps — downloads pause, the IME stops processing and the ESP simply waits — so the wall-clock enrollment duration includes this pause and can look much slower than the enrollment actually was. The matched system_sleep_episode event in the session timeline carries the exact enter/exit times, the episode kind (sleep, hibernate or Modern Standby) and, for Modern Standby, whether the device was on AC power. A long unexplained gap in the timeline right before that event is this pause, not missing telemetry.",
+  "remediation": [
+    {
+      "title": "Keep the device awake during enrollment",
+      "steps": [
+        "Check the matched system_sleep_episode event in the timeline for the episode bounds and kind — the enrollment duration minus the episode duration is the real active time.",
+        "If the device slept on battery, connect AC power during setup; Windows sleeps far more aggressively on battery.",
+        "Instruct users/technicians to keep the lid open and the device powered until the enrollment finishes.",
+        "For recurring cases, review the power plan applied during OOBE/ESP (e.g. via provisioning or Intune policy) — consider disabling sleep on AC for the enrollment window."
+      ]
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "power",
+    "standby",
+    "sleep",
+    "environment"
+  ]
+}

rules/dist/analyze-rules.json

@@ -1516,6 +1516,216 @@
         "known-issue"
       ]
     },
+    {
+      "ruleId": "ANALYZE-DEV-008",
+      "title": "Device Clock Wrong During Enrollment — Jump or Sustained Offset",
+      "description": "The device's clock changed by five or more minutes mid-session (clock jump) or ran five or more minutes off server time for the whole session (sustained offset), measured against the server receive frame of every uploaded event. Complements ANALYZE-DEV-007, which is a one-shot NTP check at agent startup and misses devices where NTP was unreachable or the clock changed later. IME-log-derived events are excluded from the measurement.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end",
+        "whiteglove_sealed"
+      ],
+      "trigger": "single",
+      "baseConfidence": 60,
+      "confidenceThreshold": 50,
+      "conditions": [
+        {
+          "signal": "clock_jump",
+          "source": "clock_skew",
+          "skewMetric": "clock_jump",
+          "operator": "gte",
+          "value": "300",
+          "required": false
+        },
+        {
+          "signal": "sustained_offset",
+          "source": "clock_skew",
+          "skewMetric": "sustained_offset",
+          "operator": "gte",
+          "value": "300",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [],
+      "explanation": "This device's {{skewSummary}} (five-minute threshold). A clock that is off by five or more minutes breaks time-sensitive enrollment mechanisms: Kerberos tolerates at most 5 minutes of skew (Hybrid Join), Entra ID token validation allows about 5 minutes on token lifetimes, and freshly issued SCEP/PKCS certificates can be rejected as \"not yet valid\" when the clock is more than ~10 minutes behind the CA.\n\nUnlike ANALYZE-DEV-007 (a one-shot NTP comparison at agent startup), this finding is measured across the whole session against the server's receive time — it also catches devices where the NTP check could not run (UDP 123 blocked) or where the clock changed after startup (time sync correcting a wrong RTC, Windows auto-timezone, manual change).",
+      "remediation": [
+        {
+          "title": "Fix the device clock and time source",
+          "steps": [
+            "Check the BIOS/RTC clock and the CMOS battery if the wrong time recurs on the same hardware.",
+            "At OOBE, run 'w32tm /resync /force' (Shift+F10 command prompt) to sync with time.windows.com.",
+            "Ensure UDP port 123 to time.windows.com is open in the deployment network.",
+            "Review 'Set time automatically' and 'Set time zone automatically' behavior on the deployment image — automatic timezone changes mid-enrollment show up as clock jumps."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Windows Autopilot known issues — device provisioning can fail (clock skew)",
+          "url": "https://learn.microsoft.com/en-us/autopilot/known-issues"
+        },
+        {
+          "title": "Microsoft Learn: Windows Autopilot requirements — Networking (NTP)",
+          "url": "https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "clock-skew",
+        "clock-jump",
+        "time-sync",
+        "kerberos",
+        "certificates",
+        "known-issue"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-009",
+      "title": "Battery Critically Low During Enrollment",
+      "description": "Detects that the device's battery dropped to 15% or less while enrolling on battery power (power_state_change threshold event from the agent's live power watcher). A device dying mid-enrollment leaves a half-provisioned state that typically needs a full reset; this rule surfaces the risk while there is still time to plug the device in. Uses a single required condition on the agent-stamped thresholdPercent field (the data field 'transition' on the event is unrelated to this rule's 'trigger' property).",
+      "severity": "high",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end",
+        "whiteglove_sealed",
+        "on_event:power_state_change"
+      ],
+      "trigger": "single",
+      "baseConfidence": 90,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "battery_threshold_15",
+          "source": "event_data",
+          "eventType": "power_state_change",
+          "dataField": "thresholdPercent",
+          "operator": "equals",
+          "value": "15",
+          "required": true
+        }
+      ],
+      "explanation": "The device's battery fell below **{{thresholdPercent}}%** while the enrollment was running on battery power. If the battery drains completely mid-enrollment, the device is left in a half-provisioned state — apps, policies, or the user profile may be incomplete, and in most cases the device has to be reset and re-enrolled. The agent detected the threshold crossing live via a Windows power-status notification; the exact percentage at that moment is recorded on the matched power_state_change event in the session timeline.",
+      "remediation": [
+        {
+          "title": "Secure power for the running enrollment",
+          "steps": [
+            "Connect the device to AC power immediately — the enrollment continues normally once power is stable.",
+            "If the device shut down before completing, check whether the session reached the desktop; if not, reset the device (Autopilot reset or reimage) and re-enroll it plugged in.",
+            "For technician/White Glove flows, make AC power part of the bench checklist — pre-provisioning on battery is the most common source of this alert.",
+            "If this fires across many devices of one model, review that model's battery health (the hardware_spec event carries design vs. full-charge capacity)."
+          ]
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "power",
+        "battery",
+        "environment"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-010",
+      "title": "Enrollment Switched From AC to Battery Power",
+      "description": "Detects that the device lost AC power and switched to battery while the enrollment was running (power_state_change event with transition ac_to_battery from the agent's live power watcher). Uses a single required condition so the match is pinned to one event instance; the event payload carries the battery percentage at the moment of the switch. The agent debounces power flapping (5s) so a brief unplug/replug does not produce this event.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end",
+        "whiteglove_sealed",
+        "on_event:power_state_change"
+      ],
+      "trigger": "single",
+      "baseConfidence": 85,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "switched_to_battery",
+          "source": "event_data",
+          "eventType": "power_state_change",
+          "dataField": "transition",
+          "operator": "equals",
+          "value": "ac_to_battery",
+          "required": true
+        }
+      ],
+      "explanation": "The device switched from AC to battery power mid-enrollment. Enrollments are power-hungry — app downloads, Windows Update and disk encryption drain a battery quickly, and Windows may also throttle CPU and network on battery, slowing the enrollment down. The battery percentage at the moment of the switch is recorded on the matched power_state_change event in the session timeline; if the device stayed on battery, look there for subsequent threshold events (50/30/15%) — a later battery_to_ac event means power was restored.",
+      "remediation": [
+        {
+          "title": "Restore AC power",
+          "steps": [
+            "Reconnect the device to AC power; the enrollment continues normally.",
+            "Check the session timeline for a subsequent battery_to_ac event (power restored) or threshold_crossed events (battery draining) to judge urgency.",
+            "If this alert is frequent in a deployment area, check docking stations/USB-C hubs for loose power delivery — a flapping dock is a common cause.",
+            "Make 'plugged in during setup' part of the end-user/technician enrollment instructions."
+          ]
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "power",
+        "battery",
+        "environment"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-012",
+      "title": "Device Entered Standby During Enrollment",
+      "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log — pre-agent episodes are backfilled). Uses a single required condition on the episode's durationSeconds so the match is pinned to one event instance and the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
+      "severity": "info",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end",
+        "whiteglove_sealed",
+        "on_event:system_sleep_episode"
+      ],
+      "trigger": "single",
+      "baseConfidence": 90,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "slept_during_enrollment",
+          "source": "event_data",
+          "eventType": "system_sleep_episode",
+          "dataField": "durationSeconds",
+          "operator": "gte",
+          "value": "300",
+          "required": true
+        }
+      ],
+      "explanation": "The device was asleep for {{durationSeconds}} seconds during the enrollment window. Nothing progresses while the device sleeps — downloads pause, the IME stops processing and the ESP simply waits — so the wall-clock enrollment duration includes this pause and can look much slower than the enrollment actually was. The matched system_sleep_episode event in the session timeline carries the exact enter/exit times, the episode kind (sleep, hibernate or Modern Standby) and, for Modern Standby, whether the device was on AC power. A long unexplained gap in the timeline right before that event is this pause, not missing telemetry.",
+      "remediation": [
+        {
+          "title": "Keep the device awake during enrollment",
+          "steps": [
+            "Check the matched system_sleep_episode event in the timeline for the episode bounds and kind — the enrollment duration minus the episode duration is the real active time.",
+            "If the device slept on battery, connect AC power during setup; Windows sleeps far more aggressively on battery.",
+            "Instruct users/technicians to keep the lid open and the device powered until the enrollment finishes.",
+            "For recurring cases, review the power plan applied during OOBE/ESP (e.g. via provisioning or Intune policy) — consider disabling sleep on AC for the enrollment window."
+          ]
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "power",
+        "standby",
+        "sleep",
+        "environment"
+      ]
+    },
     {
       "ruleId": "ANALYZE-ENRL-001",
       "title": "Enrollment Failed",

rules/schema/analyze-rule.schema.json

@@ -169,7 +169,12 @@
         "source": {
           "type": "string",
           "description": "Source of the signal.",
-          "enum": ["event_type", "event_data", "event_data_array", "phase_duration", "event_count", "app_install_duration", "event_correlation"]
+          "enum": ["event_type", "event_data", "event_data_array", "phase_duration", "event_count", "app_install_duration", "event_correlation", "clock_skew"]
+        },
+        "skewMetric": {
+          "type": "string",
+          "description": "For clock_skew only: which device-clock metric to evaluate. clock_jump = persistent step in the device's clock frame mid-session; sustained_offset = whole session ran on a clock off by at least the threshold. value is the threshold in seconds; operator is limited to gt/gte on the magnitude. IME-log-derived events are excluded from the measurement.",
+          "enum": ["clock_jump", "sustained_offset"]
         },
         "eventType": {
           "type": "string",

rules/scripts/combine.js

@@ -13,18 +13,26 @@ const rulesRoot = path.resolve(__dirname, '..');
 
 // ── Rule combination ────────────────────────────────────────────────────────
 
+// Shipped gather/analyze rules must stay inside the reserved built-in namespace:
+// (ANALYZE|GATHER)-<CATEGORY>-<NNN> with CATEGORY !== CUSTOM. The CUSTOM category is
+// the sanctioned tenant namespace (RuleIdPolicy.cs) — a built-in shipped there would
+// silently shadow every tenant's same-ID custom rule at merge time (global wins).
+const RESERVED_BUILTIN_ID = /^(ANALYZE|GATHER)-(?!CUSTOM-)[A-Z]+-\d{3}$/;
+
 const configs = [
   {
     dir: path.join(rulesRoot, 'gather'),
     output: path.join(rulesRoot, 'dist', 'gather-rules.json'),
     schema: '../schema/gather-rule.schema.json',
-    idField: 'ruleId'
+    idField: 'ruleId',
+    reservedNamespace: RESERVED_BUILTIN_ID
   },
   {
     dir: path.join(rulesRoot, 'analyze'),
     output: path.join(rulesRoot, 'dist', 'analyze-rules.json'),
     schema: '../schema/analyze-rule.schema.json',
-    idField: 'ruleId'
+    idField: 'ruleId',
+    reservedNamespace: RESERVED_BUILTIN_ID
   },
   {
     dir: path.join(rulesRoot, 'ime-log-patterns'),
@@ -37,12 +45,27 @@ const configs = [
 for (const config of configs) {
   const files = fs.readdirSync(config.dir).filter(f => f.endsWith('.json')).sort();
   const rules = [];
+  const seenIds = new Map(); // lowercased id -> filename (case variants collide for humans and RuleIdPolicy)
 
   for (const file of files) {
     const content = fs.readFileSync(path.join(config.dir, file), 'utf8');
     const rule = JSON.parse(content);
     // Remove $schema from individual entries (it's on the wrapper)
     delete rule['$schema'];
+
+    const id = rule[config.idField] || '';
+    const idKey = id.toLowerCase();
+    if (seenIds.has(idKey)) {
+      console.error(`ERROR: duplicate ${config.idField} "${id}" in ${file} (already defined in ${seenIds.get(idKey)})`);
+      process.exit(1);
+    }
+    seenIds.set(idKey, file);
+
+    if (config.reservedNamespace && !config.reservedNamespace.test(id)) {
+      console.error(`ERROR: ${file}: ${config.idField} "${id}" is outside the reserved built-in namespace ${config.reservedNamespace} — built-ins must never use the tenant CUSTOM namespace`);
+      process.exit(1);
+    }
+
     rules.push(rule);
   }
 

scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1

@@ -28,10 +28,13 @@
         (validates Windows 365 Cloud PCs against the tenant's Cloud PC inventory --
          Cloud PCs are never Autopilot-registered, so this enables agent monitoring
          of Cloud PC first-connect enrollment)
+      - All                    -> every optional permission above, in one run
+        (also works with -Revoke to remove all optional grants at once)
 
 .PARAMETER Permissions
-    Microsoft Graph application permission names to grant directly. Use when the admin UI
-    rendered a copy-paste command for you, or when you have a specific list in mind.
+    Microsoft Graph application permission names to grant directly. Use when you copied the
+    permission list from the admin UI ("Copy permissions"), or when you have a specific list
+    in mind.
 
 .PARAMETER TenantId
     Tenant ID (GUID) or verified domain. Optional -- defaults to the signed-in context.
@@ -47,12 +50,16 @@
     .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features ScriptDisplayNames
 
 .EXAMPLE
-    # Same effect, using the explicit-permission form (what the admin UI generates):
+    # Same effect, using the explicit-permission form:
     .\Grant-AutopilotMonitorAddOn.ps1 `
         -ClientId "<your-client-id>" `
         -Permissions "DeviceManagementScripts.Read.All" `
         -TenantId "contoso.onmicrosoft.com"
 
+.EXAMPLE
+    # Grant every optional capability in one run:
+    .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features All
+
 .EXAMPLE
     # Verify current state only, no changes:
     .\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<your-client-id>" -Features ScriptDisplayNames -VerifyOnly
@@ -65,6 +72,12 @@
     Requires:
       - Microsoft.Graph.Authentication PowerShell module (auto-installs if missing).
       - Sign-in as Global Administrator OR Privileged Role Administrator OR Cloud Application Administrator.
+
+    Sign-in behaviour:
+      In Azure Cloud Shell the script signs in via the ambient identity endpoint (a delegated
+      token for the already-signed-in user) - no device-code prompt, which Conditional Access
+      policies commonly block. Outside Cloud Shell it falls back to a normal interactive
+      Microsoft Graph sign-in. -TenantId only applies to the interactive fallback.
       - The Autopilot Monitor app must be admin-consented in your tenant first
         (its service principal must exist before grants can be added).
 
@@ -80,7 +93,7 @@ param(
     [string]$ClientId,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByFeatures')]
-    [ValidateSet('ScriptDisplayNames', 'W365CloudPcValidation')]
+    [ValidateSet('All', 'ScriptDisplayNames', 'W365CloudPcValidation')]
     [string[]]$Features,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByPermissions')]
@@ -106,7 +119,11 @@ $FeatureCatalog = @{
 }
 
 # Translate Features -> Permissions when caller used the high-level form.
+# 'All' is a script-side meta-value: it expands to every catalog feature.
 if ($PSCmdlet.ParameterSetName -eq 'ByFeatures') {
+    if ($Features -contains 'All') {
+        $Features = @($FeatureCatalog.Keys)
+    }
     $Permissions = @()
     foreach ($f in $Features) {
         $Permissions += $FeatureCatalog[$f]
@@ -133,7 +150,25 @@ if ($TenantId) { $connectParams['TenantId'] = $TenantId }
 
 Write-Host ""
 Write-Host "[Auth] Connecting to Microsoft Graph..." -ForegroundColor Cyan
-Connect-MgGraph @connectParams | Out-Null
+
+# Preferred path: ambient identity. In Azure Cloud Shell the local identity endpoint issues a
+# delegated Graph token for the signed-in user, which avoids the device-code flow that
+# Conditional Access policies commonly block. Outside Azure this throws and we fall back to
+# an interactive sign-in with explicit scopes.
+$identityConnected = $false
+try {
+    Connect-MgGraph -Identity -NoWelcome -ErrorAction Stop | Out-Null
+    # An ambient identity can exist yet hold no Graph permissions (e.g. a plain VM managed
+    # identity) - probe with a read before committing to this session.
+    Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$select=id&`$top=1" -ErrorAction Stop | Out-Null
+    $identityConnected = $true
+    Write-Host "[Auth] Connected via ambient identity (Azure Cloud Shell / managed identity)." -ForegroundColor Green
+}
+catch {
+    if (Get-MgContext) { Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null }
+    Write-Host "[Auth] No usable ambient identity - falling back to interactive sign-in..." -ForegroundColor Yellow
+    Connect-MgGraph @connectParams | Out-Null
+}
 
 $ctx = Get-MgContext
 if (-not $ctx) {
@@ -144,7 +179,10 @@ Write-Host "[Auth] Signed in as : $($ctx.Account)"
 Write-Host "[Auth] Tenant       : $($ctx.TenantId)"
 Write-Host "[Auth] Granted scopes: $($ctx.Scopes -join ', ')"
 
-if (-not ($ctx.Scopes -contains 'AppRoleAssignment.ReadWrite.All')) {
+# Scope check only applies to the interactive path: an ambient-identity (Cloud Shell) token
+# carries a fixed scope set (incl. Directory.AccessAsUser.All) instead of the requested scopes,
+# and its effective rights follow the signed-in user's directory role.
+if (-not $identityConnected -and -not ($ctx.Scopes -contains 'AppRoleAssignment.ReadWrite.All')) {
     Write-Warning "Scope 'AppRoleAssignment.ReadWrite.All' was NOT granted. The signed-in user likely lacks the required role (Global Admin / Privileged Role Admin / Cloud App Admin)."
     if (-not $VerifyOnly) { return }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/RemoteConfigMergerCompletenessTests.cs

@@ -37,6 +37,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             nameof(AgentConfigResponse.EnrollmentSummaryLaunchRetrySeconds),
             nameof(AgentConfigResponse.NtpServer),
             nameof(AgentConfigResponse.EnableTimezoneAutoSet),
+            nameof(AgentConfigResponse.EnableDoGroupIdAutoSet),
             nameof(AgentConfigResponse.DiagnosticsUploadEnabled),
             nameof(AgentConfigResponse.DiagnosticsUploadMode),
             nameof(AgentConfigResponse.DiagnosticsLogPaths),
@@ -52,6 +53,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             // Merge reads two Collectors knobs (AgentMaxLifetimeMinutes, HelloWaitTimeoutSeconds);
             // the remaining CollectorConfiguration flags flow untouched to DefaultComponentFactory.
             nameof(AgentConfigResponse.Collectors),
+            // Merge reads one Analyzers knob (EnableRealmJoinWatcher → diagnostics RealmJoin sections);
+            // the remaining flags flow untouched to DefaultComponentFactory + AgentAnalyzerManager.
+            nameof(AgentConfigResponse.Analyzers),
         };
 
         /// <summary>
@@ -69,8 +73,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             nameof(AgentConfigResponse.ImeLogPatterns),
             // Passed by AgentRuntimeHost into IComponentFactory.CreateCollectorHosts → ImeLogHost sealing re-emit.
             nameof(AgentConfigResponse.WhiteGloveSealingPatternIds),
-            // Consumed by DefaultComponentFactory (RealmJoin/KeepAwake/ConsoleBypass host gates) + AgentAnalyzerManager.
-            nameof(AgentConfigResponse.Analyzers),
             // Self-update ZIP integrity second trust channel — BinaryIntegrityVerifier / Program update path.
             nameof(AgentConfigResponse.LatestAgentSha256),
             // Running-EXE integrity verification — BinaryIntegrityVerifier post-config check.

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/RemoteConfigMergerTests.cs

@@ -43,6 +43,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             EnrollmentSummaryLaunchRetrySeconds = 300,
             NtpServer = "pool.ntp.org",
             EnableTimezoneAutoSet = true,
+            EnableDoGroupIdAutoSet = true,
             DiagnosticsUploadEnabled = true,
             DiagnosticsUploadMode = "OnFailure",
             DiagnosticsLogPaths = new List<DiagnosticsLogPath>
@@ -83,6 +84,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(300, agent.EnrollmentSummaryLaunchRetrySeconds);
             Assert.Equal("pool.ntp.org", agent.NtpServer);
             Assert.True(agent.EnableTimezoneAutoSet);
+            Assert.True(agent.EnableDoGroupIdAutoSet);
             Assert.True(agent.DiagnosticsUploadEnabled);
             Assert.Equal("OnFailure", agent.DiagnosticsUploadMode);
             Assert.Single(agent.DiagnosticsLogPaths);
@@ -366,6 +368,33 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(30, agent.HelloWaitTimeoutSeconds);
         }
 
+        [Fact]
+        public void Merge_mirrors_analyzers_realmjoin_watcher_onto_agent_config()
+        {
+            // The diagnostics package gates its RealmJoin sections on this flag but never
+            // sees the remote response — the merger carries the one Analyzers knob over.
+            var agent = NewAgentConfig();
+            var remote = FullRemote();
+            remote.Analyzers = new AnalyzerConfiguration { EnableRealmJoinWatcher = true };
+
+            RemoteConfigMerger.Merge(agent, remote);
+
+            Assert.True(agent.EnableRealmJoinWatcher);
+        }
+
+        [Fact]
+        public void Merge_clears_realmjoin_watcher_when_remote_analyzers_missing()
+        {
+            var agent = NewAgentConfig();
+            agent.EnableRealmJoinWatcher = true;   // stale cached true must not survive
+            var remote = FullRemote();
+            remote.Analyzers = null!;
+
+            RemoteConfigMerger.Merge(agent, remote);
+
+            Assert.False(agent.EnableRealmJoinWatcher);
+        }
+
         [Fact]
         public void Merge_replaces_diagnostics_log_paths_with_empty_list_when_remote_null()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/CmTraceCalibratorFileIsolationTests.cs

@@ -0,0 +1,109 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Pins the per-FILE isolation of the offset measurement across a full read cycle.
+    ///
+    /// <para>
+    /// Background (2026-08-20, session e9753578): the field showed "+02:00 measured for
+    /// IntuneManagementExtension.log" although that file held no +2-era line — the anchor had
+    /// crossed file boundaries. The committed code was proven innocent (this very scenario is
+    /// green here); the leak lived in a binary built from an uncommitted tree. This test keeps
+    /// the property pinned so a real regression of the file scoping can never ship silently
+    /// again — it replays the exact field pass structure: a NEW file appearing mid-run with a
+    /// different writer era than the file already being tailed.
+    /// </para>
+    /// </summary>
+    public sealed class CmTraceCalibratorFileIsolationTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 8, 20, 12, 13, 0, DateTimeKind.Utc);
+
+        private static List<ImeLogPattern> Patterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-MARK", Category = "always", Enabled = true,
+                Pattern = @"marker (?<n>\d+)",
+                Action = "noop",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private static string Line(string message, DateTime utcInstant, TimeSpan writerOffset)
+        {
+            var local = utcInstant + writerOffset;
+            return $"<![LOG[{message}]LOG]!><time=\"{local:HH:mm:ss.fffffff}\" date=\"{local:M-d-yyyy}\" " +
+                   "component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">";
+        }
+
+        [Fact]
+        public async Task NewFileWithOtherEra_MustNotRecalibrateTheOldFile()
+        {
+            var pdt = TimeSpan.FromHours(-7);   // IME service era
+            var cest = TimeSpan.FromHours(2);   // fresh child-process era
+
+            using var tmp = new TempDirectory();
+            var now = T0;
+            var tracker = new ImeLogTracker(
+                logFolder: tmp.Path,
+                patterns: Patterns(),
+                logger: new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            try
+            {
+                tracker.UtcNowProvider = () => now;
+                var imeLog = Path.Combine(tmp.Path, "IntuneManagementExtension.log");
+                var execLog = Path.Combine(tmp.Path, "AgentExecutor.log");
+
+                // Pass 1: IME.log first sight (no calibration).
+                File.AppendAllText(imeLog, Line("marker 1", now, pdt) + Environment.NewLine);
+                await tracker.CheckLogFilesAsync(CancellationToken.None);
+
+                // Pass 2: IME.log grew -> measures -7.
+                now = T0.AddSeconds(10);
+                File.AppendAllText(imeLog, Line("marker 2", now, pdt) + Environment.NewLine);
+                await tracker.CheckLogFilesAsync(CancellationToken.None);
+
+                TimeSpan imeMeasured;
+                Assert.True(tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out imeMeasured));
+                Assert.Equal(pdt, imeMeasured);
+
+                // Pass 3: AgentExecutor.log appears for the FIRST time with fresh +2-era lines
+                // while IME.log grows too — the exact field pass structure. The +2 anchor must
+                // never land under IME.log's key.
+                now = T0.AddSeconds(20);
+                File.AppendAllText(execLog, Line("marker 3", now, cest) + Environment.NewLine);
+                File.AppendAllText(imeLog, Line("marker 4", now, pdt) + Environment.NewLine);
+                await tracker.CheckLogFilesAsync(CancellationToken.None);
+
+                Assert.True(tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out imeMeasured));
+                Assert.Equal(pdt, imeMeasured);
+
+                // Pass 4: both grow — each file measures its own writer's era.
+                now = T0.AddSeconds(30);
+                File.AppendAllText(execLog, Line("marker 5", now, cest) + Environment.NewLine);
+                File.AppendAllText(imeLog, Line("marker 6", now, pdt) + Environment.NewLine);
+                await tracker.CheckLogFilesAsync(CancellationToken.None);
+
+                TimeSpan execMeasured;
+                Assert.True(tracker.OffsetCalibrator.TryGetOffset("AgentExecutor.log", out execMeasured));
+                Assert.Equal(cest, execMeasured);
+                Assert.True(tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out imeMeasured));
+                Assert.Equal(pdt, imeMeasured);
+            }
+            finally
+            {
+                tracker.Dispose();
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerLineAnchoringTests.cs

@@ -0,0 +1,441 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Logging;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Per-line self-anchoring — the era-aware successor to the reverted per-file offset
+    /// application (04b1a7c6).
+    ///
+    /// <para>
+    /// The property under test: a line read in a provably FRESH pass resolves to the instant it
+    /// was written, whatever timezone its writer believed — and neighbouring lines from writers
+    /// with DIFFERENT beliefs each resolve to their own era, because no cross-line state is
+    /// involved. That interleaving (fixture: AgentExecutor.log with PDT and CEST children in one
+    /// file, flipping both ways) is exactly what broke every cross-line anchor design.
+    /// </para>
+    ///
+    /// <para>
+    /// The freshness boundary is equally load-bearing: backlog (first sight, restart catch-up,
+    /// stalled polls) must NEVER anchor, because an old line's age can round onto the 15-minute
+    /// offset grid. Those paths keep the uniform reader-zone fallback.
+    /// </para>
+    /// </summary>
+    public sealed class ImeLogTrackerLineAnchoringTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 8, 20, 12, 13, 0, DateTimeKind.Utc);
+
+        private static List<ImeLogPattern> Patterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-ALL", Category = "always", Enabled = true,
+                Pattern = @"marker (?<n>\d+)",
+                Action = "noop",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        /// <summary>A CMTrace line as a writer holding <paramref name="writerOffset"/> renders instant <paramref name="utcInstant"/>.</summary>
+        private static string Line(string message, DateTime utcInstant, TimeSpan writerOffset)
+        {
+            var local = utcInstant + writerOffset;
+            return $"<![LOG[{message}]LOG]!><time=\"{local:HH:mm:ss.fffffff}\" date=\"{local:M-d-yyyy}\" " +
+                   "component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">";
+        }
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public ImeLogTracker Tracker { get; }
+            public DateTime Now { get; set; } = T0;
+
+            public Harness(string? stateDirectory = null)
+            {
+                Tracker = new ImeLogTracker(
+                    logFolder: _tmp.Path,
+                    patterns: Patterns(),
+                    logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                    stateDirectory: stateDirectory);
+                Tracker.UtcNowProvider = () => Now;
+            }
+
+            public string PathOf(string fileName) => Path.Combine(_tmp.Path, fileName);
+
+            public void Append(string fileName, string line)
+                => File.AppendAllText(PathOf(fileName), line + Environment.NewLine);
+
+            public Task Pass() => Tracker.CheckLogFilesAsync(CancellationToken.None);
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        [Theory]
+        // The writer's belief. A fresh line must resolve to the instant it was written,
+        // WHATEVER that belief is — including agreement with this process (the majority case,
+        // which a fix to the agent's own zone cache would have broken).
+        [InlineData(2)]     // CEST
+        [InlineData(1)]     // BST
+        [InlineData(0)]     // UTC
+        [InlineData(-7)]    // PDT — the OOBE default behind the -9 h and -17 h field cases
+        [InlineData(10)]    // E. Australia
+        public async Task FreshLine_ResolvesToItsTrueInstant_ForAnyWriterBelief(int writerOffsetHours)
+        {
+            var writerOffset = TimeSpan.FromHours(writerOffsetHours);
+            using var h = new Harness();
+
+            // First sight: backlog, must not anchor.
+            h.Append("IntuneManagementExtension.log", Line("marker 1", h.Now, writerOffset));
+            await h.Pass();
+
+            h.Now = T0.AddSeconds(10);
+            var writtenAt = h.Now.AddMilliseconds(-80);   // written just before the poll sees it
+            h.Append("IntuneManagementExtension.log", Line("marker 2", writtenAt, writerOffset));
+            await h.Pass();
+
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h.Tracker.LastMatchedSourceOffsetOrigin);
+            Assert.Equal(writtenAt, h.Tracker.LastMatchedLogTimestamp);
+            Assert.Equal(writerOffsetHours * 60, h.Tracker.LastMatchedSourceOffsetMinutes);
+        }
+
+        [Fact]
+        public async Task InterleavedEras_InOneGrowingPass_EachLineResolvesToItsOwnEra()
+        {
+            // The e9753578 file shape: two writer processes with different zone beliefs
+            // interleaved in ONE file. Any per-file offset gets one of them wrong by 9 h;
+            // per-line anchoring must get both right within the same chunk.
+            var pdt = TimeSpan.FromHours(-7);
+            var cest = TimeSpan.FromHours(2);
+            using var h = new Harness();
+
+            h.Append("AgentExecutor.log", Line("marker 1", h.Now, pdt));
+            await h.Pass();
+
+            h.Now = T0.AddSeconds(10);
+            var wrotePdt = h.Now.AddMilliseconds(-90);
+            var wroteCest = h.Now.AddMilliseconds(-50);
+            h.Append("AgentExecutor.log", Line("marker 2", wrotePdt, pdt));
+            h.Append("AgentExecutor.log", Line("marker 3", wroteCest, cest));
+
+            var resolved = new List<(DateTime? Ts, CmTraceOffsetOrigin Origin, int? Offset)>();
+            Action<string> capture = _ => resolved.Add((
+                h.Tracker.LastMatchedLogTimestamp,
+                h.Tracker.LastMatchedSourceOffsetOrigin,
+                h.Tracker.LastMatchedSourceOffsetMinutes));
+            h.Tracker.OnPatternMatched += capture;
+            try
+            {
+                await h.Pass();
+            }
+            finally
+            {
+                h.Tracker.OnPatternMatched -= capture;
+            }
+
+            Assert.Equal(2, resolved.Count);
+            Assert.Equal(wrotePdt, resolved[0].Ts);
+            Assert.Equal(-420, resolved[0].Offset);
+            Assert.Equal(wroteCest, resolved[1].Ts);
+            Assert.Equal(120, resolved[1].Offset);
+            Assert.All(resolved, r => Assert.Equal(CmTraceOffsetOrigin.LineAnchored, r.Origin));
+        }
+
+        [Fact]
+        public async Task FirstSightBacklog_FallsBackToReaderZone()
+        {
+            using var h = new Harness();
+
+            h.Append("IntuneManagementExtension.log", Line("marker 1", h.Now.AddHours(-3), TimeSpan.FromHours(2)));
+            await h.Pass();
+
+            Assert.Equal(CmTraceOffsetOrigin.None, h.Tracker.LastMatchedSourceOffsetOrigin);
+        }
+
+        [Fact]
+        public async Task FileFirstSeenEmpty_ItsFirstContentIsFresh()
+        {
+            // AgentExecutor.log in the field: the file APPEARS mid-enrollment. Seeing it empty
+            // (or not existing content-wise) counts as an observation, so its very first lines
+            // are provably written between passes and may anchor. This closes the warm-up gap
+            // for exactly the file whose eras flip the most.
+            using var h = new Harness();
+
+            File.WriteAllText(h.PathOf("AgentExecutor.log"), string.Empty);
+            await h.Pass();
+
+            h.Now = T0.AddSeconds(5);
+            var writtenAt = h.Now.AddMilliseconds(-60);
+            h.Append("AgentExecutor.log", Line("marker 1", writtenAt, TimeSpan.FromHours(2)));
+            await h.Pass();
+
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h.Tracker.LastMatchedSourceOffsetOrigin);
+            Assert.Equal(writtenAt, h.Tracker.LastMatchedLogTimestamp);
+        }
+
+        [Fact]
+        public async Task PollGapBeyondFreshWindow_FallsBack()
+        {
+            // A stalled agent (GC, CPU starvation) re-polls after a long gap: the new bytes span
+            // the whole gap and their age is unbounded, so the pass must not anchor — even
+            // though most of its lines may in fact be recent. Conservative by design.
+            using var h = new Harness();
+
+            h.Append("IntuneManagementExtension.log", Line("marker 1", h.Now, TimeSpan.FromHours(2)));
+            await h.Pass();
+            h.Now = T0.AddSeconds(10);
+            h.Append("IntuneManagementExtension.log", Line("marker 2", h.Now, TimeSpan.FromHours(2)));
+            await h.Pass();
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h.Tracker.LastMatchedSourceOffsetOrigin);
+
+            // Gap far beyond FreshLineMaxAge.
+            h.Now = h.Now + ImeLogTracker.FreshLineMaxAge + TimeSpan.FromSeconds(10);
+            h.Append("IntuneManagementExtension.log", Line("marker 3", h.Now, TimeSpan.FromHours(2)));
+            await h.Pass();
+
+            Assert.Equal(CmTraceOffsetOrigin.None, h.Tracker.LastMatchedSourceOffsetOrigin);
+
+            // And the very next tight poll is fresh again.
+            h.Now = h.Now.AddSeconds(1);
+            h.Append("IntuneManagementExtension.log", Line("marker 4", h.Now, TimeSpan.FromHours(2)));
+            await h.Pass();
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h.Tracker.LastMatchedSourceOffsetOrigin);
+        }
+
+        [Fact]
+        public async Task RestartWithRestoredBookmark_FirstPassIsBacklog_SecondPassAnchors()
+        {
+            // The persisted position bookmark survives a restart; the freshness guarantee must
+            // not — the first pass after a restart reads the downtime backlog, whose lines can
+            // be arbitrarily old.
+            using var stateDir = new TempDirectory();
+            using var h = new Harness(stateDirectory: stateDir.Path);
+
+            h.Append("IntuneManagementExtension.log", Line("marker 1", h.Now, TimeSpan.FromHours(2)));
+            await h.Pass();
+            h.Tracker.SaveStateForTest();
+
+            // "Restart": a second tracker over the same folder restores the bookmark.
+            using var h2 = new HarnessOver(h, stateDir.Path);
+            h2.Tracker.LoadStateForTest();
+
+            // Backlog written during the downtime — 30 min old, exactly on the offset grid,
+            // the nastiest possible backlog shape. Must NOT anchor.
+            h2.Now = T0.AddMinutes(30);
+            h2.Append(Line("marker 2", T0.AddSeconds(20), TimeSpan.FromHours(2)));
+            await h2.Pass();
+            Assert.Equal(CmTraceOffsetOrigin.None, h2.Tracker.LastMatchedSourceOffsetOrigin);
+
+            // The next tight poll is fresh again.
+            h2.Now = h2.Now.AddSeconds(1);
+            var writtenAt = h2.Now.AddMilliseconds(-70);
+            h2.Append(Line("marker 3", writtenAt, TimeSpan.FromHours(2)));
+            await h2.Pass();
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h2.Tracker.LastMatchedSourceOffsetOrigin);
+            Assert.Equal(writtenAt, h2.Tracker.LastMatchedLogTimestamp);
+        }
+
+        /// <summary>Second tracker over the FIRST harness's log folder — the "restarted agent".</summary>
+        private sealed class HarnessOver : IDisposable
+        {
+            private readonly string _logFolder;
+            public ImeLogTracker Tracker { get; }
+            public DateTime Now { get; set; }
+
+            public HarnessOver(Harness original, string stateDirectory)
+            {
+                _logFolder = Path.GetDirectoryName(original.PathOf("x"));
+                Tracker = new ImeLogTracker(
+                    logFolder: _logFolder,
+                    patterns: Patterns(),
+                    logger: new AgentLogger(_logFolder, AgentLogLevel.Info),
+                    stateDirectory: stateDirectory);
+                Tracker.UtcNowProvider = () => Now;
+            }
+
+            public void Append(string line)
+                => File.AppendAllText(Path.Combine(_logFolder, "IntuneManagementExtension.log"), line + Environment.NewLine);
+
+            public Task Pass() => Tracker.CheckLogFilesAsync(CancellationToken.None);
+
+            public void Dispose() => Tracker.Dispose();
+        }
+
+        [Fact]
+        public async Task FreshlyWrittenReplayLine_OnExactGridAge_ResolvesToRoughlyNow()
+        {
+            // Characterization of the one accepted edge: a line freshly WRITTEN but carrying a
+            // REPLAYED timestamp whose age is exactly a grid multiple (here 30 min) measures
+            // that age as an "offset" and resolves to ~now instead of its replayed past. The
+            // error is bounded by construction (an anchored line always lands at now ± 2 min),
+            // and sub-24h replays are treated as current by the historic-replay guard anyway.
+            using var h = new Harness();
+
+            h.Append("IntuneManagementExtension.log", Line("marker 1", h.Now, TimeSpan.Zero));
+            await h.Pass();
+
+            h.Now = T0.AddSeconds(10);
+            var replayedInstant = h.Now.AddMinutes(-30);
+            h.Append("IntuneManagementExtension.log", Line("marker 2", replayedInstant, TimeSpan.Zero));
+            await h.Pass();
+
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h.Tracker.LastMatchedSourceOffsetOrigin);
+            Assert.NotNull(h.Tracker.LastMatchedLogTimestamp);
+            var error = (h.Tracker.LastMatchedLogTimestamp!.Value - h.Now).Duration();
+            Assert.True(error <= CmTraceOffsetCalibrator.MaxGridResidual,
+                $"anchored line must resolve to now ± residual, was off by {error}");
+        }
+
+        // =====================================================================
+        // The committed field fixture — session e9753578, ImeLogs/AgentExecutor.log.
+        // One file, two writer eras (PDT hour-05 / CEST hour-14), interleaved, flipping
+        // BOTH ways. Replayed here as the live tail the field agent saw: entry by entry,
+        // with the clock following the true write time.
+        // =====================================================================
+
+        private static string FixturePath()
+        {
+            var dir = AppContext.BaseDirectory;
+            for (int i = 0; i < 12; i++)
+            {
+                if (File.Exists(Path.Combine(dir, "AutopilotMonitor.sln")))
+                    return Path.Combine(dir, "tests", "fixtures", "cmtrace-logs",
+                        "agentexecutor-two-writer-eras-v1.cmtrace");
+                var parent = Directory.GetParent(dir)?.FullName;
+                if (parent == null || parent == dir) break;
+                dir = parent;
+            }
+            throw new DirectoryNotFoundException(
+                "Could not locate repo root (AutopilotMonitor.sln) walking up from " + AppContext.BaseDirectory);
+        }
+
+        /// <summary>Group the fixture's physical lines into complete CMTrace entries (multiline-safe).</summary>
+        private static List<string> FixtureEntries()
+        {
+            var entries = new List<string>();
+            string? pending = null;
+            foreach (var rawWithBom in File.ReadAllLines(FixturePath()))
+            {
+                // The fixture keeps the original file's BOM verbatim — it sat at the START of
+                // the real AgentExecutor.log, which is mid-file in this excerpt.
+                var raw = rawWithBom.TrimStart('');
+                if (pending == null)
+                {
+                    if (raw.Length == 0 || raw[0] == '#') continue;
+                    if (!raw.StartsWith("<![LOG[", StringComparison.Ordinal)) continue;
+                    if (raw.Contains("]LOG]!>")) { entries.Add(raw); continue; }
+                    pending = raw;
+                }
+                else
+                {
+                    pending += "\n" + raw;
+                    if (raw.Contains("]LOG]!>")) { entries.Add(pending!); pending = null; }
+                }
+            }
+            return entries;
+        }
+
+        [Fact]
+        public async Task TwoWriterEraFixture_EveryLineOfBothErasResolvesToItsTrueInstant()
+        {
+            // The committed fixture is a curated, verbatim excerpt of the transition window
+            // (commit policy: anonymized, versioned) — 20 entries covering both eras and the flip.
+            var entries = FixtureEntries();
+            Assert.True(entries.Count >= 15, $"fixture unexpectedly small: {entries.Count} entries");
+
+            using var h = new Harness();
+
+            // Match every fixture entry.
+            h.Tracker.CompilePatterns(new List<ImeLogPattern>
+            {
+                new ImeLogPattern
+                {
+                    PatternId = "T-ANY", Category = "always", Enabled = true,
+                    Pattern = ".+", Action = "noop",
+                    Parameters = new Dictionary<string, string>(),
+                },
+            });
+
+            // The file exists (empty) before its first content — first sight is the observation
+            // baseline, everything after is a fresh tail, exactly like the field.
+            File.WriteAllText(h.PathOf("AgentExecutor.log"), string.Empty);
+            h.Now = new DateTime(2026, 8, 20, 12, 13, 30, DateTimeKind.Utc);
+            await h.Pass();
+
+            var anchored = 0;
+            var resolvedList = new List<(DateTime Resolved, DateTime Expected)>();
+            Action<string> capture = _ =>
+            {
+                if (h.Tracker.LastMatchedSourceOffsetOrigin == CmTraceOffsetOrigin.LineAnchored)
+                    anchored++;
+                if (h.Tracker.LastMatchedLogTimestamp.HasValue && _expectedForCurrentEntry.HasValue)
+                    resolvedList.Add((h.Tracker.LastMatchedLogTimestamp.Value, _expectedForCurrentEntry.Value));
+            };
+            h.Tracker.OnPatternMatched += capture;
+            try
+            {
+                foreach (var entry in entries)
+                {
+                    CmTraceLogEntry? parsed;
+                    Assert.True(CmTraceLogParser.TryParseLine(entry, out parsed), "fixture entry did not parse");
+
+                    // Era by local hour: the fixture holds exactly two eras — PDT (UTC-7) lines
+                    // render at local hour 05, CEST (UTC+2) lines at hour 14 (fixture header).
+                    var eraOffset = parsed.LocalTimestamp.Hour == 14
+                        ? TimeSpan.FromHours(2)
+                        : TimeSpan.FromHours(-7);
+                    var trueUtc = DateTime.SpecifyKind(parsed.LocalTimestamp - eraOffset, DateTimeKind.Utc);
+
+                    // The clock follows the write; never move backwards (interleaved eras are
+                    // written in true-UTC order, but guard against sub-ms jitter).
+                    var readAt = trueUtc.AddMilliseconds(120);
+                    if (readAt > h.Now) h.Now = readAt;
+
+                    // In production the 100 ms poll keeps running through write silences — every
+                    // empty look refreshes the freshness window. The fixture's transition window
+                    // spans multi-minute write gaps, so replay that cadence with one empty poll
+                    // just before each append; without it the NEXT pass would (correctly!)
+                    // classify the gap as a stall and refuse to anchor.
+                    h.Now = h.Now.AddMilliseconds(-100);
+                    await h.Pass();
+                    h.Now = readAt;
+
+                    _expectedForCurrentEntry = trueUtc;
+                    File.AppendAllText(h.PathOf("AgentExecutor.log"), entry + Environment.NewLine);
+                    await h.Pass();
+                    _expectedForCurrentEntry = null;
+                }
+            }
+            finally
+            {
+                h.Tracker.OnPatternMatched -= capture;
+            }
+
+            // Every matched entry resolved to the instant its writer rendered — across BOTH
+            // eras, including the flips. This is the exact property whose absence produced the
+            // -9 h script durations.
+            Assert.Equal(entries.Count, resolvedList.Count);
+            Assert.All(resolvedList, r => Assert.Equal(r.Expected, r.Resolved));
+            Assert.True(anchored == resolvedList.Count,
+                $"expected every entry line-anchored, got {anchored}/{resolvedList.Count}");
+
+            // Both eras genuinely exercised: PDT entries render at local hour 05, CEST at 14.
+            Assert.Contains(resolvedList, r => (r.Expected + TimeSpan.FromHours(-7)).Hour == 5);
+            Assert.Contains(resolvedList, r => (r.Expected + TimeSpan.FromHours(2)).Hour == 14);
+        }
+
+        private DateTime? _expectedForCurrentEntry;
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOffsetCalibrationTests.cs

@@ -80,36 +80,33 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         }
 
         [Theory]
-        // The writer's belief. Whatever it is, a line written at T must come back as T.
-        [InlineData(2)]     // CEST — the bfff9b1c writer, while the agent still believed BST
-        [InlineData(1)]     // BST — writer and a UK-defaulted agent agreeing
-        [InlineData(-7)]    // PDT — the OOBE default behind the -17 h sessions
+        // The writer's belief. The MEASUREMENT must recover it exactly, whatever it is.
+        [InlineData(2)]     // CEST
+        [InlineData(1)]     // BST
+        [InlineData(-7)]    // PDT — the OOBE default behind the -17 h and -9 h field cases
         [InlineData(10)]    // E. Australia
         [InlineData(0)]     // UTC
-        public async Task ResolvesLineToTheInstantItWasWritten_ForAnyWriterBelief(int writerOffsetHours)
+        public async Task MeasuresTheWritersOffsetExactly_ForAnyBelief(int writerOffsetHours)
         {
+            // NOTE: the per-FILE measurement asserted here is OBSERVATIONAL — its application was
+            // reverted on 2026-08-20 (04b1a7c6) because one offset per file is wrong when a file
+            // holds interleaved writer eras. Resolution now anchors per LINE instead (see
+            // ImeLogTrackerLineAnchoringTests, which restores the "a line written at T resolves
+            // to T" property era-safely). The per-file measurement stays for the Info log and
+            // measuredWriterOffsetMinutes provenance.
             var writerOffset = TimeSpan.FromHours(writerOffsetHours);
             using var h = new Harness();
 
-            // Pass 1 — first sight of the file. Its content may be arbitrarily old, so nothing is
-            // calibrated from it.
             h.Append(Line("marker 1", h.Now, writerOffset));
             await h.Pass();
 
-            // Pass 2 — the file has grown against a size we already observed, so this line was
-            // written within a poll interval and is a valid anchor.
             h.Now = T0.AddSeconds(10);
             h.Append(Line("marker 2", h.Now, writerOffset));
             await h.Pass();
 
-            // Pass 3 — resolved with the measured offset.
-            h.Now = T0.AddSeconds(20);
-            var writtenAt = h.Now;
-            h.Append(Line("marker 3", writtenAt, writerOffset));
-            await h.Pass();
-
-            Assert.True(h.Tracker.LastMatchedLogTimestamp.HasValue);
-            Assert.Equal(writtenAt, h.Tracker.LastMatchedLogTimestamp.Value);
+            TimeSpan measured;
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset(LogFileName, out measured));
+            Assert.Equal(writerOffset, measured);
         }
 
         [Fact]
@@ -175,8 +172,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             TimeSpan after;
             Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset(LogFileName, out after));
             Assert.Equal(TimeSpan.FromHours(2), after);
-            Assert.True(h.Tracker.LastMatchedLogTimestamp.HasValue);
-            Assert.Equal(writtenAt, h.Tracker.LastMatchedLogTimestamp.Value);
+            // The measurement follows the restart. Applying it is what the 2026-08-20 revert
+            // removed — that is exactly the case a file with two writer eras breaks.
+            Assert.Equal(120, h.Tracker.LastMatchedMeasuredWriterOffsetMinutes);
         }
 
         [Fact]
@@ -204,12 +202,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         }
 
         [Fact]
-        public async Task RecordsProvenance_ForACalibratedLine()
+        public async Task RecordsMeasuredOffsetSeparatelyFromTheAppliedOne()
         {
-            // P8: what the writer wrote, what we subtracted, and how we knew — the evidence that
-            // makes a stored timestamp recomputable without the diagnostics archive.
+            // The regression that forced the revert shipped an event tagged "calibrated" while
+            // carrying an offset that did not hold for that line. Measured and applied are now
+            // separate fields so a future reader cannot mistake one for the other.
             using var h = new Harness();
-            var writerOffset = TimeSpan.FromHours(-7);   // PST/PDT, the OOBE default
+            var writerOffset = TimeSpan.FromHours(-7);   // PDT, the OOBE default
 
             h.Append(Line("marker 1", h.Now, writerOffset));
             await h.Pass();
@@ -219,18 +218,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             await h.Pass();
 
             h.Now = T0.AddSeconds(20);
-            var writtenAt = h.Now;
-            h.Append(Line("marker 3", writtenAt, writerOffset));
+            h.Append(Line("marker 3", h.Now, writerOffset));
             await h.Pass();
 
-            Assert.Equal(CmTraceOffsetOrigin.Calibrated, h.Tracker.LastMatchedSourceOffsetOrigin);
-            Assert.Equal(-420, h.Tracker.LastMatchedSourceOffsetMinutes);
-            Assert.True(h.Tracker.LastMatchedSourceLocalTimestamp.HasValue);
+            // Measured: the writer's actual belief, per file.
+            Assert.Equal(-420, h.Tracker.LastMatchedMeasuredWriterOffsetMinutes);
 
-            // The raw local value is kept verbatim, with no zone attached — attaching one would
-            // re-introduce exactly the assumption this change removes.
-            Assert.Equal(writtenAt + writerOffset, h.Tracker.LastMatchedSourceLocalTimestamp.Value);
-            Assert.Equal(DateTimeKind.Unspecified, h.Tracker.LastMatchedSourceLocalTimestamp.Value.Kind);
+            // Applied: the line's OWN anchor (fresh pass), never the per-file "calibrated" value —
+            // the two must stay distinguishable even when they agree numerically.
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, h.Tracker.LastMatchedSourceOffsetOrigin);
+            Assert.NotEqual(CmTraceOffsetOrigin.Calibrated, h.Tracker.LastMatchedSourceOffsetOrigin);
         }
 
         [Fact]
@@ -244,8 +241,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             await h.Pass();
 
             Assert.Equal(CmTraceOffsetOrigin.None, h.Tracker.LastMatchedSourceOffsetOrigin);
-            Assert.Null(h.Tracker.LastMatchedSourceOffsetMinutes);
             Assert.True(h.Tracker.LastMatchedSourceLocalTimestamp.HasValue);
+
+            // The APPLIED offset is reported even on the fallback path — an event that states no
+            // offset at all cannot be recomputed later, which defeats the purpose of recording
+            // provenance. Asserted against the running machine's zone so this stays portable.
+            var readerZone = (int)TimeZoneInfo.Local
+                .GetUtcOffset(h.Tracker.LastMatchedSourceLocalTimestamp!.Value).TotalMinutes;
+            Assert.Equal(readerZone, h.Tracker.LastMatchedSourceOffsetMinutes);
         }
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/DiagnosticsPackageServiceTests.cs

@@ -1,9 +1,11 @@
 #nullable enable
+using System.Collections.Generic;
 using System.IO;
 using System.IO.Compression;
 using System.Linq;
 using System.Text;
 using AutopilotMonitor.Agent.V2.Core.Configuration;
+using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
@@ -46,7 +48,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
                 Directory.CreateDirectory(SpoolFolder);
             }
 
-            public DiagnosticsPackageService Build(System.Action<AgentConfiguration>? mutateConfig = null)
+            public DiagnosticsPackageService Build(
+                System.Action<AgentConfiguration>? mutateConfig = null,
+                IReadOnlyDictionary<string, string>? sectionFolderOverrides = null,
+                System.Func<bool>? devicePreparationProbe = null)
             {
                 // BackendApiClient is required by the public ctor but BuildArchiveBytes
                 // never touches it — construct with a throwaway HttpClient. Tests only
@@ -71,7 +76,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
                     imeLogFolderOverride: ImeTmp.Path,
                     agentStateFolderOverride: StateFolder,
                     agentSpoolFolderOverride: SpoolFolder,
-                    agentDataFolderOverride: DataFolder);
+                    agentDataFolderOverride: DataFolder,
+                    sectionFolderOverrides: sectionFolderOverrides,
+                    devicePreparationProbe: devicePreparationProbe);
             }
 
             public void Dispose()
@@ -287,6 +294,185 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
             Assert.DoesNotContain(entries, e => e.StartsWith("AgentSpool/"));
         }
 
+        // ===================================================== built-in catalog gates ====
+        // The RealmJoin sections ride behind the tenant's RealmJoin Watcher toggle, the
+        // Device Preparation bootstrapper event log behind the deterministic WDP marker.
+        // Every conditional section is skipped WITH a manifest line, never silently.
+
+        /// <summary>RealmJoin system-side folders redirected to temp (user-side goes via UserProfileResolver).</summary>
+        private sealed class RealmJoinRig : System.IDisposable
+        {
+            public TempDirectory WindowsLogs { get; } = new TempDirectory();
+            public TempDirectory Choco { get; } = new TempDirectory();
+            public TempDirectory UserProfile { get; } = new TempDirectory();
+            public string PackagesFolder => Path.Combine(WindowsLogs.Path, "RealmJoin");
+
+            public RealmJoinRig()
+            {
+                File.WriteAllText(Path.Combine(WindowsLogs.Path, "realmjoin.log"), "rj");
+                File.WriteAllText(Path.Combine(WindowsLogs.Path, "realmjoin2.log"), "rj2");
+                var pkg = Path.Combine(PackagesFolder, "Packages", "generic-7zip");
+                Directory.CreateDirectory(pkg);
+                File.WriteAllText(Path.Combine(pkg, "install.log"), "pkg");
+                var choco = Path.Combine(Choco.Path, "generic-7zip");
+                Directory.CreateDirectory(choco);
+                File.WriteAllText(Path.Combine(choco, "2026-06-30_install.log"), "choco");
+                var userRj = Path.Combine(UserProfile.Path, "AppData", "Local", "RealmJoin");
+                Directory.CreateDirectory(Path.Combine(userRj, "Logs", "generic-office"));
+                File.WriteAllText(Path.Combine(userRj, "tray.log"), "tray");
+                File.WriteAllText(Path.Combine(userRj, "config.pjson"), "not a log");
+                File.WriteAllText(Path.Combine(userRj, "Logs", "RjImeHost.log"), "host");
+                File.WriteAllText(Path.Combine(userRj, "Logs", "generic-office", "usersettings.log"), "pkg-user");
+            }
+
+            public IReadOnlyDictionary<string, string> Overrides => new Dictionary<string, string>
+            {
+                ["RealmJoinWindows"] = WindowsLogs.Path,
+                ["RealmJoinPackages"] = PackagesFolder,
+                ["RealmJoinChoco"] = Choco.Path,
+            };
+
+            public void Dispose()
+            {
+                WindowsLogs.Dispose();
+                Choco.Dispose();
+                UserProfile.Dispose();
+            }
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_skips_realmjoin_sections_when_watcher_disabled()
+        {
+            using var rig = new Rig();
+            using var rj = new RealmJoinRig();
+            UserProfileResolver.SetForTesting(rj.UserProfile.Path);
+            try
+            {
+                var bytes = rig.Build(sectionFolderOverrides: rj.Overrides).BuildArchiveBytes(enrollmentSucceeded: true);
+
+                var entries = ZipEntryNames(bytes);
+                Assert.DoesNotContain(entries, e => e.StartsWith("RealmJoinLogs/"));
+                var manifest = ReadZipEntryText(bytes, "package-manifest.txt")!;
+                Assert.Contains("SCENARIO: devicePreparation=False realmJoinWatcher=False", manifest);
+                Assert.Contains("BUILT-IN SKIPPED (RealmJoin Watcher disabled): RealmJoinWindows", manifest);
+                Assert.Contains("BUILT-IN SKIPPED (RealmJoin Watcher disabled): RealmJoinUserLogs", manifest);
+            }
+            finally
+            {
+                UserProfileResolver.Reset();
+            }
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_includes_realmjoin_sections_when_watcher_enabled()
+        {
+            using var rig = new Rig();
+            using var rj = new RealmJoinRig();
+            UserProfileResolver.SetForTesting(rj.UserProfile.Path);
+            try
+            {
+                var bytes = rig.Build(cfg => cfg.EnableRealmJoinWatcher = true, rj.Overrides)
+                    .BuildArchiveBytes(enrollmentSucceeded: false);
+
+                var entries = ZipEntryNames(bytes);
+                // ZIP layout mirrors the disk layout: flat client logs + package tree under
+                // Windows/, tray logs + per-user Logs tree under User/.
+                Assert.Contains("RealmJoinLogs/Windows/realmjoin.log", entries);
+                Assert.Contains("RealmJoinLogs/Windows/realmjoin2.log", entries);
+                Assert.Contains("RealmJoinLogs/Windows/RealmJoin/Packages/generic-7zip/install.log", entries);
+                Assert.Contains("RealmJoinLogs/Choco/generic-7zip/2026-06-30_install.log", entries);
+                Assert.Contains("RealmJoinLogs/User/tray.log", entries);
+                Assert.Contains("RealmJoinLogs/User/Logs/RjImeHost.log", entries);
+                Assert.Contains("RealmJoinLogs/User/Logs/generic-office/usersettings.log", entries);
+                // Only tray*.log is collected from the user RealmJoin root — config stays out.
+                Assert.DoesNotContain(entries, e => e.EndsWith("config.pjson"));
+                var manifest = ReadZipEntryText(bytes, "package-manifest.txt")!;
+                Assert.Contains("BUILT-IN: RealmJoinUserLogs -> folder=", manifest);
+                Assert.DoesNotContain("BUILT-IN SKIPPED (RealmJoin Watcher disabled)", manifest);
+            }
+            finally
+            {
+                UserProfileResolver.Reset();
+            }
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_skips_realmjoin_user_sections_without_user_session()
+        {
+            using var rig = new Rig();
+            using var rj = new RealmJoinRig();
+            // Token present, no interactive user detected → user-profile sections skip with a
+            // manifest line; the system-side sections are unaffected.
+            UserProfileResolver.SetForTesting(null!);
+            try
+            {
+                var bytes = rig.Build(cfg => cfg.EnableRealmJoinWatcher = true, rj.Overrides)
+                    .BuildArchiveBytes(enrollmentSucceeded: true);
+
+                var entries = ZipEntryNames(bytes);
+                Assert.Contains("RealmJoinLogs/Windows/realmjoin.log", entries);
+                Assert.DoesNotContain(entries, e => e.StartsWith("RealmJoinLogs/User"));
+                var manifest = ReadZipEntryText(bytes, "package-manifest.txt")!;
+                Assert.Contains("BUILT-IN SKIPPED (no user session for token): RealmJoinUserTray", manifest);
+                Assert.Contains("BUILT-IN SKIPPED (no user session for token): RealmJoinUserLogs", manifest);
+            }
+            finally
+            {
+                UserProfileResolver.Reset();
+            }
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_collects_bootstrapper_event_log_only_on_device_preparation()
+        {
+            using var rig = new Rig();
+            using var winevt = new TempDirectory();
+            // Synthetic evtx: no registered channel claims the file, so the export falls
+            // back to a raw copy — the point here is the scenario gate, not wevtutil.
+            File.WriteAllBytes(Path.Combine(winevt.Path, "BootstrapperAgentServiceLogProvider.evtx"), new byte[] { 1, 2, 3 });
+            var overrides = new Dictionary<string, string> { ["ImeBootstrapperEventLog"] = winevt.Path };
+
+            var classic = rig.Build(sectionFolderOverrides: overrides, devicePreparationProbe: () => false)
+                .BuildArchiveBytes(enrollmentSucceeded: true);
+            Assert.DoesNotContain("ImeLogs/BootstrapperAgentServiceLogProvider.evtx", ZipEntryNames(classic));
+            Assert.Contains("BUILT-IN SKIPPED (not a Device Preparation enrollment): ImeBootstrapperEventLog",
+                ReadZipEntryText(classic, "package-manifest.txt"));
+
+            var wdp = rig.Build(sectionFolderOverrides: overrides, devicePreparationProbe: () => true)
+                .BuildArchiveBytes(enrollmentSucceeded: true);
+            Assert.Contains("ImeLogs/BootstrapperAgentServiceLogProvider.evtx", ZipEntryNames(wdp));
+            Assert.Contains("SCENARIO: devicePreparation=True", ReadZipEntryText(wdp, "package-manifest.txt"));
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_treats_failing_device_preparation_probe_as_classic()
+        {
+            using var rig = new Rig();
+            var bytes = rig.Build(devicePreparationProbe: () => throw new System.InvalidOperationException("registry boom"))
+                .BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var manifest = ReadZipEntryText(bytes, "package-manifest.txt")!;
+            Assert.Contains("SCENARIO PROBE FAILED (treated as Classic): registry boom", manifest);
+            Assert.Contains("BUILT-IN SKIPPED (not a Device Preparation enrollment): ImeBootstrapperEventLog", manifest);
+            Assert.Contains("sessioninfo.txt", ZipEntryNames(bytes)); // archive still built
+        }
+
+        [Theory]
+        [InlineData(DiagnosticsSectionCondition.Always, false, false, true)]
+        [InlineData(DiagnosticsSectionCondition.RealmJoinWatcher, false, true, false)]
+        [InlineData(DiagnosticsSectionCondition.RealmJoinWatcher, true, false, true)]
+        [InlineData(DiagnosticsSectionCondition.DevicePreparation, true, false, false)]
+        [InlineData(DiagnosticsSectionCondition.DevicePreparation, false, true, true)]
+        [InlineData((DiagnosticsSectionCondition)999, true, true, false)]
+        public void IsSectionActive_gates_on_condition(DiagnosticsSectionCondition condition, bool watcher, bool wdp, bool expected)
+        {
+            var section = new DiagnosticsBuiltInSection("X", "X", @"C:\X", new[] { "*.log" }, false, "x", condition);
+            var cfg = Cfg();
+            cfg.EnableRealmJoinWatcher = watcher;
+
+            Assert.Equal(expected, DiagnosticsPackageService.IsSectionActive(section, cfg, wdp));
+        }
+
         private static string[] ZipEntryNames(byte[] zipBytes)
         {
             using var ms = new MemoryStream(zipBytes);

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/PowerStateTransitionTrackerTests.cs

@@ -0,0 +1,258 @@
+#nullable enable
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Runtime;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// Pure state machine behind the power watcher: AC↔battery edges, the 50/30/15 threshold
+    /// ladder (latch once per lifetime, lowest-crossed-only on multi-level jumps, baseline
+    /// coverage for sessions starting low), null-percent tolerance and the storm cap.
+    /// </summary>
+    public sealed class PowerStateTransitionTrackerTests
+    {
+        private static PowerStateResult Ac(int? percent = 80, bool charging = true) => new PowerStateResult
+        {
+            OnAcPower = true,
+            HasBattery = true,
+            BatteryPercent = percent,
+            IsCharging = charging,
+            BatteryLifeMinutes = null,
+        };
+
+        private static PowerStateResult Battery(int? percent, int? lifeMinutes = 90) => new PowerStateResult
+        {
+            OnAcPower = false,
+            HasBattery = true,
+            BatteryPercent = percent,
+            IsCharging = false,
+            BatteryLifeMinutes = lifeMinutes,
+        };
+
+        [Fact]
+        public void Baseline_on_ac_is_silent()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            Assert.Empty(tracker.Baseline(Ac()));
+        }
+
+        [Fact]
+        public void Baseline_without_battery_or_with_probe_error_is_silent()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            Assert.Empty(tracker.Baseline(new PowerStateResult { OnAcPower = true, HasBattery = false }));
+            Assert.Empty(tracker.Baseline(new PowerStateResult { ProbeError = "boom" }));
+        }
+
+        [Fact]
+        public void Baseline_on_battery_above_ladder_is_silent()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            Assert.Empty(tracker.Baseline(Battery(80)));
+        }
+
+        [Fact]
+        public void Baseline_at_12_percent_emits_exactly_the_15_threshold()
+        {
+            var tracker = new PowerStateTransitionTracker();
+
+            var emissions = tracker.Baseline(Battery(12));
+
+            var e = Assert.Single(emissions);
+            Assert.Equal(PowerStateTransitionTracker.TransitionThresholdCrossed, e.Transition);
+            Assert.Equal(15, e.ThresholdPercent);
+            Assert.Equal(12, e.BatteryPercent);
+            Assert.Equal(EventSeverity.Error, e.Severity);
+            Assert.True(e.ImmediateUpload);
+        }
+
+        [Fact]
+        public void Baseline_at_25_percent_emits_30_and_latches_50()
+        {
+            var tracker = new PowerStateTransitionTracker();
+
+            var baseline = tracker.Baseline(Battery(25));
+            var e = Assert.Single(baseline);
+            Assert.Equal(30, e.ThresholdPercent);
+            Assert.Equal(EventSeverity.Warning, e.Severity);
+            Assert.True(e.ImmediateUpload);
+
+            // 50 and 30 are latched by the baseline; draining to 40% stays silent, 14% emits 15.
+            Assert.Empty(tracker.Evaluate(Battery(40)));
+            var next = Assert.Single(tracker.Evaluate(Battery(14)));
+            Assert.Equal(15, next.ThresholdPercent);
+        }
+
+        [Fact]
+        public void Ac_to_battery_emits_warning_with_immediate_upload()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Ac(63));
+
+            var e = Assert.Single(tracker.Evaluate(Battery(63)));
+
+            Assert.Equal(PowerStateTransitionTracker.TransitionAcToBattery, e.Transition);
+            Assert.Null(e.ThresholdPercent);
+            Assert.Equal(EventSeverity.Warning, e.Severity);
+            Assert.True(e.ImmediateUpload);
+            Assert.False(e.OnAcPower);
+            Assert.Equal(63, e.BatteryPercent);
+        }
+
+        [Fact]
+        public void Battery_to_ac_emits_info_without_immediate_upload()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Battery(70));
+
+            var e = Assert.Single(tracker.Evaluate(Ac(70)));
+
+            Assert.Equal(PowerStateTransitionTracker.TransitionBatteryToAc, e.Transition);
+            Assert.Equal(EventSeverity.Info, e.Severity);
+            Assert.False(e.ImmediateUpload);
+        }
+
+        [Fact]
+        public void No_diff_stays_silent()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Ac());
+
+            Assert.Empty(tracker.Evaluate(Ac()));
+            Assert.Empty(tracker.Evaluate(Ac(79)));
+        }
+
+        [Fact]
+        public void Unplug_below_threshold_emits_transition_and_threshold_together()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Ac(10));
+
+            var emissions = tracker.Evaluate(Battery(10));
+
+            Assert.Equal(2, emissions.Count);
+            Assert.Equal(PowerStateTransitionTracker.TransitionAcToBattery, emissions[0].Transition);
+            Assert.Equal(PowerStateTransitionTracker.TransitionThresholdCrossed, emissions[1].Transition);
+            Assert.Equal(15, emissions[1].ThresholdPercent);
+        }
+
+        [Fact]
+        public void Multi_level_drop_emits_lowest_crossed_level_only()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Battery(60));
+
+            var e = Assert.Single(tracker.Evaluate(Battery(10)));
+
+            Assert.Equal(15, e.ThresholdPercent);
+            // All levels are latched — recovering and re-draining emits nothing more.
+            tracker.Evaluate(Ac(90));
+            Assert.Single(tracker.Evaluate(Battery(45)), x => x.Transition == PowerStateTransitionTracker.TransitionAcToBattery);
+            Assert.Empty(tracker.Evaluate(Battery(13)));
+        }
+
+        [Fact]
+        public void Each_level_latches_once_per_lifetime()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Battery(70));
+
+            Assert.Single(tracker.Evaluate(Battery(48))); // 50
+            Assert.Empty(tracker.Evaluate(Battery(47)));  // still inside 50, no re-emit
+            Assert.Single(tracker.Evaluate(Battery(29))); // 30
+            Assert.Single(tracker.Evaluate(Battery(15))); // 15 (boundary: <= level)
+            Assert.Empty(tracker.Evaluate(Battery(5)));   // ladder exhausted
+        }
+
+        [Fact]
+        public void Threshold_severity_ladder_is_info_warning_error()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Battery(70));
+
+            var fifty = Assert.Single(tracker.Evaluate(Battery(50)));
+            Assert.Equal(EventSeverity.Info, fifty.Severity);
+            Assert.False(fifty.ImmediateUpload);
+
+            var thirty = Assert.Single(tracker.Evaluate(Battery(30)));
+            Assert.Equal(EventSeverity.Warning, thirty.Severity);
+            Assert.True(thirty.ImmediateUpload);
+
+            var fifteen = Assert.Single(tracker.Evaluate(Battery(15)));
+            Assert.Equal(EventSeverity.Error, fifteen.Severity);
+            Assert.True(fifteen.ImmediateUpload);
+        }
+
+        [Fact]
+        public void Null_battery_percent_skips_thresholds_but_ac_diff_still_works()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Ac(null));
+
+            var e = Assert.Single(tracker.Evaluate(Battery(null, lifeMinutes: null)));
+
+            Assert.Equal(PowerStateTransitionTracker.TransitionAcToBattery, e.Transition);
+            Assert.Null(e.BatteryPercent);
+            Assert.Contains("battery level unknown", e.Message);
+            Assert.Empty(tracker.Evaluate(Battery(null, lifeMinutes: null)));
+        }
+
+        [Fact]
+        public void Probe_error_mid_run_preserves_state()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Ac());
+
+            Assert.Empty(tracker.Evaluate(new PowerStateResult { ProbeError = "transient" }));
+            // State was not corrupted by the error — the real transition still diffs cleanly.
+            Assert.Single(tracker.Evaluate(Battery(60)));
+        }
+
+        [Fact]
+        public void Evaluate_without_baseline_latches_like_a_baseline()
+        {
+            var tracker = new PowerStateTransitionTracker();
+
+            var e = Assert.Single(tracker.Evaluate(Battery(12)));
+
+            // No phantom ac_to_battery from the implicit default state — only the threshold.
+            Assert.Equal(PowerStateTransitionTracker.TransitionThresholdCrossed, e.Transition);
+        }
+
+        [Fact]
+        public void Emission_cap_suppresses_and_flips_flag_once()
+        {
+            var tracker = new PowerStateTransitionTracker(maxEmissions: 4);
+            tracker.Baseline(Ac());
+
+            // Flapping power source: each edge is one emission.
+            for (var i = 0; i < 2; i++)
+            {
+                Assert.Single(tracker.Evaluate(Battery(80)));
+                Assert.Single(tracker.Evaluate(Ac(80)));
+            }
+            Assert.False(tracker.EmissionCapReached);
+
+            Assert.Empty(tracker.Evaluate(Battery(80)));
+            Assert.True(tracker.EmissionCapReached);
+            Assert.Empty(tracker.Evaluate(Ac(80)));
+        }
+
+        [Fact]
+        public void Message_carries_percent_and_transition_context()
+        {
+            var tracker = new PowerStateTransitionTracker();
+            tracker.Baseline(Ac(62));
+
+            var toBattery = Assert.Single(tracker.Evaluate(Battery(62)));
+            Assert.Contains("AC to battery", toBattery.Message);
+            Assert.Contains("battery 62%", toBattery.Message);
+
+            var backToAc = Assert.Single(tracker.Evaluate(Ac(63)));
+            Assert.Contains("back to AC", backToAc.Message);
+            Assert.Contains("charging", backToAc.Message);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/SystemTimelineTrackerTests.cs

@@ -0,0 +1,429 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// SystemTimelineTracker — clock steps (Kernel-General 1) and completed sleep episodes
+    /// (Power-Troubleshooter 1 / Kernel-Power 507) from the System channel. Drives the primitive
+    /// <see cref="SystemTimelineTracker.ProcessEvent"/> test seam (no real EventRecord, which is
+    /// abstract + Windows-only), mirroring the WindowsUpdateTracker test pattern.
+    /// </summary>
+    public sealed class SystemTimelineTrackerTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 8, 21, 10, 0, 0, DateTimeKind.Utc);
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink;
+        private readonly SystemTimelineTracker _tracker;
+        private long _nextRecordId = 1;
+
+        public SystemTimelineTrackerTests()
+        {
+            _sink = new FakeSignalIngressSink();
+            var post = new InformationalEventPost(_sink, new VirtualClock(At));
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _tracker = new SystemTimelineTracker(
+                sessionId: "sess-stl",
+                tenantId: "tenant-stl",
+                post: post,
+                logger: logger,
+                backfillEnabled: false,
+                stateDirectory: null); // in-memory dedup for most tests
+        }
+
+        public void Dispose() => _tmp.Dispose();
+
+        // -------------------------------------------------------------------
+        // Emission helpers
+        // -------------------------------------------------------------------
+
+        private void EmitClockChange(
+            DateTime? oldTime, DateTime? newTime, string? rawDeltaMs = null,
+            int reason = 1, long? recordId = null, bool isBackfill = false, DateTime? timeCreatedUtc = null)
+        {
+            var data = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (oldTime.HasValue) data["OldTime"] = oldTime.Value.ToString("o");
+            if (newTime.HasValue) data["NewTime"] = newTime.Value.ToString("o");
+            if (rawDeltaMs != null) data["TimeDeltaInMs"] = rawDeltaMs;
+            data["Reason"] = reason.ToString();
+            data["ProcessName"] = @"\Device\HarddiskVolume3\Windows\System32\svchost.exe";
+            data["ProcessID"] = "6892";
+
+            _tracker.ProcessEvent(
+                providerName: SystemTimelineTracker.ProviderKernelGeneral,
+                eventId: SystemTimelineTracker.EventId_ClockChange,
+                recordId: recordId ?? _nextRecordId++,
+                timeCreatedUtc: timeCreatedUtc ?? At,
+                eventData: data,
+                isBackfill: isBackfill);
+        }
+
+        private void EmitClassicResume(
+            DateTime sleepTime, DateTime wakeTime, string? effectiveState = "1",
+            string? wakeSourceText = null, long? recordId = null, bool isBackfill = false, DateTime? timeCreatedUtc = null)
+        {
+            var data = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["SleepTime"] = sleepTime.ToString("o"),
+                ["WakeTime"] = wakeTime.ToString("o"),
+                ["WakeSourceType"] = "0",
+            };
+            if (effectiveState != null) data["EffectiveState"] = effectiveState;
+            if (wakeSourceText != null) data["WakeSourceText"] = wakeSourceText;
+
+            _tracker.ProcessEvent(
+                providerName: SystemTimelineTracker.ProviderPowerTroubleshooter,
+                eventId: SystemTimelineTracker.EventId_ClassicResume,
+                recordId: recordId ?? _nextRecordId++,
+                timeCreatedUtc: timeCreatedUtc ?? wakeTime,
+                eventData: data,
+                isBackfill: isBackfill);
+        }
+
+        private void EmitModernStandbyExit(
+            long sleepDurationUs, long durationUs, string powerStateAc = "true",
+            long? recordId = null, bool isBackfill = false, DateTime? timeCreatedUtc = null)
+        {
+            var data = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["SleepDurationInUs"] = sleepDurationUs.ToString(),
+                ["DurationInUs"] = durationUs.ToString(),
+                ["Reason"] = "32",
+                ["PowerStateAc"] = powerStateAc,
+                ["BatteryRemainingCapacityOnExit"] = "34180",
+            };
+
+            _tracker.ProcessEvent(
+                providerName: SystemTimelineTracker.ProviderKernelPower,
+                eventId: SystemTimelineTracker.EventId_ModernStandbyExit,
+                recordId: recordId ?? _nextRecordId++,
+                timeCreatedUtc: timeCreatedUtc ?? At,
+                eventData: data,
+                isBackfill: isBackfill);
+        }
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> ByType(string eventType) =>
+            _sink.Posted.Where(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == eventType).ToList();
+
+        private static IReadOnlyDictionary<string, object> Data(FakeSignalIngressSink.PostedSignal s) =>
+            (IReadOnlyDictionary<string, object>)s.TypedPayload!;
+
+        // -------------------------------------------------------------------
+        // system_clock_changed
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void ClockStep_AboveThreshold_EmitsInfo_WithSignedDeltaAndNormalizedTimes()
+        {
+            var oldTime = At;
+            var newTime = At.AddSeconds(10);
+            EmitClockChange(oldTime, newTime, reason: 1);
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemClockChanged));
+            Assert.Equal("Info", s.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("false", s.Payload![SignalPayloadKeys.ImmediateUpload]);
+
+            var data = Data(s);
+            Assert.Equal(10_000L, data["timeDeltaMs"]);
+            Assert.Equal("application_set", data["reasonText"]);
+            Assert.Equal(1, data["reason"]);
+            Assert.Equal(oldTime.ToString("o"), data["oldTime"]);
+            Assert.Equal(newTime.ToString("o"), data["newTime"]);
+            Assert.Equal(6892, data["processId"]);
+            Assert.Contains("forward", (string)s.Payload![SignalPayloadKeys.Message]);
+            Assert.Contains("svchost.exe", (string)s.Payload![SignalPayloadKeys.Message]);
+        }
+
+        [Theory]
+        [InlineData(1)]
+        [InlineData(1999)]
+        public void ClockMicroStep_BelowThreshold_Suppressed(int deltaMs)
+        {
+            EmitClockChange(At, At.AddMilliseconds(deltaMs));
+            Assert.Empty(ByType(Constants.EventTypes.SystemClockChanged));
+        }
+
+        [Fact]
+        public void ClockStep_Backward_EmitsNegativeDelta()
+        {
+            EmitClockChange(oldTime: At, newTime: At.AddSeconds(-3));
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemClockChanged));
+            Assert.Equal(-3000L, Data(s)["timeDeltaMs"]);
+            Assert.Contains("backward", (string)s.Payload![SignalPayloadKeys.Message]);
+        }
+
+        [Fact]
+        public void ClockStep_AtLeastFiveMinutes_WarningAndImmediateUpload()
+        {
+            EmitClockChange(At, At.AddMinutes(5), reason: 2);
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemClockChanged));
+            Assert.Equal("Warning", s.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("true", s.Payload![SignalPayloadKeys.ImmediateUpload]);
+            Assert.Equal("hardware_clock_sync", Data(s)["reasonText"]);
+        }
+
+        [Fact]
+        public void ClockStep_NoUsableTimesOrDelta_Skipped()
+        {
+            EmitClockChange(oldTime: null, newTime: null, rawDeltaMs: "not-a-number");
+            Assert.Empty(ByType(Constants.EventTypes.SystemClockChanged));
+        }
+
+        [Fact]
+        public void ClockStep_FallsBackToTimeDeltaInMs_WhenTimesUnparseable()
+        {
+            // Only the raw delta parses — the direction information of NewTime/OldTime is gone,
+            // but the magnitude still gates and emits.
+            EmitClockChange(oldTime: null, newTime: null, rawDeltaMs: "7200000");
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemClockChanged));
+            Assert.Equal(7_200_000L, Data(s)["timeDeltaMs"]);
+        }
+
+        // -------------------------------------------------------------------
+        // system_sleep_episode — classic (Power-Troubleshooter 1)
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void ClassicResume_EffectiveState5_EmitsHibernateEpisode()
+        {
+            var sleepAt = At.AddHours(-2);
+            EmitClassicResume(sleepAt, At, effectiveState: "5", wakeSourceText: "Power Button");
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemSleepEpisode));
+            Assert.Equal("Info", s.Payload![SignalPayloadKeys.Severity]);
+
+            var data = Data(s);
+            Assert.Equal("hibernate", data["kind"]);
+            Assert.Equal(7200L, data["durationSeconds"]);
+            Assert.Equal(sleepAt.ToString("o"), data["enteredAt"]);
+            Assert.Equal(At.ToString("o"), data["exitedAt"]);
+            Assert.Equal("Power Button", data["wakeSourceText"]);
+            Assert.Contains("hibernate", (string)s.Payload![SignalPayloadKeys.Message]);
+        }
+
+        [Fact]
+        public void ClassicResume_NonHibernateState_EmitsSleepKind()
+        {
+            EmitClassicResume(At.AddMinutes(-30), At, effectiveState: "4");
+            Assert.Equal("sleep", Data(Assert.Single(ByType(Constants.EventTypes.SystemSleepEpisode)))["kind"]);
+        }
+
+        [Fact]
+        public void ClassicResume_ShortEpisode_StillEmits()
+        {
+            // No duration floor for classic sleep: the event only exists for genuinely completed
+            // S3/S4 transitions, so a 30 s real sleep is still signal.
+            EmitClassicResume(At.AddSeconds(-30), At);
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemSleepEpisode));
+            Assert.Equal(30L, Data(s)["durationSeconds"]);
+        }
+
+        // -------------------------------------------------------------------
+        // system_sleep_episode — Modern Standby (Kernel-Power 507)
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void ModernStandbyExit_EmitsEpisode_WithDerivedEnterTime()
+        {
+            // Values from a live 507 on this dev machine: 38 min scenario, ~38 min actual sleep.
+            EmitModernStandbyExit(sleepDurationUs: 2_324_095_807, durationUs: 2_330_201_652);
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemSleepEpisode));
+            var data = Data(s);
+            Assert.Equal("modern_standby", data["kind"]);
+            Assert.Equal(2330L, data["durationSeconds"]);
+            Assert.Equal(2324L, data["sleepDurationSeconds"]);
+            Assert.Equal(true, data["onAcPower"]);
+            Assert.Equal(34180L, data["batteryRemainingCapacityOnExit"]);
+            Assert.Equal(At.ToString("o"), data["exitedAt"]);
+            Assert.Equal(At.AddMilliseconds(-2_330_201.652).ToString("o"), data["enteredAt"]);
+            Assert.Contains("Modern Standby", (string)s.Payload![SignalPayloadKeys.Message]);
+        }
+
+        [Fact]
+        public void ModernStandbyExit_SleepBelowFloor_Suppressed()
+        {
+            EmitModernStandbyExit(sleepDurationUs: 30_000_000, durationUs: 90_000_000); // 30 s sleep
+            Assert.Empty(ByType(Constants.EventTypes.SystemSleepEpisode));
+        }
+
+        [Fact]
+        public void ModernStandbyExit_ScreenOffWithoutSleep_Suppressed()
+        {
+            // SleepEntered=false scenarios carry SleepDurationInUs 0 — the single duration gate
+            // suppresses them without a separate branch.
+            EmitModernStandbyExit(sleepDurationUs: 0, durationUs: 6_106_696);
+            Assert.Empty(ByType(Constants.EventTypes.SystemSleepEpisode));
+        }
+
+        [Fact]
+        public void ModernStandbyExit_ScenarioShorterThanSleep_ClampsToSleepDuration()
+        {
+            EmitModernStandbyExit(sleepDurationUs: 120_000_000, durationUs: 0);
+
+            var data = Data(Assert.Single(ByType(Constants.EventTypes.SystemSleepEpisode)));
+            Assert.Equal(120L, data["durationSeconds"]);
+            Assert.Equal(120L, data["sleepDurationSeconds"]);
+        }
+
+        // -------------------------------------------------------------------
+        // Backfill semantics
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void BackfilledEvent_UsesEventTimeForTimelineTimestamp_AndFlagsData()
+        {
+            // A pre-agent standby episode (record created before the agent started) must land on
+            // the timeline where the device actually woke, not at agent start.
+            var wakeTime = At.AddHours(-3);
+            EmitClassicResume(wakeTime.AddHours(-1), wakeTime, isBackfill: true, timeCreatedUtc: wakeTime);
+
+            var s = Assert.Single(ByType(Constants.EventTypes.SystemSleepEpisode));
+            Assert.Equal(wakeTime, s.OccurredAtUtc);
+            Assert.Equal(true, Data(s)["backfilled"]);
+        }
+
+        // -------------------------------------------------------------------
+        // Dedup / watermark
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void SameRecordId_ProcessedTwice_EmitsOnce()
+        {
+            EmitClockChange(At, At.AddMinutes(1), recordId: 42);
+            EmitClockChange(At, At.AddMinutes(1), recordId: 42);
+
+            Assert.Single(ByType(Constants.EventTypes.SystemClockChanged));
+        }
+
+        [Fact]
+        public void BackfillEventWithLowerRecordId_AfterLiveEvent_IsStillEmitted()
+        {
+            // The live watcher is armed BEFORE backfill runs, so a live record with a higher
+            // RecordId can be processed first. An older, never-emitted backfill record must NOT be
+            // suppressed — pre-agent episodes are the whole point (high-water-mark trap).
+            EmitClockChange(At, At.AddMinutes(1), recordId: 100);                       // live, high
+            EmitClockChange(At, At.AddMinutes(2), recordId: 50, isBackfill: true);      // backfill, older
+
+            Assert.Equal(2, ByType(Constants.EventTypes.SystemClockChanged).Count);
+        }
+
+        [Fact]
+        public void Watermark_PersistsAcrossTrackerInstances()
+        {
+            var post = new InformationalEventPost(_sink, new VirtualClock(At));
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            var clockData = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+            {
+                ["OldTime"] = At.ToString("o"),
+                ["NewTime"] = At.AddMinutes(10).ToString("o"),
+                ["Reason"] = "1",
+            };
+
+            var first = new SystemTimelineTracker("s", "t", post, logger, backfillEnabled: false, stateDirectory: _tmp.Path);
+            first.ProcessEvent(SystemTimelineTracker.ProviderKernelGeneral, SystemTimelineTracker.EventId_ClockChange,
+                recordId: 500, timeCreatedUtc: At, eventData: clockData, isBackfill: false);
+
+            // A fresh tracker (agent restart) must load the watermark and skip the already-emitted
+            // record when the backfill re-reads it.
+            var second = new SystemTimelineTracker("s", "t", post, logger, backfillEnabled: false, stateDirectory: _tmp.Path);
+            second.LoadWatermark();
+            second.ProcessEvent(SystemTimelineTracker.ProviderKernelGeneral, SystemTimelineTracker.EventId_ClockChange,
+                recordId: 500, timeCreatedUtc: At, eventData: clockData, isBackfill: true);
+
+            Assert.Single(ByType(Constants.EventTypes.SystemClockChanged));
+        }
+
+        [Fact]
+        public void UnknownProviderOrEventId_Ignored()
+        {
+            _tracker.ProcessEvent("Microsoft-Windows-Kernel-Power", eventId: 566, recordId: _nextRecordId++,
+                timeCreatedUtc: At, eventData: new Dictionary<string, string>(), isBackfill: false);
+            _tracker.ProcessEvent("Some-Other-Provider", eventId: 1, recordId: _nextRecordId++,
+                timeCreatedUtc: At, eventData: new Dictionary<string, string>(), isBackfill: false);
+
+            Assert.Empty(_sink.Posted);
+        }
+
+        // -------------------------------------------------------------------
+        // XPath + parsing
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void BuildXPath_ContainsAllThreeProviderIdPairs_AndNo506()
+        {
+            var xpath = SystemTimelineTracker.BuildXPath();
+            Assert.Contains("Provider[@Name='Microsoft-Windows-Kernel-General'] and EventID=1", xpath);
+            Assert.Contains("Provider[@Name='Microsoft-Windows-Power-Troubleshooter'] and EventID=1", xpath);
+            Assert.Contains("Provider[@Name='Microsoft-Windows-Kernel-Power'] and EventID=507", xpath);
+            Assert.DoesNotContain("506", xpath);
+        }
+
+        [Fact]
+        public void BuildBackfillXPath_AppendsTimediffClause()
+        {
+            var xpath = SystemTimelineTracker.BuildBackfillXPath(86_400_000);
+            Assert.Contains("TimeCreated[timediff(@SystemTime) <= 86400000]", xpath);
+            Assert.Contains("EventID=507", xpath);
+        }
+
+        [Fact]
+        public void ParseEventData_RealKernelGeneralPayload_YieldsAuthoritativeFields()
+        {
+            // Verbatim (values shortened) from a live Kernel-General 1 record on a 26220 dev machine.
+            const string xml =
+                "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>" +
+                "<System><Provider Name='Microsoft-Windows-Kernel-General'/><EventID>1</EventID></System>" +
+                "<EventData>" +
+                "<Data Name='NewTime'>2026-08-21T09:40:02.1987028Z</Data>" +
+                "<Data Name='OldTime'>2026-08-21T09:40:02.1973028Z</Data>" +
+                "<Data Name='TimeDeltaInMs'>1</Data>" +
+                "<Data Name='Reason'>1</Data>" +
+                "<Data Name='ProcessName'>\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe</Data>" +
+                "<Data Name='ProcessID'>6892</Data>" +
+                "</EventData></Event>";
+
+            var data = SystemTimelineTracker.ParseEventData(xml);
+            Assert.Equal("1", data["TimeDeltaInMs"]);
+            Assert.Equal("2026-08-21T09:40:02.1987028Z", data["newtime"]); // case-insensitive keys
+            Assert.NotNull(SystemTimelineTracker.TryParseUtc(data["OldTime"]));
+        }
+
+        [Fact]
+        public void FormatDuration_CompactForms()
+        {
+            Assert.Equal("2h 05m", SystemTimelineTracker.FormatDuration(TimeSpan.FromMinutes(125)));
+            Assert.Equal("56m 12s", SystemTimelineTracker.FormatDuration(TimeSpan.FromSeconds(56 * 60 + 12)));
+            Assert.Equal("45s", SystemTimelineTracker.FormatDuration(TimeSpan.FromSeconds(45)));
+        }
+
+        [Fact]
+        public void ProcessLeafName_StripsDevicePath()
+        {
+            Assert.Equal("svchost.exe",
+                SystemTimelineTracker.ProcessLeafName(@"\Device\HarddiskVolume3\Windows\System32\svchost.exe"));
+            Assert.Null(SystemTimelineTracker.ProcessLeafName(null));
+            Assert.Null(SystemTimelineTracker.ProcessLeafName(@"\Device\HarddiskVolume3\"));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Transport/DoGroupIdServiceTests.cs

@@ -0,0 +1,126 @@
+using System;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
+{
+    public class DoGroupIdServiceTests
+    {
+        // -------------------------------------------------------------------
+        // ComputeGroupId — RealmJoin byte-layout compatibility
+        // -------------------------------------------------------------------
+
+        [Fact]
+        public void ComputeGroupId_MatchesHandComputedVector()
+        {
+            // Layout: {101,48,6} + {0,0,0} + {ip[1],0,ip[2],ip[3]} + mac — through new Guid(byte[])
+            // the first three groups print little-endian, the last eight bytes verbatim.
+            var guid = DoGroupIdService.ComputeGroupId(
+                new byte[] { 192, 168, 178, 1 },
+                new byte[] { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55 });
+
+            Assert.Equal("00063065-0000-00a8-b201-001122334455", guid.ToString());
+        }
+
+        [Theory]
+        [InlineData(new byte[] { 10, 0, 0, 1 }, new byte[] { 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF })]
+        [InlineData(new byte[] { 192, 168, 1, 254 }, new byte[] { 0x00, 0x50, 0x56, 0x01, 0x02, 0x03 })]
+        [InlineData(new byte[] { 172, 16, 254, 3 }, new byte[] { 0xF0, 0x9F, 0xC2, 0x00, 0x00, 0x01 })]
+        public void ComputeGroupId_MatchesRealmJoinReferenceImplementation(byte[] ip, byte[] mac)
+        {
+            Assert.Equal(RealmJoinReferenceGuid(ip, mac), DoGroupIdService.ComputeGroupId(ip, mac));
+        }
+
+        /// <summary>Verbatim port of RealmJoin's ConvertToGuid — the compatibility contract.</summary>
+        private static Guid RealmJoinReferenceGuid(byte[] ipBytes, byte[] address)
+        {
+            byte[] prefix = { 101, 48, 6 };
+            var stuff = new byte[4];
+            stuff[0] = ipBytes[1];
+            stuff[2] = ipBytes[2];
+            stuff[3] = ipBytes[3];
+
+            return new Guid(prefix
+                .Concat(new byte[16 - prefix.Length - stuff.Length - address.Length])
+                .Concat(stuff)
+                .Concat(address)
+                .ToArray());
+        }
+
+        [Fact]
+        public void ComputeGroupId_RejectsNonIpv4AndBadMacLengths()
+        {
+            var ip4 = new byte[] { 10, 0, 0, 1 };
+            var mac = new byte[] { 1, 2, 3, 4, 5, 6 };
+
+            Assert.Throws<ArgumentException>(() => DoGroupIdService.ComputeGroupId(new byte[16], mac));
+            Assert.Throws<ArgumentException>(() => DoGroupIdService.ComputeGroupId(null!, mac));
+            Assert.Throws<ArgumentException>(() => DoGroupIdService.ComputeGroupId(ip4, new byte[8]));
+            Assert.Throws<ArgumentException>(() => DoGroupIdService.ComputeGroupId(ip4, null!));
+        }
+
+        [Fact]
+        public void ComputeGroupId_RegistryFormat_IsBracelessLowercase()
+        {
+            // RealmJoin writes SetValue(name, Guid) which stringifies via Guid.ToString() ("d"
+            // format) — our written value must be the identical string form.
+            var text = DoGroupIdService.ComputeGroupId(
+                new byte[] { 10, 1, 2, 3 }, new byte[] { 0xAB, 0xCD, 0xEF, 0x01, 0x02, 0x03 }).ToString();
+
+            Assert.DoesNotContain("{", text);
+            Assert.Equal(text.ToLowerInvariant(), text);
+            Assert.Equal(36, text.Length);
+        }
+
+        // -------------------------------------------------------------------
+        // DecideAction — ownership matrix
+        // -------------------------------------------------------------------
+
+        private const string Computed = "00063065-0000-00a8-b201-001122334455";
+        private const string Other = "11111111-2222-3333-4444-555555555555";
+
+        [Theory]
+        [InlineData(null)]
+        [InlineData("")]
+        public void DecideAction_NoExistingValue_Writes(string? existing)
+        {
+            Assert.Equal(DoGroupIdAction.Write, DoGroupIdService.DecideAction(existing, Computed, null));
+        }
+
+        [Fact]
+        public void DecideAction_ExistingEqualsComputed_IsNoOp()
+        {
+            Assert.Equal(DoGroupIdAction.NoOp, DoGroupIdService.DecideAction(Computed, Computed, null));
+        }
+
+        [Fact]
+        public void DecideAction_ExistingEqualsComputed_ToleratesBracesAndCase()
+        {
+            // A value written by another tool in "{...}"/uppercase form is still semantically ours.
+            var braced = "{" + Computed.ToUpperInvariant() + "}";
+            Assert.Equal(DoGroupIdAction.NoOp, DoGroupIdService.DecideAction(braced, Computed, null));
+        }
+
+        [Fact]
+        public void DecideAction_ExistingIsOurStaleValue_WritesUpdate()
+        {
+            // Gateway changed: the registry still holds the GUID we wrote for the old network.
+            Assert.Equal(DoGroupIdAction.Write, DoGroupIdService.DecideAction(Other, Computed, Other));
+        }
+
+        [Fact]
+        public void DecideAction_ForeignValue_Skips()
+        {
+            Assert.Equal(DoGroupIdAction.SkipForeign, DoGroupIdService.DecideAction(Other, Computed, null));
+            Assert.Equal(DoGroupIdAction.SkipForeign, DoGroupIdService.DecideAction(Other, Computed, Computed));
+        }
+
+        [Fact]
+        public void DecideAction_NonGuidGarbageExisting_SkipsAsForeign()
+        {
+            // Never overwrite a value we can't even parse — conservative by design.
+            Assert.Equal(DoGroupIdAction.SkipForeign, DoGroupIdService.DecideAction("not-a-guid", Computed, null));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/FakeSignalIngressSink.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using AutopilotMonitor.Agent.V2.Core.Orchestration;
 using AutopilotMonitor.DecisionCore.Signals;
 
@@ -11,8 +12,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
     internal sealed class FakeSignalIngressSink : ISignalIngressSink
     {
         private readonly List<PostedSignal> _posted = new List<PostedSignal>();
+        private readonly object _gate = new object();
 
-        public IReadOnlyList<PostedSignal> Posted => _posted;
+        /// <summary>
+        /// Snapshot, not the live list: producers post from timer / worker threads (e.g. the
+        /// parked-dwell tripwire) while tests poll this in a SpinWait loop. Enumerating the live
+        /// list across an Add throws "Collection was modified" — a rare CI-only failure
+        /// (run 32644425162) with no assertion text.
+        /// </summary>
+        public IReadOnlyList<PostedSignal> Posted
+        {
+            get { lock (_gate) return _posted.ToArray(); }
+        }
 
         /// <summary>When non-null, <see cref="Post"/> throws instead of capturing.</summary>
         public Exception? ThrowOnPost { get; set; }
@@ -27,7 +38,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             object? typedPayload = null)
         {
             if (ThrowOnPost != null) throw ThrowOnPost;
-            _posted.Add(new PostedSignal(kind, occurredAtUtc, sourceOrigin, evidence, payload, kindSchemaVersion, typedPayload));
+            lock (_gate)
+                _posted.Add(new PostedSignal(kind, occurredAtUtc, sourceOrigin, evidence, payload, kindSchemaVersion, typedPayload));
         }
 
         internal sealed class PostedSignal

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/PowerStateWatcherHostTests.cs

@@ -0,0 +1,162 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Runtime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
+{
+    /// <summary>
+    /// PowerStateWatcherHost — no-battery/probe-error devices never arm, a low-battery baseline
+    /// emits its threshold event onto the single rail, and debounced ticks translate tracker
+    /// emissions into <c>power_state_change</c> events. WMI arming itself stays untested
+    /// (ConsoleBypassWatcher precedent); <c>StartCore(armWmi: false)</c> exercises everything else.
+    /// </summary>
+    public sealed class PowerStateWatcherHostTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 8, 21, 9, 0, 0, DateTimeKind.Utc);
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private readonly AgentLogger _logger;
+        private PowerStateResult _probeResult = new PowerStateResult { OnAcPower = true, HasBattery = true, BatteryPercent = 80 };
+
+        public PowerStateWatcherHostTests()
+        {
+            _logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+        }
+
+        public void Dispose() => _tmp.Dispose();
+
+        private PowerStateWatcherHost Build() => new PowerStateWatcherHost(
+            sessionId: "sess-power",
+            tenantId: "tenant-power",
+            ingress: _sink,
+            clock: new VirtualClock(At),
+            logger: _logger,
+            probe: () => _probeResult);
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> PowerEvents() =>
+            _sink.Posted.Where(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == Constants.EventTypes.PowerStateChange).ToList();
+
+        [Fact]
+        public void No_battery_emits_nothing()
+        {
+            _probeResult = new PowerStateResult { OnAcPower = true, HasBattery = false };
+
+            Build().StartCore(armWmi: false);
+
+            Assert.Empty(_sink.Posted);
+        }
+
+        [Fact]
+        public void Probe_error_emits_nothing()
+        {
+            _probeResult = new PowerStateResult { ProbeError = "GetSystemPowerStatus returned false" };
+
+            Build().StartCore(armWmi: false);
+
+            Assert.Empty(_sink.Posted);
+        }
+
+        [Fact]
+        public void Baseline_below_threshold_emits_threshold_event_with_immediate_upload()
+        {
+            _probeResult = new PowerStateResult { OnAcPower = false, HasBattery = true, BatteryPercent = 12, BatteryLifeMinutes = 34 };
+
+            Build().StartCore(armWmi: false);
+
+            var s = Assert.Single(PowerEvents());
+            Assert.Equal("Error", s.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("true", s.Payload![SignalPayloadKeys.ImmediateUpload]);
+            Assert.Contains("15%", s.Payload![SignalPayloadKeys.Message]);
+
+            var data = (IReadOnlyDictionary<string, object>)s.TypedPayload!;
+            Assert.Equal("threshold_crossed", data["transition"]);
+            Assert.Equal(15, data["thresholdPercent"]);
+            Assert.Equal(12, data["batteryPercent"]);
+            Assert.Equal(false, data["onAcPower"]);
+            Assert.Equal(34, data["batteryLifeMinutes"]);
+        }
+
+        [Fact]
+        public void Tick_after_unplug_emits_ac_to_battery_warning()
+        {
+            var host = Build();
+            host.StartCore(armWmi: false);
+            Assert.Empty(PowerEvents());
+
+            _probeResult = new PowerStateResult { OnAcPower = false, HasBattery = true, BatteryPercent = 79 };
+            host.TickForTest();
+
+            var s = Assert.Single(PowerEvents());
+            Assert.Equal("Warning", s.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("true", s.Payload![SignalPayloadKeys.ImmediateUpload]);
+
+            var data = (IReadOnlyDictionary<string, object>)s.TypedPayload!;
+            Assert.Equal("ac_to_battery", data["transition"]);
+            Assert.Equal(79, data["batteryPercent"]);
+            Assert.False(data.ContainsKey("thresholdPercent"));
+
+            // Replug: Info recovery event without immediate upload.
+            _probeResult = new PowerStateResult { OnAcPower = true, HasBattery = true, BatteryPercent = 79, IsCharging = true };
+            host.TickForTest();
+
+            Assert.Equal(2, PowerEvents().Count);
+            var back = PowerEvents()[1];
+            Assert.Equal("Info", back.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("false", back.Payload![SignalPayloadKeys.ImmediateUpload]);
+            Assert.Equal("battery_to_ac", ((IReadOnlyDictionary<string, object>)back.TypedPayload!)["transition"]);
+        }
+
+        [Fact]
+        public void Tick_with_unchanged_state_emits_nothing()
+        {
+            var host = Build();
+            host.StartCore(armWmi: false);
+
+            host.TickForTest();
+            host.TickForTest();
+
+            Assert.Empty(PowerEvents());
+        }
+
+        [Fact]
+        public void Stopped_host_ignores_ticks()
+        {
+            var host = Build();
+            host.StartCore(armWmi: false);
+            host.Stop();
+
+            _probeResult = new PowerStateResult { OnAcPower = false, HasBattery = true, BatteryPercent = 50 };
+            host.TickForTest();
+
+            Assert.Empty(PowerEvents());
+        }
+
+        [Fact]
+        public void Unknown_battery_percent_serializes_as_unknown()
+        {
+            var host = Build();
+            host.StartCore(armWmi: false);
+
+            _probeResult = new PowerStateResult { OnAcPower = false, HasBattery = true, BatteryPercent = null, BatteryLifeMinutes = null };
+            host.TickForTest();
+
+            var data = (IReadOnlyDictionary<string, object>)Assert.Single(PowerEvents()).TypedPayload!;
+            Assert.Equal("unknown", data["batteryPercent"]);
+            Assert.Equal("unknown", data["batteryLifeMinutes"]);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/SignalActivityClassifierTests.cs

@@ -35,6 +35,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
         // OS-eventlog forwarding — observability, not enrollment progress (session 8bc1180f:
         // an EventID-100 burst must not keep the periodic collectors alive).
         [InlineData("modern_deployment_log")]
+        // Environment observation — battery drain on an idle device must not reset idle clocks.
+        [InlineData("power_state_change")]
         // Agent health / control / transport — not device/enrollment progress (P2).
         [InlineData("collector_degraded")]
         [InlineData("telemetry_upload_poisoned")]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/SystemTimelineWatcherHostTests.cs

@@ -0,0 +1,57 @@
+#nullable enable
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.DecisionCore.Engine;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
+{
+    /// <summary>
+    /// SystemTimelineWatcherHost — thin ICollectorHost wrapper over SystemTimelineTracker.
+    /// Real event-log arming stays untested by convention (ConsoleBypassWatcher precedent);
+    /// these tests pin the lifecycle contract only.
+    /// </summary>
+    public sealed class SystemTimelineWatcherHostTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+
+        public void Dispose() => _tmp.Dispose();
+
+        private SystemTimelineWatcherHost CreateHost() => new SystemTimelineWatcherHost(
+            sessionId: "sess-stl",
+            tenantId: "tenant-stl",
+            logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+            ingress: new FakeSignalIngressSink(),
+            clock: new VirtualClock(new DateTime(2026, 8, 21, 10, 0, 0, DateTimeKind.Utc)),
+            backfillLookbackMinutes: 0,
+            stateDirectory: _tmp.Path);
+
+        [Fact]
+        public void Stop_BeforeStart_DoesNotThrow()
+        {
+            using (var host = CreateHost())
+            {
+                host.Stop();
+            }
+        }
+
+        [Fact]
+        public void Dispose_Twice_DoesNotThrow()
+        {
+            var host = CreateHost();
+            host.Dispose();
+            host.Dispose();
+        }
+
+        [Fact]
+        public void Name_IsStable()
+        {
+            using (var host = CreateHost())
+            {
+                Assert.Equal("SystemTimelineTracker", host.Name);
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Runtime/StartupEnvironmentProbesTests.cs

@@ -339,6 +339,114 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Runtime
             Assert.False(StartupEnvironmentProbes.IsNtpWithinTolerance(null!));
         }
 
+        // ================================================================= DO GroupId auto-set
+        // Builder/fingerprint tests only — TrySetGroupId itself does live registry + ARP I/O and
+        // must never run in a unit test (it would write HKLM on the build machine).
+
+        [Fact]
+        public void BuildDoGroupIdEvent_written_success_is_info_with_full_data()
+        {
+            var result = new DoGroupIdSetResult
+            {
+                Success = true,
+                Written = true,
+                GroupId = "00063065-0000-00a8-b201-001122334455",
+                PreviousValue = null,
+                GatewayIp = "192.168.178.1",
+                GatewayMac = "00-11-22-33-44-55",
+            };
+
+            var evt = StartupEnvironmentProbes.BuildDoGroupIdEvent(Config(), result);
+
+            Assert.Equal("do_group_id_auto_set", evt.EventType);
+            Assert.Equal(EventSeverity.Info, evt.Severity);
+            Assert.Equal("StartupEnvironmentProbes", evt.Source);
+            Assert.Equal("S1", evt.SessionId);
+            Assert.Equal("T1", evt.TenantId);
+            Assert.Contains("00063065-0000-00a8-b201-001122334455", evt.Message);
+            Assert.Equal("192.168.178.1", evt.Data["gatewayIp"]);
+            Assert.Equal("00-11-22-33-44-55", evt.Data["gatewayMac"]);
+            Assert.Equal(true, evt.Data["written"]);
+            Assert.Equal(true, evt.Data["success"]);
+            Assert.Equal(false, evt.Data["skipped"]);
+        }
+
+        [Fact]
+        public void BuildDoGroupIdEvent_noop_success_says_already_set()
+        {
+            var result = new DoGroupIdSetResult
+            {
+                Success = true,
+                Written = false,
+                GroupId = "00063065-0000-00a8-b201-001122334455",
+            };
+
+            var evt = StartupEnvironmentProbes.BuildDoGroupIdEvent(Config(), result);
+
+            Assert.Equal(EventSeverity.Info, evt.Severity);
+            Assert.Contains("already set", evt.Message);
+            Assert.Equal(false, evt.Data["written"]);
+        }
+
+        [Fact]
+        public void BuildDoGroupIdEvent_skip_is_info_with_reason()
+        {
+            var result = new DoGroupIdSetResult
+            {
+                Skipped = true,
+                SkipReason = "foreign_value_present",
+                PreviousValue = "11111111-2222-3333-4444-555555555555",
+            };
+
+            var evt = StartupEnvironmentProbes.BuildDoGroupIdEvent(Config(), result);
+
+            Assert.Equal(EventSeverity.Info, evt.Severity);
+            Assert.Contains("foreign_value_present", evt.Message);
+            Assert.Equal("foreign_value_present", evt.Data["skipReason"]);
+            Assert.Equal("11111111-2222-3333-4444-555555555555", evt.Data["previousValue"]);
+        }
+
+        [Fact]
+        public void BuildDoGroupIdEvent_error_is_warning()
+        {
+            var result = new DoGroupIdSetResult { Error = "readback mismatch" };
+
+            var evt = StartupEnvironmentProbes.BuildDoGroupIdEvent(Config(), result);
+
+            Assert.Equal(EventSeverity.Warning, evt.Severity);
+            Assert.Contains("readback mismatch", evt.Message);
+            Assert.Equal("readback mismatch", evt.Data["error"]);
+        }
+
+        [Fact]
+        public void DoGroupIdFingerprint_roundtrips_ownership_marker_for_success()
+        {
+            var fp = StartupEnvironmentProbes.ComputeDoGroupIdFingerprint(new DoGroupIdSetResult
+            {
+                Success = true,
+                GroupId = "00063065-0000-00a8-b201-001122334455",
+            });
+
+            Assert.Equal("written:00063065-0000-00a8-b201-001122334455", fp);
+            Assert.Equal("00063065-0000-00a8-b201-001122334455", StartupEnvironmentProbes.ExtractLastWrittenGroupId(fp));
+        }
+
+        [Fact]
+        public void DoGroupIdFingerprint_skip_carries_no_ownership_and_errors_never_dedupe()
+        {
+            var skipFp = StartupEnvironmentProbes.ComputeDoGroupIdFingerprint(new DoGroupIdSetResult
+            {
+                Skipped = true,
+                SkipReason = "mdm_policy_present",
+            });
+            Assert.Equal("skipped:mdm_policy_present", skipFp);
+            Assert.Null(StartupEnvironmentProbes.ExtractLastWrittenGroupId(skipFp));
+
+            // Errors: no fingerprint → the probe re-runs AND re-emits each failing start.
+            Assert.Null(StartupEnvironmentProbes.ComputeDoGroupIdFingerprint(new DoGroupIdSetResult { Error = "boom" }));
+            Assert.Null(StartupEnvironmentProbes.ExtractLastWrittenGroupId(null));
+        }
+
         [Fact]
         public async Task RunAsync_skips_geo_timezone_and_ntp_once_all_succeeded_only_power_state_emits()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/SessionRegistrationHelperTests.cs

@@ -97,7 +97,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
         }
 
         [Fact]
-        public async Task Fails_after_five_exceptions_without_auth_error()
+        public async Task Fails_after_six_exceptions_without_auth_error()
         {
             using var tmp = new TempDirectory();
             var logger = NewLogger(tmp);
@@ -111,8 +111,50 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
                 backoffDelay: _ => Task.CompletedTask);
 
             Assert.Equal(SessionRegistrationOutcome.Failed, result.Outcome);
-            Assert.Equal(5, apiClient.CallCount);
-            Assert.Contains("transient attempt 5", result.ErrorMessage);
+            Assert.Equal(6, apiClient.CallCount);
+            Assert.Contains("transient attempt 6", result.ErrorMessage);
+        }
+
+        [Fact]
+        public async Task Waits_for_network_link_before_first_attempt()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var order = new System.Collections.Generic.List<string>();
+            var apiClient = new FakeApiClient(_ =>
+            {
+                order.Add("register");
+                return new RegisterSessionResponse { Success = true, SessionId = config.SessionId };
+            });
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                backoffDelay: _ => Task.CompletedTask,
+                networkLinkWait: _ => { order.Add("link-wait"); return Task.CompletedTask; });
+
+            Assert.Equal(SessionRegistrationOutcome.Succeeded, result.Outcome);
+            Assert.Equal(new[] { "link-wait", "register" }, order);
+        }
+
+        [Fact]
+        public async Task Network_link_wait_failure_does_not_block_registration()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var apiClient = new FakeApiClient(_ =>
+                new RegisterSessionResponse { Success = true, SessionId = config.SessionId });
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                backoffDelay: _ => Task.CompletedTask,
+                networkLinkWait: _ => throw new InvalidOperationException("probe broken"));
+
+            Assert.Equal(SessionRegistrationOutcome.Succeeded, result.Outcome);
+            Assert.Equal(1, apiClient.CallCount);
         }
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterTimingTests.cs

@@ -245,11 +245,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
         }
 
         [Fact]
-        public void Terminal_to_active_retry_rearms_CompletedAt_and_final_terminal_covers_total_occupancy()
+        public void Terminal_to_active_retry_rearms_BothEndpoints_and_final_terminal_covers_last_attempt()
         {
-            // Audit Q1: the IME retry path (Error -> Downloading -> Installed is permitted by
-            // AppPackageState.UpdateState). Pre-fix, CompletedAt froze at the first Error, so
-            // the final Installed payload carried the first failure's completedAt/duration.
+            // Audit Q1 + 2026-08 attempt-duration change: the IME retry path
+            // (Error -> Downloading -> Installed is permitted by AppPackageState.UpdateState).
+            // A terminal->active transition re-arms BOTH endpoints, so the final Installed
+            // payload describes the retry ATTEMPT (matching the backend's AppInstallSummaries
+            // semantics) — not the first-start -> last-terminal span across attempts.
             using var f = new ImeLogTrackerAdapterFixture(T0);
             using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
             var app = new AppPackageState("app-R", 0);
@@ -261,23 +263,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             adapter.TriggerAppStateFromTest(app, AppInstallationState.Error, AppInstallationState.Downloading);
 
             // Re-armed while active again: the retry's download event carries no completedAt,
-            // and the FIRST start stamp is kept.
+            // and the start stamp is the RETRY's re-entry time (fresh attempt window).
             Assert.Null(adapter.AppTimings["app-R"].CompletedAtUtc);
             var retryDownload = f.InfoEvent(SharedEventTypes.AppDownloadStarted);
             Assert.False(retryDownload.Payload!.ContainsKey("completedAt"));
             Assert.False(retryDownload.Payload.ContainsKey("durationSeconds"));
-            Assert.Equal(T0.ToString("o"), retryDownload.Payload["startedAt"]);
+            Assert.Equal(T0.AddSeconds(15).ToString("o"), retryDownload.Payload["startedAt"]);
 
             f.Clock.Advance(TimeSpan.FromSeconds(20));
             adapter.TriggerAppStateFromTest(app, AppInstallationState.Downloading, AppInstallationState.Installed);
 
             var timing = adapter.AppTimings["app-R"];
-            Assert.Equal(T0, timing.StartedAtUtc);
+            Assert.Equal(T0.AddSeconds(15), timing.StartedAtUtc);
             Assert.Equal(T0.AddSeconds(35), timing.CompletedAtUtc);
-            Assert.Equal(35.0, timing.DurationSeconds);
+            Assert.Equal(20.0, timing.DurationSeconds);
 
             var completed = Assert.Single(f.InfoEvents(SharedEventTypes.AppInstallComplete));
-            Assert.Equal("35.00", completed.Payload!["durationSeconds"]);
+            Assert.Equal("20.00", completed.Payload!["durationSeconds"]);
             Assert.Equal(T0.AddSeconds(35).ToString("o"), completed.Payload["completedAt"]);
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderTests.cs

@@ -107,6 +107,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.False(req.Headers.ContainsKey("X-Bootstrap-Token"));
         }
 
+        [Fact]
+        public async Task UploadBatchAsync_stamps_send_time_header_per_attempt()
+        {
+            // P14: X-Send-Time-Utc carries the device clock at the SEND moment, round-trip
+            // ISO-8601, one value per request. A retry is a new send moment — the header is
+            // stamped inside UploadBatchAsync, so each attempt gets a fresh value.
+            using var rig = new Rig();
+            rig.Handler.QueueStatus(HttpStatusCode.ServiceUnavailable);
+            rig.Handler.QueueStatus(HttpStatusCode.OK);
+
+            var before = DateTime.UtcNow;
+            await rig.Sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+            await rig.Sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+            var after = DateTime.UtcNow;
+
+            Assert.Equal(2, rig.Handler.Captured.Count);
+            foreach (var req in rig.Handler.Captured)
+            {
+                Assert.True(req.TryGetHeader("X-Send-Time-Utc", out var raw));
+                var parsed = DateTime.Parse(raw, null, System.Globalization.DateTimeStyles.RoundtripKind);
+                Assert.Equal(DateTimeKind.Utc, parsed.Kind);
+                Assert.InRange(parsed, before.AddSeconds(-1), after.AddSeconds(1));
+            }
+        }
+
         // ============================================================ Compression (bandwidth)
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/AgentConfiguration.cs

@@ -109,6 +109,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         /// </summary>
         public bool EnableTimezoneAutoSet { get; set; } = false;
 
+        /// <summary>
+        /// Whether to set the Delivery Optimization group ID (DOGroupId policy value) from a
+        /// deterministic network fingerprint (default gateway IP + MAC, RealmJoin-compatible).
+        /// Existing DOGroupId/DOGroupIdSource policies are never overwritten.
+        /// Default: false
+        /// </summary>
+        public bool EnableDoGroupIdAutoSet { get; set; } = false;
+
         /// <summary>
         /// Continue-Anyway observation mode (operator-set tenant opt-in, delivered via
         /// remote config): stamped into the esp_config_detected decision-signal payload so
@@ -254,6 +262,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         /// </summary>
         public bool UnrestrictedMode { get; set; } = false;
 
+        /// <summary>
+        /// Mirror of <c>AnalyzerConfiguration.EnableRealmJoinWatcher</c> (remote, per tenant).
+        /// Gates the RealmJoin built-in sections of the diagnostics package — the package
+        /// service only sees this configuration, not the remote response. The RealmJoin host
+        /// itself keeps reading the remote Analyzers block. Default: false.
+        /// </summary>
+        public bool EnableRealmJoinWatcher { get; set; } = false;
+
         /// <summary>
         /// Sanitized command-line arguments for the agent_started event.
         /// Secrets (e.g. bootstrap token) are redacted before assignment.

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/RemoteConfigMerger.cs

@@ -94,12 +94,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
             //                  a tenant admin can clear a previously-applied custom NTP server.
             agentConfig.NtpServer = remoteConfig.NtpServer;
             agentConfig.EnableTimezoneAutoSet = remoteConfig.EnableTimezoneAutoSet;
+            agentConfig.EnableDoGroupIdAutoSet = remoteConfig.EnableDoGroupIdAutoSet;
 
             // ---------------- Diagnostics — remote wins (including DiagnosticsUploadMode="Off"
             //                  which must clear any CLI-initial default).
             agentConfig.DiagnosticsUploadEnabled = remoteConfig.DiagnosticsUploadEnabled;
             agentConfig.DiagnosticsUploadMode = remoteConfig.DiagnosticsUploadMode;
             agentConfig.DiagnosticsLogPaths = remoteConfig.DiagnosticsLogPaths ?? new List<DiagnosticsLogPath>();
+            // The diagnostics package gates its RealmJoin sections on the tenant's watcher
+            // toggle but never sees the remote response — mirror the one Analyzers knob here.
+            // The remaining Analyzers flags flow untouched to DefaultComponentFactory.
+            agentConfig.EnableRealmJoinWatcher = remoteConfig.Analyzers?.EnableRealmJoinWatcher ?? false;
 
             agentConfig.SendTraceEvents = remoteConfig.SendTraceEvents;
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/AppInstallTiming.cs

@@ -10,10 +10,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
     /// the <c>app_tracking_summary</c> terminal event.
     /// <para>
     /// <b>StartedAtUtc</b> is recorded on the first lifecycle transition into Downloading /
-    /// Installing / InProgress and never overwritten. <b>CompletedAtUtc</b> is recorded on a
-    /// transition to a terminal state (Installed / Skipped / Postponed / Error) and re-armed
-    /// to <c>null</c> when the app goes terminal → active again (IME retry / re-evaluation,
-    /// audit Q1) — so the final terminal event carries first-start → last-terminal.
+    /// Installing / InProgress. <b>CompletedAtUtc</b> is recorded on a transition to a
+    /// terminal state (Installed / Skipped / Postponed / Error). When the app goes
+    /// terminal → active again (IME retry / re-evaluation pass, audit Q1) BOTH endpoints
+    /// re-arm — CompletedAtUtc to <c>null</c>, StartedAtUtc to the re-entry time — so the
+    /// final terminal event carries the status-defining ATTEMPT's window (2026-08
+    /// attempt-duration change, matching the backend's AppInstallSummaries semantics),
+    /// never the first-start → last-terminal span across install passes.
     /// </para>
     /// </summary>
     public sealed class AppInstallTiming

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/CmTraceOffsetCalibrator.cs

@@ -12,8 +12,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <summary>The writer declared its offset in the line ("+480"). Authoritative.</summary>
         Bias = 1,
 
-        /// <summary>Offset measured from a freshly appended line. See <see cref="CmTraceOffsetCalibrator"/>.</summary>
+        /// <summary>
+        /// A per-FILE measured offset was applied. Retired by the 2026-08-20 revert (04b1a7c6):
+        /// one offset per file is wrong when a file holds lines from two writer eras. Kept so
+        /// stored events from agent 2.0.1410 remain interpretable.
+        /// </summary>
         Calibrated = 2,
+
+        /// <summary>
+        /// The line anchored ITSELF: it was read in a pass whose lines are provably fresh
+        /// (written since the previous poll), so its own distance to the agent clock, rounded
+        /// to the 15-minute offset grid, IS the writer's offset — no cross-line state involved.
+        /// Immune to interleaved writer eras by construction. See
+        /// <see cref="CmTraceOffsetCalibrator.TryMeasureOffset"/>.
+        /// </summary>
+        LineAnchored = 3,
     }
 
     /// <summary>
@@ -98,24 +111,51 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <param name="localTimestamp">The line's local time exactly as written (Kind is ignored).</param>
         /// <param name="agentUtcNow">The agent's UTC clock at parse time.</param>
         /// <returns><c>true</c> when the anchor was accepted and the offset updated.</returns>
-        public bool TryCalibrate(string sourceKey, DateTime localTimestamp, DateTime agentUtcNow)
+        /// <summary>
+        /// The pure measurement: the distance between a FRESH line's local time and the agent's
+        /// UTC clock, rounded to the 15-minute offset grid, is the writer's UTC offset.
+        /// <para>
+        /// Freshness is the caller's obligation and is what makes this correct — for a line
+        /// written within the last poll interval, <c>local - now</c> differs from the writer's
+        /// true offset only by seconds, which the grid rounding absorbs. Returns <c>false</c>
+        /// when the residual exceeds <see cref="MaxGridResidual"/> (the line is not fresh, or
+        /// the writer's clock is broken) or the rounded value is not a real timezone offset.
+        /// </para>
+        /// <para>
+        /// Known, accepted edge: a freshly WRITTEN line carrying an old REPLAYED timestamp whose
+        /// age happens to sit within the residual of an exact grid multiple measures that age as
+        /// an "offset" — the line then resolves to roughly the read time instead of its replayed
+        /// past. The error is bounded by construction (an anchored line always resolves to
+        /// now ± <see cref="MaxGridResidual"/>), the case needs an age of exactly N×15 min ± 2 min,
+        /// and sub-24h replays are treated as current by the historic-replay guard anyway.
+        /// </para>
+        /// </summary>
+        public static bool TryMeasureOffset(DateTime localTimestamp, DateTime agentUtcNow, out TimeSpan offset)
         {
-            if (string.IsNullOrEmpty(sourceKey)) return false;
-
             var candidate = DateTime.SpecifyKind(localTimestamp, DateTimeKind.Unspecified)
                           - DateTime.SpecifyKind(agentUtcNow, DateTimeKind.Unspecified);
 
             var gridUnits = Math.Round(candidate.TotalMinutes / OffsetGrid.TotalMinutes,
                                        MidpointRounding.AwayFromZero);
-            var offset = TimeSpan.FromMinutes(gridUnits * OffsetGrid.TotalMinutes);
+            offset = TimeSpan.FromMinutes(gridUnits * OffsetGrid.TotalMinutes);
 
-            // Off-grid by more than the tolerance: the anchor was not fresh, or the writer's own
-            // clock is broken. Either way it must not become the offset.
+            // Off-grid by more than the tolerance: the line was not fresh, or the writer's own
+            // clock is broken. Either way it must not become an offset.
             if ((candidate - offset).Duration() > MaxGridResidual) return false;
 
             // Not a value any real timezone can produce.
             if (offset < MinOffset || offset > MaxOffset) return false;
 
+            return true;
+        }
+
+        public bool TryCalibrate(string sourceKey, DateTime localTimestamp, DateTime agentUtcNow)
+        {
+            if (string.IsNullOrEmpty(sourceKey)) return false;
+
+            TimeSpan offset;
+            if (!TryMeasureOffset(localTimestamp, agentUtcNow, out offset)) return false;
+
             lock (_lock)
             {
                 if (_bySource.TryGetValue(sourceKey, out var existing))

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -77,12 +77,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     var fileInfo = new FileInfo(filePath);
                     if (!fileInfo.Exists) continue;
 
-                    // Captured BEFORE GetSafePosition, which creates the entry as a side effect.
-                    // Growth measured against a previously observed size is what makes the last
-                    // line of this pass a valid "written now" calibration anchor.
+                    // Captured BEFORE MarkChecked below stamps this pass. Growth measured
+                    // against a previously observed state is what makes this pass's lines valid
+                    // "written now" anchors — for the per-file measurement AND per-line anchoring.
                     var hadPreviousObservation = _positionTracker.HasSeen(filePath);
+                    var lastCheckedUtc = _positionTracker.GetLastCheckedUtc(filePath);
+                    var passNowUtc = UtcNowProvider();
 
                     var startPos = _positionTracker.GetSafePosition(filePath, fileInfo.Length);
+
+                    // Every look counts, including "no new data" and an empty first sight: the
+                    // NEXT pass's freshness window is measured from here. Restored bookmarks
+                    // deliberately carry no LastCheckedUtc — the first pass after a restart reads
+                    // downtime backlog and must never count as fresh.
+                    _positionTracker.MarkChecked(filePath, passNowUtc);
+
                     if (startPos >= fileInfo.Length)
                     {
                         // M2: guard the interpolated string so it isn't built every 100 ms tick
@@ -95,6 +104,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         _logger.Trace($"ImeLogTracker: reading {Path.GetFileName(filePath)} from pos {startPos} (size={fileInfo.Length}, delta={fileInfo.Length - startPos})");
 
                     _currentSourceFileName = Path.GetFileName(filePath);
+                    _currentPassLinesAreFresh = hadPreviousObservation
+                        && lastCheckedUtc > DateTime.MinValue
+                        && (passNowUtc - lastCheckedUtc) <= FreshLineMaxAge;
 
                     // Newest bias-less line of this pass — the calibration anchor. Bias-carrying
                     // lines are skipped: they already state the writer's offset, so they need no
@@ -210,7 +222,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         // growing pass, during which lines fall back to the reader zone and are
                         // flagged as such.
                         if (hadPreviousObservation && calibrationAnchor != null)
-                            CalibrateFrom(_currentSourceFileName, calibrationAnchor);
+                            CalibrateFrom(_currentSourceFileName, Path.GetFileName(filePath), calibrationAnchor);
                     }
                 }
                 catch (FileNotFoundException) { }
@@ -254,6 +266,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 LastMatchedSourceLocalTimestamp = null;
                 LastMatchedSourceOffsetMinutes = null;
                 LastMatchedSourceOffsetOrigin = CmTraceOffsetOrigin.None;
+                LastMatchedMeasuredWriterOffsetMinutes = null;
             }
             else
             {
@@ -263,6 +276,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 LastMatchedSourceLocalTimestamp = entry.HasTimestamp ? entry.LocalTimestamp : (DateTime?)null;
                 LastMatchedSourceOffsetMinutes = offsetMinutes;
                 LastMatchedSourceOffsetOrigin = origin;
+
+                // Observational: what the calibrator measured for this file, distinct from what
+                // was applied above.
+                TimeSpan measuredWriterOffset;
+                LastMatchedMeasuredWriterOffsetMinutes =
+                    _currentSourceFileName != null
+                    && OffsetCalibrator.TryGetOffset(_currentSourceFileName, out measuredWriterOffset)
+                        ? (int)measuredWriterOffset.TotalMinutes
+                        : (int?)null;
             }
 
             // Generic pattern-match hook (M4.4.4). Invoked before action-specific callbacks so
@@ -640,52 +662,110 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
             if (!entry.HasTimestamp) return UtcNowProvider();
 
-            // Measured offset of the process that wrote this file.
-            TimeSpan measured;
-            DateTime calibrated;
-            if (_currentSourceFileName != null
-                && OffsetCalibrator.TryGetOffset(_currentSourceFileName, out measured)
-                && OffsetCalibrator.TryResolveUtc(_currentSourceFileName, entry.LocalTimestamp, out calibrated))
+            // ERA-AWARE RESOLUTION (2026-08-20, second attempt): a FRESH line anchors ITSELF.
+            //
+            // The first attempt (e9dba11b, reverted in 04b1a7c6) applied one measured offset per
+            // FILE — wrong, because a single log file holds lines from multiple writer eras:
+            // AgentExecutor.log is written by short-lived child processes whose zone belief
+            // flips per process, interleaved in one file (fixture
+            // tests/fixtures/cmtrace-logs/agentexecutor-two-writer-eras-v1.cmtrace). Any
+            // cross-line anchor — per file, or nearest-in-write-order — inherits that trap.
+            //
+            // Per-line self-anchoring does not: at a 100 ms poll every line of a growing pass
+            // was written essentially "now", so its own distance to the agent clock IS its
+            // writer's offset, era by era. The line's timestamp still contributes the sub-poll
+            // precision and ordering (two lines 6 ms apart stay 6 ms apart — a plain
+            // occurredAt=now could not do that), while the offset grid absorbs poll latency.
+            // Freshness is load-bearing (see FreshLineMaxAge) — backlog passes, restart
+            // catch-up and replay logs must never anchor, because an old line's AGE can round
+            // onto the grid.
+            if (_currentPassLinesAreFresh)
             {
-                origin = CmTraceOffsetOrigin.Calibrated;
-                offsetMinutes = (int)measured.TotalMinutes;
-                return calibrated;
+                TimeSpan lineOffset;
+                if (CmTraceOffsetCalibrator.TryMeasureOffset(entry.LocalTimestamp, UtcNowProvider(), out lineOffset))
+                {
+                    origin = CmTraceOffsetOrigin.LineAnchored;
+                    offsetMinutes = (int)lineOffset.TotalMinutes;
+                    return DateTime.SpecifyKind(entry.LocalTimestamp - lineOffset, DateTimeKind.Utc);
+                }
             }
 
-            // Not calibrated yet (first growing pass, or a file that never grows while we watch).
-            // Falls back to this process's zone, which is right only if the writer happens to
-            // share our belief. Origin stays None so the emitted event says so.
+            // Fallback for everything not provably fresh: assume the reader's zone, UNIFORMLY.
+            // Wrong in absolute terms whenever the writer held a different belief, but
+            // self-consistent — both ends of a duration are wrong by the same amount, so derived
+            // durations stay right. That asymmetry is the lesson of the 04b1a7c6 revert:
+            // partially corrected is strictly worse than uniformly wrong. Origin stays None so
+            // the emitted event says so.
+            var readerZoneOffset = TimeZoneInfo.Local.GetUtcOffset(entry.LocalTimestamp);
+            offsetMinutes = (int)readerZoneOffset.TotalMinutes;
             return CmTraceLogParser.ResolveUtcAssumingReaderZone(entry.LocalTimestamp);
         }
 
+        // Field-forensics (tripwire, 2026-08-20): sessions e9753578 and 067797d8 both logged a
+        // measurement whose LABEL and ANCHOR could not have come from the same file iteration —
+        // 067797d8's anchor value (19:51:26.948) does not even exist in ANY log file on the
+        // device, and IntuneManagementExtension.log never produced its expected first
+        // measurement at all. Mechanism unexplained; resolution is immune (per-line anchoring),
+        // but the observational layer must convict the culprit on the next occurrence. Hence:
+        // the stream's file name travels alongside the label (a mismatch is THE smoking gun),
+        // and the first rejected anchor per file becomes visible instead of silent.
+        private readonly HashSet<string> _calibrationRejectLogged = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
         /// <summary>
         /// Feed the pass's newest bias-less line to the calibrator and report a measured offset
         /// that disagrees with this process's own zone — that disagreement is precisely the
         /// condition that used to corrupt every IME-derived timestamp silently.
         /// </summary>
-        private void CalibrateFrom(string sourceFileName, CmTraceLogEntry anchor)
+        /// <param name="sourceFileName">The calibration key (<c>_currentSourceFileName</c>).</param>
+        /// <param name="streamFileName">The file the enclosing iteration actually read. Must equal
+        /// <paramref name="sourceFileName"/> — logged loudly when it does not (see tripwire note).</param>
+        private void CalibrateFrom(string sourceFileName, string streamFileName, CmTraceLogEntry anchor)
         {
+            if (!string.Equals(sourceFileName, streamFileName, StringComparison.OrdinalIgnoreCase))
+            {
+                _logger?.Warning(
+                    $"ImeLogTracker: CALIBRATION LABEL MISMATCH — key='{sourceFileName}' but the iteration read '{streamFileName}' " +
+                    $"(anchor local={anchor.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fffffff}). Skipping this anchor; see tripwire note.");
+                return;
+            }
+
             TimeSpan previous;
             var hadOffset = OffsetCalibrator.TryGetOffset(sourceFileName, out previous);
 
             if (!OffsetCalibrator.TryCalibrate(sourceFileName, anchor.LocalTimestamp, UtcNowProvider()))
+            {
+                // Once per file: why a file that visibly grows never produces a measurement.
+                // 067797d8 ran 24 s of growing IME.log passes with no measurement at all — this
+                // silence is exactly what made the phenomenon undiagnosable from the log.
+                if (_calibrationRejectLogged.Add(sourceFileName))
+                {
+                    _logger?.Debug(
+                        $"ImeLogTracker: {sourceFileName} anchor rejected by calibrator " +
+                        $"(anchor local={anchor.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fffffff}, now={UtcNowProvider():HH:mm:ss.fff}Z) — first rejection for this file, further ones stay silent.");
+                }
                 return;
+            }
 
             TimeSpan measured;
             if (!OffsetCalibrator.TryGetOffset(sourceFileName, out measured)) return;
             if (hadOffset && measured == previous) return;
 
+            // The anchor's local timestamp is part of the record ON PURPOSE (tripwire, 2026-08-20):
+            // session e9753578 logged "+02:00 measured for IntuneManagementExtension.log" although
+            // that file provably held no +2-era line — an anchor/label pairing the committed code
+            // could not be shown to produce. Should it ever happen again, the logged anchor value
+            // itself will prove (or refute) the crossing without needing the device's log files.
             var readerZoneOffset = TimeZoneInfo.Local.GetUtcOffset(UtcNowProvider());
             if (measured == readerZoneOffset)
             {
                 _logger?.Debug(
-                    $"ImeLogTracker: {sourceFileName} writer offset measured {measured} (matches this process).");
+                    $"ImeLogTracker: {sourceFileName} writer offset measured {measured} (matches this process, anchor local={anchor.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fff}).");
                 return;
             }
 
             _logger?.Info(
                 $"ImeLogTracker: {sourceFileName} writer offset measured {measured}, this process believes {readerZoneOffset} " +
-                $"— timestamps from this file are corrected by {(measured - readerZoneOffset).Negate()}.");
+                $"(anchor local={anchor.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fff}). Measurement is observational — resolution anchors per line.");
         }
 
     }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -103,6 +103,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// </summary>
         private string _currentSourceFileName;
 
+        /// <summary>
+        /// Whether every line of the file iteration currently in flight is provably FRESH —
+        /// written after the previous look at this file, which happened at most
+        /// <see cref="FreshLineMaxAge"/> ago in THIS process. Only then may a line anchor its
+        /// own UTC offset (<see cref="CmTraceOffsetCalibrator.TryMeasureOffset"/>): the grid
+        /// rounding is safe when the line's age is bounded by seconds, and becomes a trap on
+        /// backlog whose age can hit an exact grid multiple. Same single-task justification as
+        /// <see cref="_currentSourceFileName"/>.
+        /// </summary>
+        private bool _currentPassLinesAreFresh;
+
+        /// <summary>
+        /// Maximum gap between two looks at a file for its new bytes to count as fresh. Far
+        /// above the 100 ms poll (rides out GC pauses and ESP CPU starvation), far below the
+        /// 13-minute danger zone where a line's AGE could round onto the 15-minute offset grid.
+        /// </summary>
+        internal static readonly TimeSpan FreshLineMaxAge = TimeSpan.FromSeconds(30);
+
         internal static DateTime NormalizeUtc(DateTime value) =>
             value.Kind == DateTimeKind.Utc ? value : DateTime.SpecifyKind(value, DateTimeKind.Utc);
 
@@ -228,6 +246,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <summary>How that offset was arrived at — declared, measured, or neither.</summary>
         public CmTraceOffsetOrigin LastMatchedSourceOffsetOrigin { get; internal set; }
 
+        /// <summary>
+        /// The offset the calibrator MEASURED for the source file, which is not necessarily the
+        /// one applied.
+        /// <para>
+        /// Since the 2026-08-20 revert the measurement is observational only: it is recorded so the
+        /// field tells us what an era-aware calibrator would have to work with, without acting on
+        /// it. Reported separately from <see cref="LastMatchedSourceOffsetMinutes"/> precisely so
+        /// the two can never be confused — that event said "calibrated" while carrying a wrong
+        /// value, and an honest record has to distinguish measured from applied.
+        /// </para>
+        /// </summary>
+        public int? LastMatchedMeasuredWriterOffsetMinutes { get; internal set; }
+
         // Callbacks to EnrollmentTracker
         public Action<string> OnEspPhaseChanged { get; set; }
         public Action<string> OnImeAgentVersion { get; set; }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/LogFilePositionTracker.cs

@@ -65,6 +65,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             state.LastReadTime = DateTime.UtcNow;
         }
 
+        /// <summary>
+        /// Records that the file was looked at in a poll pass — whether or not it had new data.
+        /// Creates the entry on first sight (position 0), so a file first seen EMPTY counts as
+        /// observed and its first content is provably fresh.
+        /// <para>
+        /// This timestamp is the freshness reference for per-line offset anchoring: bytes found
+        /// in the NEXT pass were written after this instant, so
+        /// <c>now - LastCheckedUtc</c> bounds the age of every line in that pass's chunk.
+        /// The caller supplies the clock (the tracker's <c>UtcNowProvider</c>) so replay/test
+        /// clocks stay consistent with the freshness comparison.
+        /// </para>
+        /// </summary>
+        public void MarkChecked(string filePath, DateTime nowUtc)
+        {
+            FilePositionState state;
+            if (!_positions.TryGetValue(filePath, out state))
+            {
+                state = new FilePositionState();
+                _positions[filePath] = state;
+            }
+
+            state.LastCheckedUtc = nowUtc;
+        }
+
+        /// <summary>
+        /// When the file was last looked at, or <see cref="DateTime.MinValue"/> when it never
+        /// was in THIS process — including entries restored from persisted state, whose
+        /// bookmark survives an agent restart but whose freshness deliberately does not
+        /// (the restart gap can hold arbitrarily old backlog).
+        /// </summary>
+        public DateTime GetLastCheckedUtc(string filePath)
+        {
+            FilePositionState state;
+            return _positions.TryGetValue(filePath, out state) ? state.LastCheckedUtc : DateTime.MinValue;
+        }
+
         /// <summary>
         /// Gets the stored position for a file, or 0 if not tracked.
         /// Does not perform rollover detection.
@@ -89,6 +125,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <summary>
         /// Restores a previously persisted position for a file.
         /// Used on agent restart to continue reading from the last known position.
+        /// <para>
+        /// <see cref="FilePositionState.LastCheckedUtc"/> is deliberately NOT restored: the
+        /// bookmark survives the restart, the freshness guarantee does not — the first pass
+        /// after a restart reads the whole downtime backlog and must never anchor per-line
+        /// offsets on it.
+        /// </para>
         /// </summary>
         public void RestorePosition(string filePath, long position, long lastKnownSize)
         {
@@ -96,7 +138,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 Position = position,
                 LastKnownSize = lastKnownSize,
-                LastReadTime = DateTime.UtcNow
+                LastReadTime = DateTime.UtcNow,
+                LastCheckedUtc = DateTime.MinValue
             };
         }
     }
@@ -106,5 +149,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         public long Position { get; set; }
         public long LastKnownSize { get; set; }
         public DateTime LastReadTime { get; set; }
+
+        /// <summary>
+        /// When this file was last looked at by a poll pass IN THIS PROCESS. In-memory only —
+        /// never persisted, so a restart resets it (see <see cref="LogFilePositionTracker.RestorePosition"/>).
+        /// </summary>
+        public DateTime LastCheckedUtc { get; set; }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/PowerStateTransitionTracker.cs

@@ -0,0 +1,197 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Runtime;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
+{
+    /// <summary>
+    /// Pure state machine behind <c>PowerStateWatcherHost</c>: diffs successive
+    /// <see cref="PowerStateResult"/> snapshots into <c>power_state_change</c> emissions.
+    /// No WMI, no timers, no logging — fully deterministic and unit-testable.
+    /// <para>
+    /// Semantics:
+    /// <list type="bullet">
+    ///   <item><b>AC↔battery transitions</b> — one emission per accepted edge
+    ///         (<c>ac_to_battery</c> Warning/immediate, <c>battery_to_ac</c> Info).</item>
+    ///   <item><b>Threshold ladder</b> (default 50/30/15 %) — evaluated only while ON battery;
+    ///         each level latches once per tracker lifetime (no re-emit when the device charges
+    ///         back up and drains again — avoids plug-cycle alarm spam). A multi-level jump
+    ///         emits only the LOWEST newly-crossed level. Entering battery power already below
+    ///         a level counts as crossing it (covers "unplugged at 12 %" and, via
+    ///         <see cref="Baseline"/>, "enrollment started at 12 %").</item>
+    ///   <item><b>Storm cap</b> — a lifetime emission cap (default 20) as backstop against a
+    ///         flapping dock / dying battery controller; <see cref="EmissionCapReached"/> flips
+    ///         once so the host can log a single warning.</item>
+    /// </list>
+    /// A snapshot with <see cref="PowerStateResult.ProbeError"/> is ignored (previous state
+    /// preserved); a null <see cref="PowerStateResult.BatteryPercent"/> skips threshold
+    /// evaluation but AC diffing still works.
+    /// </para>
+    /// </summary>
+    internal sealed class PowerStateTransitionTracker
+    {
+        public const string TransitionAcToBattery = "ac_to_battery";
+        public const string TransitionBatteryToAc = "battery_to_ac";
+        public const string TransitionThresholdCrossed = "threshold_crossed";
+
+        internal static readonly int[] DefaultThresholdLadder = { 50, 30, 15 };
+        internal const int DefaultMaxEmissions = 20;
+
+        private readonly int[] _ladder;              // strictly descending
+        private readonly int _maxEmissions;
+        private readonly HashSet<int> _latchedLevels = new HashSet<int>();
+
+        private bool _hasState;
+        private bool _lastOnAc;
+        private int _emitted;
+
+        public PowerStateTransitionTracker(IReadOnlyList<int>? thresholdLadder = null, int maxEmissions = DefaultMaxEmissions)
+        {
+            _ladder = (thresholdLadder ?? DefaultThresholdLadder).OrderByDescending(l => l).ToArray();
+            _maxEmissions = maxEmissions;
+        }
+
+        /// <summary>True once the lifetime emission cap suppressed at least one emission.</summary>
+        public bool EmissionCapReached { get; private set; }
+
+        /// <summary>
+        /// Latches the arm-time state silently — except when the device is already on battery
+        /// at/below a ladder level, which yields one threshold emission for the lowest crossed
+        /// level (an enrollment STARTING at 12 % must still produce the event the analyze rule
+        /// matches on). No AC-transition emission is ever produced from a baseline.
+        /// </summary>
+        public IReadOnlyList<PowerStateEmission> Baseline(PowerStateResult probe)
+        {
+            if (probe == null || probe.ProbeError != null || !probe.HasBattery)
+                return Array.Empty<PowerStateEmission>();
+
+            _hasState = true;
+            _lastOnAc = probe.OnAcPower;
+
+            var emissions = new List<PowerStateEmission>();
+            EvaluateThresholds(probe, emissions);
+            return emissions;
+        }
+
+        /// <summary>
+        /// Diffs a fresh (host-debounced) snapshot against the last accepted state and returns
+        /// 0..n emissions — an AC transition and a threshold crossing can co-occur (unplugged
+        /// at 10 % ⇒ <c>ac_to_battery</c> + <c>threshold_crossed:15</c>).
+        /// </summary>
+        public IReadOnlyList<PowerStateEmission> Evaluate(PowerStateResult probe)
+        {
+            if (probe == null || probe.ProbeError != null)
+                return Array.Empty<PowerStateEmission>();
+            if (!_hasState)
+                return Baseline(probe);
+
+            var emissions = new List<PowerStateEmission>();
+
+            if (_lastOnAc && !probe.OnAcPower)
+            {
+                Emit(emissions, new PowerStateEmission(
+                    transition: TransitionAcToBattery,
+                    thresholdPercent: null,
+                    probe: probe,
+                    severity: EventSeverity.Warning,
+                    immediateUpload: true,
+                    message: $"Power source switched from AC to battery ({FormatPercent(probe)} remaining) during enrollment"));
+            }
+            else if (!_lastOnAc && probe.OnAcPower)
+            {
+                Emit(emissions, new PowerStateEmission(
+                    transition: TransitionBatteryToAc,
+                    thresholdPercent: null,
+                    probe: probe,
+                    severity: EventSeverity.Info,
+                    immediateUpload: false,
+                    message: $"Power source switched back to AC ({FormatPercent(probe)}{(probe.IsCharging ? ", charging" : string.Empty)})"));
+            }
+
+            _lastOnAc = probe.OnAcPower;
+            EvaluateThresholds(probe, emissions);
+            return emissions;
+        }
+
+        /// <summary>
+        /// While on battery with a known percentage: emit the LOWEST ladder level at/above the
+        /// current charge that is not yet latched, then latch every level at/above the charge
+        /// (a 60 %→10 % jump emits threshold 15 only, latching 50/30/15).
+        /// </summary>
+        private void EvaluateThresholds(PowerStateResult probe, List<PowerStateEmission> emissions)
+        {
+            if (probe.OnAcPower || !probe.BatteryPercent.HasValue) return;
+            var percent = probe.BatteryPercent.Value;
+
+            int? lowestCrossed = null;
+            foreach (var level in _ladder) // descending — the last match is the lowest crossed level
+            {
+                if (percent <= level && !_latchedLevels.Contains(level))
+                    lowestCrossed = level;
+            }
+            if (!lowestCrossed.HasValue) return;
+
+            foreach (var level in _ladder)
+            {
+                if (percent <= level) _latchedLevels.Add(level);
+            }
+
+            var threshold = lowestCrossed.Value;
+            var severity = threshold <= 15 ? EventSeverity.Error
+                         : threshold <= 30 ? EventSeverity.Warning
+                         : EventSeverity.Info;
+            Emit(emissions, new PowerStateEmission(
+                transition: TransitionThresholdCrossed,
+                thresholdPercent: threshold,
+                probe: probe,
+                severity: severity,
+                immediateUpload: severity >= EventSeverity.Warning,
+                message: $"Battery dropped below {threshold}% ({FormatPercent(probe)} remaining) while enrolling on battery power"));
+        }
+
+        private void Emit(List<PowerStateEmission> emissions, PowerStateEmission emission)
+        {
+            if (_emitted >= _maxEmissions)
+            {
+                EmissionCapReached = true;
+                return;
+            }
+            _emitted++;
+            emissions.Add(emission);
+        }
+
+        private static string FormatPercent(PowerStateResult probe)
+            => probe.BatteryPercent.HasValue ? $"battery {probe.BatteryPercent.Value}%" : "battery level unknown";
+    }
+
+    /// <summary>One decided <c>power_state_change</c> emission — the host maps this 1:1 onto an event.</summary>
+    internal sealed class PowerStateEmission
+    {
+        public PowerStateEmission(string transition, int? thresholdPercent, PowerStateResult probe,
+            EventSeverity severity, bool immediateUpload, string message)
+        {
+            Transition = transition;
+            ThresholdPercent = thresholdPercent;
+            OnAcPower = probe.OnAcPower;
+            BatteryPercent = probe.BatteryPercent;
+            IsCharging = probe.IsCharging;
+            BatteryLifeMinutes = probe.BatteryLifeMinutes;
+            Severity = severity;
+            ImmediateUpload = immediateUpload;
+            Message = message;
+        }
+
+        public string Transition { get; }
+        public int? ThresholdPercent { get; }
+        public bool OnAcPower { get; }
+        public int? BatteryPercent { get; }
+        public bool IsCharging { get; }
+        public int? BatteryLifeMinutes { get; }
+        public EventSeverity Severity { get; }
+        public bool ImmediateUpload { get; }
+        public string Message { get; }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/SystemTimelineTracker.cs

@@ -0,0 +1,681 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Eventing.Reader;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Xml.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
+{
+    /// <summary>
+    /// Watches the <c>System</c> event log for two enrollment blind spots and forwards them as
+    /// timeline ground truth:
+    /// <list type="bullet">
+    ///   <item><b>System clock steps</b> (Kernel-General EventID 1) → <c>system_clock_changed</c>.
+    ///         The payload carries <c>oldTime</c>/<c>newTime</c>/<c>timeDeltaMs</c> plus the
+    ///         setting process — the "clock set from X to Y" fact that today has to be inferred
+    ///         from timestamp discontinuities. w32time also logs frequent 1 ms micro-slews on the
+    ///         same EventID, so emissions are gated on <see cref="MinClockDeltaMs"/>.</item>
+    ///   <item><b>Completed sleep episodes</b> → <c>system_sleep_episode</c>. Classic S3/S4 comes
+    ///         from Power-Troubleshooter EventID 1 (one event per episode at wake, carrying
+    ///         SleepTime + WakeTime). Modern Standby comes from Kernel-Power EventID 507 (exit),
+    ///         whose payload carries the scenario duration and the actual sleep residency; the
+    ///         enter time is derived as exit − duration. Kernel-Power 506 (enter) is deliberately
+    ///         NOT consumed: 507 already carries everything, and pairing 506/507 would need an
+    ///         orphan-tolerant state machine across agent restarts for zero information gain —
+    ///         an episode without a 507 never completed and would not be emitted under any design.</item>
+    /// </list>
+    /// <para>
+    /// <b>Payload times are authoritative.</b> The decisive clock correction (w32time fixing a
+    /// wrong BIOS clock) happens exactly when the device clock is untrustworthy, and the backend
+    /// clamps implausible event timestamps to server time. All semantic instants therefore travel
+    /// as explicit ISO-8601 payload fields, never only as the event's own <c>Timestamp</c>.
+    /// </para>
+    /// <para>
+    /// <b>Backfill + cross-restart dedup</b> mirror <see cref="WindowsUpdateTracker"/>: the System
+    /// .evtx persists across the OOBE reboots, so a startup scan recovers pre-agent clock steps
+    /// and standby episodes; a persisted RecordId watermark plus an intra-run seen-set (a HashSet,
+    /// NOT a high-water mark — see the field comment) keep restarts from re-emitting.
+    /// </para>
+    /// </summary>
+    internal sealed class SystemTimelineTracker : IDisposable
+    {
+        internal const string Channel = "System";
+
+        internal const string ProviderKernelGeneral       = "Microsoft-Windows-Kernel-General";       // EventID 1: system time changed
+        internal const string ProviderPowerTroubleshooter = "Microsoft-Windows-Power-Troubleshooter"; // EventID 1: resumed from classic sleep/hibernate
+        internal const string ProviderKernelPower         = "Microsoft-Windows-Kernel-Power";         // EventID 507: Modern Standby exit
+
+        internal const int EventId_ClockChange       = 1;
+        internal const int EventId_ClassicResume     = 1;
+        internal const int EventId_ModernStandbyExit = 507;
+
+        internal const string WatermarkStateFileName = "system-timeline-watermark.json";
+
+        // w32time logs Kernel-General 1 for routine 1 ms slew corrections (verified live: several
+        // per hour). Only genuine steps are timeline-relevant; anything below this is claimed in
+        // the dedup set but never emitted.
+        internal const long MinClockDeltaMs = 2000;
+
+        // A step of at least 5 minutes can invalidate token/cert validation windows and visibly
+        // reorders the timeline (matches the web's TimeJumpBadge threshold) — surface it fast.
+        internal const long ClockDeltaWarningMs = 5 * 60 * 1000;
+
+        // Modern Standby logs a 506/507 pair for every screen-off scenario, including seconds-long
+        // ones where the device never actually slept (SleepDurationInUs 0). Only episodes with
+        // real sleep residency are emitted. Classic Power-Troubleshooter episodes have no floor:
+        // they only exist for genuinely completed S3/S4 transitions.
+        internal const long MinSleepDurationSeconds = 60;
+
+        private readonly AgentLogger _logger;
+        private readonly string _sessionId;
+        private readonly string _tenantId;
+        private readonly InformationalEventPost _post;
+        private readonly bool _backfillEnabled;
+        private readonly int _backfillLookbackMinutes;
+        private readonly string _stateDirectory;
+
+        private EventLogWatcher _watcher;
+
+        // Dedup. Guarded because EventRecordWritten callbacks run concurrently with the backfill scan.
+        //
+        // Cross-restart boundary loaded from disk: the highest RecordId emitted in a PRIOR run.
+        // Immutable during this run — records at/below it were already emitted before this process
+        // started and must not be re-emitted by the backfill scan.
+        private long _restartWatermark = -1;
+        // RecordIds claimed in THIS run — the intra-run dedup set. Deliberately a HashSet, NOT a
+        // high-water mark: the live watcher is armed before the backfill runs, so a live record with
+        // a HIGHER RecordId can be processed before/during backfill. A high-water mark would then
+        // make the dedup skip every older, never-emitted backfill record — silently dropping exactly
+        // the pre-agent clock corrections and standby episodes this tracker exists for. The targeted
+        // records are low-volume, so the set stays tiny.
+        private readonly HashSet<long> _seenThisRun = new HashSet<long>();
+        // Highest RecordId claimed so far (max of restart watermark + this run). Persisted so the
+        // next run's restart watermark is correct.
+        private long _maxEmittedRecordId = -1;
+        private readonly object _watermarkLock = new object();
+
+        public SystemTimelineTracker(
+            string sessionId,
+            string tenantId,
+            InformationalEventPost post,
+            AgentLogger logger,
+            bool backfillEnabled = true,
+            int backfillLookbackMinutes = 1440,
+            string stateDirectory = null)
+        {
+            _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
+            _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
+            _post = post ?? throw new ArgumentNullException(nameof(post));
+            _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+            _backfillEnabled = backfillEnabled;
+            _backfillLookbackMinutes = backfillLookbackMinutes;
+            _stateDirectory = stateDirectory != null ? Environment.ExpandEnvironmentVariables(stateDirectory) : null;
+        }
+
+        public void Start()
+        {
+            LoadWatermark();
+            StartWatcher();
+
+            if (_backfillEnabled && _backfillLookbackMinutes > 0)
+                BackfillRecentEvents();
+            else
+                _logger.Info("SystemTimeline backfill disabled by config");
+        }
+
+        public void Stop()
+        {
+            if (_watcher == null) return;
+            try
+            {
+                _watcher.Enabled = false;
+                _watcher.Dispose();
+                _logger.Info("SystemTimeline watcher stopped");
+            }
+            catch (Exception ex)
+            {
+                _logger.Error("Error stopping SystemTimeline watcher", ex);
+            }
+            finally
+            {
+                _watcher = null;
+            }
+        }
+
+        public void Dispose() => Stop();
+
+        // -----------------------------------------------------------------------
+        // Watcher lifecycle
+        // -----------------------------------------------------------------------
+
+        private void StartWatcher()
+        {
+            try
+            {
+                var query = new EventLogQuery(Channel, PathType.LogName, BuildXPath());
+                _watcher = new EventLogWatcher(query);
+                _watcher.EventRecordWritten += OnEventRecordWritten;
+                _watcher.Enabled = true;
+                _logger.Info($"SystemTimeline watcher started: {Channel} (clock changes + sleep episodes)");
+            }
+            catch (EventLogNotFoundException)
+            {
+                _logger.Warning($"SystemTimeline event log not found: {Channel} (normal on non-Windows test environments)");
+            }
+            catch (UnauthorizedAccessException ex)
+            {
+                _logger.Warning($"SystemTimeline watcher access denied for {Channel}: {ex.Message}");
+            }
+            catch (Exception ex)
+            {
+                _logger.Error($"Failed to start SystemTimeline watcher for {Channel}", ex);
+                CollectorDegradationReporter.Report(_post, _sessionId, _tenantId,
+                    collectorName: "SystemTimelineTracker", reason: $"watcher_arm_failed:{Channel}", ex: ex);
+            }
+        }
+
+        /// <summary>
+        /// Provider-qualified XPath for the three targeted signals. Provider filtering is mandatory
+        /// on the System channel — EventID 1 alone matches many unrelated providers.
+        /// Exposed as internal for tests.
+        /// </summary>
+        internal static string BuildXPath() =>
+            "*[System[" + ProviderIdClauses() + "]]";
+
+        /// <summary>Backfill variant of <see cref="BuildXPath"/> with the lookback window applied.</summary>
+        internal static string BuildBackfillXPath(long lookbackMs) =>
+            "*[System[(" + ProviderIdClauses() + $") and TimeCreated[timediff(@SystemTime) <= {lookbackMs}]]]";
+
+        private static string ProviderIdClauses() =>
+            $"(Provider[@Name='{ProviderKernelGeneral}'] and EventID={EventId_ClockChange})" +
+            $" or (Provider[@Name='{ProviderPowerTroubleshooter}'] and EventID={EventId_ClassicResume})" +
+            $" or (Provider[@Name='{ProviderKernelPower}'] and EventID={EventId_ModernStandbyExit})";
+
+        // -----------------------------------------------------------------------
+        // Event processing
+        // -----------------------------------------------------------------------
+
+        private void OnEventRecordWritten(object sender, EventRecordWrittenEventArgs e)
+        {
+            if (e.EventRecord == null) return;
+            try
+            {
+                ProcessRecord(e.EventRecord, isBackfill: false);
+            }
+            catch (Exception ex)
+            {
+                _logger.Error("Error processing SystemTimeline event", ex);
+            }
+        }
+
+        private void ProcessRecord(EventRecord record, bool isBackfill)
+        {
+            var recordId = record.RecordId ?? -1;
+
+            // Cheap dedup gate BEFORE the XML rendering work.
+            if (IsAlreadyProcessed(recordId))
+                return;
+
+            string xml = null;
+            try { xml = record.ToXml(); }
+            catch { /* fall through with empty EventData */ }
+
+            ProcessEvent(
+                providerName: record.ProviderName,
+                eventId: record.Id,
+                recordId: recordId,
+                timeCreatedUtc: record.TimeCreated?.ToUniversalTime(),
+                eventData: ParseEventData(xml),
+                isBackfill: isBackfill);
+        }
+
+        /// <summary>
+        /// Core processing extracted to primitive inputs so tests can drive it without synthesizing
+        /// an abstract, Windows-only <see cref="EventRecord"/> (WindowsUpdateTracker test-seam
+        /// pattern; a plain dictionary instead of named args because three providers with ~10
+        /// payload fields each make a fixed signature impractical).
+        /// </summary>
+        internal void ProcessEvent(
+            string providerName,
+            int eventId,
+            long recordId,
+            DateTime? timeCreatedUtc,
+            Dictionary<string, string> eventData,
+            bool isBackfill)
+        {
+            if (!MarkProcessed(recordId))
+                return; // already emitted (cross-restart or duplicate delivery)
+
+            eventData = eventData ?? new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
+            if (string.Equals(providerName, ProviderKernelGeneral, StringComparison.OrdinalIgnoreCase) && eventId == EventId_ClockChange)
+                HandleClockChange(recordId, timeCreatedUtc, eventData, isBackfill);
+            else if (string.Equals(providerName, ProviderPowerTroubleshooter, StringComparison.OrdinalIgnoreCase) && eventId == EventId_ClassicResume)
+                HandleClassicResume(recordId, timeCreatedUtc, eventData, isBackfill);
+            else if (string.Equals(providerName, ProviderKernelPower, StringComparison.OrdinalIgnoreCase) && eventId == EventId_ModernStandbyExit)
+                HandleModernStandbyExit(recordId, timeCreatedUtc, eventData, isBackfill);
+            // Anything else slipped past the XPath filter — ignore.
+        }
+
+        // -----------------------------------------------------------------------
+        // system_clock_changed (Kernel-General EventID 1)
+        // -----------------------------------------------------------------------
+
+        private void HandleClockChange(long recordId, DateTime? timeCreatedUtc, Dictionary<string, string> eventData, bool isBackfill)
+        {
+            eventData.TryGetValue("NewTime", out var newTimeRaw);
+            eventData.TryGetValue("OldTime", out var oldTimeRaw);
+            var newTime = TryParseUtc(newTimeRaw);
+            var oldTime = TryParseUtc(oldTimeRaw);
+
+            // Signed delta preferably from the authoritative instants (NewTime − OldTime carries
+            // the direction unambiguously); TimeDeltaInMs is the fallback when either fails to
+            // parse. Records with neither are unusable and skipped (already claimed by dedup).
+            long deltaMs;
+            if (newTime.HasValue && oldTime.HasValue)
+            {
+                deltaMs = (long)Math.Round((newTime.Value - oldTime.Value).TotalMilliseconds);
+            }
+            else if (eventData.TryGetValue("TimeDeltaInMs", out var deltaRaw) &&
+                long.TryParse(deltaRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var parsedDelta))
+            {
+                deltaMs = parsedDelta;
+            }
+            else
+            {
+                _logger.Debug($"SystemTimeline: clock-change record {recordId} has no usable times/delta — skipped");
+                return;
+            }
+
+            if (Math.Abs(deltaMs) < MinClockDeltaMs)
+                return; // w32time micro-slew — claimed (MarkProcessed) but never emitted
+
+            eventData.TryGetValue("Reason", out var reasonRaw);
+            int.TryParse(reasonRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var reason);
+            var reasonText = reason == 1 ? "application_set"
+                : reason == 2 ? "hardware_clock_sync"
+                : "unknown";
+
+            eventData.TryGetValue("ProcessName", out var processName);
+
+            var data = new Dictionary<string, object>
+            {
+                { "timeDeltaMs", deltaMs },
+                { "reason", reason },
+                { "reasonText", reasonText },
+                { "backfilled", isBackfill },
+            };
+            // Authoritative instants: re-normalized ISO-8601 when parseable, raw pass-through
+            // otherwise — the payload must survive even a malformed provider rendering.
+            data["newTime"] = newTime.HasValue ? newTime.Value.ToString("o") : (object)(newTimeRaw ?? string.Empty);
+            data["oldTime"] = oldTime.HasValue ? oldTime.Value.ToString("o") : (object)(oldTimeRaw ?? string.Empty);
+            if (recordId >= 0) data["recordId"] = recordId;
+            if (timeCreatedUtc.HasValue) data["timeCreated"] = timeCreatedUtc.Value.ToString("o");
+            if (!string.IsNullOrEmpty(processName)) data["processName"] = processName;
+            if (eventData.TryGetValue("ProcessID", out var pidRaw) &&
+                int.TryParse(pidRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var pid))
+            {
+                data["processId"] = pid;
+            }
+
+            var direction = deltaMs >= 0 ? "forward" : "backward";
+            var processLeaf = ProcessLeafName(processName);
+            var message = $"System clock stepped {direction} {FormatDuration(TimeSpan.FromMilliseconds(Math.Abs(deltaMs)))}" +
+                $" (reason: {reasonText}" + (processLeaf != null ? $", process: {processLeaf})" : ")");
+
+            var isLargeStep = Math.Abs(deltaMs) >= ClockDeltaWarningMs;
+            _post.Emit(new EnrollmentEvent
+            {
+                SessionId = _sessionId,
+                TenantId = _tenantId,
+                // The record's own creation time, not UtcNow: backfilled pre-agent clock steps must
+                // land on the timeline where they happened (WindowsUpdateTracker convention).
+                Timestamp = timeCreatedUtc ?? DateTime.UtcNow,
+                EventType = Constants.EventTypes.SystemClockChanged,
+                Severity = isLargeStep ? EventSeverity.Warning : EventSeverity.Info,
+                Source = "SystemTimelineWatcher",
+                Phase = EnrollmentPhase.Unknown,
+                Message = message,
+                Data = data,
+                ImmediateUpload = isLargeStep,
+            });
+        }
+
+        // -----------------------------------------------------------------------
+        // system_sleep_episode — classic sleep/hibernate (Power-Troubleshooter EventID 1)
+        // -----------------------------------------------------------------------
+
+        private void HandleClassicResume(long recordId, DateTime? timeCreatedUtc, Dictionary<string, string> eventData, bool isBackfill)
+        {
+            eventData.TryGetValue("SleepTime", out var sleepRaw);
+            eventData.TryGetValue("WakeTime", out var wakeRaw);
+            var enteredAt = TryParseUtc(sleepRaw);
+            var exitedAt = TryParseUtc(wakeRaw);
+
+            // EffectiveState 5 = hibernate (S4); TargetState is the fallback when the effective
+            // state is missing (older event versions).
+            eventData.TryGetValue("EffectiveState", out var effectiveState);
+            eventData.TryGetValue("TargetState", out var targetState);
+            var stateValue = !string.IsNullOrEmpty(effectiveState) ? effectiveState : targetState;
+            var kind = stateValue == "5" ? "hibernate" : "sleep";
+
+            long? durationSeconds = null;
+            if (enteredAt.HasValue && exitedAt.HasValue && exitedAt.Value > enteredAt.Value)
+                durationSeconds = (long)Math.Round((exitedAt.Value - enteredAt.Value).TotalSeconds);
+
+            var data = new Dictionary<string, object>
+            {
+                { "kind", kind },
+                { "backfilled", isBackfill },
+            };
+            data["enteredAt"] = enteredAt.HasValue ? enteredAt.Value.ToString("o") : (object)(sleepRaw ?? string.Empty);
+            data["exitedAt"] = exitedAt.HasValue ? exitedAt.Value.ToString("o") : (object)(wakeRaw ?? string.Empty);
+            if (durationSeconds.HasValue) data["durationSeconds"] = durationSeconds.Value;
+            if (recordId >= 0) data["recordId"] = recordId;
+            if (timeCreatedUtc.HasValue) data["timeCreated"] = timeCreatedUtc.Value.ToString("o");
+            if (eventData.TryGetValue("WakeSourceType", out var wakeTypeRaw) &&
+                int.TryParse(wakeTypeRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var wakeType))
+            {
+                data["wakeSourceType"] = wakeType;
+            }
+            eventData.TryGetValue("WakeSourceText", out var wakeText);
+            if (!string.IsNullOrEmpty(wakeText)) data["wakeSourceText"] = wakeText;
+
+            var durationLabel = durationSeconds.HasValue
+                ? " after " + FormatDuration(TimeSpan.FromSeconds(durationSeconds.Value))
+                : string.Empty;
+            var wakeLabel = !string.IsNullOrEmpty(wakeText) ? $" (wake source: {wakeText})" : string.Empty;
+
+            EmitSleepEpisode(timeCreatedUtc, data,
+                $"Device resumed from {kind}{durationLabel}{wakeLabel}");
+        }
+
+        // -----------------------------------------------------------------------
+        // system_sleep_episode — Modern Standby (Kernel-Power EventID 507)
+        // -----------------------------------------------------------------------
+
+        private void HandleModernStandbyExit(long recordId, DateTime? timeCreatedUtc, Dictionary<string, string> eventData, bool isBackfill)
+        {
+            eventData.TryGetValue("SleepDurationInUs", out var sleepUsRaw);
+            long.TryParse(sleepUsRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var sleepUs);
+            var sleepDurationSeconds = sleepUs / 1_000_000;
+
+            // Every screen-off scenario logs a 507, including seconds-long ones where the device
+            // never slept (SleepDurationInUs 0, incl. SleepEntered=false) — one gate covers both.
+            if (sleepDurationSeconds < MinSleepDurationSeconds)
+                return; // claimed but not an episode worth the timeline
+
+            eventData.TryGetValue("DurationInUs", out var durationUsRaw);
+            long.TryParse(durationUsRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var durationUs);
+            if (durationUs < sleepUs) durationUs = sleepUs; // scenario duration can never undercut its sleep residency
+
+            var durationSeconds = durationUs / 1_000_000;
+            var exitedAt = timeCreatedUtc; // 507 is written at scenario exit
+            DateTime? enteredAt = exitedAt.HasValue
+                ? exitedAt.Value.AddMilliseconds(-(durationUs / 1000.0))
+                : (DateTime?)null;
+
+            var data = new Dictionary<string, object>
+            {
+                { "kind", "modern_standby" },
+                { "durationSeconds", durationSeconds },
+                { "sleepDurationSeconds", sleepDurationSeconds },
+                { "backfilled", isBackfill },
+            };
+            if (enteredAt.HasValue) data["enteredAt"] = enteredAt.Value.ToString("o");
+            if (exitedAt.HasValue) data["exitedAt"] = exitedAt.Value.ToString("o");
+            if (recordId >= 0) data["recordId"] = recordId;
+            if (timeCreatedUtc.HasValue) data["timeCreated"] = timeCreatedUtc.Value.ToString("o");
+            if (eventData.TryGetValue("Reason", out var reasonRaw) &&
+                int.TryParse(reasonRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var reason))
+            {
+                data["reason"] = reason;
+            }
+            bool? onAcPower = null;
+            if (eventData.TryGetValue("PowerStateAc", out var acRaw) && bool.TryParse(acRaw, out var ac))
+            {
+                onAcPower = ac;
+                data["onAcPower"] = ac;
+            }
+            if (eventData.TryGetValue("BatteryRemainingCapacityOnExit", out var battRaw) &&
+                long.TryParse(battRaw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var batt))
+            {
+                data["batteryRemainingCapacityOnExit"] = batt;
+            }
+
+            var powerLabel = onAcPower.HasValue ? (onAcPower.Value ? ", on AC" : ", on battery") : string.Empty;
+            EmitSleepEpisode(timeCreatedUtc, data,
+                $"Device exited Modern Standby after {FormatDuration(TimeSpan.FromSeconds(durationSeconds))}" +
+                $" (slept {FormatDuration(TimeSpan.FromSeconds(sleepDurationSeconds))}{powerLabel})");
+        }
+
+        private void EmitSleepEpisode(DateTime? timeCreatedUtc, Dictionary<string, object> data, string message)
+        {
+            _post.Emit(new EnrollmentEvent
+            {
+                SessionId = _sessionId,
+                TenantId = _tenantId,
+                // Wake/exit moment (the record's creation time) — backfilled pre-agent episodes
+                // must land on the timeline where the device actually woke.
+                Timestamp = timeCreatedUtc ?? DateTime.UtcNow,
+                EventType = Constants.EventTypes.SystemSleepEpisode,
+                Severity = EventSeverity.Info,
+                Source = "SystemTimelineWatcher",
+                Phase = EnrollmentPhase.Unknown,
+                Message = message,
+                Data = data,
+                ImmediateUpload = false,
+            });
+        }
+
+        // -----------------------------------------------------------------------
+        // Parsing helpers
+        // -----------------------------------------------------------------------
+
+        /// <summary>
+        /// Extracts <c>&lt;Data Name="..."&gt;value&lt;/Data&gt;</c> pairs from an event's rendered
+        /// XML, keyed case-insensitively. Namespace-agnostic (matches on local name). Returns an
+        /// empty map on null/malformed XML — never throws.
+        /// </summary>
+        internal static Dictionary<string, string> ParseEventData(string xml)
+        {
+            var result = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (string.IsNullOrEmpty(xml)) return result;
+
+            try
+            {
+                var doc = XDocument.Parse(xml);
+                foreach (var el in doc.Descendants().Where(e => e.Name.LocalName == "Data"))
+                {
+                    var nameAttr = el.Attribute("Name");
+                    if (nameAttr == null || string.IsNullOrEmpty(nameAttr.Value)) continue;
+                    if (!result.ContainsKey(nameAttr.Value))
+                        result[nameAttr.Value] = el.Value;
+                }
+            }
+            catch
+            {
+                // Malformed / unexpected XML — best effort, return what we have.
+            }
+
+            return result;
+        }
+
+        internal static DateTime? TryParseUtc(string value)
+        {
+            if (string.IsNullOrWhiteSpace(value)) return null;
+            return DateTime.TryParse(value, CultureInfo.InvariantCulture,
+                DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal, out var parsed)
+                ? parsed
+                : (DateTime?)null;
+        }
+
+        /// <summary>Compact human duration for messages: "2h 05m", "56m 12s", "45s".</summary>
+        internal static string FormatDuration(TimeSpan span)
+        {
+            if (span.TotalHours >= 1)
+                return $"{(long)span.TotalHours}h {span.Minutes:D2}m";
+            if (span.TotalMinutes >= 1)
+                return $"{span.Minutes}m {span.Seconds:D2}s";
+            return $"{(long)Math.Ceiling(span.TotalSeconds)}s";
+        }
+
+        /// <summary>Leaf file name of a kernel device path like <c>\Device\HarddiskVolume3\Windows\System32\svchost.exe</c>.</summary>
+        internal static string ProcessLeafName(string devicePath)
+        {
+            if (string.IsNullOrEmpty(devicePath)) return null;
+            var idx = devicePath.LastIndexOf('\\');
+            var leaf = idx >= 0 ? devicePath.Substring(idx + 1) : devicePath;
+            return string.IsNullOrEmpty(leaf) ? null : leaf;
+        }
+
+        // -----------------------------------------------------------------------
+        // Backfill
+        // -----------------------------------------------------------------------
+
+        private void BackfillRecentEvents()
+        {
+            try
+            {
+                var lookbackMs = (long)_backfillLookbackMinutes * 60 * 1000;
+                _logger.Info($"SystemTimeline backfill: scanning {Channel} " +
+                    $"(lookback={_backfillLookbackMinutes}min, restartWatermark={_restartWatermark})");
+
+                var query = new EventLogQuery(Channel, PathType.LogName, BuildBackfillXPath(lookbackMs));
+
+                int processed = 0;
+                using (var reader = new EventLogReader(query))
+                {
+                    EventRecord record;
+                    while ((record = reader.ReadEvent()) != null)
+                    {
+                        using (record)
+                        {
+                            ProcessRecord(record, isBackfill: true);
+                            processed++;
+                        }
+                    }
+                }
+
+                if (processed == 0)
+                    _logger.Debug($"SystemTimeline backfill: no targeted events in last {_backfillLookbackMinutes} minutes");
+                else
+                    _logger.Info($"SystemTimeline backfill: scanned {processed} record(s)");
+            }
+            catch (EventLogNotFoundException)
+            {
+                _logger.Warning($"SystemTimeline event log not found during backfill: {Channel} (normal on non-Windows test environments)");
+            }
+            catch (UnauthorizedAccessException ex)
+            {
+                _logger.Warning($"SystemTimeline backfill access denied: {ex.Message}");
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"SystemTimeline backfill failed: {ex.Message}");
+            }
+        }
+
+        // -----------------------------------------------------------------------
+        // Watermark dedup (cross-restart)
+        // -----------------------------------------------------------------------
+
+        private bool IsAlreadyProcessed(long recordId)
+        {
+            if (recordId < 0) return false; // no RecordId → cannot dedup, let it through
+            lock (_watermarkLock)
+            {
+                return recordId <= _restartWatermark || _seenThisRun.Contains(recordId);
+            }
+        }
+
+        /// <summary>
+        /// Atomically claims <paramref name="recordId"/>. Returns true if this is the first time we
+        /// see it (caller should evaluate/emit), false if it was already processed — either in a
+        /// PRIOR run (at/below the restart watermark) or already this run (in the seen-set). Only
+        /// advances + persists the max on a genuinely-new, higher RecordId. Records without a
+        /// RecordId (-1) are always processed, never tracked or persisted. Note: threshold-suppressed
+        /// records are claimed too, so a restart's backfill does not re-evaluate them.
+        /// </summary>
+        private bool MarkProcessed(long recordId)
+        {
+            if (recordId < 0) return true;
+
+            long toPersist = -1;
+            lock (_watermarkLock)
+            {
+                if (recordId <= _restartWatermark || !_seenThisRun.Add(recordId))
+                    return false;
+
+                if (recordId > _maxEmittedRecordId)
+                {
+                    _maxEmittedRecordId = recordId;
+                    toPersist = _maxEmittedRecordId;
+                }
+            }
+            if (toPersist >= 0) PersistWatermark(toPersist);
+            return true;
+        }
+
+        internal void LoadWatermark()
+        {
+            if (string.IsNullOrEmpty(_stateDirectory)) return;
+
+            var filePath = Path.Combine(_stateDirectory, WatermarkStateFileName);
+            if (!File.Exists(filePath)) return;
+
+            try
+            {
+                var json = File.ReadAllText(filePath);
+                var state = JsonConvert.DeserializeObject<WatermarkState>(json);
+                if (state != null)
+                {
+                    lock (_watermarkLock)
+                    {
+                        _restartWatermark = state.LastRecordId;
+                        _maxEmittedRecordId = state.LastRecordId;
+                    }
+                    _logger.Info($"SystemTimeline watermark loaded: lastRecordId={state.LastRecordId} (persisted {state.PersistedUtc:O})");
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"Failed to load SystemTimeline watermark: {ex.Message}");
+            }
+        }
+
+        private void PersistWatermark(long recordId)
+        {
+            if (string.IsNullOrEmpty(_stateDirectory)) return;
+
+            try
+            {
+                Directory.CreateDirectory(_stateDirectory);
+                var filePath = Path.Combine(_stateDirectory, WatermarkStateFileName);
+                var state = new WatermarkState { LastRecordId = recordId, PersistedUtc = DateTime.UtcNow };
+                var json = JsonConvert.SerializeObject(state, Formatting.Indented);
+                var tempPath = filePath + ".tmp";
+                File.WriteAllText(tempPath, json);
+                File.Copy(tempPath, filePath, overwrite: true);
+                try { File.Delete(tempPath); } catch { }
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"Failed to persist SystemTimeline watermark: {ex.Message}");
+            }
+        }
+
+        internal sealed class WatermarkState
+        {
+            public long LastRecordId { get; set; }
+            public DateTime PersistedUtc { get; set; }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/ArpNativeMethods.cs

@@ -0,0 +1,64 @@
+#nullable enable
+using System;
+using System.Net;
+using System.Net.Sockets;
+using System.Runtime.InteropServices;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
+{
+    /// <summary>
+    /// ARP resolution via <c>iphlpapi!SendARP</c> — resolves the MAC address of an on-link IPv4
+    /// host (in practice: the default gateway). IPv4 only by API design; the OS answers from its
+    /// ARP cache or sends a real ARP request, so the target must be on the local subnet.
+    /// </summary>
+    internal static class ArpNativeMethods
+    {
+        [DllImport("iphlpapi.dll", ExactSpelling = true)]
+        private static extern int SendARP(uint destIP, uint srcIP, byte[] macAddress, ref uint macAddressLength);
+
+        /// <summary>
+        /// Fail-soft MAC resolution. Returns false (with a diagnostic in <paramref name="error"/>)
+        /// for non-IPv4 addresses, SendARP failures, or unexpected reply lengths — never throws.
+        /// </summary>
+        internal static bool TryResolveMac(IPAddress? ipv4Address, out byte[] mac, out string? error)
+        {
+            mac = new byte[6];
+            error = null;
+            try
+            {
+                if (ipv4Address == null || ipv4Address.AddressFamily != AddressFamily.InterNetwork)
+                {
+                    error = "not an IPv4 address";
+                    return false;
+                }
+
+                // SendARP takes the IPv4 address as a uint in network byte order (first octet in
+                // the lowest byte).
+                var addressBytes = ipv4Address.GetAddressBytes();
+                uint dest = ((uint)addressBytes[3] << 24)
+                          | ((uint)addressBytes[2] << 16)
+                          | ((uint)addressBytes[1] << 8)
+                          | addressBytes[0];
+
+                uint len = (uint)mac.Length;
+                var err = SendARP(dest, 0, mac, ref len);
+                if (err != 0)
+                {
+                    error = $"SendARP returned {err}";
+                    return false;
+                }
+                if (len != 6)
+                {
+                    error = $"SendARP returned unexpected MAC length {len}";
+                    return false;
+                }
+                return true;
+            }
+            catch (Exception ex)
+            {
+                error = ex.Message;
+                return false;
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/NetworkInterfaceLocator.cs

@@ -0,0 +1,68 @@
+#nullable enable
+using System.Net;
+using System.Net.NetworkInformation;
+using System.Net.Sockets;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring
+{
+    /// <summary>
+    /// Shared "which NIC is the device actually using" heuristic: Up, not Loopback/Tunnel,
+    /// carries a non-0.0.0.0 default gateway. Fail-soft — any enumeration error yields null.
+    /// </summary>
+    internal static class NetworkInterfaceLocator
+    {
+        /// <summary>
+        /// Finds the active network interface: Up, not Loopback/Tunnel, has a non-0.0.0.0 gateway.
+        /// </summary>
+        internal static NetworkInterface? FindActiveNetworkInterface()
+        {
+            try
+            {
+                var interfaces = NetworkInterface.GetAllNetworkInterfaces();
+                foreach (var nic in interfaces)
+                {
+                    if (nic.OperationalStatus != OperationalStatus.Up)
+                        continue;
+                    if (nic.NetworkInterfaceType == NetworkInterfaceType.Loopback ||
+                        nic.NetworkInterfaceType == NetworkInterfaceType.Tunnel)
+                        continue;
+
+                    var ipProps = nic.GetIPProperties();
+                    foreach (var gw in ipProps.GatewayAddresses)
+                    {
+                        if (gw.Address.ToString() != "0.0.0.0")
+                            return nic;
+                    }
+                }
+            }
+            catch
+            {
+                // Caller handles null
+            }
+            return null;
+        }
+
+        /// <summary>First IPv4 default gateway of the interface (0.0.0.0 excluded), or null.</summary>
+        internal static IPAddress? GetIpv4Gateway(NetworkInterface nic)
+        {
+            try
+            {
+                foreach (var gw in nic.GetIPProperties().GatewayAddresses)
+                {
+                    var address = gw?.Address;
+                    if (address != null
+                        && address.AddressFamily == AddressFamily.InterNetwork
+                        && address.ToString() != "0.0.0.0")
+                    {
+                        return address;
+                    }
+                }
+            }
+            catch
+            {
+                // Caller handles null
+            }
+            return null;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/DiagnosticsPackageService.cs

@@ -10,7 +10,9 @@ using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using AutopilotMonitor.Agent.V2.Core.Security;
 using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
@@ -124,62 +126,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             }
         }
 
-        private readonly string _imeLogFolder;
-        private readonly string _agentLogFolder;
-        private readonly string _agentStateFolder;
-        private readonly string _agentSpoolFolder;
-        private readonly string _agentDataFolder;
+        // Built-in sections come from the Shared catalog (DiagnosticsBuiltInSections.All) — the
+        // same list the backend serves to the portal, so what administrators see is exactly
+        // what this service collects. Test seam: section id → folder; production leaves the
+        // map empty and every section resolves from the catalog's (unexpanded) source folder.
+        private readonly IReadOnlyDictionary<string, string> _sectionFolderOverrides;
 
-        private static readonly string DefaultImeLogFolder =
-            Environment.ExpandEnvironmentVariables(@"%ProgramData%\Microsoft\IntuneManagementExtension\Logs");
-
-        private static readonly string DefaultAgentLogFolder =
-            Environment.ExpandEnvironmentVariables(Constants.LogDirectory);
-
-        private static readonly string DefaultAgentStateFolder =
-            Environment.ExpandEnvironmentVariables(Constants.StateDirectory);
-
-        private static readonly string DefaultAgentSpoolFolder =
-            Environment.ExpandEnvironmentVariables(Constants.SpoolDirectory);
-
-        private static readonly string DefaultAgentDataFolder =
-            Environment.ExpandEnvironmentVariables(@"%ProgramData%\AutopilotMonitor");
-
-        /// <summary>
-        /// File extensions collected from built-in log folders (Agent + IME).
-        /// Covers standard logs, structured data, traces, event logs, and diagnostics archives.
-        /// </summary>
-        private static readonly string[] LogFilePatterns = new[]
-        {
-            "*.log", "*.txt", "*.json", "*.jsonl",
-            "*.etl", "*.evtx", "*.xml", "*.csv", "*.cab"
-        };
-
-        /// <summary>
-        /// Patterns collected from the agent state folder. Adds completion markers on top of
-        /// the standard log patterns so files like <c>enrollment-complete.marker</c> and
-        /// <c>whiteglove-backfill-state.json</c> reach the diagnostics archive.
-        /// </summary>
-        private static readonly string[] StateFilePatterns = new[]
-        {
-            "*.log", "*.txt", "*.json", "*.jsonl",
-            "*.etl", "*.evtx", "*.xml", "*.csv", "*.cab",
-            "*.complete", "*.marker"
-        };
-
-        /// <summary>
-        /// Marker patterns from the top-level data directory. Kept tight on purpose: only
-        /// completion/exit markers, no session.id / bootstrap.json (those are config, not
-        /// forensic state).
-        /// </summary>
-        private static readonly string[] RootMarkerPatterns = new[] { "*.complete", "*.marker" };
-
-        /// <summary>
-        /// Telemetry spool: only the JSON-shaped files. The spool folder may also contain
-        /// quarantine subfolders, so subfolders are excluded to keep the archive focused
-        /// on what is actually pending upload.
-        /// </summary>
-        private static readonly string[] SpoolFilePatterns = new[] { "*.jsonl", "*.json" };
+        // Scenario oracle for DiagnosticsSectionCondition.DevicePreparation. Production reads
+        // the deterministic WDP registry marker (the same gate every other WDP switch uses);
+        // tests inject a constant so they never touch the registry.
+        private readonly Func<bool> _devicePreparationProbe;
 
         public DiagnosticsPackageService(AgentConfiguration configuration, AgentLogger logger, BackendApiClient apiClient)
             : this(configuration, logger, apiClient, null, null, null, null, null)
@@ -188,7 +144,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
 
         // Test seam: allows xUnit fixtures to redirect log/state/spool/data folders to a
         // temp dir without touching real %ProgramData% paths. Production callers always go
-        // through the public ctor.
+        // through the public ctor. The five named overrides map onto the catalog's section
+        // ids; sectionFolderOverrides covers every other section (RealmJoin*, ImeBootstrapper…).
         internal DiagnosticsPackageService(
             AgentConfiguration configuration,
             AgentLogger logger,
@@ -197,18 +154,38 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             string imeLogFolderOverride,
             string agentStateFolderOverride,
             string agentSpoolFolderOverride,
-            string agentDataFolderOverride)
+            string agentDataFolderOverride,
+            IReadOnlyDictionary<string, string> sectionFolderOverrides = null,
+            Func<bool> devicePreparationProbe = null)
         {
             _configuration = configuration;
             _logger = logger;
             _apiClient = apiClient;
             _httpClient = new HttpClient { Timeout = TimeSpan.FromMinutes(5) };
 
-            _agentLogFolder = agentLogFolderOverride ?? DefaultAgentLogFolder;
-            _imeLogFolder = imeLogFolderOverride ?? DefaultImeLogFolder;
-            _agentStateFolder = agentStateFolderOverride ?? DefaultAgentStateFolder;
-            _agentSpoolFolder = agentSpoolFolderOverride ?? DefaultAgentSpoolFolder;
-            _agentDataFolder = agentDataFolderOverride ?? DefaultAgentDataFolder;
+            var overrides = new Dictionary<string, string>(StringComparer.Ordinal);
+            void Map(string sectionId, string folder)
+            {
+                if (folder != null) overrides[sectionId] = folder;
+            }
+            Map("AgentLogs", agentLogFolderOverride);
+            Map("ImeLogs", imeLogFolderOverride);
+            Map("AgentState", agentStateFolderOverride);
+            Map("AgentSpool", agentSpoolFolderOverride);
+            Map("AgentMarkers", agentDataFolderOverride);
+            if (sectionFolderOverrides != null)
+            {
+                foreach (var kv in sectionFolderOverrides)
+                    overrides[kv.Key] = kv.Value;
+            }
+            _sectionFolderOverrides = overrides;
+
+            // Tests that pass folder overrides but no probe must stay registry-free: a seam
+            // caller gets "not WDP" by default, the production ctor gets the real marker.
+            _devicePreparationProbe = devicePreparationProbe
+                ?? (overrides.Count == 0
+                    ? (Func<bool>)EnrollmentRegistryDetector.IsDeterministicDevicePreparation
+                    : () => false);
         }
 
         /// <summary>
@@ -370,33 +347,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                     // 1. sessioninfo.txt — informational metadata, not subject to caps.
                     AddSessionInfo(archive, enrollmentSucceeded);
 
-                    // 2. Agent logs
-                    foreach (var pattern in LogFilePatterns)
-                        AddLogFiles(archive, _agentLogFolder, "AgentLogs", pattern, tracker);
+                    // 2. Built-in sections — ONE catalog shared with the backend (the portal
+                    //    shows exactly this list): agent logs, IME logs (+ the Device Preparation
+                    //    bootstrapper event log on WDP), agent state (recursive: `.quarantine`
+                    //    and `.part1-<utc>/` buckets ride along), telemetry spool, top-level
+                    //    markers, and the RealmJoin logs behind the tenant's watcher toggle.
+                    //    The scenario probe is a registry read — evaluate it once per build.
+                    var isDevicePreparation = ProbeDevicePreparation();
+                    ManifestLine($"SCENARIO: devicePreparation={isDevicePreparation} realmJoinWatcher={_configuration.EnableRealmJoinWatcher}");
+                    foreach (var section in DiagnosticsBuiltInSections.All)
+                        AddBuiltInSection(archive, section, tracker, isDevicePreparation);
 
-                    // 3. IME logs (all relevant files in the IME log folder)
-                    foreach (var pattern in LogFilePatterns)
-                        AddLogFiles(archive, _imeLogFolder, "ImeLogs", pattern, tracker);
-
-                    // 4. Agent state: snapshot, journal, signal-log, ime-tracker-state,
-                    //    enrollment-complete.marker, final-status.json, whiteglove-backfill-state.json.
-                    //    Recursive to include `.quarantine` subfolders AND `.part1-<utc>/` buckets
-                    //    that StateArchiver creates on WG Part-2 boot — both ride along under
-                    //    AgentState/ via the same recursive walk.
-                    foreach (var pattern in StateFilePatterns)
-                        AddLogFiles(archive, _agentStateFolder, "AgentState", pattern, tracker, includeSubfolders: true);
-
-                    // 5. Telemetry spool — pending uploads + upload cursor (forensic: what didn't ship?)
-                    foreach (var pattern in SpoolFilePatterns)
-                        AddLogFiles(archive, _agentSpoolFolder, "AgentSpool", pattern, tracker, includeSubfolders: false);
-
-                    // 6. Top-level markers (whiteglove.complete, clean-exit marker) — Part-1/Part-2
-                    //    bridge + ghost-restart guard. Top-directory only to avoid re-zipping
-                    //    State/Spool/Logs/Agent which already have their own sections.
-                    foreach (var pattern in RootMarkerPatterns)
-                        AddLogFiles(archive, _agentDataFolder, "AgentMarkers", pattern, tracker, includeSubfolders: false);
-
-                    // 7. Configured additional log paths (global + tenant, validated by guards)
+                    // 3. Configured additional log paths (global + tenant, validated by guards)
                     foreach (var entry in _configuration.DiagnosticsLogPaths ?? new System.Collections.Generic.List<Shared.Models.DiagnosticsLogPath>())
                     {
                         // Resolve %LOGGED_ON_USER_PROFILE% token and get profile path for guard exception
@@ -447,6 +409,81 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             }
         }
 
+        private bool ProbeDevicePreparation()
+        {
+            try
+            {
+                return _devicePreparationProbe();
+            }
+            catch (Exception ex)
+            {
+                // Fail toward Classic like every other WDP gate: the evtx export is skipped,
+                // never the whole package.
+                _logger.Warning($"Device Preparation probe failed — treating as Classic: {ex.Message}");
+                ManifestLine($"SCENARIO PROBE FAILED (treated as Classic): {ex.Message}");
+                return false;
+            }
+        }
+
+        /// <summary>
+        /// Pure gate: is this built-in section collected under the given configuration and
+        /// enrollment scenario? Unknown conditions (a newer Shared catalog than this agent)
+        /// fail closed.
+        /// </summary>
+        internal static bool IsSectionActive(DiagnosticsBuiltInSection section, AgentConfiguration configuration, bool isDevicePreparation)
+        {
+            switch (section.Condition)
+            {
+                case DiagnosticsSectionCondition.Always:
+                    return true;
+                case DiagnosticsSectionCondition.RealmJoinWatcher:
+                    return configuration.EnableRealmJoinWatcher;
+                case DiagnosticsSectionCondition.DevicePreparation:
+                    return isDevicePreparation;
+                default:
+                    return false;
+            }
+        }
+
+        private static string DescribeInactiveCondition(DiagnosticsSectionCondition condition)
+        {
+            switch (condition)
+            {
+                case DiagnosticsSectionCondition.RealmJoinWatcher:
+                    return "RealmJoin Watcher disabled";
+                case DiagnosticsSectionCondition.DevicePreparation:
+                    return "not a Device Preparation enrollment";
+                default:
+                    return $"unknown condition {condition}";
+            }
+        }
+
+        private void AddBuiltInSection(ZipArchive archive, DiagnosticsBuiltInSection section, BudgetTracker tracker, bool isDevicePreparation)
+        {
+            if (!IsSectionActive(section, _configuration, isDevicePreparation))
+            {
+                ManifestLine($"BUILT-IN SKIPPED ({DescribeInactiveCondition(section.Condition)}): {section.Id}");
+                return;
+            }
+
+            // Override (test seam) or catalog source folder with %ProgramData% /
+            // %LOGGED_ON_USER_PROFILE% expanded; null means the token is present but no
+            // interactive user has been detected yet — same skip as configured paths.
+            var folder = _sectionFolderOverrides.TryGetValue(section.Id, out var overrideFolder)
+                ? overrideFolder
+                : UserProfileResolver.ExpandCustomTokens(section.SourceFolder);
+            if (folder == null)
+            {
+                _logger.Warning($"Built-in diagnostics section skipped (no user session for token): {section.Id}");
+                ManifestLine($"BUILT-IN SKIPPED (no user session for token): {section.Id} '{section.SourceFolder}'");
+                return;
+            }
+
+            ManifestLine($"BUILT-IN: {section.Id} -> folder='{folder}' zip='{section.ZipFolder}' recursive={section.IncludeSubfolders}");
+            foreach (var pattern in section.Patterns)
+                AddLogFiles(archive, folder, section.ZipFolder, pattern, tracker, section.IncludeSubfolders);
+        }
+
         private void AddSessionInfo(ZipArchive archive, bool? enrollmentSucceeded)
         {
             var sb = new StringBuilder();

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/UserProfileResolver.cs

@@ -20,7 +20,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
     /// </summary>
     public static class UserProfileResolver
     {
-        public const string Token = "%LOGGED_ON_USER_PROFILE%";
+        // Spelled once, in Shared: the built-in diagnostics catalog uses the same token.
+        public const string Token = Shared.Models.DiagnosticsBuiltInSections.UserProfileToken;
 
         private static readonly object Lock = new object();
         private static bool _resolved;

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/DeviceInfo/DeviceInfoCollector.NetworkAndSecurity.cs

@@ -922,36 +922,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
             }
         }
 
-        /// <summary>
-        /// Finds the active network interface: Up, not Loopback/Tunnel, has a non-0.0.0.0 gateway.
-        /// </summary>
-        private static NetworkInterface FindActiveNetworkInterface()
-        {
-            try
-            {
-                var interfaces = NetworkInterface.GetAllNetworkInterfaces();
-                foreach (var nic in interfaces)
-                {
-                    if (nic.OperationalStatus != OperationalStatus.Up)
-                        continue;
-                    if (nic.NetworkInterfaceType == NetworkInterfaceType.Loopback ||
-                        nic.NetworkInterfaceType == NetworkInterfaceType.Tunnel)
-                        continue;
-
-                    var ipProps = nic.GetIPProperties();
-                    foreach (var gw in ipProps.GatewayAddresses)
-                    {
-                        if (gw.Address.ToString() != "0.0.0.0")
-                            return nic;
-                    }
-                }
-            }
-            catch
-            {
-                // Caller handles null
-            }
-            return null;
-        }
+        private static NetworkInterface FindActiveNetworkInterface() =>
+            Monitoring.NetworkInterfaceLocator.FindActiveNetworkInterface();
 
         /// <summary>
         /// Collects WiFi signal info via the native WLAN API (<see cref="WifiInfoReader"/>,

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/NetworkChangeDetector.cs

@@ -420,36 +420,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
         // Helpers
         // -------------------------------------------------------------------
 
-        /// <summary>
-        /// Finds the active network interface: Up, not Loopback/Tunnel, has a non-0.0.0.0 gateway.
-        /// </summary>
-        private static NetworkInterface FindActiveNetworkInterface()
-        {
-            try
-            {
-                var interfaces = NetworkInterface.GetAllNetworkInterfaces();
-                foreach (var nic in interfaces)
-                {
-                    if (nic.OperationalStatus != OperationalStatus.Up)
-                        continue;
-                    if (nic.NetworkInterfaceType == NetworkInterfaceType.Loopback ||
-                        nic.NetworkInterfaceType == NetworkInterfaceType.Tunnel)
-                        continue;
-
-                    var ipProps = nic.GetIPProperties();
-                    foreach (var gw in ipProps.GatewayAddresses)
-                    {
-                        if (gw.Address.ToString() != "0.0.0.0")
-                            return nic;
-                    }
-                }
-            }
-            catch
-            {
-                // Caller handles null
-            }
-            return null;
-        }
+        private static NetworkInterface FindActiveNetworkInterface() =>
+            NetworkInterfaceLocator.FindActiveNetworkInterface();
 
         private static string BuildChangeMessage(NetworkStateSnapshot before, NetworkStateSnapshot after)
         {

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/DoGroupIdService.cs

@@ -0,0 +1,217 @@
+#nullable enable
+using System;
+using System.Net;
+using System.Net.Sockets;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic;
+using Microsoft.Win32;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
+{
+    public class DoGroupIdSetResult
+    {
+        /// <summary>The DOGroupId value is the computed one after this run (written or already there).</summary>
+        public bool Success { get; set; }
+
+        /// <summary>True when this run actually wrote the registry value (false for the idempotent no-op).</summary>
+        public bool Written { get; set; }
+
+        /// <summary>Deliberate non-action (existing foreign policy/value, no usable network) — not an error.</summary>
+        public bool Skipped { get; set; }
+        public string? SkipReason { get; set; }
+
+        public string? GroupId { get; set; }
+        public string? PreviousValue { get; set; }
+        public string? GatewayIp { get; set; }
+        public string? GatewayMac { get; set; }
+        public string? Error { get; set; }
+    }
+
+    internal enum DoGroupIdAction
+    {
+        Write,
+        NoOp,
+        SkipForeign,
+    }
+
+    /// <summary>
+    /// Sets the Delivery Optimization group ID policy value (<c>DOGroupId</c> under the GPO
+    /// DeliveryOptimization key) from a network fingerprint: a deterministic GUID derived from the
+    /// default gateway's IPv4 address and MAC address, so all devices behind the same gateway land
+    /// in the same DO peering group. The byte layout is RealmJoin-compatible — devices managed by
+    /// RealmJoin on the same network compute the identical GUID and peer with ours.
+    /// <para>
+    /// Deliberately conservative where RealmJoin is not: no random-GUID fallback (a per-device
+    /// random ID would isolate the device in a one-member group — worse than the OS default
+    /// grouping), and existing foreign configuration always wins: a DOGroupIdSource policy, an
+    /// MDM-managed DOGroupId, or a GPO value we did not write ourselves all result in a skip.
+    /// Never throws.
+    /// </para>
+    /// </summary>
+    public static class DoGroupIdService
+    {
+        internal const string GroupIdValueName = "DOGroupId";
+        internal const string GroupIdSourceValueName = "DOGroupIdSource";
+
+        // RealmJoin's fingerprint-GUID prefix — part of the compatible byte layout, do not change.
+        private static readonly byte[] GuidPrefix = { 101, 48, 6 };
+
+        /// <summary>
+        /// Computes and applies the fingerprint GroupId. <paramref name="lastWrittenGroupId"/> is
+        /// the GUID a previous agent run wrote (null when none is recorded) — it lets us update our
+        /// own value after a gateway change while never touching a foreign one.
+        /// </summary>
+        public static DoGroupIdSetResult TrySetGroupId(string? lastWrittenGroupId, AgentLogger logger)
+        {
+            var result = new DoGroupIdSetResult();
+
+            try
+            {
+                // ---- Network fingerprint -------------------------------------------------
+                var nic = NetworkInterfaceLocator.FindActiveNetworkInterface();
+                var gateway = nic == null ? null : NetworkInterfaceLocator.GetIpv4Gateway(nic);
+                if (gateway == null)
+                {
+                    result.Skipped = true;
+                    result.SkipReason = "no_ipv4_gateway";
+                    logger.Info("DO GroupId auto-set: no active interface with an IPv4 default gateway — skipping.");
+                    return result;
+                }
+                result.GatewayIp = gateway.ToString();
+
+                if (!ArpNativeMethods.TryResolveMac(gateway, out var mac, out var arpError))
+                {
+                    result.Skipped = true;
+                    result.SkipReason = "arp_failed";
+                    result.Error = arpError;
+                    logger.Warning($"DO GroupId auto-set: could not resolve gateway MAC ({arpError}) — skipping.");
+                    return result;
+                }
+                result.GatewayMac = BitConverter.ToString(mac);
+
+                var computed = ComputeGroupId(gateway.GetAddressBytes(), mac).ToString();
+                result.GroupId = computed;
+
+                // ---- Foreign-configuration checks ----------------------------------------
+                // DOGroupIdSource (either store) selects a dynamic group source — a fingerprint
+                // GroupId would fight it. An MDM-managed DOGroupId means Intune owns the setting.
+                if (ReadPolicyValue(DoThrottlePolicyReader.GpoKeyPath, GroupIdSourceValueName) != null
+                    || ReadPolicyValue(DoThrottlePolicyReader.MdmKeyPath, GroupIdSourceValueName) != null)
+                {
+                    result.Skipped = true;
+                    result.SkipReason = "group_id_source_policy";
+                    logger.Info("DO GroupId auto-set: DOGroupIdSource policy is configured — skipping.");
+                    return result;
+                }
+                if (ReadPolicyValue(DoThrottlePolicyReader.MdmKeyPath, GroupIdValueName) != null)
+                {
+                    result.Skipped = true;
+                    result.SkipReason = "mdm_policy_present";
+                    logger.Info("DO GroupId auto-set: DOGroupId is managed via MDM policy — skipping.");
+                    return result;
+                }
+
+                // ---- Ownership decision ---------------------------------------------------
+                var existing = ReadPolicyValue(DoThrottlePolicyReader.GpoKeyPath, GroupIdValueName) as string;
+                result.PreviousValue = existing;
+
+                switch (DecideAction(existing, computed, lastWrittenGroupId))
+                {
+                    case DoGroupIdAction.NoOp:
+                        result.Success = true;
+                        logger.Info($"DO GroupId auto-set: already set to {computed} — nothing to do.");
+                        return result;
+
+                    case DoGroupIdAction.SkipForeign:
+                        result.Skipped = true;
+                        result.SkipReason = "foreign_value_present";
+                        logger.Info($"DO GroupId auto-set: existing DOGroupId '{existing}' was not written by us — skipping.");
+                        return result;
+                }
+
+                // ---- Write + readback -----------------------------------------------------
+                using (var hklm = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64))
+                using (var key = hklm.CreateSubKey(DoThrottlePolicyReader.GpoKeyPath))
+                {
+                    key.SetValue(GroupIdValueName, computed, RegistryValueKind.String);
+                }
+
+                var readback = ReadPolicyValue(DoThrottlePolicyReader.GpoKeyPath, GroupIdValueName) as string;
+                if (!string.Equals(readback, computed, StringComparison.OrdinalIgnoreCase))
+                {
+                    result.Error = $"readback mismatch: wrote '{computed}', read '{readback ?? "<null>"}'";
+                    logger.Warning($"DO GroupId auto-set failed: {result.Error}");
+                    return result;
+                }
+
+                result.Success = true;
+                result.Written = true;
+                logger.Info($"DO GroupId auto-set: DOGroupId set to {computed} (gateway {result.GatewayIp}, previous: {existing ?? "<none>"})");
+                return result;
+            }
+            catch (Exception ex)
+            {
+                result.Error = ex.Message;
+                logger.Warning($"DO GroupId auto-set failed: {ex.Message}");
+                return result;
+            }
+        }
+
+        /// <summary>
+        /// RealmJoin-compatible fingerprint GUID: 16 bytes laid out as
+        /// prefix {101,48,6} + {0,0,0} + {ip[1],0,ip[2],ip[3]} + mac[6], passed to
+        /// <c>new Guid(byte[])</c>. The IP byte shuffle mirrors RealmJoin's "swap for
+        /// new Guid()" step — the layout must stay bit-identical for cross-product peering.
+        /// </summary>
+        internal static Guid ComputeGroupId(byte[] ipv4Bytes, byte[] macBytes)
+        {
+            if (ipv4Bytes == null || ipv4Bytes.Length != 4)
+                throw new ArgumentException("IPv4 address bytes required", nameof(ipv4Bytes));
+            if (macBytes == null || macBytes.Length != 6)
+                throw new ArgumentException("6-byte MAC required", nameof(macBytes));
+
+            var bytes = new byte[16];
+            Array.Copy(GuidPrefix, 0, bytes, 0, GuidPrefix.Length);
+            // bytes[3..5] stay zero (RealmJoin's zero padding)
+            bytes[6] = ipv4Bytes[1];
+            // bytes[7] stays zero
+            bytes[8] = ipv4Bytes[2];
+            bytes[9] = ipv4Bytes[3];
+            Array.Copy(macBytes, 0, bytes, 10, macBytes.Length);
+            return new Guid(bytes);
+        }
+
+        /// <summary>
+        /// Pure ownership decision. GUID comparison tolerates case and braces so a value written
+        /// by another tool in "{...}" form still matches semantically.
+        /// </summary>
+        internal static DoGroupIdAction DecideAction(string? existing, string computed, string? lastWrittenByUs)
+        {
+            if (string.IsNullOrEmpty(existing))
+                return DoGroupIdAction.Write;
+            if (GuidEquals(existing, computed))
+                return DoGroupIdAction.NoOp;
+            if (GuidEquals(existing, lastWrittenByUs))
+                return DoGroupIdAction.Write; // our own stale value — gateway changed
+            return DoGroupIdAction.SkipForeign;
+        }
+
+        private static bool GuidEquals(string? a, string? b)
+        {
+            if (string.IsNullOrEmpty(a) || string.IsNullOrEmpty(b)) return false;
+            return Guid.TryParse(a, out var ga) && Guid.TryParse(b, out var gb) && ga == gb;
+        }
+
+        private static object? ReadPolicyValue(string keyPath, string valueName)
+        {
+            // Registry64 explicitly — SOFTWARE\Policies is WOW64-redirected, and the policy
+            // stores live in the 64-bit view regardless of the agent's bitness.
+            using (var hklm = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64))
+            using (var key = hklm.OpenSubKey(keyPath))
+            {
+                return key?.GetValue(valueName);
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/DefaultComponentFactory.cs

@@ -557,6 +557,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                     stateDirectory: _stateDirectory));
             }
 
+            // System timeline watcher — System channel: Kernel-General 1 (system clock stepped,
+            // ground truth for time jumps incl. old/new time + setting process) and completed
+            // sleep/standby episodes (Power-Troubleshooter 1, Kernel-Power 507). Backfill recovers
+            // the pre-agent OOBE clock correction and standby episodes from the persistent .evtx.
+            if (collectors.EnableSystemTimelineWatcher)
+            {
+                hosts.Add(new SystemTimelineWatcherHost(
+                    sessionId: sessionId,
+                    tenantId: tenantId,
+                    logger: logger,
+                    ingress: ingress,
+                    clock: clock,
+                    backfillLookbackMinutes: collectors.SystemEventBackfillLookbackMinutes,
+                    stateDirectory: _stateDirectory));
+            }
+
             // ----- Peripheral hosts (event-only; driven by remote-config toggles) --------------
 
             // V1 parity (PeriodicCollectorManager) — combine Performance + AgentSelfMetrics under
@@ -595,6 +611,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 logger: logger,
                 apiBaseUrl: _agentConfig.ApiBaseUrl));
 
+            // Live AC/battery watcher — WMI Win32_PowerManagementEvent push (no polling), emits
+            // power_state_change on AC↔battery transitions and 50/30/15 % downward threshold
+            // crossings. Deliberately NOT under PeriodicCollectorLifecycleHost: it is push-based
+            // (zero idle cost) and must stay alive precisely when the device sits idle on battery.
+            // Never arms on devices without a battery. Kill-switchable via remote config.
+            if (collectors.EnablePowerStateWatcher)
+            {
+                hosts.Add(new PowerStateWatcherHost(
+                    sessionId: sessionId,
+                    tenantId: tenantId,
+                    ingress: ingress,
+                    clock: clock,
+                    logger: logger));
+            }
+
             // Microsoft 365 Apps (Office C2R) install detector — event-driven (Rev 2): woken by a WMI
             // Win32_ProcessStartTrace push on OfficeC2RClient.exe (+ startup probe), progress via
             // RegNotifyChangeKeyValue, stop via Process.Exited. No idle polling. Constructed first so

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/PowerStateWatcherHost.cs

@@ -0,0 +1,332 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Management;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Runtime;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Agent.V2.Core.Orchestration
+{
+    /// <summary>
+    /// Live AC/battery watcher: subscribes to the WMI push event
+    /// <c>Win32_PowerManagementEvent WHERE EventCode = 10</c> (PBT_APMPOWERSTATUSCHANGE — fires on
+    /// AC↔DC switches and battery-percentage steps), falling back to the intrinsic
+    /// <c>__InstanceModificationEvent WITHIN 30 … Win32_Battery</c> where the legacy push provider
+    /// no longer loads (Windows 11 24H2/25H2, builds 26200+: activation fails WBEM_E_NOT_FOUND
+    /// although the provider is still registered — session 161b838c). Either way the arriving
+    /// event's payload is ignored; each arrival re-probes via <see cref="PowerStateProbe"/> and
+    /// diffs the snapshots through the pure <see cref="PowerStateTransitionTracker"/> into
+    /// <c>power_state_change</c> events. No polling in this process (the fallback's WITHIN
+    /// sampling runs inside WinMgmt). Complements the one-shot startup
+    /// <c>power_state_check</c> (<c>StartupEnvironmentProbes</c>), which stays the baseline event.
+    /// <para>
+    /// Devices without a battery (or with a failing probe) never arm the WMI subscription — zero
+    /// overhead on desktops/VMs. WMI arming runs on a background thread (WinMgmt can hang in OOBE;
+    /// same rationale as <c>ConsoleBypassWatcher</c>), and an arm failure is surfaced once as
+    /// <c>collector_degraded</c>. A 5 s trailing-edge debounce collapses docking flaps to a
+    /// no-diff; the tracker's lifetime emission cap is the storm backstop.
+    /// </para>
+    /// </summary>
+    internal sealed class PowerStateWatcherHost : ICollectorHost
+    {
+        public string Name => "PowerStateWatcher";
+
+        private static readonly TimeSpan DebounceDelay = TimeSpan.FromSeconds(5);
+
+        private readonly string _sessionId;
+        private readonly string _tenantId;
+        private readonly AgentLogger _logger;
+        private readonly InformationalEventPost _post;
+        private readonly Func<PowerStateResult> _probe;
+        private readonly PowerStateTransitionTracker _tracker = new PowerStateTransitionTracker();
+        private readonly object _lock = new object();
+        private readonly object _tickLock = new object();
+
+        private ManagementEventWatcher? _watcher;
+        private Timer? _debounceTimer;
+        private bool _started;
+        private bool _disposed;
+        private bool _capWarned;
+
+        /// <param name="probe">Power-state snapshot source; test seam, defaults to
+        /// <see cref="PowerStateProbe.Probe"/>. The ctor never calls it (the factory constructs
+        /// hosts eagerly; all probing happens in <see cref="Start"/>'s background thread).</param>
+        public PowerStateWatcherHost(
+            string sessionId,
+            string tenantId,
+            ISignalIngressSink ingress,
+            IClock clock,
+            AgentLogger logger,
+            Func<PowerStateResult>? probe = null)
+        {
+            if (ingress == null) throw new ArgumentNullException(nameof(ingress));
+            if (clock == null) throw new ArgumentNullException(nameof(clock));
+            _sessionId = sessionId;
+            _tenantId = tenantId;
+            _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+            _post = new InformationalEventPost(ingress, clock, logger);
+            _probe = probe ?? PowerStateProbe.Probe;
+        }
+
+        public void Start()
+        {
+            lock (_lock)
+            {
+                if (_started || _disposed) return;
+                _started = true;
+            }
+
+            // Baseline probe + WMI arming are synchronous WinMgmt-adjacent operations and WinMgmt
+            // can hang during OOBE — never run them inline on the orchestrator's sequential
+            // host-start loop (ConsoleBypassWatcher precedent). Disposal racing the background
+            // start is handled by the _disposed re-checks inside StartCore.
+            System.Threading.Tasks.Task.Run(() => StartCore(armWmi: true));
+        }
+
+        /// <summary>Internal for tests: the synchronous start body; tests pass
+        /// <paramref name="armWmi"/> = false so no real WMI subscription is created
+        /// (precedent: ConsoleBypassWatcher leaves WMI arming untested).</summary>
+        internal void StartCore(bool armWmi)
+        {
+            PowerStateResult baseline;
+            try
+            {
+                baseline = _probe();
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"[{Name}] baseline probe threw ({ex.Message}) — power-state watcher not armed");
+                return;
+            }
+
+            if (baseline.ProbeError != null)
+            {
+                _logger.Info($"[{Name}] power probe failed ({baseline.ProbeError}) — watcher not armed");
+                return;
+            }
+            if (!baseline.HasBattery)
+            {
+                _logger.Info($"[{Name}] no battery present (desktop/VM) — watcher not armed");
+                return;
+            }
+
+            // Latch the baseline BEFORE arming so the first WMI push diffs against a real state.
+            // A session already on battery below a ladder level emits its threshold event here.
+            EmitAll(_tracker.Baseline(baseline));
+
+            if (!armWmi) return;
+
+            // Arm chain: the extrinsic push event first (zero WinMgmt cost, still alive on older
+            // builds), then the intrinsic Win32_Battery modification event. On Windows 11 24H2/25H2
+            // (observed on builds 26200/26220, session 161b838c) the MS_Power_Management_Event_Provider
+            // is still REGISTERED but its activation fails with WBEM_E_NOT_FOUND — the legacy provider
+            // no longer loads, so the push query throws on exactly the devices that enroll today.
+            // The fallback's WITHIN polling runs inside WinMgmt (a Win32_Battery snapshot every 30 s),
+            // NOT in this process; the handler path is identical (payload ignored, re-probe + diff),
+            // worst-case detection latency ≈ 35 s incl. debounce.
+            if (TryArmWatcher(
+                    "SELECT * FROM Win32_PowerManagementEvent WHERE EventCode = 10",
+                    "power_management_event (push)", baseline, out var pushError))
+            {
+                return;
+            }
+
+            if (TryArmWatcher(
+                    "SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Battery'",
+                    "battery_instance_poll (WinMgmt WITHIN 30s)", baseline, out var fallbackError))
+            {
+                return;
+            }
+
+            _logger.Warning($"[{Name}] could not arm any WMI power watcher — " +
+                $"push: {Describe(pushError)}; fallback: {Describe(fallbackError)} — " +
+                "live power-state transitions will not be observed this run");
+            CollectorDegradationReporter.Report(_post, _sessionId, _tenantId, Name, "watcher_arm_failed",
+                fallbackError ?? pushError);
+        }
+
+        private static string Describe(Exception? ex)
+            => ex == null ? "n/a" : $"{ex.GetType().Name}: {ex.Message}";
+
+        /// <summary>
+        /// One arm attempt for the given WQL event query, with the full dispose-race dance
+        /// (ConsoleBypassWatcher pattern). Returns true when the chain should stop: the watcher
+        /// armed, or disposal won the race (then arming anything would leak a subscription).
+        /// Returns false with the captured exception so the caller can try the next query.
+        /// </summary>
+        private bool TryArmWatcher(string wql, string modeLabel, PowerStateResult baseline, out Exception? error)
+        {
+            error = null;
+            try
+            {
+                var watcher = new ManagementEventWatcher(new WqlEventQuery(wql));
+                watcher.EventArrived += OnPowerStatusChange;
+
+                lock (_lock)
+                {
+                    if (_disposed)
+                    {
+                        // Dispose won the race against the background start — don't arm.
+                        try { watcher.EventArrived -= OnPowerStatusChange; } catch { }
+                        try { watcher.Dispose(); } catch { }
+                        return true;
+                    }
+                    _watcher = watcher;
+                }
+
+                watcher.Start();
+
+                // Re-check after arming: Dispose() may have run between the lock release above and
+                // Start() — it then stopped a not-yet-armed watcher and this thread armed it right
+                // back. If disposal won that race, tear the watcher down here.
+                bool disposedDuringArm;
+                lock (_lock)
+                {
+                    disposedDuringArm = _disposed;
+                    if (disposedDuringArm) _watcher = null;
+                }
+                if (disposedDuringArm)
+                {
+                    try { watcher.EventArrived -= OnPowerStatusChange; } catch { }
+                    try { watcher.Stop(); } catch { }
+                    try { watcher.Dispose(); } catch { }
+                    return true;
+                }
+
+                _logger.Info($"[{Name}] armed via {modeLabel} — " +
+                    $"baseline: {(baseline.OnAcPower ? "AC" : "battery")}, {baseline.BatteryPercent?.ToString() ?? "?"}%");
+                return true;
+            }
+            catch (Exception ex)
+            {
+                error = ex;
+                _logger.Info($"[{Name}] arm attempt '{modeLabel}' failed ({ex.GetType().Name}: {ex.Message})");
+                lock (_lock) { _watcher = null; }
+                return false;
+            }
+        }
+
+        private void OnPowerStatusChange(object sender, EventArrivedEventArgs e)
+        {
+            // Push and fallback events are treated identically: the payload is ignored, the event
+            // only tells us "power status may have changed". Debounce, then re-probe — never call
+            // watcher.Stop() from inside this callback.
+            try { ScheduleDebouncedTick(); }
+            catch (Exception ex) { _logger.Debug($"[{Name}] power event handler error: {ex.Message}"); }
+        }
+
+        private void ScheduleDebouncedTick()
+        {
+            lock (_lock) { if (_disposed) return; }
+            // One trailing-edge tick per change burst (ImeRegistryAppStateHost pattern): a
+            // dock-flap AC→battery→AC inside the window collapses to a no-diff in the tracker.
+            var timer = _debounceTimer;
+            if (timer == null)
+            {
+                var created = new Timer(_ => DebouncedTick(), null, DebounceDelay, Timeout.InfiniteTimeSpan);
+                if (Interlocked.CompareExchange(ref _debounceTimer, created, null) != null)
+                    created.Dispose();
+                else
+                    return;
+                timer = _debounceTimer;
+            }
+            try { timer?.Change(DebounceDelay, Timeout.InfiniteTimeSpan); }
+            catch (ObjectDisposedException) { /* stopping */ }
+        }
+
+        /// <summary>Internal for tests: runs one debounced probe/diff/emit cycle synchronously,
+        /// exactly what the trailing-edge timer callback executes after a WMI push.</summary>
+        internal void TickForTest() => DebouncedTick();
+
+        private void DebouncedTick()
+        {
+            lock (_lock) { if (_disposed) return; }
+            try
+            {
+                IReadOnlyList<PowerStateEmission> emissions;
+                lock (_tickLock) // tracker is not thread-safe; ticks must not interleave
+                {
+                    emissions = _tracker.Evaluate(_probe());
+                }
+                EmitAll(emissions);
+
+                if (_tracker.EmissionCapReached && !_capWarned)
+                {
+                    _capWarned = true;
+                    _logger.Warning($"[{Name}] emission cap reached — further power_state_change events " +
+                        "suppressed this run (flapping power source or dying battery controller)");
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.Debug($"[{Name}] debounced power tick failed: {ex.Message}");
+            }
+        }
+
+        private void EmitAll(IReadOnlyList<PowerStateEmission> emissions)
+        {
+            foreach (var emission in emissions)
+            {
+                try
+                {
+                    var data = new Dictionary<string, object>
+                    {
+                        { "transition", emission.Transition },
+                        { "onAcPower", emission.OnAcPower },
+                        { "batteryPercent", emission.BatteryPercent.HasValue ? (object)emission.BatteryPercent.Value : "unknown" },
+                        { "isCharging", emission.IsCharging },
+                        { "batteryLifeMinutes", emission.BatteryLifeMinutes.HasValue ? (object)emission.BatteryLifeMinutes.Value : "unknown" },
+                    };
+                    if (emission.ThresholdPercent.HasValue)
+                        data["thresholdPercent"] = emission.ThresholdPercent.Value;
+
+                    _post.Emit(new EnrollmentEvent
+                    {
+                        SessionId = _sessionId,
+                        TenantId = _tenantId,
+                        EventType = Constants.EventTypes.PowerStateChange,
+                        Severity = emission.Severity,
+                        Source = Name,
+                        Phase = EnrollmentPhase.Unknown,
+                        Message = emission.Message,
+                        ImmediateUpload = emission.ImmediateUpload,
+                        Data = data,
+                    });
+                }
+                catch (Exception ex)
+                {
+                    _logger.Warning($"[{Name}] failed to emit power_state_change: {ex.Message}");
+                }
+            }
+        }
+
+        public void Stop()
+        {
+            ManagementEventWatcher? watcher;
+            lock (_lock)
+            {
+                if (_disposed) return;
+                _disposed = true;
+                watcher = _watcher;
+                _watcher = null;
+            }
+
+            if (watcher != null)
+            {
+                try { watcher.EventArrived -= OnPowerStatusChange; } catch { }
+                try { watcher.Stop(); } catch { }
+                try { watcher.Dispose(); } catch { }
+            }
+
+            _debounceTimer?.Dispose();
+            _debounceTimer = null;
+        }
+
+        public void Dispose() => Stop();
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/SystemTimelineWatcherHost.cs

@@ -0,0 +1,68 @@
+#nullable enable
+using System;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+
+namespace AutopilotMonitor.Agent.V2.Core.Orchestration
+{
+    /// <summary>
+    /// Standalone host for the <see cref="SystemTimelineTracker"/> — watches the <c>System</c>
+    /// event log for system clock steps (Kernel-General 1) and completed sleep/standby episodes
+    /// (Power-Troubleshooter 1 / Kernel-Power 507) and forwards them via the shared single-rail
+    /// ingress. Mirrors <see cref="WindowsUpdateWatcherHost"/>: builds its own
+    /// <see cref="InformationalEventPost"/> and delegates Start/Stop to the tracker.
+    /// </summary>
+    internal sealed class SystemTimelineWatcherHost : ICollectorHost
+    {
+        public string Name => "SystemTimelineTracker";
+
+        private readonly SystemTimelineTracker _tracker;
+        private readonly AgentLogger _logger;
+        private int _disposed;
+
+        public SystemTimelineWatcherHost(
+            string sessionId,
+            string tenantId,
+            AgentLogger logger,
+            ISignalIngressSink ingress,
+            IClock clock,
+            int backfillLookbackMinutes,
+            string stateDirectory)
+        {
+            if (ingress == null) throw new ArgumentNullException(nameof(ingress));
+            if (clock == null) throw new ArgumentNullException(nameof(clock));
+            _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+
+            var post = new InformationalEventPost(ingress, clock, logger);
+            _tracker = new SystemTimelineTracker(
+                sessionId: sessionId,
+                tenantId: tenantId,
+                post: post,
+                logger: logger,
+                backfillEnabled: backfillLookbackMinutes > 0,
+                backfillLookbackMinutes: backfillLookbackMinutes,
+                stateDirectory: stateDirectory);
+        }
+
+        public void Start()
+        {
+            _tracker.Start();
+            _logger.Info("SystemTimelineWatcherHost: started.");
+        }
+
+        public void Stop()
+        {
+            try { _tracker.Stop(); }
+            catch (Exception ex) { _logger.Warning($"SystemTimelineWatcherHost: stop failed: {ex.Message}"); }
+        }
+
+        public void Dispose()
+        {
+            if (Interlocked.Exchange(ref _disposed, 1) == 1) return;
+            Stop();
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/SignalActivityClassifier.cs

@@ -56,6 +56,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             // real activity (rare, and worth keeping diagnostics running for).
             SharedConstants.EventTypes.ModernDeploymentLog,
 
+            // Environment observation, not device/enrollment progress: an idle device draining
+            // its battery must not keep the periodic collectors alive or push out stall
+            // detection — the exact scenario the power watcher exists to observe.
+            SharedConstants.EventTypes.PowerStateChange,
+
+            // Same reasoning for the system timeline watcher: a clock step, a wake from standby,
+            // or a backfilled episode at agent start is environment observation and must not
+            // reset the idle/stall clocks.
+            SharedConstants.EventTypes.SystemClockChanged,
+            SharedConstants.EventTypes.SystemSleepEpisode,
+
             // Agent health / control / transport — not device/enrollment progress.
             SharedConstants.EventTypes.CollectorDegraded,
             SharedConstants.EventTypes.TelemetryUploadPoisoned,

src/Agent/AutopilotMonitor.Agent.V2.Core/Persistence/StartupEventGate.cs

@@ -124,6 +124,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Persistence
             }
         }
 
+        /// <summary>
+        /// Read-only peek of the key's current fingerprint (possibly restored from a previous
+        /// agent run), or null when none is recorded. Like <see cref="HasFingerprint"/> this makes
+        /// NO claim — use it when the fingerprint carries state the caller needs to read back
+        /// (e.g. the DO GroupId ownership marker).
+        /// </summary>
+        public string? GetFingerprint(string key)
+        {
+            if (string.IsNullOrEmpty(key)) return null;
+            lock (_lock)
+            {
+                return _entries.TryGetValue(key, out var entry) ? entry.Fingerprint : null;
+            }
+        }
+
         /// <summary>Retry-until-success: true when <see cref="MarkSucceeded"/> latched this key in any run.</summary>
         public bool AlreadySucceeded(string key)
         {

src/Agent/AutopilotMonitor.Agent.V2.Core/Runtime/StartupEnvironmentProbes.cs

@@ -25,6 +25,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Runtime
     ///     Always emitted — offset &gt;60s is Warning, smaller is Info, failure is Warning.</item>
     ///   <item><b>power_state_check</b> — AC vs. battery snapshot via Win32 <c>GetSystemPowerStatus</c>.
     ///     On battery with &lt;80% charge is Warning, otherwise Info, probe failure is Warning.</item>
+    ///   <item><b>do_group_id_auto_set</b> — only when <c>EnableDoGroupIdAutoSet=true</c>. Sets the
+    ///     Delivery Optimization <c>DOGroupId</c> policy value from a network fingerprint via
+    ///     <see cref="DoGroupIdService"/>; skips (Info) rather than fight foreign policy values.</item>
     /// </list>
     /// <para>
     /// Each probe runs best-effort: failures are logged + optionally emitted as a Warning event,
@@ -78,6 +81,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Runtime
                 await RunNtpCheck(configuration, logger, post, gate).ConfigureAwait(false);
             }
 
+            if (configuration.EnableDoGroupIdAutoSet)
+                RunDoGroupIdAutoSet(configuration, logger, post, gate);
+
             RunPowerStateCheck(configuration, logger, post);
         }
 
@@ -331,6 +337,99 @@ namespace AutopilotMonitor.Agent.V2.Core.Runtime
             };
         }
 
+        /// <summary>
+        /// One-shot DO GroupId apply with change-based restart dedup: the gate fingerprint doubles
+        /// as the ownership marker ("written:&lt;guid&gt;" records the GUID we last wrote, so a later
+        /// run can distinguish our own stale value from a foreign one after a gateway change).
+        /// Unchanged outcomes (same GUID, same skip reason) re-run silently without a duplicate
+        /// event; errors never claim a fingerprint so each failing start keeps its retry trail.
+        /// </summary>
+        private static void RunDoGroupIdAutoSet(
+            AgentConfiguration configuration,
+            AgentLogger logger,
+            Orchestration.InformationalEventPost post,
+            Persistence.StartupEventGate? gate)
+        {
+            try
+            {
+                var lastWritten = ExtractLastWrittenGroupId(gate?.GetFingerprint(Constants.EventTypes.DoGroupIdAutoSet));
+                var result = DoGroupIdService.TrySetGroupId(lastWritten, logger);
+
+                var fingerprint = ComputeDoGroupIdFingerprint(result);
+                if (fingerprint != null && gate != null
+                    && !gate.ShouldEmit(Constants.EventTypes.DoGroupIdAutoSet, fingerprint))
+                {
+                    logger.Debug("StartupEnvironmentProbes: DO GroupId outcome unchanged — skipping duplicate event (restart dedup).");
+                    return;
+                }
+
+                SafeEmit(post, logger, BuildDoGroupIdEvent(configuration, result));
+
+                if (fingerprint != null)
+                    gate?.MarkEmitted(Constants.EventTypes.DoGroupIdAutoSet);
+            }
+            catch (Exception ex)
+            {
+                logger.Warning($"StartupEnvironmentProbes: DO GroupId auto-set threw: {ex.Message}");
+            }
+        }
+
+        internal const string DoGroupIdWrittenFingerprintPrefix = "written:";
+
+        /// <summary>
+        /// Success (written or already correct) fingerprints as "written:&lt;guid&gt;", a skip as
+        /// "skipped:&lt;reason&gt;"; errors return null so they are never deduped.
+        /// </summary>
+        internal static string? ComputeDoGroupIdFingerprint(DoGroupIdSetResult result)
+        {
+            if (result.Success) return DoGroupIdWrittenFingerprintPrefix + result.GroupId;
+            if (result.Skipped) return "skipped:" + result.SkipReason;
+            return null;
+        }
+
+        /// <summary>Ownership marker readback: the GUID from a "written:" fingerprint, else null.</summary>
+        internal static string? ExtractLastWrittenGroupId(string? fingerprint) =>
+            fingerprint != null && fingerprint.StartsWith(DoGroupIdWrittenFingerprintPrefix, StringComparison.Ordinal)
+                ? fingerprint.Substring(DoGroupIdWrittenFingerprintPrefix.Length)
+                : null;
+
+        internal static EnrollmentEvent BuildDoGroupIdEvent(AgentConfiguration configuration, DoGroupIdSetResult result)
+        {
+            string message;
+            if (result.Success && result.Written)
+                message = $"Delivery Optimization GroupId set to {result.GroupId} (gateway {result.GatewayIp})";
+            else if (result.Success)
+                message = $"Delivery Optimization GroupId already set to {result.GroupId}";
+            else if (result.Skipped)
+                message = $"Delivery Optimization GroupId not set: {result.SkipReason}";
+            else
+                message = $"Delivery Optimization GroupId auto-set failed: {result.Error}";
+
+            return new EnrollmentEvent
+            {
+                SessionId = configuration.SessionId,
+                TenantId = configuration.TenantId,
+                EventType = Constants.EventTypes.DoGroupIdAutoSet,
+                Severity = result.Success || result.Skipped ? EventSeverity.Info : EventSeverity.Warning,
+                Source = "StartupEnvironmentProbes",
+                Phase = EnrollmentPhase.Unknown,
+                Timestamp = DateTime.UtcNow,
+                Message = message,
+                Data = new Dictionary<string, object>
+                {
+                    { "groupId", result.GroupId ?? "" },
+                    { "previousValue", result.PreviousValue ?? "" },
+                    { "gatewayIp", result.GatewayIp ?? "" },
+                    { "gatewayMac", result.GatewayMac ?? "" },
+                    { "written", result.Written },
+                    { "skipped", result.Skipped },
+                    { "skipReason", result.SkipReason ?? "" },
+                    { "success", result.Success },
+                    { "error", result.Error ?? "" },
+                },
+            };
+        }
+
         private static void RunPowerStateCheck(
             AgentConfiguration configuration,
             AgentLogger logger,

src/Agent/AutopilotMonitor.Agent.V2.Core/Security/SessionRegistrationHelper.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Net.NetworkInformation;
 using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Configuration;
 using AutopilotMonitor.Agent.V2.Core.Logging;
@@ -19,7 +20,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
     /// <b>Retry contract (V1 <c>MonitoringService.RegisterSessionAsync</c>):</b>
     /// </para>
     /// <list type="bullet">
-    ///   <item>5 attempts total; between attempts <c>2^attempt</c> seconds (2s, 4s, 8s, 16s).</item>
+    ///   <item>Boot-time NIC grace before the first attempt: when no network link is up yet
+    ///     (BootTrigger relaunch after a mid-enrollment reboot, Wi-Fi still associating) wait
+    ///     up to <see cref="NetworkLinkWaitMax"/> for the link-level signal. Best-effort and
+    ///     free on the normal path — a live link returns immediately.</item>
+    ///   <item>6 attempts total; between attempts <c>2^attempt</c> seconds (2s, 4s, 8s, 16s, 32s —
+    ///     ~62 s of backoff). The original V1 budget of 5 attempts / ~30 s was too short for the
+    ///     reboot-relaunch on Wi-Fi kiosks: the relaunched agent gave up and exited 7 before
+    ///     the network came back, leaving the session silent forever (tenant aebdce78,
+    ///     2026-08-23 audit). A relaunch that misses here is lost — nothing retries later.</item>
     ///   <item>On <c>response.Success == true</c> → stop immediately.</item>
     ///   <item>On <see cref="BackendAuthException"/> (401/403) → report to the
     ///     <see cref="AuthFailureTracker"/> (which fires the first-failure distress + may trip
@@ -37,16 +46,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
     /// </summary>
     public static class SessionRegistrationHelper
     {
-        private const int MaxAttempts = 5;
+        private const int MaxAttempts = 6;
+
+        /// <summary>Upper bound for the pre-registration link wait (see class remarks).</summary>
+        internal static readonly TimeSpan NetworkLinkWaitMax = TimeSpan.FromSeconds(15);
 
         /// <summary>
-        /// Executes the 5-retry register-session handshake against the backend. Returns the
+        /// Executes the retrying register-session handshake against the backend. Returns the
         /// response + classified outcome. Never throws.
         /// </summary>
         /// <param name="backoffDelay">
         /// Optional delay-provider used by tests to avoid real-time waits. Production callers
         /// pass <c>null</c> → V1 parity <c>Task.Delay(2^attempt * 1000)</c> between attempts.
         /// </param>
+        /// <param name="networkLinkWait">
+        /// Optional pre-registration link wait used by tests. Production callers pass
+        /// <c>null</c> → <see cref="WaitForNetworkLinkAsync"/> (bounded by <see cref="NetworkLinkWaitMax"/>).
+        /// </param>
         public static async Task<SessionRegistrationResult> RegisterWithRetryAsync(
             BackendApiClient apiClient,
             AgentConfiguration agentConfig,
@@ -56,14 +72,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
             EmergencyReporter emergencyReporter = null,
             Func<int, Task> backoffDelay = null,
             Func<Exception, Task> onTerminalTransportFailure = null,
-            (string Manufacturer, string Model, string SerialNumber)? deviceHardware = null)
+            (string Manufacturer, string Model, string SerialNumber)? deviceHardware = null,
+            Func<AgentLogger, Task> networkLinkWait = null)
         {
             if (apiClient == null) throw new ArgumentNullException(nameof(apiClient));
             if (agentConfig == null) throw new ArgumentNullException(nameof(agentConfig));
             if (logger == null) throw new ArgumentNullException(nameof(logger));
 
             backoffDelay ??= DefaultBackoffDelay;
+            networkLinkWait ??= WaitForNetworkLinkAsync;
             var registration = BuildRegistration(agentConfig, agentVersion, deviceHardware);
+
+            try { await networkLinkWait(logger).ConfigureAwait(false); }
+            catch (Exception ex) { logger.Debug($"Pre-registration network wait failed ({ex.Message}) — registering anyway."); }
             string lastError = null;
             Exception lastException = null;
 
@@ -113,7 +134,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
 
                 if (attempt < MaxAttempts)
                 {
-                    var delaySeconds = (int)Math.Pow(2, attempt); // 2, 4, 8, 16
+                    var delaySeconds = (int)Math.Pow(2, attempt); // 2, 4, 8, 16, 32
                     logger.Info($"Retrying session registration in {delaySeconds}s");
                     await backoffDelay(attempt).ConfigureAwait(false);
                 }
@@ -143,6 +164,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
         private static Task DefaultBackoffDelay(int attempt)
             => Task.Delay(((int)Math.Pow(2, attempt)) * 1000);
 
+        /// <summary>
+        /// Boot-time NIC grace (same pattern as the emergency-break reporter): polls the cheap
+        /// link-level signal once per second for at most <see cref="NetworkLinkWaitMax"/>. It
+        /// cannot prove backend reachability — the retry loop handles that — it only keeps the
+        /// first attempts from being burned into a link that is provably still down. Probe
+        /// errors end the wait, never the registration.
+        /// </summary>
+        internal static async Task WaitForNetworkLinkAsync(AgentLogger logger)
+        {
+            if (NetworkInterface.GetIsNetworkAvailable()) return;
+
+            logger?.Info($"Session registration: no network link yet — waiting up to {NetworkLinkWaitMax.TotalSeconds:F0}s.");
+            var deadline = DateTime.UtcNow + NetworkLinkWaitMax;
+            while (DateTime.UtcNow < deadline)
+            {
+                await Task.Delay(1000).ConfigureAwait(false);
+                if (NetworkInterface.GetIsNetworkAvailable())
+                {
+                    logger?.Info("Session registration: network link is up.");
+                    return;
+                }
+            }
+            logger?.Warning($"Session registration: still no network link after {NetworkLinkWaitMax.TotalSeconds:F0}s — attempting anyway.");
+        }
+
         private static SessionRegistration BuildRegistration(
             AgentConfiguration agentConfig,
             string agentVersion,
@@ -194,7 +240,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
         /// <summary>401/403 from the backend — cert/token rejected. No retry was attempted.</summary>
         AuthFailed = 1,
 
-        /// <summary>All 5 attempts failed with non-auth errors (network, 5xx, malformed response).</summary>
+        /// <summary>All attempts failed with non-auth errors (network, 5xx, malformed response).</summary>
         Failed = 2,
     }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/SignalAdapters/ImeLogTrackerAdapter.cs

@@ -407,6 +407,13 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                 var offsetMinutes = _tracker.LastMatchedSourceOffsetMinutes;
                 if (offsetMinutes.HasValue)
                     data["sourceOffsetMinutes"] = offsetMinutes.Value.ToString(culture);
+
+                // Observational only — what the calibrator measured, which since the 2026-08-20
+                // revert is deliberately NOT what was applied. Kept separate so the two can never
+                // be read as the same thing.
+                var measured = _tracker.LastMatchedMeasuredWriterOffsetMinutes;
+                if (measured.HasValue)
+                    data["measuredWriterOffsetMinutes"] = measured.Value.ToString(culture);
             }
 
             if (!derivedFromClock) return;
@@ -420,9 +427,14 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
             switch (origin)
             {
                 case CmTraceOffsetOrigin.Bias: return "bias";
+                // Per-FILE offset application, retired by the 2026-08-20 revert (04b1a7c6).
+                // Kept so stored 2.0.1410 events remain interpretable; no current path emits it.
                 case CmTraceOffsetOrigin.Calibrated: return "calibrated";
-                // The writer's offset was never measured, so this process's own zone was assumed —
-                // correct only if the writer happens to share it.
+                // The line anchored itself: read provably fresh, its own distance to the agent
+                // clock (grid-rounded) was applied as the writer's offset. Era-safe per line.
+                case CmTraceOffsetOrigin.LineAnchored: return "line-anchored";
+                // The line was not provably fresh (backlog, restart catch-up, replay), so this
+                // process's own zone was assumed — correct only if the writer happens to share it.
                 default: return "reader-zone-fallback";
             }
         }
@@ -792,12 +804,15 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
         /// <see cref="AppInstallTiming"/> so the emitter can inline the values on the
         /// current event's payload without a second dictionary lookup.
         /// <para>
-        /// Audit Q1: a terminal→active transition (the IME retry path — <see
-        /// cref="AppPackageState.UpdateState"/> permits e.g. Error→Downloading and
-        /// Skipped→Downloading) re-arms <c>Completed</c> to <c>null</c>, so the NEXT terminal
-        /// transition stamps a fresh CompletedAt. StartedAt keeps its first value — the final
-        /// terminal payload then covers first-start → last-terminal (total occupancy across
-        /// attempts) instead of freezing at the first failure. Observed pre-fix: a user-scope
+        /// Audit Q1 + 2026-08 attempt-duration change: a terminal→active transition (the IME
+        /// retry / re-evaluation path — <see cref="AppPackageState.UpdateState"/> permits e.g.
+        /// Error→Downloading and Skipped→Downloading) re-arms BOTH endpoints: <c>Completed</c>
+        /// to <c>null</c> (the NEXT terminal transition stamps fresh) and <c>Started</c> to
+        /// the re-entry time. The final terminal payload therefore describes the
+        /// status-defining ATTEMPT — matching the backend's AppInstallSummaries semantics —
+        /// instead of first-start → last-terminal across passes: the IME processes the app
+        /// list repeatedly (device-ESP evaluation pass, user-context pass), and the idle gap
+        /// between passes is not install time. Observed pre-fix (old bug shape): a user-scope
         /// app Skipped early in DeviceSetup, retried after sign-in, emitted its final
         /// Installed event with the stale early CompletedAt (durationSeconds=-2342).
         /// </para>
@@ -808,11 +823,13 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
             {
                 _appTimings.TryGetValue(appId, out var current);
 
-                // Terminal→active (retry): the earlier terminal stamp no longer describes this
-                // app's outcome — re-arm so the next terminal transition stamps fresh.
+                // Terminal→active (retry / new pass): the earlier stamps no longer describe
+                // this app's outcome — re-arm both endpoints so the next terminal transition
+                // reports the fresh attempt's window.
                 if (current.Completed != null && IsLifecycleActive(newState))
                 {
                     current.Completed = null;
+                    current.Started = now;
                 }
 
                 // First lifecycle-active transition → record StartedAt.

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/BackendTelemetryUploader.cs

@@ -119,6 +119,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                 AddSecurityHeaders(request);
                 request.Headers.Add("X-Correlation-ID", correlationId);
 
+                // P14: device-clock send time, one value per request. Lets the backend separate
+                // spool delay (SentAt − OccurredUtc, both device frame) from device-vs-server
+                // clock offset (ReceivedAt − SentAt) — indistinguishable without this header.
+                // Stamped per attempt on purpose: a retry after backoff is a NEW send moment.
+                request.Headers.Add("X-Send-Time-Utc", DateTime.UtcNow.ToString("O"));
+
                 HttpResponseMessage response;
                 try
                 {

src/Agent/AutopilotMonitor.Agent.V2/Runtime/BackendSessionRegistration.cs

@@ -11,7 +11,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
 {
     /// <summary>
     /// Phase 6 of <see cref="Program"/>'s <c>RunAgent</c>: blocking
-    /// <c>POST /api/agent/register-session</c> with 5-retry exponential backoff before the
+    /// <c>POST /api/agent/register-session</c> with link-wait + 6-retry exponential backoff before the
     /// orchestrator starts. V1 parity (MonitoringService.RegisterSessionAsync) — without
     /// this call the backend's Sessions table never gets a row for this session, so
     /// <c>IncrementSessionEventCountAsync</c> / <c>UpdateSessionStatusAsync</c> silently

src/Agent/AutopilotMonitor.DecisionCore.Tests/RealmJoinGateTests.cs

@@ -372,6 +372,9 @@ namespace AutopilotMonitor.DecisionCore.Tests
             // Before RealmJoinPhaseChanged became a typed signal, LastDeploymentPhase was only
             // written at detection time — every realmjoin_timeout claimed "last phase: 0" no
             // matter how far RJ actually got, hiding this whole failure class from ops.
+            // Since the activity-based extension, the PhaseChanged at T0+6 counts as activity,
+            // so the first fire (59 min later) extends once; the timeout lands on the re-armed
+            // fire a full inactivity window after the last activity.
             var engine = new DecisionEngine();
             var state = PrimeClassicAwaitingDesktop(engine);
             state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
@@ -384,7 +387,13 @@ namespace AutopilotMonitor.DecisionCore.Tests
                 })).NewState;
             state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.DesktopArrived, T0.AddMinutes(7))).NewState;
 
-            var step = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, T0.AddMinutes(65),
+            // First fire at the original due (T0+65): activity 59 min ago → extends to T0+66.
+            state = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, T0.AddMinutes(65),
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout })).NewState;
+            var rearmed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            Assert.Equal(T0.AddMinutes(66), rearmed.DueAtUtc);
+
+            var step = engine.Reduce(state, MakeSignal(9, DecisionSignalKind.DeadlineFired, rearmed.DueAtUtc,
                 new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
 
             var timeout = Assert.Single(step.Effects, e =>
@@ -395,6 +404,248 @@ namespace AutopilotMonitor.DecisionCore.Tests
             Assert.Equal("101", timeout.Parameters["lastSeenPhase"]);
         }
 
+        // ============================================================== Activity-based extension (report 55e6afd61c9d)
+
+        [Fact]
+        public void Timeout_fire_with_recent_first_deployment_activity_extends_instead_of_timing_out()
+        {
+            // Report 55e6afd61c9d (Douglas): timer armed at detection (phase 0, RJ agent MSI
+            // install during DeviceSetup), first deployment only started 16 min later, Office
+            // completed 3 s before the deadline — the hard cut truncated an actively working
+            // deployment. The fire must now re-arm to lastActivity + 60 min instead.
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "0" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.RealmJoinPhaseChanged, T0.AddMinutes(21),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "101",
+                    [DecisionEngine.RealmJoinPayloadKeys.PreviousPhase] = "0",
+                })).NewState;
+            state = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.RealmJoinPackageCompleted, T0.AddMinutes(62),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.PackageId] = "generic-microsoft-office-2016-proplus",
+                    [DecisionEngine.RealmJoinPayloadKeys.Scope] = RealmJoinPackageFact.ScopeMachine,
+                    [DecisionEngine.RealmJoinPayloadKeys.Success] = "true",
+                    [DecisionEngine.RealmJoinPayloadKeys.LastExitCode] = "0",
+                })).NewState;
+
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            var step = engine.Reduce(state, MakeSignal(9, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
+
+            // No completion, no outcome — the gate stays closed and the window is re-armed.
+            Assert.NotEqual(SessionStage.Finalizing, step.NewState.Stage);
+            Assert.Null(step.NewState.RealmJoinFacts.Outcome);
+            Assert.Equal($"DeadlineFired:{DeadlineNames.RealmJoinTimeout}:Extended", step.Transition.Trigger);
+
+            var rearmed = Assert.Single(step.NewState.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            Assert.Equal(T0.AddMinutes(62 + 60), rearmed.DueAtUtc); // lastActivity + inactivity window
+
+            Assert.Single(step.Effects, e =>
+                e.Kind == DecisionEffectKind.ScheduleDeadline &&
+                e.Deadline != null &&
+                e.Deadline.Name == DeadlineNames.RealmJoinTimeout &&
+                e.Deadline.DueAtUtc == rearmed.DueAtUtc);
+
+            var extended = Assert.Single(step.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry &&
+                e.Parameters != null &&
+                e.Parameters.TryGetValue("eventType", out var et) && et == "realmjoin_timeout_extended");
+            Assert.Equal("Info", extended.Parameters!["severity"]);
+            Assert.Equal("101", extended.Parameters["deploymentPhase"]);
+            Assert.DoesNotContain(step.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry &&
+                e.Parameters != null &&
+                e.Parameters.TryGetValue("eventType", out var et) && et == "realmjoin_timeout");
+        }
+
+        [Fact]
+        public void Resolved_after_extension_completes_via_classic_path()
+        {
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "101" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.RealmJoinPhaseChanged, T0.AddMinutes(40),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "100",
+                    [DecisionEngine.RealmJoinPayloadKeys.PreviousPhase] = "101",
+                })).NewState;
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            state = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout })).NewState;
+            Assert.Null(state.RealmJoinFacts.Outcome); // extended, not timed out
+
+            var step = engine.Reduce(state, MakeSignal(9, DecisionSignalKind.RealmJoinResolved, T0.AddMinutes(80),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "110" }));
+
+            Assert.Equal(SessionStage.Finalizing, step.NewState.Stage);
+            Assert.Equal("Resolved", step.NewState.RealmJoinFacts.Outcome!.Value);
+            Assert.DoesNotContain(step.NewState.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+        }
+
+        [Fact]
+        public void Rearmed_fire_after_quiet_window_times_out_with_inactivity_reason()
+        {
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "0" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.RealmJoinPhaseChanged, T0.AddMinutes(30),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "101",
+                    [DecisionEngine.RealmJoinPayloadKeys.PreviousPhase] = "0",
+                })).NewState;
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            state = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout })).NewState;
+            var rearmed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            Assert.Equal(T0.AddMinutes(90), rearmed.DueAtUtc); // lastActivity (T0+30) + 60 min
+
+            // No further activity — the re-armed fire must now time out for real.
+            var step = engine.Reduce(state, MakeSignal(9, DecisionSignalKind.DeadlineFired, rearmed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
+
+            Assert.Equal(SessionStage.Finalizing, step.NewState.Stage);
+            Assert.Equal("Timeout", step.NewState.RealmJoinFacts.Outcome!.Value);
+            var timeout = Assert.Single(step.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry &&
+                e.Parameters != null &&
+                e.Parameters.TryGetValue("eventType", out var et) && et == "realmjoin_timeout");
+            Assert.Equal("inactivity", timeout.Parameters!["reason"]);
+            Assert.Contains("no deployment activity", timeout.Parameters["message"]);
+        }
+
+        [Fact]
+        public void Extension_is_capped_at_absolute_ceiling_and_cap_fire_times_out_despite_activity()
+        {
+            // Late activity pushes the sliding window beyond detection + 4 h — the re-arm must
+            // clamp to the cap, and the cap fire must time out even though activity is recent.
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "101" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            // Package completion whose sliding window (T0+230+60) would exceed the cap (T0+245).
+            state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.RealmJoinPackageCompleted, T0.AddMinutes(230),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.PackageId] = "generic-big-suite",
+                    [DecisionEngine.RealmJoinPayloadKeys.Scope] = RealmJoinPackageFact.ScopeMachine,
+                    [DecisionEngine.RealmJoinPayloadKeys.Success] = "true",
+                    [DecisionEngine.RealmJoinPayloadKeys.LastExitCode] = "0",
+                })).NewState;
+
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            state = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout })).NewState;
+
+            var rearmed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            Assert.Equal(T0.AddMinutes(5).AddHours(4), rearmed.DueAtUtc); // clamped to detection + cap
+
+            var step = engine.Reduce(state, MakeSignal(9, DecisionSignalKind.DeadlineFired, rearmed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
+
+            Assert.Equal(SessionStage.Finalizing, step.NewState.Stage);
+            Assert.Equal("Timeout", step.NewState.RealmJoinFacts.Outcome!.Value);
+            var timeout = Assert.Single(step.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry &&
+                e.Parameters != null &&
+                e.Parameters.TryGetValue("eventType", out var et) && et == "realmjoin_timeout");
+            Assert.Equal("absolute_cap", timeout.Parameters!["reason"]);
+        }
+
+        [Fact]
+        public void Stale_fire_of_old_incarnation_after_rearm_is_dead_end()
+        {
+            // Race: the OLD deadline incarnation's fire was already queued when the extension
+            // re-armed. The armed deadline is due LATER than the stale fire — dead-end, no
+            // second extension evaluation, no timeout.
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "0" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.RealmJoinPhaseChanged, T0.AddMinutes(30),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "101",
+                    [DecisionEngine.RealmJoinPayloadKeys.PreviousPhase] = "0",
+                })).NewState;
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout })).NewState;
+            Assert.Null(state.RealmJoinFacts.Outcome); // extended
+
+            var step = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
+
+            Assert.False(step.Transition.Taken);
+            Assert.Null(step.NewState.RealmJoinFacts.Outcome);
+            Assert.Empty(step.Effects);
+            var stillArmed = Assert.Single(step.NewState.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            Assert.Equal(T0.AddMinutes(90), stillArmed.DueAtUtc);
+        }
+
+        [Fact]
+        public void Detection_phase_alone_is_not_activity_idle_case_times_out_at_60_min_unchanged()
+        {
+            // The phase captured AT detection must not count as activity — RJ detected in a
+            // first-deployment phase that then never moves still times out after the original
+            // 60 min (the extension exists for demonstrable progress, not for standing still).
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "101" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            Assert.Null(state.RealmJoinFacts.LastActivityUtc);
+
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            var step = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
+
+            Assert.Equal(SessionStage.Finalizing, step.NewState.Stage);
+            Assert.Equal("Timeout", step.NewState.RealmJoinFacts.Outcome!.Value);
+            var timeout = Assert.Single(step.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry &&
+                e.Parameters != null &&
+                e.Parameters.TryGetValue("eventType", out var et) && et == "realmjoin_timeout");
+            Assert.Equal("hard_timeout", timeout.Parameters!["reason"]);
+        }
+
+        [Fact]
+        public void Regular_deployment_phase_with_activity_does_not_extend()
+        {
+            // Session 6f1959c0 shape: RJ stood at 210 when the agent booted and deploys
+            // regular (non-first) packages afterwards. Phase 200/210 is outside the
+            // first-deployment window — activity there must NOT hold the session hostage.
+            var engine = new DecisionEngine();
+            var state = PrimeClassicAwaitingDesktop(engine);
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "210" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            state = engine.Reduce(state, MakeSignal(7, DecisionSignalKind.RealmJoinPhaseChanged, T0.AddMinutes(40),
+                new Dictionary<string, string>
+                {
+                    [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "200",
+                    [DecisionEngine.RealmJoinPayloadKeys.PreviousPhase] = "210",
+                })).NewState;
+
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+            var step = engine.Reduce(state, MakeSignal(8, DecisionSignalKind.DeadlineFired, armed.DueAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }));
+
+            Assert.Equal(SessionStage.Finalizing, step.NewState.Stage);
+            Assert.Equal("Timeout", step.NewState.RealmJoinFacts.Outcome!.Value);
+        }
+
         [Fact]
         public void SelfDeploying_deferred_terminal_released_by_first_deployment_incomplete()
         {

src/Backend/AutopilotMonitor.Functions.Tests/AppInstallTerminalStateAndReconcileTests.cs

@@ -198,4 +198,164 @@ public class AppInstallTerminalStateAndReconcileTests
         // Column absent → Merge-mode preserves a prior batch's terminal state.
         Assert.False(empty.ContainsKey("TerminalState"));
     }
+
+    // ── attempt-duration semantics (2026-08): the field case that motivated it ──
+    // Session 44862cd3, "Set TimeZone": device-ESP evaluation pass ends Skipped, the real
+    // install happens ~66 min later in the user-context pass and takes 23 s. The old span
+    // semantics reported 4002 s.
+
+    [Fact]
+    public void TwoPasses_SingleBatch_DurationIsLastAttempt_NotSpan()
+    {
+        var s = Aggregate(
+            AppEvent("app_install_started", T0),
+            AppEvent("app_install_completed", T0.AddMinutes(6), "Skipped"),
+            AppEvent("app_install_started", T0.AddMinutes(66)),
+            AppEvent("app_install_completed", T0.AddMinutes(66).AddSeconds(23), "Installed"))["App"].Summary;
+
+        Assert.Equal(23, s.DurationSeconds);                        // last attempt, not 3983 s
+        Assert.Equal(T0, s.StartedAt);                              // first-seen anchor untouched
+        Assert.Equal(T0.AddMinutes(66), s.LastAttemptStartedAt);
+        Assert.Equal(2, s.InstallPassCount);
+        Assert.Equal("Installed", s.TerminalState);
+        Assert.Equal(T0.AddMinutes(66).AddSeconds(23), s.CompletedAt);
+    }
+
+    [Fact]
+    public void WeakerTerminal_CompletedSkipped_NeverOverridesInstalled_InBatch()
+    {
+        // Re-evaluation after a real install reports Skipped (already present) — the row
+        // keeps describing the install attempt, incl. CompletedAt and duration.
+        var s = Aggregate(
+            AppEvent("app_install_started", T0),
+            AppEvent("app_install_completed", T0.AddSeconds(40), "Installed"),
+            AppEvent("app_install_started", T0.AddMinutes(30)),
+            AppEvent("app_install_completed", T0.AddMinutes(30).AddSeconds(2), "Skipped"))["App"].Summary;
+
+        Assert.Equal("Installed", s.TerminalState);
+        Assert.Equal(T0.AddSeconds(40), s.CompletedAt);
+        Assert.Equal(40, s.DurationSeconds);
+    }
+
+    [Fact]
+    public void StartInOneBatch_TerminalInNext_ReconcileAnchorsOnStoredAttempt()
+    {
+        // Pass 2 start landed in batch N (stored anchor); the terminal-only batch N+1 must
+        // pair against it — not against the first-seen StartedAt an hour earlier.
+        var existing = new TableEntity("tenant", "session_App")
+        {
+            ["Status"] = "InProgress",
+            ["StartedAt"] = new DateTimeOffset(T0),
+            ["LastAttemptStartedAt"] = new DateTimeOffset(T0.AddMinutes(66)),
+            ["InstallPassCount"] = 2,
+        };
+        var summary = new AppInstallSummary
+        {
+            AppName = "App", SessionId = "session", TenantId = "tenant",
+            Status = "Succeeded", TerminalState = "Installed",
+            StartedAt = T0.AddMinutes(66).AddSeconds(23),           // batch init stamp (terminal event)
+            CompletedAt = T0.AddMinutes(66).AddSeconds(23),
+        };
+
+        TableStorageService.ReconcileAppInstallSummaryWithExisting(summary, existing);
+
+        Assert.Equal(T0, summary.StartedAt);                        // earliest wins (window key)
+        Assert.Equal(T0.AddMinutes(66), summary.LastAttemptStartedAt);
+        Assert.Equal(23, summary.DurationSeconds);                  // attempt-anchored, not 3983 s
+        Assert.Equal(2, summary.InstallPassCount);
+    }
+
+    [Fact]
+    public void Reconcile_ReplayedOlderBatch_NeverRegressesAnchorOrDoubleCountsPasses()
+    {
+        var existing = new TableEntity("tenant", "session_App")
+        {
+            ["StartedAt"] = new DateTimeOffset(T0),
+            ["LastAttemptStartedAt"] = new DateTimeOffset(T0.AddMinutes(66)),
+            ["InstallPassCount"] = 2,
+        };
+        // Replay of the pass-1 batch: its newest start is OLDER than the stored anchor.
+        var summary = new AppInstallSummary
+        {
+            AppName = "App", Status = "InProgress",
+            StartedAt = T0, LastAttemptStartedAt = T0, InstallPassCount = 1,
+        };
+
+        TableStorageService.ReconcileAppInstallSummaryWithExisting(summary, existing);
+
+        Assert.Equal(T0.AddMinutes(66), summary.LastAttemptStartedAt);  // max-fold: no regression
+        Assert.Equal(2, summary.InstallPassCount);                      // not 3 — replay not re-counted
+    }
+
+    [Fact]
+    public void Reconcile_NewerAttemptBatch_AddsPassCount()
+    {
+        var existing = new TableEntity("tenant", "session_App")
+        {
+            ["StartedAt"] = new DateTimeOffset(T0),
+            ["LastAttemptStartedAt"] = new DateTimeOffset(T0),
+            ["InstallPassCount"] = 1,
+        };
+        var summary = new AppInstallSummary
+        {
+            AppName = "App", Status = "InProgress",
+            StartedAt = T0.AddMinutes(66), LastAttemptStartedAt = T0.AddMinutes(66), InstallPassCount = 1,
+        };
+
+        TableStorageService.ReconcileAppInstallSummaryWithExisting(summary, existing);
+
+        Assert.Equal(T0.AddMinutes(66), summary.LastAttemptStartedAt);
+        Assert.Equal(2, summary.InstallPassCount);
+    }
+
+    [Fact]
+    public void Reconcile_WeakerTerminalBatch_NeverOverridesStoredInstalled()
+    {
+        // Cross-batch mirror of the in-batch guard: a batch that only saw the Skipped
+        // re-evaluation must not re-describe an Installed row.
+        var existing = new TableEntity("tenant", "session_App")
+        {
+            ["Status"] = "Succeeded",
+            ["TerminalState"] = "Installed",
+            ["StartedAt"] = new DateTimeOffset(T0),
+            ["CompletedAt"] = new DateTimeOffset(T0.AddSeconds(40)),
+            ["DurationSeconds"] = 40,
+        };
+        var summary = new AppInstallSummary
+        {
+            AppName = "App", Status = "Succeeded", TerminalState = "Skipped",
+            StartedAt = T0.AddMinutes(30),
+            LastAttemptStartedAt = T0.AddMinutes(30), InstallPassCount = 1,
+            CompletedAt = T0.AddMinutes(30).AddSeconds(2), DurationSeconds = 2,
+        };
+
+        TableStorageService.ReconcileAppInstallSummaryWithExisting(summary, existing);
+
+        Assert.Equal("Installed", summary.TerminalState);
+        // The guard drops the skip-pass endpoints; the Q4 path then re-adopts the STORED
+        // CompletedAt (the surviving install attempt's) — same value as on disk, and the
+        // attempt anchor being newer keeps DurationSeconds at 0, so the omitted column
+        // lets Merge preserve the stored 40 s.
+        Assert.Equal(T0.AddSeconds(40), summary.CompletedAt);
+        Assert.Equal(0, summary.DurationSeconds);
+    }
+
+    [Fact]
+    public void EntityBuilder_AttemptColumns_AreSentinelGated()
+    {
+        var with = new AppInstallSummary
+        {
+            AppName = "App",
+            LastAttemptStartedAt = T0,
+            InstallPassCount = 2,
+        };
+        var entity = TableStorageService.BuildAppInstallSummaryEntity(with, "rk");
+        Assert.Equal(new DateTimeOffset(T0), entity.GetDateTimeOffset("LastAttemptStartedAt"));
+        Assert.Equal(2, entity.GetInt32("InstallPassCount"));
+
+        var without = new AppInstallSummary { AppName = "App" };
+        var empty = TableStorageService.BuildAppInstallSummaryEntity(without, "rk");
+        Assert.False(empty.ContainsKey("LastAttemptStartedAt"));
+        Assert.False(empty.ContainsKey("InstallPassCount"));
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/AppVersionRegressionRadarTests.cs

@@ -36,7 +36,8 @@ public class AppVersionRegressionRadarTests
         string appName = App,
         string status = "Succeeded",
         string terminalState = "Installed",
-        bool collision = false)
+        bool collision = false,
+        bool attemptAnchored = true)
         => new()
         {
             TenantId = TenantA,
@@ -47,6 +48,9 @@ public class AppVersionRegressionRadarTests
             TerminalState = terminalState,
             DurationSeconds = durationSeconds,
             StartedAt = startedAt ?? Now.AddDays(-1),
+            // Post-cutover rows carry the attempt anchor; the radar's cutover gate
+            // excludes rows without it (attemptAnchored: false = legacy span row).
+            LastAttemptStartedAt = attemptAnchored ? (startedAt ?? Now.AddDays(-1)) : null,
             AppIdCollision = collision,
         };
 
@@ -164,6 +168,26 @@ public class AppVersionRegressionRadarTests
         Assert.Equal(900, finding.CurrentMedianSeconds);
     }
 
+    [Fact]
+    public void Evaluate_CutoverGate_LegacySpanRows_ExcludedOnBothSides()
+    {
+        // 2026-08 attempt-duration cutover: rows without LastAttemptStartedAt carry the old
+        // full-span semantics and are excluded from BOTH comparison sides.
+
+        // Current side: 10 legacy span rows would fire (lift 3.0), but only 5 are
+        // attempt-anchored → below MinMeasuredInstalls → silent.
+        var rows = Batch("1.0", 10, 300, Now.AddDays(-20));
+        rows.AddRange(Enumerable.Range(0, 10).Select(_ => Install("2.0", 900, Now.AddDays(-5), attemptAnchored: false)));
+        rows.AddRange(Enumerable.Range(0, 5).Select(_ => Install("2.0", 900, Now.AddDays(-5))));
+        Assert.Empty(AppVersionRegressionRadar.Evaluate(rows));
+
+        // Previous side entirely legacy → gated away → no comparison basis → silent,
+        // even though the raw medians (300 → 900) would scream regression.
+        var rows2 = Enumerable.Range(0, 10).Select(_ => Install("1.0", 300, Now.AddDays(-20), attemptAnchored: false)).ToList();
+        rows2.AddRange(Batch("2.0", 10, 900, Now.AddDays(-5)));
+        Assert.Empty(AppVersionRegressionRadar.Evaluate(rows2));
+    }
+
     [Fact]
     public void Evaluate_DeterministicOrdering_LiftDesc_ThenAppNameOrdinal()
     {

src/Backend/AutopilotMonitor.Functions.Tests/BuiltInRuleCatalogPolicyTests.cs

@@ -0,0 +1,56 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the shipped rule catalogs to the reserved built-in ID namespace from
+/// RuleIdPolicy: every built-in occupies (ANALYZE|GATHER)-&lt;CATEGORY&gt;-&lt;NUMBER&gt; with
+/// CATEGORY != CUSTOM, and IDs are unique (case-insensitively — case variants are
+/// indistinguishable to humans and to the policy regex). This is the backend-side
+/// enforcement of the "platform never ships a built-in in the CUSTOM namespace"
+/// commitment documented in RuleIdPolicy — without it, a shipped CUSTOM-ID rule
+/// would silently shadow every tenant's same-ID custom rule at merge time
+/// (global wins, tenant copy dropped). combine.js mirrors these checks at
+/// catalog-build time; this test guards the embedded resource actually deployed.
+/// </summary>
+public class BuiltInRuleCatalogPolicyTests
+{
+    [Fact]
+    public void BuiltIn_analyze_ids_are_reserved_namespace_and_unique()
+    {
+        var ids = BuiltInAnalyzeRules.GetAll().Select(r => r.RuleId).ToList();
+
+        Assert.NotEmpty(ids);
+        foreach (var id in ids)
+        {
+            Assert.True(RuleIdPolicy.IsReservedBuiltInId(id),
+                $"Built-in analyze rule '{id}' lies outside the reserved built-in namespace — " +
+                "it would collide with the tenant custom namespace.");
+        }
+
+        var duplicates = ids.GroupBy(id => id, StringComparer.OrdinalIgnoreCase)
+            .Where(g => g.Count() > 1).Select(g => g.Key).ToList();
+        Assert.True(duplicates.Count == 0,
+            $"Duplicate built-in analyze rule IDs: {string.Join(", ", duplicates)}");
+    }
+
+    [Fact]
+    public void BuiltIn_gather_ids_are_reserved_namespace_and_unique()
+    {
+        var ids = BuiltInGatherRules.GetAll().Select(r => r.RuleId).ToList();
+
+        Assert.NotEmpty(ids);
+        foreach (var id in ids)
+        {
+            Assert.True(RuleIdPolicy.IsReservedBuiltInId(id),
+                $"Built-in gather rule '{id}' lies outside the reserved built-in namespace — " +
+                "it would collide with the tenant custom namespace.");
+        }
+
+        var duplicates = ids.GroupBy(id => id, StringComparer.OrdinalIgnoreCase)
+            .Where(g => g.Count() > 1).Select(g => g.Key).ToList();
+        Assert.True(duplicates.Count == 0,
+            $"Duplicate built-in gather rule IDs: {string.Join(", ", duplicates)}");
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/CmTraceSkewTripwireTests.cs

@@ -0,0 +1,152 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the CMTrace time-skew regression tripwire (CmTraceSkewTripwire.Evaluate): fires only
+/// when the IME-vs-other median delta divergence sits on the 15-minute offset grid (residual
+/// &lt; 2 min) AND both sides have enough samples over enough distinct upload batches. The
+/// tripwire's goal state is to never fire, so the must-stay-silent directions are the primary
+/// cases: off-grid replays, sub-grid divergence, thin samples, batch-composition artifacts,
+/// and common-mode spool latency must all pass without a hit.
+/// </summary>
+public class CmTraceSkewTripwireTests
+{
+    /// <summary>Scan with the given per-side medians, comfortably above all sample/batch minimums.</summary>
+    private static SessionSkewScan MakeScan(
+        double imeDeltaMinutes, double otherDeltaMinutes,
+        int imeSamples = 30, int otherSamples = 30,
+        int imeBatches = 5, int otherBatches = 5)
+    {
+        var scan = new SessionSkewScan
+        {
+            ImeDistinctBatchCount = imeBatches,
+            OtherDistinctBatchCount = otherBatches,
+        };
+        for (int i = 0; i < imeSamples; i++)
+            scan.ImeDeltaMinutes.Add(imeDeltaMinutes);
+        for (int i = 0; i < otherSamples; i++)
+            scan.OtherDeltaMinutes.Add(otherDeltaMinutes);
+        return scan;
+    }
+
+    // ── Must fire ──────────────────────────────────────────────────────────
+
+    [Fact]
+    public void Fires_OnLargeNegativeGridDivergence()
+    {
+        // −540 min = the field-measured E.-Australia-style skew (−9 h), exactly 36 grid steps.
+        // Both sides share 1.2 min upload latency — it cancels in the difference.
+        var result = CmTraceSkewTripwire.Evaluate(MakeScan(imeDeltaMinutes: -538.8, otherDeltaMinutes: 1.2));
+
+        Assert.NotNull(result);
+        Assert.Equal(-36, result!.GridSteps);
+        Assert.Equal(-540.0, result.DiffMinutes, 3);
+        Assert.True(result.ResidualMinutes < CmTraceSkewTripwire.ResidualToleranceMinutes);
+    }
+
+    [Fact]
+    public void Fires_OnSingleGridStepWithBoundaryResidual()
+    {
+        // +15 min divergence with residual 1.9 — just inside the 2-min tolerance.
+        var result = CmTraceSkewTripwire.Evaluate(MakeScan(imeDeltaMinutes: 16.9, otherDeltaMinutes: 0.0));
+
+        Assert.NotNull(result);
+        Assert.Equal(1, result!.GridSteps);
+        Assert.Equal(1.9, result.ResidualMinutes, 3);
+    }
+
+    // ── Must stay silent ───────────────────────────────────────────────────
+
+    [Fact]
+    public void Silent_WhenResidualOffGrid()
+    {
+        // 17.5 min divergence: nearest grid step is 15, residual 2.5 ≥ tolerance — the replay
+        // signature (old log lines re-read late land anywhere, not on the zone grid).
+        Assert.Null(CmTraceSkewTripwire.Evaluate(MakeScan(imeDeltaMinutes: 17.5, otherDeltaMinutes: 0.0)));
+    }
+
+    [Fact]
+    public void Silent_WhenDivergenceBelowOneGridStep()
+    {
+        // 9 min rounds to 1 step but with residual 6 — and 7 min rounds to 0 steps. Both silent.
+        Assert.Null(CmTraceSkewTripwire.Evaluate(MakeScan(imeDeltaMinutes: 9.0, otherDeltaMinutes: 0.0)));
+        Assert.Null(CmTraceSkewTripwire.Evaluate(MakeScan(imeDeltaMinutes: 7.0, otherDeltaMinutes: 0.0)));
+    }
+
+    [Fact]
+    public void Silent_WhenImeSampleCountBelowMinimum()
+    {
+        var scan = MakeScan(imeDeltaMinutes: -540.0, otherDeltaMinutes: 0.0,
+            imeSamples: CmTraceSkewTripwire.MinSamplesPerSide - 1);
+        Assert.Null(CmTraceSkewTripwire.Evaluate(scan));
+    }
+
+    [Fact]
+    public void Silent_WhenDistinctBatchesBelowMinimum()
+    {
+        // A perfect grid divergence backed by only 2 upload batches on one side is a
+        // batch-composition artifact (ReceivedAt is stamped per batch, not per event).
+        var scan = MakeScan(imeDeltaMinutes: -540.0, otherDeltaMinutes: 0.0,
+            otherBatches: CmTraceSkewTripwire.MinDistinctBatchesPerSide - 1);
+        Assert.Null(CmTraceSkewTripwire.Evaluate(scan));
+    }
+
+    [Fact]
+    public void Silent_OnCommonModeSpoolLatency()
+    {
+        // Offline spool: BOTH sides uploaded 45 min late. The difference of medians is ~0 —
+        // shared latency must cancel, never read as skew.
+        Assert.Null(CmTraceSkewTripwire.Evaluate(MakeScan(imeDeltaMinutes: 45.3, otherDeltaMinutes: 45.1)));
+    }
+
+    [Fact]
+    public void Silent_OnNullOrEmptyScan()
+    {
+        Assert.Null(CmTraceSkewTripwire.Evaluate(null));
+        Assert.Null(CmTraceSkewTripwire.Evaluate(new SessionSkewScan()));
+    }
+
+    [Fact]
+    public void MedianIsRobustAgainstMinorityOutliers()
+    {
+        // A handful of replayed old lines (huge off-grid deltas) inside an otherwise healthy
+        // IME stream must not drag the median onto the grid.
+        var scan = MakeScan(imeDeltaMinutes: 0.5, otherDeltaMinutes: 0.4);
+        scan.ImeDeltaMinutes.Add(-1327.0);
+        scan.ImeDeltaMinutes.Add(-738.0);
+        Assert.Null(CmTraceSkewTripwire.Evaluate(scan));
+    }
+
+    // ── Bias suppression predicate ─────────────────────────────────────────
+
+    [Fact]
+    public void BiasDominated_WhenBiasIsHalfOrMore()
+    {
+        Assert.True(CmTraceSkewTripwire.IsBiasDominated(new Dictionary<string, int>
+        {
+            ["bias"] = 50,
+            ["line-anchored"] = 50,
+        }));
+        Assert.True(CmTraceSkewTripwire.IsBiasDominated(new Dictionary<string, int>
+        {
+            ["Bias"] = 3, // case-insensitive
+        }));
+    }
+
+    [Fact]
+    public void NotBiasDominated_WhenAnchoredMajorityOrNoData()
+    {
+        Assert.False(CmTraceSkewTripwire.IsBiasDominated(new Dictionary<string, int>
+        {
+            ["bias"] = 10,
+            ["line-anchored"] = 80,
+            ["reader-zone-fallback"] = 11,
+        }));
+        // Empty/missing histogram fails open toward reporting — a storage error must not
+        // silently swallow a genuine regression hit.
+        Assert.False(CmTraceSkewTripwire.IsBiasDominated(new Dictionary<string, int>()));
+        Assert.False(CmTraceSkewTripwire.IsBiasDominated(null));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/DiagnosticsBuiltInSectionsTests.cs

@@ -0,0 +1,96 @@
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Invariants of the built-in diagnostics catalog (<see cref="DiagnosticsBuiltInSections"/>).
+/// Shared has no test project, so the catalog is pinned here: the agent iterates it to build the
+/// archive and the backend serves it to the portal, so a malformed entry would either break
+/// collection on every device or mislead every administrator reading the list.
+/// </summary>
+public class DiagnosticsBuiltInSectionsTests
+{
+    [Fact]
+    public void SectionIds_AreUnique()
+    {
+        var ids = DiagnosticsBuiltInSections.All.Select(s => s.Id).ToArray();
+        Assert.Equal(ids.Length, ids.Distinct(StringComparer.Ordinal).Count());
+    }
+
+    [Fact]
+    public void ZipFolderAndSourceFolderPairs_AreUnique()
+    {
+        // Two sections may share a ZIP folder (ImeLogs + the bootstrapper evtx) only when they
+        // read from different source folders — the same (zip, source) pair would double-add
+        // every file under duplicate entry names.
+        var pairs = DiagnosticsBuiltInSections.All
+            .Select(s => $"{s.ZipFolder}|{s.SourceFolder}".ToLowerInvariant())
+            .ToArray();
+        Assert.Equal(pairs.Length, pairs.Distinct().Count());
+    }
+
+    [Fact]
+    public void AlwaysSections_KeepHistoricalArchiveLayoutAndOrder()
+    {
+        // Archive-layout lock: these five sections (and their order) are what every diagnostics
+        // ZIP has carried since the PR1-B forensics work; tooling and support habits rely on it.
+        var always = DiagnosticsBuiltInSections.All
+            .Where(s => s.Condition == DiagnosticsSectionCondition.Always)
+            .Select(s => s.Id)
+            .ToArray();
+        Assert.Equal(new[] { "AgentLogs", "ImeLogs", "AgentState", "AgentSpool", "AgentMarkers" }, always);
+    }
+
+    [Fact]
+    public void ConditionalSections_CarryTheExpectedGate()
+    {
+        foreach (var section in DiagnosticsBuiltInSections.All)
+        {
+            if (section.Id.StartsWith("RealmJoin", StringComparison.Ordinal))
+                Assert.Equal(DiagnosticsSectionCondition.RealmJoinWatcher, section.Condition);
+            if (section.Id == "ImeBootstrapperEventLog")
+                Assert.Equal(DiagnosticsSectionCondition.DevicePreparation, section.Condition);
+        }
+        Assert.Contains(DiagnosticsBuiltInSections.All, s => s.Id == "ImeBootstrapperEventLog");
+        Assert.Equal(5, DiagnosticsBuiltInSections.All.Count(s => s.Condition == DiagnosticsSectionCondition.RealmJoinWatcher));
+    }
+
+    [Fact]
+    public void UserProfileTokenSections_AreNeverAlwaysOn()
+    {
+        // The token resolves only once an interactive user exists; an Always section reading
+        // from the user profile would be skipped on every pre-desktop package and mislead the
+        // portal's "collected by every agent" wording.
+        var tokenSections = DiagnosticsBuiltInSections.All
+            .Where(s => s.SourceFolder.Contains(DiagnosticsBuiltInSections.UserProfileToken, StringComparison.OrdinalIgnoreCase))
+            .ToArray();
+        Assert.NotEmpty(tokenSections);
+        Assert.All(tokenSections, s => Assert.NotEqual(DiagnosticsSectionCondition.Always, s.Condition));
+    }
+
+    [Fact]
+    public void Patterns_AreFileNamesWithoutPathSeparators()
+    {
+        Assert.All(DiagnosticsBuiltInSections.All, s =>
+        {
+            Assert.NotEmpty(s.Patterns);
+            Assert.All(s.Patterns, p =>
+            {
+                Assert.False(string.IsNullOrWhiteSpace(p));
+                Assert.DoesNotContain('\\', p);
+                Assert.DoesNotContain('/', p);
+            });
+            Assert.False(string.IsNullOrWhiteSpace(s.Description));
+            Assert.False(s.ZipFolder.StartsWith("/") || s.ZipFolder.EndsWith("/"));
+            Assert.DoesNotContain('\\', s.ZipFolder);
+        });
+    }
+
+    [Fact]
+    public void NoBuiltInSection_UsesTheConfiguredPathsZipFolder()
+    {
+        // AdditionalLogs/<folder> is reserved for admin-configured entries.
+        Assert.All(DiagnosticsBuiltInSections.All,
+            s => Assert.False(s.ZipFolder.StartsWith("AdditionalLogs", StringComparison.OrdinalIgnoreCase)));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/DiscordRendererTests.cs

@@ -0,0 +1,124 @@
+using System.Text.Json;
+using AutopilotMonitor.Functions.Services.Notifications;
+using AutopilotMonitor.Shared.Models.Notifications;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Discord embed rendering: payload shape, color mapping, and the Discord embed limits
+/// (25 fields, 256/1024 name/value, 4096 description, 6000 total).
+/// </summary>
+public class DiscordRendererTests
+{
+    private static JsonElement RenderEmbed(NotificationAlert alert)
+    {
+        var json = new DiscordRenderer().RenderToJson(alert);
+        var doc = JsonDocument.Parse(json);
+        var embeds = doc.RootElement.GetProperty("embeds");
+        Assert.Equal(1, embeds.GetArrayLength());
+        return embeds[0];
+    }
+
+    [Fact]
+    public void RendersSingleEmbed_WithTitleColorFieldsAndLinks()
+    {
+        var alert = new NotificationAlert
+        {
+            Title = "Enrollment Succeeded",
+            Summary = "Enrollment Succeeded: DESK-001",
+            Severity = NotificationSeverity.Success,
+            ThemeColor = "00B050",
+            Facts = { new NotificationFact { Name = "Device", Value = "DESK-001" } },
+            Sections = { new NotificationSection { Title = "Details", Text = "All apps installed." } },
+            Actions = { new NotificationAction { Type = "openUrl", Title = "Open session", Url = "https://portal.example.com/sessions/abc" } },
+        };
+
+        var embed = RenderEmbed(alert);
+
+        Assert.Equal("✅ Enrollment Succeeded", embed.GetProperty("title").GetString());
+        Assert.Equal(0x00B050, embed.GetProperty("color").GetInt32());
+
+        var description = embed.GetProperty("description").GetString()!;
+        Assert.StartsWith("Enrollment Succeeded: DESK-001", description);
+        Assert.Contains("**Details**\nAll apps installed.", description);
+        // Webhooks cannot post buttons — actions become markdown links.
+        Assert.Contains("[Open session](https://portal.example.com/sessions/abc)", description);
+
+        var fields = embed.GetProperty("fields");
+        Assert.Equal(1, fields.GetArrayLength());
+        Assert.Equal("Device", fields[0].GetProperty("name").GetString());
+        Assert.Equal("DESK-001", fields[0].GetProperty("value").GetString());
+        Assert.True(fields[0].GetProperty("inline").GetBoolean());
+    }
+
+    [Theory]
+    [InlineData(NotificationSeverity.Success, 0x2ECC71)]
+    [InlineData(NotificationSeverity.Error, 0xE74C3C)]
+    [InlineData(NotificationSeverity.Warning, 0xF1C40F)]
+    [InlineData(NotificationSeverity.Info, 0x3498DB)]
+    public void Color_FallsBackToSeverity_WhenThemeColorMissingOrInvalid(NotificationSeverity severity, int expected)
+    {
+        foreach (var themeColor in new[] { "", "not-hex" })
+        {
+            var embed = RenderEmbed(new NotificationAlert { Title = "T", Severity = severity, ThemeColor = themeColor });
+            Assert.Equal(expected, embed.GetProperty("color").GetInt32());
+        }
+    }
+
+    [Fact]
+    public void Fields_CappedAt25_AndEmptyFactsSkipped()
+    {
+        var alert = new NotificationAlert { Title = "T", Summary = "S" };
+        alert.Facts.Add(new NotificationFact { Name = "", Value = "dropped" });
+        alert.Facts.Add(new NotificationFact { Name = "dropped", Value = " " });
+        for (var i = 0; i < 30; i++)
+            alert.Facts.Add(new NotificationFact { Name = $"f{i}", Value = "v" });
+
+        var fields = RenderEmbed(alert).GetProperty("fields");
+
+        Assert.Equal(25, fields.GetArrayLength());
+        Assert.Equal("f0", fields[0].GetProperty("name").GetString()); // empty facts skipped, not counted
+    }
+
+    [Fact]
+    public void FieldValue_TruncatedTo1024_WithEllipsis()
+    {
+        var alert = new NotificationAlert { Title = "T" };
+        alert.Facts.Add(new NotificationFact { Name = "long", Value = new string('x', 2000) });
+
+        var value = RenderEmbed(alert).GetProperty("fields")[0].GetProperty("value").GetString()!;
+
+        Assert.Equal(1024, value.Length);
+        Assert.EndsWith("…", value);
+    }
+
+    [Fact]
+    public void TotalEmbedLength_CappedAt6000_ByDroppingTrailingFields()
+    {
+        var alert = new NotificationAlert { Title = "T", Summary = "S" };
+        for (var i = 0; i < 25; i++)
+            alert.Facts.Add(new NotificationFact { Name = $"f{i}", Value = new string('v', 1000) });
+
+        var embed = RenderEmbed(alert);
+        var fields = embed.GetProperty("fields");
+
+        var total = embed.GetProperty("title").GetString()!.Length
+            + embed.GetProperty("description").GetString()!.Length;
+        for (var i = 0; i < fields.GetArrayLength(); i++)
+            total += fields[i].GetProperty("name").GetString()!.Length + fields[i].GetProperty("value").GetString()!.Length;
+
+        Assert.True(fields.GetArrayLength() < 25);
+        Assert.True(total <= 6000);
+        Assert.Equal("f0", fields[0].GetProperty("name").GetString()); // leading fields kept
+    }
+
+    [Fact]
+    public void EmptyDescription_Omitted_AndProviderTypeIsDiscord()
+    {
+        var embed = RenderEmbed(new NotificationAlert { Title = "T", Severity = NotificationSeverity.Info });
+
+        Assert.False(embed.TryGetProperty("description", out _));
+        Assert.False(embed.TryGetProperty("fields", out _));
+        Assert.Equal(WebhookProviderType.Discord, new DiscordRenderer().ProviderType);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/EmailServiceTests.cs

@@ -0,0 +1,315 @@
+using System.Collections.Generic;
+using System.Net;
+using System.Net.Http;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Coverage for the provider-neutral <see cref="EmailService"/> (welcome + farewell mails).
+/// The provider HTTP call is driven through a stub handler, so the Mandrill wire format,
+/// the result-array interpretation and the fail-soft contract are pinned without network.
+/// <list type="bullet">
+///   <item>Neither send method ever throws — not on a missing key, missing recipient,
+///         HTTP 500, a rejected recipient, nor a malformed body.</item>
+///   <item>Gate ordering: missing-key short-circuits before missing-recipient.</item>
+///   <item>Tracking is off on the wire (trust-page claim: provider receives only the
+///         recipient address and tenant domain).</item>
+///   <item>The farewell template is final: no [DRAFT]/placeholder residue, domain is
+///         interpolated, empty domain falls back to "your organization".</item>
+/// </list>
+/// </summary>
+public sealed class EmailServiceTests
+{
+    private const string TenantId = "88888888-8888-8888-8888-888888888888";
+
+    // ----- configuration gates -----
+
+    [Fact]
+    public async Task SendAsync_EmptyApiKey_NoOps_AndLogsMissingKeyDebugLine()
+    {
+        var (sut, handler, logger) = Build(apiKey: "");
+
+        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId, CancellationToken.None);
+
+        Assert.Equal(0, handler.CallCount);
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Debug && e.Message.Contains("Email:ApiKey not configured"));
+    }
+
+    [Fact]
+    public async Task SendAsync_EmptyRecipient_NoOps_AndLogsMissingEmailDebugLine()
+    {
+        var (sut, handler, logger) = Build(apiKey: "any-non-empty-key");
+
+        await sut.SendAsync("", "contoso.invalid", TenantId);
+
+        Assert.Equal(0, handler.CallCount);
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Debug && e.Message.Contains("No notification email captured"));
+    }
+
+    [Fact]
+    public async Task SendAsync_EmptyApiKey_ShortCircuitsBeforeRecipientCheck()
+    {
+        // Pins the gate ordering: missing-key > missing-email. Both are empty here; only
+        // the key line must show up.
+        var (sut, _, logger) = Build(apiKey: "");
+
+        await sut.SendAsync("", "contoso.invalid", TenantId);
+
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Debug && e.Message.Contains("Email:ApiKey not configured"));
+        Assert.DoesNotContain(logger.Entries,
+            e => e.Message.Contains("No notification email captured"));
+    }
+
+    [Fact]
+    public async Task SendPreviewApprovedEmailAsync_EmptyApiKey_NoOps()
+    {
+        var (sut, handler, logger) = Build(apiKey: "");
+
+        await sut.SendPreviewApprovedEmailAsync("it@contoso.invalid", "contoso.invalid");
+
+        Assert.Equal(0, handler.CallCount);
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Debug && e.Message.Contains("Email:ApiKey not configured"));
+    }
+
+    // ----- wire format -----
+
+    [Fact]
+    public async Task SendPreviewApprovedEmailAsync_PostsMandrillPayload_WithTrackingOff()
+    {
+        var (sut, handler, logger) = Build(apiKey: "md-test-key");
+
+        await sut.SendPreviewApprovedEmailAsync("it@contoso.invalid", "contoso.invalid");
+
+        Assert.Equal(1, handler.CallCount);
+        Assert.Equal(HttpMethod.Post, handler.LastRequest!.Method);
+        Assert.Equal(EmailService.DefaultEndpoint, handler.LastRequest.RequestUri!.ToString());
+
+        using var doc = JsonDocument.Parse(handler.LastBody!);
+        var root = doc.RootElement;
+        Assert.Equal("md-test-key", root.GetProperty("key").GetString());
+
+        var message = root.GetProperty("message");
+        Assert.Equal(EmailService.DefaultFromAddress, message.GetProperty("from_email").GetString());
+        Assert.Equal(EmailService.DefaultFromName, message.GetProperty("from_name").GetString());
+        Assert.Equal("it@contoso.invalid", message.GetProperty("to")[0].GetProperty("email").GetString());
+        Assert.Equal("to", message.GetProperty("to")[0].GetProperty("type").GetString());
+        Assert.Equal(EmailTemplates.PreviewApprovedSubject, message.GetProperty("subject").GetString());
+        Assert.Contains("contoso.invalid", message.GetProperty("html").GetString());
+        Assert.True(message.GetProperty("auto_text").GetBoolean());
+        Assert.False(message.GetProperty("track_opens").GetBoolean());
+        Assert.False(message.GetProperty("track_clicks").GetBoolean());
+        Assert.Equal("welcome", message.GetProperty("tags")[0].GetString());
+
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Information && e.Message.Contains("Preview approval email sent"));
+    }
+
+    [Fact]
+    public async Task SendAsync_UsesFarewellTemplate_AndFarewellTag()
+    {
+        var (sut, handler, logger) = Build(apiKey: "md-test-key");
+
+        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+
+        using var doc = JsonDocument.Parse(handler.LastBody!);
+        var message = doc.RootElement.GetProperty("message");
+        Assert.Equal(EmailTemplates.OffboardingFarewellSubject, message.GetProperty("subject").GetString());
+        Assert.Equal("offboarding-farewell", message.GetProperty("tags")[0].GetString());
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Information && e.Message.Contains("Offboard farewell email sent"));
+    }
+
+    [Fact]
+    public async Task ConfiguredEndpointAndSender_OverrideDefaults()
+    {
+        var (sut, handler, _) = Build(apiKey: "md-test-key", extra: new Dictionary<string, string?>
+        {
+            ["Email:Endpoint"] = "https://mail.example.invalid/send",
+            ["Email:FromAddress"] = "hello@example.invalid",
+            ["Email:FromName"] = "Example Sender",
+        });
+
+        await sut.SendPreviewApprovedEmailAsync("it@contoso.invalid", "contoso.invalid");
+
+        Assert.Equal("https://mail.example.invalid/send", handler.LastRequest!.RequestUri!.ToString());
+        using var doc = JsonDocument.Parse(handler.LastBody!);
+        var message = doc.RootElement.GetProperty("message");
+        Assert.Equal("hello@example.invalid", message.GetProperty("from_email").GetString());
+        Assert.Equal("Example Sender", message.GetProperty("from_name").GetString());
+    }
+
+    // ----- provider responses / fail-soft -----
+
+    [Fact]
+    public async Task ProviderHttpError_DoesNotThrow_AndLogsWarning_WithoutSuccessLine()
+    {
+        var (sut, _, logger) = Build(apiKey: "md-test-key",
+            responder: _ => Json(HttpStatusCode.InternalServerError,
+                "{\"status\":\"error\",\"code\":-1,\"name\":\"Invalid_Key\",\"message\":\"Invalid API key\"}"));
+
+        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Warning && e.Message.Contains("500") && e.Message.Contains("Invalid_Key"));
+        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Information);
+    }
+
+    [Fact]
+    public async Task ProviderRejectsRecipient_LogsWarningWithReason_WithoutSuccessLine()
+    {
+        var (sut, _, logger) = Build(apiKey: "md-test-key",
+            responder: _ => Json(HttpStatusCode.OK,
+                "[{\"email\":\"ops@contoso.invalid\",\"status\":\"rejected\",\"reject_reason\":\"hard-bounce\",\"_id\":\"abc\"}]"));
+
+        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Warning && e.Message.Contains("rejected") && e.Message.Contains("hard-bounce"));
+        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Information);
+    }
+
+    [Theory]
+    [InlineData("sent")]
+    [InlineData("queued")]
+    [InlineData("scheduled")]
+    public async Task ProviderAcceptedStatuses_CountAsSuccess(string status)
+    {
+        var (sut, _, logger) = Build(apiKey: "md-test-key",
+            responder: _ => Json(HttpStatusCode.OK,
+                $"[{{\"email\":\"ops@contoso.invalid\",\"status\":\"{status}\",\"_id\":\"abc\"}}]"));
+
+        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Information);
+        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Warning);
+    }
+
+    [Fact]
+    public async Task MalformedProviderBody_DoesNotThrow_AndLogsWarning()
+    {
+        var (sut, _, logger) = Build(apiKey: "md-test-key",
+            responder: _ => Json(HttpStatusCode.OK, "not json"));
+
+        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Warning);
+        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Information);
+    }
+
+    [Fact]
+    public async Task TransportException_DoesNotThrow_AndLogsWarning()
+    {
+        var (sut, _, logger) = Build(apiKey: "md-test-key",
+            responder: _ => throw new HttpRequestException("simulated provider outage"));
+
+        await sut.SendPreviewApprovedEmailAsync("it@contoso.invalid", "contoso.invalid");
+
+        Assert.Contains(logger.Entries,
+            e => e.Level == LogLevel.Warning && e.Message.Contains("Failed to send welcome mail"));
+    }
+
+    // ----- templates -----
+
+    [Fact]
+    public void FarewellTemplate_IsFinal_NoDraftResidue()
+    {
+        Assert.DoesNotContain("DRAFT", EmailTemplates.OffboardingFarewellSubject);
+
+        var html = EmailTemplates.GetOffboardingFarewellHtml("contoso.invalid");
+        Assert.DoesNotContain("DRAFT", html);
+        Assert.DoesNotContain("TEMPLATE NOT FINALISED", html);
+        Assert.DoesNotContain("TODO", html);
+    }
+
+    [Fact]
+    public void FarewellTemplate_InterpolatesDomain_AndLinksFeedbackChannels()
+    {
+        var html = EmailTemplates.GetOffboardingFarewellHtml("contoso.invalid");
+
+        Assert.Contains("contoso.invalid", html);
+        // The mail is sent from a noreply address after portal access is gone, so the
+        // feedback pointers must be external channels the recipient can actually reach.
+        Assert.Contains("https://github.com/okieselbach/AutopilotMonitor/issues", html);
+        Assert.Contains("linkedin.com", html);
+    }
+
+    [Fact]
+    public void FarewellTemplate_EmptyDomain_FallsBackToGenericLabel()
+    {
+        var html = EmailTemplates.GetOffboardingFarewellHtml("");
+        Assert.Contains("your organization", html);
+    }
+
+    // ----- harness -----
+
+    private static HttpResponseMessage Json(HttpStatusCode status, string body)
+        => new(status) { Content = new StringContent(body, System.Text.Encoding.UTF8, "application/json") };
+
+    private static (EmailService sut, StubHandler handler, CapturingLogger<EmailService> logger) Build(
+        string apiKey,
+        Dictionary<string, string?>? extra = null,
+        System.Func<HttpRequestMessage, HttpResponseMessage>? responder = null)
+    {
+        var settings = new Dictionary<string, string?> { ["Email:ApiKey"] = apiKey };
+        if (extra is not null)
+            foreach (var kv in extra) settings[kv.Key] = kv.Value;
+
+        var config = new ConfigurationBuilder().AddInMemoryCollection(settings).Build();
+        var handler = new StubHandler();
+        if (responder is not null) handler.Responder = responder;
+        var logger = new CapturingLogger<EmailService>();
+        var templates = new EmailTemplateService(
+            Moq.Mock.Of<AutopilotMonitor.Shared.DataAccess.IConfigRepository>(),
+            new Microsoft.Extensions.Caching.Memory.MemoryCache(new Microsoft.Extensions.Caching.Memory.MemoryCacheOptions()),
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<EmailTemplateService>.Instance);
+        var sut = new EmailService(new HttpClient(handler, disposeHandler: false), config, templates, logger);
+        return (sut, handler, logger);
+    }
+
+    private sealed class StubHandler : HttpMessageHandler
+    {
+        public int CallCount { get; private set; }
+        public HttpRequestMessage? LastRequest { get; private set; }
+        public string? LastBody { get; private set; }
+        public System.Func<HttpRequestMessage, HttpResponseMessage> Responder { get; set; } = _ =>
+            Json(HttpStatusCode.OK, "[{\"email\":\"x@y.invalid\",\"status\":\"sent\",\"_id\":\"abc\"}]");
+
+        protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            CallCount++;
+            LastRequest = request;
+            LastBody = request.Content is null ? null : await request.Content.ReadAsStringAsync(cancellationToken);
+            return Responder(request);
+        }
+    }
+
+    private sealed class CapturingLogger<T> : ILogger<T>
+    {
+        public readonly List<(LogLevel Level, string Message)> Entries = new();
+        public IDisposable BeginScope<TState>(TState state) where TState : notnull => NullScope.Instance;
+        public bool IsEnabled(LogLevel logLevel) => true;
+        public void Log<TState>(
+            LogLevel logLevel, EventId eventId, TState state, System.Exception? exception,
+            System.Func<TState, System.Exception?, string> formatter)
+        {
+            Entries.Add((logLevel, formatter(state, exception)));
+        }
+
+        private sealed class NullScope : IDisposable
+        {
+            public static readonly NullScope Instance = new();
+            public void Dispose() { }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/EmailTemplateServiceTests.cs

@@ -0,0 +1,131 @@
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the operator-override layer over the built-in transactional templates:
+/// override wins when stored, built-in otherwise; placeholder rendering matches the
+/// built-ins' empty-domain fallback; the send path is fail-soft on storage errors while the
+/// admin path is not; save validates and invalidates the cache; reset is idempotent.
+/// </summary>
+public sealed class EmailTemplateServiceTests
+{
+    [Fact]
+    public async Task NoOverride_ReturnsBuiltIn_Rendered()
+    {
+        var (sut, _) = Build();
+
+        var html = await sut.GetHtmlAsync(EmailTemplateKind.Welcome, "contoso.invalid");
+
+        Assert.Equal(EmailTemplates.GetPreviewApprovedHtml("contoso.invalid"), html);
+        Assert.DoesNotContain(EmailTemplateService.DomainPlaceholder, html);
+    }
+
+    [Fact]
+    public async Task Override_WinsAndRendersPlaceholder()
+    {
+        var (sut, repo) = Build();
+        repo.Setup(r => r.GetEmailTemplateOverrideAsync("farewell"))
+            .ReturnsAsync(new EmailTemplateOverride { Kind = "farewell", Html = "<p>Bye {{domainName}}</p>" });
+
+        var html = await sut.GetHtmlAsync(EmailTemplateKind.Farewell, "contoso.invalid");
+
+        Assert.Equal("<p>Bye contoso.invalid</p>", html);
+    }
+
+    [Fact]
+    public async Task Override_EmptyDomain_FallsBackToGenericLabel_LikeBuiltIn()
+    {
+        var (sut, repo) = Build();
+        repo.Setup(r => r.GetEmailTemplateOverrideAsync("welcome"))
+            .ReturnsAsync(new EmailTemplateOverride { Kind = "welcome", Html = "Hi {{domainName}}" });
+
+        Assert.Equal("Hi your organization", await sut.GetHtmlAsync(EmailTemplateKind.Welcome, ""));
+    }
+
+    [Fact]
+    public async Task StorageError_SendPath_FallsBackToBuiltIn_AdminPath_Throws()
+    {
+        var (sut, repo) = Build();
+        repo.Setup(r => r.GetEmailTemplateOverrideAsync(It.IsAny<string>()))
+            .ThrowsAsync(new System.InvalidOperationException("storage down"));
+
+        var html = await sut.GetHtmlAsync(EmailTemplateKind.Welcome, "contoso.invalid");
+        Assert.Contains("contoso.invalid", html);
+
+        await Assert.ThrowsAsync<System.InvalidOperationException>(() => sut.GetOverrideAsync(EmailTemplateKind.Welcome));
+    }
+
+    [Fact]
+    public async Task Save_Validates_ThenInvalidatesCache()
+    {
+        var (sut, repo) = Build();
+        repo.Setup(r => r.GetEmailTemplateOverrideAsync("welcome")).ReturnsAsync((EmailTemplateOverride?)null);
+
+        // warm the cache with "no override"
+        Assert.Null(await sut.GetOverrideAsync(EmailTemplateKind.Welcome));
+
+        await Assert.ThrowsAsync<System.ArgumentException>(() => sut.SaveOverrideAsync(EmailTemplateKind.Welcome, "   ", "ga@contoso.invalid"));
+        await Assert.ThrowsAsync<System.ArgumentException>(() =>
+            sut.SaveOverrideAsync(EmailTemplateKind.Welcome, new string('x', EmailTemplateService.MaxHtmlLength + 1), "ga@contoso.invalid"));
+        repo.Verify(r => r.SaveEmailTemplateOverrideAsync(It.IsAny<EmailTemplateOverride>()), Times.Never);
+
+        EmailTemplateOverride? stored = null;
+        repo.Setup(r => r.SaveEmailTemplateOverrideAsync(It.IsAny<EmailTemplateOverride>()))
+            .Callback<EmailTemplateOverride>(e => stored = e).Returns(Task.CompletedTask);
+        repo.Setup(r => r.GetEmailTemplateOverrideAsync("welcome")).ReturnsAsync(() => stored);
+
+        var saved = await sut.SaveOverrideAsync(EmailTemplateKind.Welcome, "<p>{{domainName}}</p>", "ga@contoso.invalid");
+
+        Assert.Equal("welcome", saved.Kind);
+        Assert.Equal("ga@contoso.invalid", saved.UpdatedBy);
+        // cache was invalidated: the next read sees the stored override, not the cached null
+        Assert.NotNull(await sut.GetOverrideAsync(EmailTemplateKind.Welcome));
+        Assert.Equal("<p>contoso.invalid</p>", await sut.GetHtmlAsync(EmailTemplateKind.Welcome, "contoso.invalid"));
+    }
+
+    [Fact]
+    public async Task Delete_ClearsCache_ReturnsToBuiltIn()
+    {
+        var (sut, repo) = Build();
+        var stored = new EmailTemplateOverride { Kind = "farewell", Html = "custom {{domainName}}" };
+        repo.Setup(r => r.GetEmailTemplateOverrideAsync("farewell")).ReturnsAsync(() => stored);
+        Assert.Equal("custom contoso.invalid", await sut.GetHtmlAsync(EmailTemplateKind.Farewell, "contoso.invalid"));
+
+        repo.Setup(r => r.DeleteEmailTemplateOverrideAsync("farewell")).Callback(() => stored = null!).Returns(Task.CompletedTask);
+        await sut.DeleteOverrideAsync(EmailTemplateKind.Farewell, "ga@contoso.invalid");
+
+        Assert.Equal(EmailTemplates.GetOffboardingFarewellHtml("contoso.invalid"),
+            await sut.GetHtmlAsync(EmailTemplateKind.Farewell, "contoso.invalid"));
+    }
+
+    [Theory]
+    [InlineData("welcome", true)]
+    [InlineData("Farewell", true)]
+    [InlineData("invoice", false)]
+    [InlineData(null, false)]
+    public void TryParseKind_AcceptsOnlyKnownKinds(string? value, bool expected)
+        => Assert.Equal(expected, EmailTemplateService.TryParseKind(value, out _));
+
+    [Fact]
+    public void BuiltInRaw_ContainsPlaceholder_ForBothKinds()
+    {
+        Assert.Contains(EmailTemplateService.DomainPlaceholder, EmailTemplateService.BuiltInRaw(EmailTemplateKind.Welcome));
+        Assert.Contains(EmailTemplateService.DomainPlaceholder, EmailTemplateService.BuiltInRaw(EmailTemplateKind.Farewell));
+    }
+
+    private static (EmailTemplateService sut, Mock<IConfigRepository> repo) Build()
+    {
+        var repo = new Mock<IConfigRepository>(MockBehavior.Loose);
+        var sut = new EmailTemplateService(repo.Object, new MemoryCache(new MemoryCacheOptions()), NullLogger<EmailTemplateService>.Instance);
+        return (sut, repo);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/EndpointPolicyCatalogCompletenessTests.cs

@@ -191,6 +191,21 @@ public class EndpointPolicyCatalogCompletenessTests
         Assert.Equal(EndpointPolicy.GlobalAdminOnly, reseed.Policy);
     }
 
+    /// <summary>
+    /// The built-in diagnostics catalog + global paths are platform-wide, secret-free data that
+    /// every settings viewer needs (what is collected from the tenant's devices). Member tier,
+    /// JWT-scoped — an upgrade to a global tier would hide it from tenant admins again.
+    /// </summary>
+    [Fact]
+    public void DiagnosticsPaths_IsMemberReadJwtScoped()
+    {
+        var entry = EndpointAccessPolicyCatalog.FindPolicy("GET", "/api/diagnostics/paths");
+
+        Assert.NotNull(entry);
+        Assert.Equal(EndpointPolicy.MemberRead, entry.Policy);
+        Assert.Equal(TenantScoping.Jwt, entry.TenantScoping);
+    }
+
     /// <summary>
     /// Unregistered routes must return null (fail-closed).
     /// </summary>

src/Backend/AutopilotMonitor.Functions.Tests/EnrollmentTimeoutClassifierTests.cs

@@ -163,6 +163,12 @@ public class EnrollmentTimeoutClassifierTests
     // -------- ClassifyTimedOutSession --------
 
     private static (SessionStatus, string) Classify(IReadOnlyList<EnrollmentEvent> events, double hoursSinceStart = 6, int grace = 72)
+    {
+        var (status, reason, _) = ClassifyWithRule(events, hoursSinceStart, grace);
+        return (status, reason);
+    }
+
+    private static (SessionStatus, string, string) ClassifyWithRule(IReadOnlyList<EnrollmentEvent> events, double hoursSinceStart = 6, int grace = 72)
     {
         var rollup = EnrollmentTimeoutClassifier.ExtractRollup(events);
         var now = Start.AddHours(hoursSinceStart);
@@ -220,7 +226,7 @@ public class EnrollmentTimeoutClassifierTests
             Esp(DeviceSetup44), Esp(AccountSetup15),
             Evt("desktop_arrived"), Evt("hello_provisioning_completed"), Evt("realmjoin_detected"),
         });
-        var (status, reason) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(
+        var (status, reason, _) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(
             rollup, Start, now, graceHours: 72, lastEventAtUtc: lastEvent);
 
         Assert.Equal(SessionStatus.Succeeded, status);
@@ -471,4 +477,230 @@ public class EnrollmentTimeoutClassifierTests
             Assert.NotEqual(SessionStatus.Failed, status);
         }
     }
+
+    // -------- WhiteGlove Part-2 awaiting-user gate (fairstone.ca analysis 2026-08-21) --------
+
+    private static readonly DateTime Resumed = Start.AddMinutes(20);
+
+    private static (SessionStatus, string) ClassifyWhiteGlove(
+        IReadOnlyList<EnrollmentEvent> events, double hoursSinceStart = 6, int grace = 51)
+    {
+        var rollup = EnrollmentTimeoutClassifier.ExtractRollup(events);
+        var now = Start.AddHours(hoursSinceStart);
+        var (status, reason, _) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(
+            rollup, Start, now, grace, isPreProvisioned: true, resumedAt: Resumed);
+        return (status, reason);
+    }
+
+    /// <summary>The fairstone event shape: Part 1 sealed, Part 2 resumed, nobody signed in.</summary>
+    private static EnrollmentEvent[] WgParkedEvents() => new[]
+    {
+        Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup05),
+    };
+
+    [Fact]
+    public void ExtractRollup_separates_enrollment_complete_from_whiteglove_complete()
+    {
+        var wgOnly = EnrollmentTimeoutClassifier.ExtractRollup(new[] { Evt("whiteglove_complete") });
+        Assert.True(wgOnly.HasTerminalComplete);
+        Assert.False(wgOnly.HasEnrollmentComplete);
+
+        var real = EnrollmentTimeoutClassifier.ExtractRollup(new[] { Evt("enrollment_complete") });
+        Assert.True(real.HasTerminalComplete);
+        Assert.True(real.HasEnrollmentComplete);
+    }
+
+    [Fact]
+    public void WhiteGloveGate_requires_preprovisioned_and_resume_and_device_setup()
+    {
+        var parked = EnrollmentTimeoutClassifier.ExtractRollup(WgParkedEvents());
+        Assert.True(EnrollmentTimeoutClassifier.IsWhiteGloveAwaitingUser(parked, true, Resumed));
+        Assert.False(EnrollmentTimeoutClassifier.IsWhiteGloveAwaitingUser(parked, false, Resumed));
+        Assert.False(EnrollmentTimeoutClassifier.IsWhiteGloveAwaitingUser(parked, true, null));
+
+        // Powered off before Device Setup ever provisioned → not the parking state.
+        var early = EnrollmentTimeoutClassifier.ExtractRollup(new[]
+        {
+            Esp("ESP provisioning status: DeviceSetup — 3 of 4 subcategories completed"),
+        });
+        Assert.False(EnrollmentTimeoutClassifier.IsWhiteGloveAwaitingUser(early, true, Resumed));
+    }
+
+    [Fact]
+    public void WhiteGloveGate_any_user_evidence_or_terminal_disarms_it()
+    {
+        foreach (var evidence in new[]
+        {
+            Esp(AccountSetup15),                    // Account Setup progressed → user was there
+            Evt("desktop_arrived"),                 // real-user desktop
+            Evt("hello_provisioning_completed"),    // positive Hello terminal
+            Evt("enrollment_complete"),             // real completion
+            Evt("enrollment_failed"),               // explicit failure
+        })
+        {
+            var rollup = EnrollmentTimeoutClassifier.ExtractRollup(new[]
+            {
+                Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup05), evidence,
+            });
+            Assert.False(EnrollmentTimeoutClassifier.IsWhiteGloveAwaitingUser(rollup, true, Resumed));
+        }
+    }
+
+    [Fact]
+    public void Classify_whiteglove_part2_parked_within_grace_is_AwaitingUser()
+    {
+        // The fairstone shape: technician powers the device off at the logon screen minutes
+        // after the reseal-reboot. Part-1 whiteglove_complete must NOT reconcile to Succeeded.
+        var (status, reason) = ClassifyWhiteGlove(WgParkedEvents(), hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.AwaitingUser, status);
+        Assert.Contains("sealed or powered off awaiting the end user", reason);
+        Assert.Contains("(Account Setup 0/5)", reason);
+    }
+
+    [Fact]
+    public void Classify_whiteglove_part2_parked_past_grace_reconciles_with_honest_reason()
+    {
+        var (status, reason) = ClassifyWhiteGlove(WgParkedEvents(), hoursSinceStart: 60, grace: 51);
+        Assert.Equal(SessionStatus.Succeeded, status);
+        Assert.Contains("pre-provisioning (WhiteGlove Part 1) completed", reason);
+        Assert.DoesNotContain("Account Setup completed", reason);
+    }
+
+    [Fact]
+    public void Classify_whiteglove_part2_with_partial_user_progress_is_not_reconciled_on_part1_evidence()
+    {
+        // User signed in and Account Setup progressed to 1/5, then silence. The Part-1
+        // whiteglove_complete previously reconciled this to Succeeded claiming "Account Setup
+        // completed" — on a resumed session only a real enrollment_complete proves the outcome,
+        // so this honest shape falls through to the AwaitingUser/Incomplete rules.
+        var events = new[]
+        {
+            Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup15),
+        };
+        var (withinGrace, _) = ClassifyWhiteGlove(events, hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.AwaitingUser, withinGrace);
+
+        var (pastGrace, reason) = ClassifyWhiteGlove(events, hoursSinceStart: 60, grace: 51);
+        Assert.Equal(SessionStatus.Incomplete, pastGrace);
+        Assert.Contains("1/5", reason);
+    }
+
+    [Fact]
+    public void Classify_whiteglove_part2_with_desktop_and_hello_still_reconciles_via_user_evidence()
+    {
+        // Both Classic completion prerequisites in → the user provably finished; the
+        // user-completed reconcile (rule 4) owns this, not the parking gate.
+        var (status, reason) = ClassifyWhiteGlove(new[]
+        {
+            Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup15),
+            Evt("desktop_arrived"), Evt("hello_provisioning_completed"),
+        }, hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.Succeeded, status);
+        Assert.Contains("user completed setup", reason);
+    }
+
+    [Fact]
+    public void Classify_whiteglove_part2_real_enrollment_complete_still_reconciles_to_Succeeded()
+    {
+        var (status, _) = ClassifyWhiteGlove(new[]
+        {
+            Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup05), Evt("enrollment_complete"),
+        }, hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.Succeeded, status);
+    }
+
+    [Fact]
+    public void Classify_unresumed_session_keeps_terminal_complete_reconcile()
+    {
+        // No resumedAt (plain sessions, or a sealed Part 1 whose Pending write was lost):
+        // whiteglove_complete keeps reconciling to Succeeded exactly as before.
+        var rollup = EnrollmentTimeoutClassifier.ExtractRollup(new[]
+        {
+            Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup05),
+        });
+        var (status, _, _) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(
+            rollup, Start, Start.AddHours(6), 51, isPreProvisioned: true, resumedAt: null);
+        Assert.Equal(SessionStatus.Succeeded, status);
+    }
+
+    // -------- Self-deploying profile gate (kiosk tenant aebdce78, audit 2026-08-23) --------
+
+    private static (SessionStatus, string) ClassifySelfDeploying(
+        IReadOnlyList<EnrollmentEvent> events, double hoursSinceStart = 3, int grace = 51)
+    {
+        var rollup = EnrollmentTimeoutClassifier.ExtractRollup(events);
+        var (status, reason, _) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(
+            rollup, Start, Start.AddHours(hoursSinceStart), grace,
+            lastEventAtUtc: Start.AddMinutes(4), isSelfDeployingProfile: true);
+        return (status, reason);
+    }
+
+    // Session 195593e2 replay: DeviceSetup 4/4 (fallback-confirmed), AccountSetup registry
+    // at 0/5 (the IME false positive — user ESP never runs on this profile), Hello disabled,
+    // SkipUser=True, then silence after the post-ESP reboot. No user will ever sign in.
+    private static readonly EnrollmentEvent[] KioskSilentStream =
+    {
+        Esp(DeviceSetup44), Esp(AccountSetup05), Esp(DeviceSetupFallback),
+        HelloPolicy(enabled: false), EspConfig(skipUser: true),
+    };
+
+    [Fact]
+    public void IsSelfDeployingProvisioned_requires_flag_device_setup_and_no_failure()
+    {
+        var provisioned = EnrollmentTimeoutClassifier.ExtractRollup(KioskSilentStream);
+        Assert.True(EnrollmentTimeoutClassifier.IsSelfDeployingProvisioned(provisioned, isSelfDeployingProfile: true));
+        Assert.False(EnrollmentTimeoutClassifier.IsSelfDeployingProvisioned(provisioned, isSelfDeployingProfile: false));
+
+        var beforeDeviceSetup = EnrollmentTimeoutClassifier.ExtractRollup(new[] { Esp(AccountSetup05) });
+        Assert.False(EnrollmentTimeoutClassifier.IsSelfDeployingProvisioned(beforeDeviceSetup, isSelfDeployingProfile: true));
+
+        var failed = EnrollmentTimeoutClassifier.ExtractRollup(new[] { Esp(DeviceSetup44), Evt("enrollment_failed") });
+        Assert.False(EnrollmentTimeoutClassifier.IsSelfDeployingProvisioned(failed, isSelfDeployingProfile: true));
+    }
+
+    [Fact]
+    public void Classify_self_deploying_silent_after_device_setup_reconciles_to_Succeeded_within_grace()
+    {
+        var (status, reason) = ClassifySelfDeploying(KioskSilentStream, hoursSinceStart: 3);
+        Assert.Equal(SessionStatus.Succeeded, status);
+        Assert.Contains("self-deploying profile", reason);
+        Assert.Contains("no user / Account Setup phase", reason);
+        Assert.Contains("Agent last reported 2026-07-06 15:04 UTC", reason);
+        Assert.DoesNotContain("Account Setup completed", reason);
+    }
+
+    [Fact]
+    public void Classify_self_deploying_silent_after_device_setup_reconciles_to_Succeeded_past_grace()
+    {
+        // Grace is a user-phase concept; it does not apply when there is no user phase.
+        var (status, _) = ClassifySelfDeploying(KioskSilentStream, hoursSinceStart: 60, grace: 51);
+        Assert.Equal(SessionStatus.Succeeded, status);
+    }
+
+    [Fact]
+    public void Classify_same_stream_without_self_deploying_flag_keeps_user_phase_verdicts()
+    {
+        // Guard against the gate leaking into user-driven sessions: the identical event shape
+        // on a user-driven profile is still "awaiting user" within grace / Incomplete past it.
+        var rollup = EnrollmentTimeoutClassifier.ExtractRollup(KioskSilentStream);
+        var (within, _, _) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(rollup, Start, Start.AddHours(3), 51);
+        var (past, _, _) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(rollup, Start, Start.AddHours(60), 51);
+        Assert.Equal(SessionStatus.AwaitingUser, within);
+        Assert.Equal(SessionStatus.Incomplete, past);
+    }
+
+    [Fact]
+    public void Classify_self_deploying_explicit_failure_stays_Failed()
+    {
+        var (status, _) = ClassifySelfDeploying(new[] { Esp(DeviceSetup44), Evt("enrollment_failed") });
+        Assert.Equal(SessionStatus.Failed, status);
+    }
+
+    [Fact]
+    public void Classify_self_deploying_silent_before_device_setup_is_Incomplete()
+    {
+        // The profile flag alone proves nothing — Device ESP must have finished.
+        var (status, _) = ClassifySelfDeploying(new[] { Esp(AccountSetup05), Evt("agent_started") });
+        Assert.Equal(SessionStatus.Incomplete, status);
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/EventTimestampValidationTests.cs

@@ -379,20 +379,50 @@ public class EventTimestampValidationTests
     }
 
     [Fact]
-    public void RecalculateAppDurations_DownloadThenInstall_CorrectDownloadDuration()
+    public void DownloadThenInstall_AttemptScopedPairing_DownloadAndInstallDurations()
     {
+        // 2026-08 attempt-duration change: DownloadDurationSeconds pairs the latest download
+        // start with the NEXT install start at event-fold time (no first→first span math),
+        // and DurationSeconds anchors on the install attempt (download time is reported
+        // separately, not folded into the install duration).
         var downloadStart = new DateTime(2026, 3, 30, 10, 0, 0, DateTimeKind.Utc);
         var installStart = downloadStart.AddSeconds(30);
         var completed = installStart.AddSeconds(45);
 
+        var summaries = new Dictionary<string, AppInstallAggregationState>(StringComparer.OrdinalIgnoreCase);
+        foreach (var evt in new[]
+        {
+            AppInstallEvent("app_download_started", downloadStart),
+            AppInstallEvent("app_install_started", installStart),
+            AppInstallEvent("app_install_completed", completed, "Installed"),
+        })
+        {
+            EventIngestProcessor.AggregateAppInstallEvent(evt, "tenant", "session", summaries);
+        }
+
+        var summary = summaries["TestApp"].Summary;
+        Assert.Equal(30, summary.DownloadDurationSeconds); // download→install gap
+        Assert.Equal(45, summary.DurationSeconds);         // install attempt only
+        Assert.Equal(installStart, summary.LastAttemptStartedAt);
+        Assert.Equal(downloadStart, summary.StartedAt);    // first-seen anchor
+    }
+
+    [Fact]
+    public void RecalculateAppDurations_AttemptAnchor_BeatsFirstSeenSpan()
+    {
+        // With an observed attempt start, the duration is the attempt — never the span
+        // back to the first observation an hour earlier.
+        var firstSeen = new DateTime(2026, 3, 30, 10, 0, 0, DateTimeKind.Utc);
+        var attemptStart = firstSeen.AddMinutes(60);
+        var completed = attemptStart.AddSeconds(45);
+
         var state = new AppInstallAggregationState
         {
-            DownloadStartedAt = downloadStart,
-            InstallStartedAt = installStart,
             Summary = new AppInstallSummary
             {
                 AppName = "TestApp",
-                StartedAt = downloadStart,
+                StartedAt = firstSeen,
+                LastAttemptStartedAt = attemptStart,
                 CompletedAt = completed,
                 Status = "Succeeded"
             }
@@ -400,8 +430,46 @@ public class EventTimestampValidationTests
 
         EventIngestProcessor.RecalculateAppDurations(state);
 
-        Assert.Equal(30, state.Summary.DownloadDurationSeconds); // download→install gap
-        Assert.Equal(75, state.Summary.DurationSeconds);         // full duration
+        Assert.Equal(45, state.Summary.DurationSeconds);
+    }
+
+    [Fact]
+    public void RecalculateAppDurations_AttemptNewerThanCompletion_KeepsRecordedDuration()
+    {
+        // A fresh pass is in flight (start after the last terminal): CompletedAt belongs to
+        // the previous attempt — its recorded duration must stand.
+        var attempt1 = new DateTime(2026, 3, 30, 10, 0, 0, DateTimeKind.Utc);
+        var completed = attempt1.AddSeconds(40);
+        var attempt2 = completed.AddMinutes(30);
+
+        var state = new AppInstallAggregationState
+        {
+            Summary = new AppInstallSummary
+            {
+                AppName = "TestApp",
+                StartedAt = attempt1,
+                LastAttemptStartedAt = attempt2,
+                CompletedAt = completed,
+                DurationSeconds = 40,
+                Status = "Succeeded"
+            }
+        };
+
+        EventIngestProcessor.RecalculateAppDurations(state);
+
+        Assert.Equal(40, state.Summary.DurationSeconds);
+    }
+
+    private static EnrollmentEvent AppInstallEvent(string eventType, DateTime ts, string? state = null)
+    {
+        var evt = new EnrollmentEvent
+        {
+            EventType = eventType,
+            Timestamp = ts,
+            Data = new Dictionary<string, object> { ["appName"] = "TestApp" },
+        };
+        if (state != null) evt.Data["state"] = state;
+        return evt;
     }
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/FleetHealthPayloadTests.cs

@@ -46,6 +46,8 @@ public class FleetHealthPayloadTests
         Assert.Equal(0, payload.Stats.Total);
         Assert.Equal(0d, payload.Stats.SuccessRate);
         Assert.Equal(0, payload.Stats.AvgDurationMinutes);
+        Assert.Equal(0, payload.Stats.MedianDurationMinutes);
+        Assert.Equal(0, payload.Stats.P90DurationMinutes);
         Assert.Empty(payload.FailureReasons);
         Assert.Empty(payload.ModelHealth);
         Assert.Empty(payload.SlowestModels);
@@ -109,6 +111,28 @@ public class FleetHealthPayloadTests
 
         // (600 + 1200) / 2 / 60 = 15 min.
         Assert.Equal(15, payload.Stats.AvgDurationMinutes);
+        // Same population feeds the percentile stats: sorted [600, 1200].
+        Assert.Equal(10, payload.Stats.MedianDurationMinutes);
+        Assert.Equal(20, payload.Stats.P90DurationMinutes);
+    }
+
+    [Fact]
+    public void MedianDuration_IsRobustAgainstOutliers_ThatDominateTheAverage()
+    {
+        // The card's raison d'être: 8 typical 10-min enrollments plus a 2 h and a 24 h
+        // outlier (overnight ESP / WhiteGlove late user phase). The mean explodes to ~2.7 h
+        // while the median still answers "how long does a typical enrollment take".
+        var sessions = new List<SessionSummary>();
+        for (int i = 0; i < 8; i++)
+            sessions.Add(S(SessionStatus.Succeeded, durationSeconds: 600));
+        sessions.Add(S(SessionStatus.Succeeded, durationSeconds: 7200));
+        sessions.Add(S(SessionStatus.Succeeded, durationSeconds: 86400));
+
+        var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 7);
+
+        Assert.Equal(164, payload.Stats.AvgDurationMinutes);   // (8*600 + 7200 + 86400) / 10 / 60
+        Assert.Equal(10, payload.Stats.MedianDurationMinutes); // unmoved by the tail
+        Assert.Equal(120, payload.Stats.P90DurationMinutes);   // tail stays visible
     }
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/GetAgentConfigFunctionTests.cs

@@ -1,4 +1,5 @@
 using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Functions.Tests;
 
@@ -32,6 +33,44 @@ public class GetAgentConfigFunctionTests
         Assert.Equal(expectedMajor, actual);
     }
 
+    // ── MergeDiagnosticsLogPaths — global ∪ tenant without duplicate ZIP entries ──────────
+
+    private static DiagnosticsLogPath P(string path, string description = "") =>
+        new() { Path = path, Description = description };
+
+    [Fact]
+    public void MergeDiagnosticsLogPaths_GlobalFirst_OrderPreserved_DuplicatesDroppedCaseInsensitively()
+    {
+        var global = new[] { P(@"C:\Windows\Panther\setupact.log", "global"), P(@"C:\Windows\Logs\DISM\dism.log") };
+        var tenant = new[]
+        {
+            P(@"c:\windows\panther\SETUPACT.LOG", "tenant copy"),   // same path, different case → dropped
+            P(@"  C:\Windows\Logs\DISM\dism.log  "),                 // trimmed duplicate → dropped
+            P(@"C:\Windows\SetupDiag\*.log", "tenant"),
+        };
+
+        var merged = GetAgentConfigFunction.MergeDiagnosticsLogPaths(global, tenant);
+
+        Assert.Equal(new[]
+        {
+            @"C:\Windows\Panther\setupact.log",
+            @"C:\Windows\Logs\DISM\dism.log",
+            @"C:\Windows\SetupDiag\*.log",
+        }, merged.Select(p => p.Path));
+        Assert.Equal("global", merged[0].Description);   // first occurrence (global) wins
+    }
+
+    [Fact]
+    public void MergeDiagnosticsLogPaths_DropsBlankEntries()
+    {
+        var merged = GetAgentConfigFunction.MergeDiagnosticsLogPaths(
+            new[] { P(""), P("   "), P(@"C:\Install\Log\*.log") },
+            new DiagnosticsLogPath[] { null!, P(@"C:\Install\Log\*.log") });
+
+        Assert.Single(merged);
+        Assert.Equal(@"C:\Install\Log\*.log", merged[0].Path);
+    }
+
     [Theory]
     // CustomerSas: gated on the per-tenant SAS URL being present.
     [InlineData("https://acct.blob.core.windows.net/c?sv=...", "CustomerSas", true)]

src/Backend/AutopilotMonitor.Functions.Tests/GetDiagnosticsPathsPayloadTests.cs

@@ -0,0 +1,70 @@
+using System.Text.Json;
+using AutopilotMonitor.Functions.Functions.Diagnostics;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Wire shape of <c>GET /api/diagnostics/paths</c> (<see cref="GetDiagnosticsPathsFunction.BuildPayload"/>).
+/// The route is MemberRead, so the field set is locked: the payload must stay "what is
+/// collected" — never grow admin-only config.
+/// </summary>
+public class GetDiagnosticsPathsPayloadTests
+{
+    // Mirrors the worker's serializer (Program.cs: PropertyNamingPolicy = CamelCase) so the
+    // nested DiagnosticsLogPath class serializes the way the portal actually receives it.
+    private static readonly JsonSerializerOptions WorkerJson = new() { PropertyNamingPolicy = JsonNamingPolicy.CamelCase };
+
+    private static JsonElement Serialize(AdminConfiguration config)
+    {
+        var json = JsonSerializer.Serialize(GetDiagnosticsPathsFunction.BuildPayload(config), WorkerJson);
+        return JsonDocument.Parse(json).RootElement;
+    }
+
+    [Fact]
+    public void Payload_HasExactlyBuiltInAndGlobalPaths()
+    {
+        var element = Serialize(new AdminConfiguration());
+
+        var fieldNames = element.EnumerateObject().Select(p => p.Name).OrderBy(n => n).ToArray();
+        Assert.Equal(new[] { "builtIn", "globalPaths" }, fieldNames);
+        Assert.Equal(JsonValueKind.Array, element.GetProperty("globalPaths").ValueKind);
+        Assert.Equal(0, element.GetProperty("globalPaths").GetArrayLength());
+    }
+
+    [Fact]
+    public void BuiltIn_MirrorsTheCatalog_WithConditionAsName()
+    {
+        var builtIn = Serialize(new AdminConfiguration()).GetProperty("builtIn");
+
+        Assert.Equal(DiagnosticsBuiltInSections.All.Count, builtIn.GetArrayLength());
+        var first = builtIn[0];
+        Assert.Equal("AgentLogs", first.GetProperty("id").GetString());
+        Assert.Equal("AgentLogs", first.GetProperty("zipFolder").GetString());
+        Assert.Equal(AutopilotMonitor.Shared.Constants.LogDirectory, first.GetProperty("sourceFolder").GetString());
+        Assert.Equal(DiagnosticsBuiltInSections.LogFilePatterns.Length, first.GetProperty("patterns").GetArrayLength());
+        Assert.False(first.GetProperty("includeSubfolders").GetBoolean());
+        Assert.Equal("Always", first.GetProperty("condition").GetString());
+
+        var conditions = builtIn.EnumerateArray().Select(s => s.GetProperty("condition").GetString()).ToArray();
+        Assert.Contains("RealmJoinWatcher", conditions);
+        Assert.Contains("DevicePreparation", conditions);
+        Assert.All(conditions, c => Assert.False(int.TryParse(c, out _), "condition must serialize as the enum name"));
+    }
+
+    [Fact]
+    public void GlobalPaths_RoundTripTheStoredJson()
+    {
+        var config = new AdminConfiguration
+        {
+            DiagnosticsGlobalLogPathsJson =
+                "[{\"path\":\"C:\\\\Windows\\\\Panther\\\\setupact.log\",\"description\":\"Setup\",\"isBuiltIn\":true,\"includeSubfolders\":false}]",
+        };
+
+        var globalPaths = Serialize(config).GetProperty("globalPaths");
+
+        Assert.Equal(1, globalPaths.GetArrayLength());
+        Assert.Equal(@"C:\Windows\Panther\setupact.log", globalPaths[0].GetProperty("path").GetString());
+        Assert.Equal("Setup", globalPaths[0].GetProperty("description").GetString());
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GraphFeatureCatalogSyncTests.cs

@@ -54,9 +54,13 @@ public class GraphFeatureCatalogSyncTests
             .Select(m => m.Groups["f"].Value)
             .ToArray();
 
+        // 'All' is a script-side meta-value that expands to every catalog feature — it is not
+        // (and must never become) a GraphFeatureCatalog entry, but the script must keep offering it.
+        Assert.Contains("All", scriptFeatures);
+
         Assert.Equal(
             GraphFeatureCatalog.Features.OrderBy(f => f, StringComparer.OrdinalIgnoreCase),
-            scriptFeatures.OrderBy(f => f, StringComparer.OrdinalIgnoreCase));
+            scriptFeatures.Where(f => f != "All").OrderBy(f => f, StringComparer.OrdinalIgnoreCase));
     }
 
     private static string ReadGrantScript()

src/Backend/AutopilotMonitor.Functions.Tests/IngestCriticalPathTests.cs

@@ -33,6 +33,31 @@ public class IngestCriticalPathTests
         Assert.All(events, evt => Assert.Equal(receivedAt, evt.ReceivedAt));
     }
 
+    [Fact]
+    public void StampServerFields_SetsSentAtOnAllEvents_AndOverridesAgentValues()
+    {
+        // P14: SentAt is request-level and server-stamped — a per-event value coming off the
+        // wire (agent bug, forged payload) must never survive.
+        var sentAt = DateTime.UtcNow.AddSeconds(-4);
+        var events = MakeEvents(3);
+        events[1].SentAt = DateTime.UtcNow.AddYears(1);
+
+        EventIngestProcessor.StampServerFields(events, ValidTenantId, ValidSessionId, DateTime.UtcNow, sentAt);
+
+        Assert.All(events, evt => Assert.Equal(sentAt, evt.SentAt));
+    }
+
+    [Fact]
+    public void StampServerFields_WithoutSendTimeHeader_LeavesSentAtNull()
+    {
+        var events = MakeEvents(2);
+        events[0].SentAt = DateTime.UtcNow; // forged per-event value must be cleared, not kept
+
+        EventIngestProcessor.StampServerFields(events, ValidTenantId, ValidSessionId, DateTime.UtcNow);
+
+        Assert.All(events, evt => Assert.Null(evt.SentAt));
+    }
+
     [Fact]
     public void StampServerFields_SetsTenantIdOnAllEvents()
     {

src/Backend/AutopilotMonitor.Functions.Tests/IngestTelemetryFunctionTests.cs

@@ -43,6 +43,45 @@ public class IngestTelemetryFunctionTests
         Assert.Equal(string.Empty, session);
     }
 
+    // ============================================================ X-Send-Time-Utc parsing (P14)
+
+    [Fact]
+    public void ParseSendTimeHeader_RoundTripUtc_ParsesToUtc()
+    {
+        var parsed = IngestTelemetryFunction.ParseSendTimeHeader("2026-08-21T10:15:30.1234567Z");
+
+        Assert.Equal(new DateTime(2026, 8, 21, 10, 15, 30, DateTimeKind.Utc).AddTicks(1234567), parsed);
+        Assert.Equal(DateTimeKind.Utc, parsed!.Value.Kind);
+    }
+
+    [Fact]
+    public void ParseSendTimeHeader_OffsetValue_NormalizedToUtc()
+    {
+        var parsed = IngestTelemetryFunction.ParseSendTimeHeader("2026-08-21T12:15:30+02:00");
+
+        Assert.Equal(new DateTime(2026, 8, 21, 10, 15, 30, DateTimeKind.Utc), parsed);
+    }
+
+    [Fact]
+    public void ParseSendTimeHeader_FutureDatedValue_KeptVerbatim()
+    {
+        // A future send time IS the device-clock-error measurement — no upper clamp.
+        var parsed = IngestTelemetryFunction.ParseSendTimeHeader("2027-01-01T00:00:00Z");
+
+        Assert.Equal(new DateTime(2027, 1, 1, 0, 0, 0, DateTimeKind.Utc), parsed);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("not-a-date")]
+    [InlineData("1999-12-31T23:59:59Z")] // pre-2000 can only be garbage (Table Storage floor guard)
+    public void ParseSendTimeHeader_AbsentOrGarbage_ReturnsNull(string? headerValue)
+    {
+        Assert.Null(IngestTelemetryFunction.ParseSendTimeHeader(headerValue));
+    }
+
     // ============================================================ Payload size-cap guard
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/MaintenanceSweepProjectionEquivalenceTests.cs

@@ -0,0 +1,166 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Azure.Data.Tables;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins that the ONE projected window scan the maintenance tick shares across its rolling
+/// sweeps (<c>GetMaintenanceWindowSessionsAsync</c> / <c>MaintenanceSweepSessionProjection</c>)
+/// carries every field the time-attribution, device-journey and verdict-calibration sweeps
+/// read. In Azure Table Storage a <c>$select</c> returns ONLY the listed properties, so the
+/// projected row here is built from the production array — dropping a column there fails the
+/// sweep that consumes it. Mirrors <see cref="UsageMetricsProjectionEquivalenceTests"/>.
+/// </summary>
+public class MaintenanceSweepProjectionEquivalenceTests
+{
+    private const string TenantId = "00000000-0000-0000-0000-000000000abc";
+    private static readonly DateTime Started = new(2026, 8, 10, 9, 0, 0, DateTimeKind.Utc);
+
+    private static readonly TableStorageService Sut =
+        new(new Mock<TableServiceClient>().Object, NullLogger<TableStorageService>.Instance);
+
+    /// <summary>Full wide Sessions row with every column the sweeps read set to a distinct non-default value, plus noise.</summary>
+    private static TableEntity FullRow() => new(TenantId, "11111111-1111-1111-1111-111111111111")
+    {
+        ["Status"] = "Succeeded",
+        ["StartedAt"] = new DateTimeOffset(Started),
+        ["CompletedAt"] = new DateTimeOffset(Started.AddHours(1)),
+        ["LastEventAt"] = new DateTimeOffset(Started.AddHours(2)),
+        ["DurationSeconds"] = 3600,
+        ["EventCount"] = 321,
+        ["DeletionState"] = "None",
+        ["SerialNumber"] = "SN-1234",
+        ["Manufacturer"] = "Contoso",
+        ["Model"] = "Model-X",
+        ["EnrollmentType"] = "v2",
+        ["IsPreProvisioned"] = true,
+        ["IsSelfDeployingProfile"] = true,
+        ["IsUserDriven"] = false,
+        ["ResumedAt"] = new DateTimeOffset(Started.AddMinutes(30)),
+        ["AdminMarkedAction"] = "Succeeded",
+        ["VerdictPath"] = "manual:succeeded",
+        ["PriorStatus"] = "Incomplete",
+        ["PriorVerdictPath"] = "sweep:r6",
+        ["FailureReason"] = "No Device Setup completion or explicit failure signal observed before timeout",
+        ["ReconcileReason"] = "Reconciled at timeout: user completed setup (desktop + Windows Hello)",
+        ["FailureSource"] = "manual",
+        ["EspSoftFailure"] = true,
+        // Noise the sweeps never read — present on the wide row, dropped by the projection.
+        ["DeviceName"] = "PC-FULL",
+        ["OsName"] = "Windows 11",
+        ["OsBuild"] = "26200.1234",
+        ["GeoCountry"] = "DE",
+        ["AgentVersion"] = "2.9.0",
+        ["DiagnosticsBlobName"] = "diag.zip",
+        ["FailureSnapshotJson"] = "{\"big\":\"" + new string('x', 2000) + "\"}",
+    };
+
+    private static TableEntity Project(TableEntity full)
+    {
+        var keep = new HashSet<string>(TableStorageService.MaintenanceSweepSessionProjection, StringComparer.Ordinal);
+        var projected = new TableEntity(full.PartitionKey, full.RowKey);
+        foreach (var kv in full)
+        {
+            if (keep.Contains(kv.Key)) projected[kv.Key] = kv.Value;
+        }
+        return projected;
+    }
+
+    [Fact]
+    public void Projection_drops_the_wide_columns()
+    {
+        var projected = Project(FullRow());
+        Assert.False(projected.ContainsKey("FailureSnapshotJson"));
+        Assert.False(projected.ContainsKey("GeoCountry"));
+        Assert.False(projected.ContainsKey("OsBuild"));
+        Assert.True(projected.Count < FullRow().Count);
+    }
+
+    [Fact]
+    public void Every_field_the_sweeps_read_survives_the_projection()
+    {
+        var full = Sut.MapToSessionSummary(FullRow());
+        var proj = Sut.MapToSessionSummary(Project(FullRow()));
+
+        // Shared / structural
+        Assert.Equal(full.TenantId, proj.TenantId);
+        Assert.Equal(full.SessionId, proj.SessionId);
+        Assert.Equal(full.Status, proj.Status);
+        Assert.Equal(full.StartedAt, proj.StartedAt);
+        Assert.Equal(full.CompletedAt, proj.CompletedAt);
+        Assert.Equal(full.DeletionState, proj.DeletionState);
+
+        // Time attribution: Status/DurationSeconds/DeletionState/EventCount + enrollment class
+        Assert.Equal(full.DurationSeconds, proj.DurationSeconds);
+        Assert.Equal(full.EventCount, proj.EventCount);
+        Assert.Equal(TimeAttributionCalculator.GetEnrollmentClass(full), TimeAttributionCalculator.GetEnrollmentClass(proj));
+
+        // Device journeys: BuildSessionRef + BuildDeviceHistoryRow display fields
+        Assert.Equal(full.SerialNumber, proj.SerialNumber);
+        Assert.Equal(full.Manufacturer, proj.Manufacturer);
+        Assert.Equal(full.Model, proj.Model);
+        Assert.Equal(full.EnrollmentType, proj.EnrollmentType);
+        Assert.Equal(full.IsPreProvisioned, proj.IsPreProvisioned);
+        Assert.Equal(full.AdminMarkedAction, proj.AdminMarkedAction);
+        var refFull = DeviceJourneyCalculator.BuildSessionRef(full)!;
+        var refProj = DeviceJourneyCalculator.BuildSessionRef(proj)!;
+        Assert.Equal(System.Text.Json.JsonSerializer.Serialize(refFull), System.Text.Json.JsonSerializer.Serialize(refProj));
+
+        // Verdict calibration: attribution + legacy derivation inputs + proxy timestamps
+        Assert.Equal(full.LastEventAt, proj.LastEventAt);
+        Assert.Equal(full.VerdictPath, proj.VerdictPath);
+        Assert.Equal(full.PriorStatus, proj.PriorStatus);
+        Assert.Equal(full.PriorVerdictPath, proj.PriorVerdictPath);
+        Assert.Equal(full.FailureReason, proj.FailureReason);
+        Assert.Equal(full.ReconcileReason, proj.ReconcileReason);
+        Assert.Equal(full.FailureSource, proj.FailureSource);
+        Assert.Equal(full.EspSoftFailure, proj.EspSoftFailure);
+        Assert.Equal(VerdictPathDerivation.Derive(full), VerdictPathDerivation.Derive(proj));
+        // Unstamped variant exercises the derivation on the projected inputs.
+        var unstampedFull = FullRow(); unstampedFull.Remove("VerdictPath"); unstampedFull.Remove("AdminMarkedAction"); unstampedFull.Remove("FailureSource");
+        Assert.Equal(VerdictPathDerivation.Derive(Sut.MapToSessionSummary(unstampedFull)),
+                     VerdictPathDerivation.Derive(Sut.MapToSessionSummary(Project(unstampedFull))));
+    }
+
+    [Fact]
+    public void Aggregation_cores_produce_identical_rows_from_the_projected_scan()
+    {
+        var now = new DateTime(2026, 8, 23, 12, 0, 0, DateTimeKind.Utc);
+        var fullList = new List<SessionSummary> { Sut.MapToSessionSummary(FullRow()) };
+        var projList = new List<SessionSummary> { Sut.MapToSessionSummary(Project(FullRow())) };
+        var histories = new Dictionary<string, List<DeviceHistory>>();
+
+        var a = MaintenanceService.BuildVerdictCalibrationAggregates(fullList, histories, now);
+        var b = MaintenanceService.BuildVerdictCalibrationAggregates(projList, histories, now);
+        Assert.Equal(System.Text.Json.JsonSerializer.Serialize(a), System.Text.Json.JsonSerializer.Serialize(b));
+    }
+
+    [Fact]
+    public void SliceSweepWindow_keeps_sessions_from_the_window_start()
+    {
+        var window = new List<SessionSummary>
+        {
+            new() { SessionId = "old", StartedAt = Started.AddDays(-40) },
+            new() { SessionId = "edge", StartedAt = Started },
+            new() { SessionId = "new", StartedAt = Started.AddDays(1) },
+        };
+        var sliced = MaintenanceService.SliceSweepWindow(window, Started);
+        Assert.Equal(new[] { "edge", "new" }, sliced.Select(s => s.SessionId));
+    }
+
+    [Fact]
+    public void Shared_window_covers_every_sweeps_horizon()
+    {
+        // 7d window + 28d baseline anchored on yesterday = 35 days back ≥ the 30-day rolling sweeps.
+        Assert.Equal(35, MaintenanceService.SweepWindowDays);
+        Assert.True(MaintenanceService.SweepWindowDays >= 30);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/NotificationChannelsTests.cs

@@ -1,4 +1,5 @@
 using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Models.Notifications;
@@ -64,6 +65,17 @@ public class NotificationChannelsTests
         Assert.Empty(slack.GetCustomHeaders());
     }
 
+    [Fact]
+    public void GetSigningSecret_OnlyForGenericJson()
+    {
+        var secret = "0123456789abcdef";
+        Assert.Equal(secret, new NotificationChannel { Id = "g", ProviderType = 20, SigningSecret = secret }.GetSigningSecret());
+        Assert.Null(new NotificationChannel { Id = "s", ProviderType = 10, SigningSecret = secret }.GetSigningSecret());
+        Assert.Null(new NotificationChannel { Id = "d", ProviderType = 30, SigningSecret = secret }.GetSigningSecret());
+        Assert.Null(new NotificationChannel { Id = "w", ProviderType = 20, SigningSecret = "  " }.GetSigningSecret());
+        Assert.Null(new NotificationChannel { Id = "n", ProviderType = 20 }.GetSigningSecret());
+    }
+
     // ── Legacy synthesis (GetNotificationChannels) ────────────────────────
 
     [Fact]
@@ -141,7 +153,7 @@ public class NotificationChannelsTests
         var cfg = new TenantConfiguration
         {
             NotificationChannelsJson = "[" +
-                ChannelJson("ch-1", extra: ",\"customHeadersJson\":\"{\\\"X-Api-Key\\\":\\\"k\\\"}\"") + "," +
+                ChannelJson("ch-1", extra: ",\"customHeadersJson\":\"{\\\"X-Api-Key\\\":\\\"k\\\"}\",\"signingSecret\":\"0123456789abcdef\"") + "," +
                 ChannelJson("ch-2", providerType: 10, url: "https://slack.example/h") + "]",
         };
 
@@ -151,8 +163,10 @@ public class NotificationChannelsTests
         Assert.Equal("ch-1", redacted[0].Id);                                  // structure visible
         Assert.Equal(Constants.RedactedSecretPlaceholder, redacted[0].Url);    // secrets masked
         Assert.Equal(Constants.RedactedSecretPlaceholder, redacted[0].CustomHeadersJson);
+        Assert.Equal(Constants.RedactedSecretPlaceholder, redacted[0].SigningSecret);
         Assert.Equal(Constants.RedactedSecretPlaceholder, redacted[1].Url);
         Assert.Null(redacted[1].CustomHeadersJson);                            // unset stays unset
+        Assert.Null(redacted[1].SigningSecret);
     }
 
     [Fact]
@@ -169,7 +183,7 @@ public class NotificationChannelsTests
         {
             NotificationChannelsJson = "[" +
                 ChannelJson("ch-1", url: "https://real.example/hook",
-                    extra: ",\"customHeadersJson\":\"{\\\"X-Api-Key\\\":\\\"real\\\"}\"") + "]",
+                    extra: ",\"customHeadersJson\":\"{\\\"X-Api-Key\\\":\\\"real\\\"}\",\"signingSecret\":\"real-secret-0123\"") + "]",
         };
 
         // Round-trip the redacted view back onto a save (defense-in-depth path).
@@ -179,6 +193,7 @@ public class NotificationChannelsTests
         var ch = Assert.Single(NotificationChannel.ParseList(incoming.NotificationChannelsJson));
         Assert.Equal("https://real.example/hook", ch.Url);
         Assert.Equal("{\"X-Api-Key\":\"real\"}", ch.CustomHeadersJson);
+        Assert.Equal("real-secret-0123", ch.SigningSecret);
     }
 
     [Fact]
@@ -244,4 +259,40 @@ public class NotificationChannelsTests
         Assert.NotNull(error);
         Assert.Contains("headers", error);
     }
+
+    // ── Signing-secret validation ─────────────────────────────────────────
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("0123456789abcdef")] // 16 chars (minimum)
+    public void ValidateWebhookSigningSecret_AcceptsAbsentOrValid(string? secret)
+    {
+        Assert.Null(TenantConfigValidation.ValidateWebhookSigningSecret(secret));
+        // 128 chars (maximum) and a typical generated 64-char hex secret
+        Assert.Null(TenantConfigValidation.ValidateWebhookSigningSecret(new string('a', 128)));
+        Assert.Null(TenantConfigValidation.ValidateWebhookSigningSecret(new string('f', 64)));
+    }
+
+    [Theory]
+    [InlineData("short-15-chars.")]                  // below minimum
+    [InlineData("has a space in the middle!")]       // whitespace
+    [InlineData("line\nbreak-0123456789")]           // control char
+    [InlineData("umlauts-äöü-0123456789")]           // non-ASCII
+    [InlineData("***REDACTED***")]                   // unrestored sentinel (too short anyway)
+    public void ValidateWebhookSigningSecret_RejectsInvalid(string secret)
+    {
+        Assert.NotNull(TenantConfigValidation.ValidateWebhookSigningSecret(secret));
+        Assert.NotNull(TenantConfigValidation.ValidateWebhookSigningSecret(new string('a', 129)));
+    }
+
+    [Fact]
+    public void ValidateNotificationChannels_RejectsBadPerChannelSigningSecret()
+    {
+        var json = "[" + ChannelJson("ch-1", extra: ",\"signingSecret\":\"too-short\"") + "]";
+        var error = UpdateTenantConfigurationFunction.ValidateNotificationChannels(json);
+        Assert.NotNull(error);
+        Assert.Contains("signing secret", error);
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/Offboarding/FakeOffboardFarewellEmailSender.cs

@@ -7,7 +7,7 @@ namespace AutopilotMonitor.Functions.Tests.Offboarding;
 /// <summary>
 /// Test double for <see cref="IOffboardFarewellEmailSender"/>. Records every invocation so
 /// the handler-side tests can assert "did the farewell send fire after History → Completed?"
-/// without booting the real Resend client. Default = silent noop; set <see cref="ThrowOnSend"/>
+/// without booting the real mail provider client. Default = silent noop; set <see cref="ThrowOnSend"/>
 /// to simulate downstream failures and prove the handler's fail-soft contract.
 /// </summary>
 internal sealed class FakeOffboardFarewellEmailSender : IOffboardFarewellEmailSender

src/Backend/AutopilotMonitor.Functions.Tests/Offboarding/TenantOffboardingHandlerOrderingTests.cs

@@ -221,7 +221,7 @@ public class TenantOffboardingHandlerOrderingTests
     public async Task PostDrain_FarewellEmail_Skipped_WhenNotificationEmailNull()
     {
         // Tenants that never set a preview-notification email get null capture; the handler
-        // skip-gates the send so no Resend call is even attempted.
+        // skip-gates the send so no provider call is even attempted.
         var harness = Harness.New();
         Assert.Null(harness.Repo.History[HistoryRowKey].NotificationEmail);
 
@@ -235,7 +235,7 @@ public class TenantOffboardingHandlerOrderingTests
     public async Task PostDrain_FarewellEmail_Skipped_WhenNotificationEmailWhitespace()
     {
         // Defensive: legacy History rows may have a non-null empty/whitespace value. Treat
-        // these as "no email captured" so we never call Resend with a useless string.
+        // these as "no email captured" so we never call the mail provider with a useless string.
         var harness = Harness.New();
         harness.Repo.History[HistoryRowKey].NotificationEmail = "   ";
 
@@ -248,11 +248,11 @@ public class TenantOffboardingHandlerOrderingTests
     [Fact]
     public async Task PostDrain_FarewellEmail_SenderThrows_HandlerSurvives_HistoryStillCompleted()
     {
-        // The send is best-effort. A Resend outage / template bug / serializer crash must
+        // The send is best-effort. A mail-provider outage / template bug / serializer crash must
         // NOT propagate to the queue worker — that would re-poison a Completed offboard.
         var harness = Harness.New();
         harness.Repo.History[HistoryRowKey].NotificationEmail = "ops@contoso.invalid";
-        harness.FarewellEmail.ThrowOnSend = new InvalidOperationException("simulated Resend outage");
+        harness.FarewellEmail.ThrowOnSend = new InvalidOperationException("simulated mail-provider outage");
 
         await harness.Sut.HandleAsync(harness.Envelope());
 

src/Backend/AutopilotMonitor.Functions.Tests/OffboardingSessionEnumeratorTests.cs

@@ -112,9 +112,11 @@ public class OffboardingSessionEnumeratorTests
         public Task<List<SessionSummary>> GetSessionsOlderThanAsync(string tenantId, DateTime cutoffDate, int maxResults = int.MaxValue, bool excludeInFlightDeletions = false) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetSessionsByDateRangeAsync(DateTime startDate, DateTime endDate, string? tenantId = null) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetUsageWindowSessionsAsync(DateTime startDate, DateTime endDate, string? tenantId = null) => throw new NotImplementedException();
+        public Task<List<SessionSummary>> GetMaintenanceWindowSessionsAsync(DateTime startDate, DateTime endDate) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetGeoWindowSessionsAsync(DateTime startDate, DateTime endDate, string? tenantId = null) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetStalledSessionsAsync(string tenantId, DateTime cutoffTime) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetLegacyTimeoutFailedSessionsAsync(string tenantId, int maxResults) => throw new NotImplementedException();
+        public Task<List<SessionSummary>> GetSelfDeployingSilentSessionsAsync(string tenantId, int maxResults) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetSessionsLeanAsync(string tenantId) => throw new NotImplementedException();
         public Task<List<SessionSummary>> GetAgentSilentSessionsAsync(string tenantId, DateTime silenceCutoff, DateTime hardCutoff) => throw new NotImplementedException();
         public Task<List<string>> GetAllTenantIdsAsync() => throw new NotImplementedException();

src/Backend/AutopilotMonitor.Functions.Tests/PlanManagementTransitionTests.cs

@@ -0,0 +1,145 @@
+using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Tests for <see cref="PlanManagementFunction.ApplyPlanChanges"/> — the pure mutation core
+/// of the PATCH plan endpoint. Pins the retention-grace anchor lifecycle: an EFFECTIVE
+/// Pro→Community transition stamps <see cref="TenantConfiguration.ProDowngradedUtc"/>, any
+/// effectively-Pro outcome clears it, and a planTier downgrade under an active trial does
+/// NOT stamp (the edition is still Pro — the later trial expiry is the anchor then).
+/// </summary>
+public class PlanManagementTransitionTests
+{
+    private static readonly DateTime Now = new(2026, 8, 22, 12, 0, 0, DateTimeKind.Utc);
+    private const string Caller = "ga@operator.example";
+
+    private static (TenantEdition Before, TenantEdition After, Dictionary<string, string> Changes) Apply(
+        TenantConfiguration config, string? planTier = null, bool trialProvided = false, DateTime? trialExpiresUtc = null)
+    {
+        var changes = new Dictionary<string, string>();
+        var (before, after) = PlanManagementFunction.ApplyPlanChanges(
+            config, planTier, trialProvided, trialExpiresUtc, Caller, Now, changes);
+        return (before, after, changes);
+    }
+
+    [Fact]
+    public void Downgrade_ProToCommunity_StampsAnchorAndRecordsChange()
+    {
+        var config = new TenantConfiguration { TenantId = "t1", PlanTier = "pro" };
+
+        var (before, after, changes) = Apply(config, planTier: "community");
+
+        Assert.Equal(TenantEdition.Pro, before);
+        Assert.Equal(TenantEdition.Community, after);
+        Assert.Equal(Now, config.ProDowngradedUtc);
+        Assert.True(changes.ContainsKey("ProDowngradedUtc"));
+        Assert.True(changes.ContainsKey("PlanTier"));
+    }
+
+    [Fact]
+    public void Upgrade_CommunityToPro_ClearsAnchor()
+    {
+        var config = new TenantConfiguration
+        {
+            TenantId = "t1",
+            PlanTier = "community",
+            ProDowngradedUtc = Now.AddDays(-10)
+        };
+
+        var (_, after, changes) = Apply(config, planTier: "pro");
+
+        Assert.Equal(TenantEdition.Pro, after);
+        Assert.Null(config.ProDowngradedUtc);
+        Assert.True(changes.ContainsKey("ProDowngradedUtc"));
+    }
+
+    [Fact]
+    public void Downgrade_WithActiveTrial_DoesNotStamp_EditionStaysPro()
+    {
+        // planTier drops but the trial keeps the EFFECTIVE edition Pro: no anchor now —
+        // the trial's own expiry timestamp anchors the grace later, read-time.
+        var config = new TenantConfiguration
+        {
+            TenantId = "t1",
+            PlanTier = "pro",
+            TrialExpiresUtc = Now.AddDays(5)
+        };
+
+        var (before, after, changes) = Apply(config, planTier: "community");
+
+        Assert.Equal(TenantEdition.Pro, before);
+        Assert.Equal(TenantEdition.Pro, after);
+        Assert.Null(config.ProDowngradedUtc);
+        Assert.False(changes.ContainsKey("ProDowngradedUtc"));
+    }
+
+    [Fact]
+    public void EndingTrialExplicitly_StampsAnchor()
+    {
+        // GA sets trialExpiresUtc: null on a trial-Pro tenant — TrialExpiresUtc is gone, so
+        // WITHOUT the explicit stamp the grace would have no anchor at all.
+        var config = new TenantConfiguration
+        {
+            TenantId = "t1",
+            PlanTier = "free",
+            TrialExpiresUtc = Now.AddDays(5)
+        };
+
+        var (before, after, _) = Apply(config, trialProvided: true, trialExpiresUtc: null);
+
+        Assert.Equal(TenantEdition.Pro, before);
+        Assert.Equal(TenantEdition.Community, after);
+        Assert.Equal(Now, config.ProDowngradedUtc);
+        Assert.Null(config.TrialExpiresUtc);
+    }
+
+    [Fact]
+    public void GrantingTrial_ToDowngradedTenant_ClearsAnchor()
+    {
+        var config = new TenantConfiguration
+        {
+            TenantId = "t1",
+            PlanTier = "community",
+            ProDowngradedUtc = Now.AddDays(-10)
+        };
+
+        var (_, after, _) = Apply(config, trialProvided: true, trialExpiresUtc: Now.AddDays(30));
+
+        Assert.Equal(TenantEdition.Pro, after);
+        Assert.Null(config.ProDowngradedUtc);
+        Assert.Equal(Caller, config.TrialGrantedBy);
+    }
+
+    [Fact]
+    public void NoOpPatch_SameTier_RecordsNothing()
+    {
+        var config = new TenantConfiguration { TenantId = "t1", PlanTier = "community" };
+
+        var (before, after, changes) = Apply(config, planTier: "community");
+
+        Assert.Equal(TenantEdition.Community, before);
+        Assert.Equal(TenantEdition.Community, after);
+        Assert.Empty(changes);
+        Assert.Null(config.ProDowngradedUtc);
+    }
+
+    [Fact]
+    public void RepeatedDowngradeAfterReUpgrade_RestampsWithNewTimestamp()
+    {
+        var config = new TenantConfiguration { TenantId = "t1", PlanTier = "pro" };
+
+        Apply(config, planTier: "community");
+        Assert.Equal(Now, config.ProDowngradedUtc);
+
+        Apply(config, planTier: "pro");
+        Assert.Null(config.ProDowngradedUtc);
+
+        var changes = new Dictionary<string, string>();
+        var later = Now.AddDays(40);
+        PlanManagementFunction.ApplyPlanChanges(config, "community", false, null, Caller, later, changes);
+        Assert.Equal(later, config.ProDowngradedUtc);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/PowerStateRuleTests.cs

@@ -0,0 +1,222 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Power watcher analyze rules — pins the firing behaviour of the built-ins that consume the
+/// agent's live <c>power_state_change</c> events (PowerStateWatcherHost):
+///   - ANALYZE-DEV-009 (high): battery crossed the 15% threshold while enrolling on battery.
+///   - ANALYZE-DEV-010 (warning): the device switched from AC to battery mid-enrollment.
+/// Both rules are deliberately single-required-condition: event_data conditions scan events
+/// INDEPENDENTLY (no same-instance join), so a two-condition rule could false-positive across
+/// two different power events. DEV-009 matches the agent-stamped thresholdPercent (only present
+/// on threshold events, value pins the ladder level); DEV-010 matches transition=ac_to_battery.
+/// Also pins that the rule's string "15" compares equal against the agent's numeric payload.
+/// </summary>
+public class PowerStateRuleTests
+{
+    private const string TenantId  = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+    private const string SessionId = "11111111-2222-3333-4444-555555555555";
+
+    [Fact]
+    public async Task ANALYZE_DEV_009_fires_high_on_the_15_percent_threshold_event()
+    {
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-DEV-009");
+        Assert.True(rule.Enabled);
+        Assert.Equal("high", rule.Severity);
+        Assert.False(rule.MarkSessionAsFailedDefault); // environment risk, not a KO verdict
+
+        var events = new List<EnrollmentEvent>
+        {
+            ThresholdCrossed(thresholdPercent: 15, batteryPercent: 13),
+        };
+
+        var outcome = await RunAsync(rule, events);
+
+        var result = Assert.Single(outcome.Results);
+        Assert.Equal("ANALYZE-DEV-009", result.RuleId);
+        Assert.Equal("high", result.Severity);
+
+        // The numeric payload (int 15) must satisfy the rule's string value "15"; field/value on
+        // the matched condition feed the {{thresholdPercent}} interpolation token.
+        var matched = AsDict(result.MatchedConditions["battery_threshold_15"]);
+        Assert.Equal("thresholdPercent", AsString(matched["field"]));
+        Assert.Equal("15", AsString(matched["value"]));
+    }
+
+    [Theory]
+    [InlineData(50)]
+    [InlineData(30)]
+    public async Task ANALYZE_DEV_009_does_not_fire_on_higher_threshold_levels(int level)
+    {
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-DEV-009");
+
+        var events = new List<EnrollmentEvent>
+        {
+            ThresholdCrossed(thresholdPercent: level, batteryPercent: level - 2),
+        };
+
+        var outcome = await RunAsync(rule, events);
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task ANALYZE_DEV_009_does_not_fire_on_a_low_battery_transition_event()
+    {
+        // An ac_to_battery event at 13% carries batteryPercent but NO thresholdPercent — the
+        // agent emits the separate threshold event for that; the rule must not fire early here.
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-DEV-009");
+
+        var events = new List<EnrollmentEvent>
+        {
+            Transition("ac_to_battery", onAcPower: false, batteryPercent: 13),
+        };
+
+        var outcome = await RunAsync(rule, events);
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task ANALYZE_DEV_010_fires_warning_on_ac_to_battery()
+    {
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-DEV-010");
+        Assert.True(rule.Enabled);
+        Assert.Equal("warning", rule.Severity);
+        Assert.False(rule.MarkSessionAsFailedDefault);
+
+        var events = new List<EnrollmentEvent>
+        {
+            Transition("ac_to_battery", onAcPower: false, batteryPercent: 63),
+        };
+
+        var outcome = await RunAsync(rule, events);
+
+        var result = Assert.Single(outcome.Results);
+        Assert.Equal("ANALYZE-DEV-010", result.RuleId);
+        Assert.Equal("warning", result.Severity);
+
+        var matched = AsDict(result.MatchedConditions["switched_to_battery"]);
+        Assert.Equal("transition", AsString(matched["field"]));
+        Assert.Equal("ac_to_battery", AsString(matched["value"]));
+    }
+
+    [Theory]
+    [InlineData("battery_to_ac")]
+    [InlineData("threshold_crossed")]
+    public async Task ANALYZE_DEV_010_does_not_fire_on_other_transitions(string transition)
+    {
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-DEV-010");
+
+        var events = new List<EnrollmentEvent>
+        {
+            Transition(transition, onAcPower: transition == "battery_to_ac", batteryPercent: 40),
+        };
+
+        var outcome = await RunAsync(rule, events);
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task Neither_rule_fires_on_the_startup_power_state_check()
+    {
+        // The one-shot startup probe event (power_state_check) is a different event type and must
+        // not satisfy either rule, even when it reports a low battery on DC power.
+        var rules = BuiltInAnalyzeRules.GetAll()
+            .Where(r => r.RuleId is "ANALYZE-DEV-009" or "ANALYZE-DEV-010").ToList();
+        Assert.Equal(2, rules.Count);
+
+        var events = new List<EnrollmentEvent>
+        {
+            new()
+            {
+                EventId = Guid.NewGuid().ToString(),
+                TenantId = TenantId,
+                SessionId = SessionId,
+                EventType = "power_state_check",
+                Timestamp = DateTime.UtcNow,
+                Sequence = 5,
+                Data = new Dictionary<string, object>
+                {
+                    ["onAcPower"] = false,
+                    ["hasBattery"] = true,
+                    ["batteryPercent"] = 12,
+                    ["isCharging"] = false,
+                },
+            },
+        };
+
+        foreach (var rule in rules)
+        {
+            var outcome = await RunAsync(rule, events);
+            Assert.Empty(outcome.Results);
+        }
+    }
+
+    // ===== Event builders — mirror the PowerStateWatcherHost emit shape =====
+
+    private static EnrollmentEvent ThresholdCrossed(int thresholdPercent, int batteryPercent) => new()
+    {
+        EventId = Guid.NewGuid().ToString(),
+        TenantId = TenantId,
+        SessionId = SessionId,
+        EventType = "power_state_change",
+        Timestamp = DateTime.UtcNow,
+        Sequence = 42,
+        Data = new Dictionary<string, object>
+        {
+            ["transition"] = "threshold_crossed",
+            ["thresholdPercent"] = thresholdPercent,
+            ["onAcPower"] = false,
+            ["batteryPercent"] = batteryPercent,
+            ["isCharging"] = false,
+            ["batteryLifeMinutes"] = 25,
+        }
+    };
+
+    private static EnrollmentEvent Transition(string transition, bool onAcPower, int batteryPercent) => new()
+    {
+        EventId = Guid.NewGuid().ToString(),
+        TenantId = TenantId,
+        SessionId = SessionId,
+        EventType = "power_state_change",
+        Timestamp = DateTime.UtcNow,
+        Sequence = 43,
+        Data = new Dictionary<string, object>
+        {
+            ["transition"] = transition,
+            ["onAcPower"] = onAcPower,
+            ["batteryPercent"] = batteryPercent,
+            ["isCharging"] = onAcPower,
+            ["batteryLifeMinutes"] = 120,
+        }
+    };
+
+    private static Dictionary<string, object> AsDict(object o)
+    {
+        if (o is Dictionary<string, object> d) return d;
+        throw new InvalidOperationException($"Expected Dictionary<string,object>, got {o?.GetType().Name ?? "null"}");
+    }
+
+    private static string AsString(object o) => o?.ToString() ?? string.Empty;
+
+    private static async Task<AnalysisOutcome> RunAsync(AnalyzeRule rule, List<EnrollmentEvent> events)
+    {
+        var ruleRepo = new Mock<IRuleRepository>();
+        ruleRepo.Setup(r => r.GetAnalyzeRulesAsync("global")).ReturnsAsync(new List<AnalyzeRule> { rule });
+        ruleRepo.Setup(r => r.GetAnalyzeRulesAsync(TenantId)).ReturnsAsync(new List<AnalyzeRule>());
+        ruleRepo.Setup(r => r.GetRuleStatesAsync(It.IsAny<string>())).ReturnsAsync(new Dictionary<string, RuleState>());
+        ruleRepo.Setup(r => r.GetRuleResultsAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync(new List<RuleResult>());
+
+        var sessionRepo = new Mock<ISessionRepository>();
+        sessionRepo.Setup(s => s.GetSessionEventsStrictAsync(TenantId, SessionId, It.IsAny<int>())).ReturnsAsync(events);
+
+        var ruleService = new AnalyzeRuleService(ruleRepo.Object, NullLogger<AnalyzeRuleService>.Instance);
+        var engine = new RuleEngine(ruleService, ruleRepo.Object, sessionRepo.Object, NullLogger<PowerStateRuleTests>.Instance);
+
+        return await engine.AnalyzeSessionAsync(TenantId, SessionId);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/RateLimitServiceConcurrencyTests.cs

@@ -0,0 +1,76 @@
+using System.Collections.Concurrent;
+using AutopilotMonitor.Functions.Services;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Both sliding-window limiters keep the request history and its lock in one cache entry.
+/// Previously the entry was re-Set without its eviction callback, which (a) leaked per-key lock
+/// objects and (b) let two threads mutate the same List under different locks. These tests hammer
+/// one key from many threads: the count of allowed requests must be exactly the limit and nothing
+/// may throw (a List mutated concurrently throws InvalidOperationException or corrupts Count).
+/// </summary>
+public class RateLimitServiceConcurrencyTests
+{
+    private const int Threads = 16;
+    private const int RequestsPerThread = 500;
+
+    [Fact]
+    public void CheckRateLimit_ManyThreadsSameKey_AllowsExactlyTheLimit()
+    {
+        var sut = new RateLimitService(new MemoryCache(new MemoryCacheOptions()), NullLogger<RateLimitService>.Instance);
+        const int limit = 1000;
+        var allowed = 0;
+        var errors = new ConcurrentBag<Exception>();
+
+        RunInParallel(() =>
+        {
+            try
+            {
+                if (sut.CheckRateLimit("thumb-shared", limit).IsAllowed)
+                    Interlocked.Increment(ref allowed);
+            }
+            catch (Exception ex) { errors.Add(ex); }
+        });
+
+        Assert.Empty(errors);
+        Assert.Equal(limit, allowed);
+        Assert.False(sut.CheckRateLimit("thumb-shared", limit).IsAllowed);
+    }
+
+    [Fact]
+    public void DistressCheck_ManyThreadsSameIp_AllowsExactlyTheIpLimit()
+    {
+        var sut = new DistressRateLimitService(new MemoryCache(new MemoryCacheOptions()), NullLogger<DistressRateLimitService>.Instance);
+        var allowed = 0;
+        var errors = new ConcurrentBag<Exception>();
+
+        RunInParallel(() =>
+        {
+            try
+            {
+                if (sut.Check("10.0.0.9", "a1b2c3d4-e5f6-7890-abcd-ef1234567890").IsAllowed)
+                    Interlocked.Increment(ref allowed);
+            }
+            catch (Exception ex) { errors.Add(ex); }
+        });
+
+        Assert.Empty(errors);
+        Assert.Equal(5, allowed); // MaxPerIp
+    }
+
+    private static void RunInParallel(Action body)
+    {
+        using var gate = new ManualResetEventSlim(false);
+        var tasks = Enumerable.Range(0, Threads).Select(_ => Task.Run(() =>
+        {
+            gate.Wait();
+            for (var i = 0; i < RequestsPerThread; i++) body();
+        })).ToArray();
+        gate.Set();
+        Task.WaitAll(tasks);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/ReportAgentErrorFunctionTests.cs

@@ -200,4 +200,120 @@ public class ReportAgentErrorFunctionTests
 
         Assert.Empty(h.OpsEvents);
     }
+
+    // =========================================================================
+    // MaterializeIntegrityMismatchAsync — an IntegrityCheckFailed report becomes an
+    // AgentBinaryIntegrityMismatch ops event, UNLESS it is the known release race
+    // (agents comparing against hash snapshots that don't belong to their own binary;
+    // AdminConfig cache TTL 5 min). e9753578 proved the race: a genuine 1410 exe was
+    // compared against the cached 1409 hash and reported a "mismatch" that cost a day
+    // of mis-attributed root-causing while sitting invisible in App Insights.
+    // =========================================================================
+
+    private const string RunningExeSha = "5fca975e43fa5fca975e43fa5fca975e43fa5fca975e43fa5fca975e43fa0000";
+    private const string PublishedExeSha = "8ebaa060ad348ebaa060ad348ebaa060ad348ebaa060ad348ebaa060ad340000";
+
+    private static AgentErrorReport IntegrityReport(
+        string? sessionId = SessionId, string agentVersion = "2.0.1410", string? actualSha = null) => new()
+    {
+        SessionId = sessionId!,
+        TenantId = TenantId,
+        ErrorType = AgentErrorType.IntegrityCheckFailed,
+        Message = $"Running exe SHA-256 differs from backend-advertised hash. actual={actualSha ?? RunningExeSha}, expected={PublishedExeSha}",
+        AgentVersion = agentVersion,
+        Timestamp = Now,
+    };
+
+    private static Task RunIntegrityAsync(
+        Harness h, AgentErrorReport report,
+        string? latestVersion = "2.0.1410", string? latestExeSha = PublishedExeSha)
+        => ReportAgentErrorFunction.MaterializeIntegrityMismatchAsync(
+            report, TenantId, h.OpsService, latestVersion, latestExeSha,
+            NullLogger<ReportAgentErrorFunction>.Instance);
+
+    [Fact]
+    public async Task SameVersion_with_unknown_binary_records_ops_event()
+    {
+        // The real signal: an agent claiming the LATEST version whose running exe is NOT
+        // the published one — tamper, stale blob, or a build outside the release pipeline.
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, IntegrityReport());
+
+        var ops = Assert.Single(h.OpsEvents);
+        Assert.Equal("AgentBinaryIntegrityMismatch", ops.EventType);
+        Assert.Equal(TenantId, ops.TenantId);
+        Assert.Contains("actual=5fca", ops.Message);
+        Assert.Contains("2.0.1410", ops.Message);
+    }
+
+    [Fact]
+    public async Task RunningHash_equal_to_published_exe_is_suppressed_as_stale_expectation()
+    {
+        // e9753578's exact shape: the device RUNS the published binary; only its cached
+        // expectation was the previous release's hash. Self-heals — must not alert.
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, IntegrityReport(actualSha: PublishedExeSha));
+
+        Assert.Empty(h.OpsEvents);
+    }
+
+    [Fact]
+    public async Task Older_agent_version_than_latest_is_suppressed_as_update_race()
+    {
+        // The long-known direction: version N agent sees version N+1's hash right after a
+        // release; the forced self-update heals it.
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, IntegrityReport(agentVersion: "2.0.1409+d43cfe2b"), latestVersion: "2.0.1410");
+
+        Assert.Empty(h.OpsEvents);
+    }
+
+    [Fact]
+    public async Task Version_with_commit_suffix_matches_latest_without_suffix()
+    {
+        // Agent versions carry "+<commit>", AdminConfiguration does not — the comparison
+        // must normalize, otherwise every genuine mismatch would look like a version race.
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, IntegrityReport(agentVersion: "2.0.1410+3b59dab2df6c"));
+
+        Assert.Single(h.OpsEvents);
+    }
+
+    [Fact]
+    public async Task Missing_latest_config_fails_open_to_recording()
+    {
+        // No published-version info available → visibility wins over suppression.
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, IntegrityReport(), latestVersion: null, latestExeSha: null);
+
+        Assert.Single(h.OpsEvents);
+    }
+
+    [Fact]
+    public async Task Integrity_mismatch_without_session_id_still_records_ops_event()
+    {
+        // The report can arrive before session registration — the binary evidence must
+        // never be dropped for lack of a session.
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, IntegrityReport(sessionId: null));
+
+        var ops = Assert.Single(h.OpsEvents);
+        Assert.Equal("AgentBinaryIntegrityMismatch", ops.EventType);
+    }
+
+    [Fact]
+    public async Task Other_error_types_do_not_record_integrity_ops_event()
+    {
+        var h = new Harness();
+
+        await RunIntegrityAsync(h, Report(Now));
+
+        Assert.Empty(h.OpsEvents);
+    }
 }