fix(security): validate enrollment summary branding image URL (https-only, no quotes); launcher drops unsafe URLs instead of interpolating them into the dialog command line

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/deploy-mcp.yml

@@ -11,7 +11,11 @@ env:
   ACR_NAME: autopilotmonitoreuacr
   CONTAINER_APP_NAME: autopilotmonitor-mcp
   RESOURCE_GROUP: ${{ secrets.AZURE_MCP_RESOURCE_GROUP }}
-  IMAGE_TAG: ${{ github.sha }}
+  # Unique per RUN, not per commit: the docs corpus is baked into the image, so a
+  # docs-only redeploy at an unchanged code sha must still produce a new image
+  # reference — with a sha-only tag `az containerapp update` saw the same image
+  # and silently created no revision (2026-08-28).
+  IMAGE_TAG: ${{ github.sha }}-${{ github.run_number }}
   HEALTH_URL: https://mcp.autopilotmonitor.com/health
   VERSIONS_CONTAINER: https://autopilotmonitoreu.blob.core.windows.net/versions
   PACKAGE_JSON: src/McpServer/autopilot-monitor-mcp/package.json
@@ -28,8 +32,9 @@ jobs:
       # baked into the image as the search_docs corpus (see the Dockerfile). No
       # token is needed. Checking it out here rather than vendoring it keeps the
       # docs single-sourced — but it also means EDITING THE DOCS DOES NOT UPDATE A
-      # RUNNING SERVER; this workflow must be re-run. /health reports the SHA
-      # captured below so that staleness is checkable.
+      # RUNNING SERVER; this workflow must be re-run (IMAGE_TAG is per run so the
+      # re-run actually rolls a new revision). /health reports the SHA captured
+      # below so that staleness is checkable.
       - name: Check out documentation bundle
         uses: actions/checkout@v7
         with:

docs/agent/cmtrace-time-resolution.md

@@ -94,7 +94,11 @@ batch, the counter reconcile's existing event-partition scan additionally collec
 rest (`CmTraceSkewTripwire`, hooked in `EventIngestProcessor`). If
 `median(Δ_IME) − median(Δ_other)` is a clean 15-minute multiple (residual < 2 min — the
 same constants as the anchoring grid guard above) with ≥ 20 samples over ≥ 3 distinct
-upload batches per side, a `CmTraceTimeSkewRegression` ops event fires (category Agent,
+upload batches per side, and ≥ 80 % of the individual IME deltas (relative to the other
+side's median) themselves sit within 2 min of some grid multiple — added after the 2026-08-28
+soak, when relaunched agents re-tailing the IME log produced one burst holding most of a
+session's IME samples with a continuum of ages whose median hit the grid by chance (7 false
+fires in a week, 0 true) — a `CmTraceTimeSkewRegression` ops event fires (category Agent,
 warning), carrying all numbers plus the session's `sourceOffsetOrigin` histogram.
 Bias-dominated sessions are suppressed (writer-declared offsets cannot be an anchoring
 regression); `measuredWriterOffsetMinutes` is never consulted (sticky after era

docs/agent/decision-engine.md

@@ -128,6 +128,15 @@ user-ESP Install-intent apps are still pending (IME logs "Completed user session
 *pass*, not once per session — sessions 14690fc2/6cb01530). The reducer stays free of
 app-pending guards; adapters sanitize evidence before it becomes a signal.
 
+**Zero user-targeted apps** (sessions 81daa77f/75d6ae8e): IME never writes its
+"Completed user session" line at all when the user has no assigned apps — its zero-app
+branch returns first — so fact 3 was unreachable by construction and every such device
+fell through to the backstop. `IME-USER-SESSION-ZERO-APPS` reads the line IME *does*
+write there and posts the same signal, guarded to the AccountSetup phase. The event
+carries an `evidence` field (`zero_user_apps_enumerated` vs `user_session_completed`)
+naming which observation carried the completion. See
+[zero-user-apps-completion-gate.md](zero-user-apps-completion-gate.md).
+
 ## Completion attempt sites and sequence
 
 Completion can be attempted from whichever fact arrives last: `HelloResolved`,
@@ -166,6 +175,11 @@ advisory backstop. All routes converge on `CompleteThroughFinalizingOrDefer`:
    scheduler contract) dead-ends as `realmjoin_timeout_stale_superseded_by_rearm`.
    The idle case (detected, no deployment activity ever) times out at 60 min
    unchanged, and phase 200/210 activity never extends.
+   A closed gate also outranks the 30-minute `AdvisoryCompletion` backstop: that
+   handler re-arms (trigger suffix `:CompletionGateHolding`) instead of failing while
+   the RealmJoin gate is closed *and* its own deadline is still armed, because the gate
+   carries a bounded resolution of its own. Before this, the shorter timer always won —
+   session 75d6ae8e was failed 2 min after its 25th successful RealmJoin package.
 2. `Finalizing` stage + ~5 s `FinalizingGrace` deadline.
 3. Grace fires → `Completed`, `EnrollmentComplete` outcome, `enrollment_complete`
    timeline event with full audit payload.
@@ -202,7 +216,12 @@ Wired by `EnrollmentOrchestrator.Start` (`src/Agent/AutopilotMonitor.Agent.V2.Co
 - `SignalIngress` — bounded queue (256, back-pressure) + **one** worker thread. Per
   signal, in order: assign ordinals → `SignalLog.Append` (durable, *before* reducing;
   append failure ⇒ reducer does not run, no ordinal gap) → `engine.Reduce` →
-  `DecisionStepProcessor.ApplyStep`.
+  `DecisionStepProcessor.ApplyStep`. A `Post` issued *by the worker thread itself*
+  (the `EffectRunner` posting `ClassifierVerdictIssued` from inside `ApplyStep`) never
+  enters the bounded queue: it goes to a worker-local follow-up queue that is drained,
+  ahead of the channel, right after the current item — the worker is the queue's only
+  consumer, so blocking on a full channel there would freeze the pipeline for the rest
+  of the run.
 - `DecisionStepProcessor.ApplyStep` (same thread, no locks): journal append (the only
   hard-throwing path; 3 consecutive failures escalate to quarantine) → effects run
   synchronously via `EffectRunner` → best-effort snapshot → advance `CurrentState` →

docs/agent/index.md

@@ -7,6 +7,7 @@ How the on-device agent works:
 * [Logs, Persistence & Crash Recovery](logs-and-persistence.md) - every persisted file and why it exists; signal log vs spool; snapshot/journal; the replay-based recovery flow and quarantine.
 * [Diagnostics Package](diagnostics-package.md) - what the diagnostics ZIP contains: the built-in section catalog shared with the portal (Shared `DiagnosticsBuiltInSections`, served by GET diagnostics/paths), the RealmJoin Watcher and Device Preparation collection gates, why built-ins bypass the configured-path guards, global ∪ tenant path dedup, caps and the package manifest.
 * [Hello Wizard Un-Skip](hello-wizard-unskip.md) - why a single "WHfB disabled" policy read never decides completion: the HelloWizardStarted signal (prevention + cure) and the HelloTracker confirmation second read.
+* [Zero User-Targeted Apps](zero-user-apps-completion-gate.md) - why a user with no targeted Intune apps starved every user-phase completion path (IME never writes its "Completed user session" line in the zero-app branch), and why a completion gate that is still holding the session must outrank the 30-minute backstop.
 * [Autopilot ZTD Diagnostics](autopilot-ztd-diagnostics.md) - Windows' own diagnostic surfaces for the profile-download flow: ModernDeployment event IDs (807/815/164/...), the Diagnostics\Autopilot registry key, deployment-service endpoints, and the known-issue error-code map.
 * [MDM Reboot Coalescing](mdm-reboot-coalescing.md) - attributing the mid-ESP coalesced reboot ("second sign-in") to the device-assigned policy URIs that forced it: aggregated 2800 observations (neutral, flush-time watermark) + ANALYZE-ESP-005 gated on an actually-observed reboot.
 * [Power-State Watcher](power-state-watcher.md) - live AC↔battery transitions and 50/30/15% downward threshold crossings via a WMI push subscription (no polling): power_state_change semantics (latch/debounce/cap, never armed without a battery) and the single-condition analyze rules ANALYZE-DEV-009/-010 on top.

docs/agent/overview.md

@@ -109,7 +109,9 @@ telemetry directly:
 ```
 Collector callback
   → SignalAdapter (dual emission: decision signal + InformationalEvent)
-    → SignalIngress.Post()            (bounded queue 256, back-pressure blocks producer)
+    → SignalIngress.Post()            (bounded queue 256, back-pressure blocks producer;
+                                       posts from the worker thread itself bypass the
+                                       queue via a worker-local follow-up queue)
       → single worker thread:
           assign ordinals → SignalLog.Append (durable)   ← source of truth
           → DecisionEngine.Reduce → apply step/effects

docs/agent/wifi-ssid-location-gate.md

@@ -0,0 +1,185 @@
+---
+type: Concept
+title: WiFi SSID and the Windows 24H2 Location Gate
+description: Why wifi_signal_info silently disappeared on Windows 11 24H2+ devices, why the netsh fallback could never fix it, and the tiered reader that restores the SSID from the SYSTEM context.
+resource: src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WifiInfoProvider.cs
+tags:
+  - agent
+  - interop
+  - wifi
+  - telemetry
+timestamp: 2026-08-26T14:05:00+02:00
+---
+
+# Summary
+
+The agent reports the enrollment WiFi as a `wifi_signal_info` event (SSID, signal, PHY, channel).
+On Windows 11 24H2 and later the event went missing on a large share of devices — no error, no
+partial payload, simply no event. The cause is a Windows privacy change, not a bug in the reader:
+**`WlanQueryInterface` with `wlan_intf_opcode_current_connection` is gated behind precise-location
+consent**, and the agent runs as SYSTEM in session 0 where that consent usually does not exist.
+
+The fix is a tiered reader ([WifiInfoProvider](../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WifiInfoProvider.cs))
+whose middle tier uses the one SSID API Microsoft left ungated.
+
+# The Gate
+
+Microsoft restricted the Win32 WLAN APIs that expose BSSIDs, because nearby-BSSID lists are a
+precise-location oracle. Without consent these return `ERROR_ACCESS_DENIED` (5):
+
+* `WlanGetAvailableNetworkList`
+* `WlanGetNetworkBssList`
+* `WlanScan`
+* **`WlanQueryInterface` when `OpCode` is `wlan_intf_opcode_current_connection`** — the only opcode
+  the agent needs, and the one that carries SSID, signal quality, PHY type.
+
+Two properties of the gate decide the agent's fate:
+
+1. **The consent prompt only appears for a process running in the user's context and outside
+   `C:\Windows\System32`.** The agent is neither during ESP: it is SYSTEM, in session 0, before any
+   user has seen the OOBE privacy page. It is therefore denied *silently* — no prompt, no event
+   log, nothing that surfaces without asking the API for its return code.
+2. **Consent resolves per user hive, with the device-level setting as the floor.** An interactive
+   user typically has
+   `HKCU\...\CapabilityAccessManager\ConsentStore\location\NonPackaged\Value = Allow`
+   ("Let desktop apps access your location"). The SYSTEM account (`HKU\S-1-5-18`) normally has
+   **nothing** set there and falls back to
+   `HKLM\...\ConsentStore\location\Value`. Where that device-level value is `Deny`, SYSTEM is
+   denied even though the logged-on user on the very same machine reads the SSID fine.
+
+That asymmetry is why the failure looks random from the outside: it tracks the **image's
+device-level location setting**, which varies per fleet, not per hardware, driver, or language.
+
+# Why netsh Was Never the Answer
+
+`NetshWifiFallback` was added in 2026-07 on the theory that inbox `netsh` still reported the
+connection where the WLAN API did not, and it was later extended with localized label variants for
+every enrollment-geography language. Field data says otherwise: **`netsh wlan` hangs off the same
+location gate** ("Network shell commands need location permission to access WLAN information"), so
+it fails in lockstep with tier 1 rather than covering for it. In the reported session the agent
+build already contained the netsh fallback and still produced no event.
+
+Consequence for future work: **adding more netsh language labels cannot fix a missing SSID.** Every
+`wifi_signal_info` event that does exist carries a fully populated SSID — the failure is binary at
+the reader level, never a half-parsed or mis-decoded payload. A missing SSID is an access problem,
+not a parsing problem.
+
+# The Tiered Reader
+
+`WifiInfoProvider.TryRead` owns the order so the two collectors (`DeviceInfoCollector`,
+`NetworkChangeDetector`) cannot drift apart. First non-null wins:
+
+| # | Reader | Yields | Location-gated |
+|---|---|---|---|
+| 1 | `WifiInfoReader` (native `wlanapi.dll`) | SSID, signal %, PHY, channel | yes |
+| 2 | `WinRtWifiSsidReader` (WinRT `GetConnectedSsid`) | SSID only | **no** |
+| 3 | `NetshWifiFallback` (process spawn, localized parse) | SSID, signal %, radio type, channel | yes |
+
+Tier 2 is Microsoft's own documented replacement for this exact scenario:
+`Windows.Networking.Connectivity.WlanConnectionProfileDetails.GetConnectedSsid()`. It is not part of
+the BSSID-bearing surface, so it needs no consent, and it has existed since Windows 10 1507.
+
+It is bound through the CLR's built-in WinRT projection with
+`Type.GetType("…, ContentType=WindowsRuntime")` — no NuGet package, no winmd reference, no csproj
+change — the same mechanism [OobeStateReader](../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/OobeStateReader.cs)
+already uses from the SYSTEM service context. Every step degrades to null rather than throwing,
+because the caller runs fire-and-forget inside `Task.Run`.
+
+# Telling the Operator
+
+A missing signal reading is indistinguishable from a bug unless the payload says why, and the
+device-level location setting is not something an admin would think to check. When tier 2 wins
+*and* the native tier reported `rc=5`, the `wifi_signal_info` payload therefore carries
+
+```
+wifiDataLimitedReason = "location_services_off"
+```
+
+and the event message gains `- signal unavailable, Location services off`, so the reason is visible
+in the timeline itself. The portal's WiFi card (`DeviceDetailsCard`) matches that literal and
+renders the explanation plus the Intune setting that fixes it. The value is a published contract —
+agent, portal and the MCP device-property catalog all match the same string.
+
+The claim is only made on observed evidence: any other native failure (no WLAN service, no
+connected interface) leaves the field null rather than blaming a privacy setting we did not
+measure. `WifiInfoProvider.IsLocationGateDenied` is the single predicate, pinned by tests at its
+boundaries (`rc=5` yes; `rc=50`, `rc=5023`, `rc=1062` no).
+
+The network timeline reads the same field. It needs no payload of its own: `buildSegments`
+already merges every `wifi_signal_info` into the WiFi segment covering its timestamp, so the
+reason rides in with the sample. A segment that never got a sample (a mid-session reconnect emits
+no `wifi_signal_info`) inherits it — the gate is a device-level setting and cannot flip during an
+enrollment — while a segment that *did* get a real reading is never overwritten. The segment
+tooltip then reads `Signal: unavailable - Location services off on this device` where the
+percentage would be, and the "Avg WiFi signal" stat says `n/a (Location services off)` instead of
+disappearing.
+
+`network_state_change` deliberately does NOT carry the reason: that event has never carried
+`signalPercent` or `radioType` at all (`NetworkChangeDetector` collects them into its snapshot for
+change detection but only `before_/after_wifiSsid` reaches the payload), so there is no absent
+field there for a reason to explain. Adding it would ship a field nothing reads. The SSID it does
+carry is unaffected by the gate.
+
+Fleet-wide the same field is queryable through
+`search_sessions(deviceProperties: { "wifi_signal_info.wifiDataLimitedReason": "location_services_off" })`,
+which sizes how much of a fleet is affected before anyone changes a policy.
+
+Tier 2 returns the SSID alone. Signal quality, PHY type and channel have no ungated source; they
+stay null when the native tier is denied. That is deliberate — deriving a percentage from
+`ConnectionProfile.GetSignalBars()` (0–5) would fabricate precision the API does not have.
+
+# Diagnostics
+
+The step-level native return codes were already collected, but they were logged with
+`_logger.Debug` — and the agent's default log level is `Info`, so the diagnostic built to explain
+this failure never reached a single field log. Both collectors now log at **Warning** when all tiers
+fail, which they only reach when the active NIC really is WiFi. A native `rc=5` is spelled out as
+`ERROR_ACCESS_DENIED` with the location-gate explanation, so the log line diagnoses itself:
+
+```
+EnrollmentTracker: no wifi_signal_info — no WiFi info from any reader — native: [<guid>]
+query(current_connection) rc=5; ; WinRT: no SSID; netsh: no parsable output. rc=5 is
+ERROR_ACCESS_DENIED — Windows 11 24H2+ gates the current-connection opcode (and netsh wlan)
+behind precise-location consent, which is off in this image; enable Location services to
+restore signal/PHY/channel.
+```
+
+# Evidence
+
+Session `7305e0ad` (HP EliteBook X Flip G1i, build 26200.9168, agent 2.0.1407, reported as
+`WIFI SSID fehlt`): `network_interface_info` shows the active NIC as `Intel(R) Wi-Fi 7 BE201`,
+`Wireless80211`, `connectionType=WiFi`, so the `isWifi` gate passed and collection ran — yet zero
+`wifi_signal_info` events across 214 events and 22 minutes, with the netsh fallback already shipped
+in that build.
+
+Fleet correlation over WiFi sessions from 2026-08-01 (n=276), share with a `wifi_signal_info` event:
+
+| OS build | WiFi sessions | with SSID |
+|---|---|---|
+| 22631 (23H2, pre-gate) | 3 | 100% |
+| 26100 (24H2) | 178 | 21% |
+| 26200 (25H2) | 95 | 45% |
+
+Within a single model the outcome splits by fleet, not by hardware — ThinkPad T14 Gen 6: 7/91;
+ThinkPad E14 Gen 7: 9/9 — which is what a per-image privacy setting looks like.
+
+Local verification (build 26220.9022): `HKLM\…\ConsentStore\location = Deny` while
+`HKCU\…\ConsentStore\location\NonPackaged = Allow`; the interactive user reads the SSID through
+both the native API and netsh, `HKU\S-1-5-18` has no consent value at all, and the WinRT chain
+resolves and returns the SSID under net48.
+
+# Operator Guidance
+
+A device that reports no SSID is not misconfigured for enrollment — only the telemetry field is
+missing. To get the full payload (signal, PHY, channel) back, the **device-level** location setting
+must be on: *Settings → Privacy & security → Location → Location services*, or via Intune
+(`Privacy/LetAppsAccessLocation`). Without it the SSID still arrives via tier 2.
+
+# Citations
+
+* [Changes to API behavior for Wi-Fi access and location](https://learn.microsoft.com/en-us/windows/win32/nativewifi/wi-fi-access-location-changes)
+* [WlanConnectionProfileDetails.GetConnectedSsid](https://learn.microsoft.com/en-us/uwp/api/windows.networking.connectivity.wlanconnectionprofiledetails.getconnectedssid)
+* [WifiInfoProvider.cs](../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WifiInfoProvider.cs)
+* [WinRtWifiSsidReader.cs](../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WinRtWifiSsidReader.cs)
+* [WifiInfoReader.cs](../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WifiInfoReader.cs)
+* [NetshWifiFallback.cs](../../src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/NetshWifiFallback.cs)

docs/agent/zero-user-apps-completion-gate.md

@@ -0,0 +1,136 @@
+---
+type: Concept
+title: Zero User-Targeted Apps — the starved user-phase completion gate
+description: Why a device with no user-targeted Intune apps could never satisfy the IME user-session gate, how that turned into a 30-minute esp_exit_without_completion_evidence false positive on a third of one tenant's enrollments, and the two fixes — reading the line IME actually writes in its zero-app branch, and refusing to fail a session while a completion gate is deliberately holding it.
+resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime
+tags:
+  - agent
+  - ime
+  - esp
+  - completion
+  - realmjoin
+  - false-positive
+timestamp: 2026-08-25
+---
+
+# Summary
+
+A Classic user-driven enrollment whose user has **zero targeted Intune Win32 apps** could not
+produce the evidence every user-phase completion path required. The session parked, and the
+30-minute `advisory_completion` backstop resolved it as
+`enrollment_failed: esp_exit_without_completion_evidence` — while the user was at a working
+desktop, Windows Hello was provisioned, and RealmJoin was still installing packages.
+
+One tenant hit this on **10 of 30 enrollments in a week**. Every one of them was a false
+positive; the devices were healthy in Intune and RealmJoin.
+
+# The starvation chain
+
+The IME writes `Completed user session N, userId: …` at the end of a user-session processing
+pass. `IME-USER-SESSION-COMPLETED` matches it and the adapter posts
+`ImeUserSessionCompleted`, which sets `DecisionState.ImeUserSessionCompletedUtc`.
+
+But the IME never reaches that statement when the user has no assigned apps. Decompiled IME
+`1.104.102.0`, `Win32AppPlugIn/ApplicationPoller.cs`:
+
+```csharp
+if (!appPolicies.Any())
+{
+    AppWorkloadLog.TraceInformation($"[Win32App] Get 0 apps for user session {user.RDSSessionId}, user id = {user.IntuneId}");
+    RegisterApplicationsInIfInESP(sender, user, delegate {
+        espLockInProcessor.AttemptToLockInApplications(user, new List<ProcessorSubgraph>());
+    });
+    continue;                       // skips the "Completed user session" statement below
+}
+```
+
+Identical shape in `1.97.107.0`, `1.83.107.0`, `1.80.132.0`. With that fact missing, every door
+out of the user phase is shut at once:
+
+| Path | Requirement | Why it is dead |
+|---|---|---|
+| `ShouldTransitionToAwaitingHello` arm A | `AccountSetupProvisioningSucceededUtc` | ESP registry froze at `AccountSetup: 1 of 5`; neither `categorySucceeded` nor the all-subcategories fallback can ever hold |
+| arm B | `SkipUserEsp` | Full ESP, not a skip-user flow |
+| arm C | `IsImeUserSessionGenuine` | needs the missing IME fact |
+| arm D | `EnrollmentMode.DevicePreparation` | Autopilot v1, not WDP |
+| `MaybeSynthesizeAccountSetupCompleteFromSettledUserApps` | `AreUserEspAppsSettled` | returned `false` on an empty app list |
+| `HandleAdvisoryCompletionDeadlineFired` conjunction | `imeUserSessionGenuine \|\| isObservationAdvisory` | both false |
+
+The last row is the one that produced the verdict: the backstop that exists to resolve a
+dead-end resolved it as a failure.
+
+`AreUserEspAppsSettled` deserves its own note. Its "at least one required app" rule is
+deliberately conservative — an empty list normally means *the phase just cleared* or *apps have
+not surfaced yet*. But it made **zero apps**, the most settled state possible, indistinguishable
+from *unknown*, and there was no evidence available to tell them apart.
+
+# Fix 1 — read the line IME does write
+
+`IME-USER-SESSION-ZERO-APPS` matches the zero-app line and routes it through the **same**
+`OnUserSessionCompleted` callback. Downstream this genuinely *is* a completed user session, so
+the adapter's pending-apps deferral and its fire-once flag apply unchanged.
+
+This is not a weakened gate — it is IME's own verdict. The zero-app branch locks the ESP in with
+an *empty* application list, and the sibling emit site in `AppWorkloadAbstraction.ExecuteUserCheckIn`
+returns `ProviderResult.ProvisioningComplete` straight after logging it. All three emit sites are
+user-session-scoped (`user.RDSSessionId`, `user.IntuneId`); none is device-scoped.
+
+Guards that stay in force:
+
+* **Phase guard** — the observation only fires while the tracker is in `AccountSetup`. Firing
+  earlier would burn the adapter's fire-once flag on a pre-sign-in (defaultuser0) timestamp that
+  `IsImeUserSessionGenuine` (`>= AccountSetupEnteredUtc`) can never accept. An observation made
+  before the phase was known is remembered and replayed on the transition into it, because IME
+  writes its check-in lines independently of when the agent first parses the phase marker.
+* **Engine guards unchanged** — arm C still requires a post-AccountSetup final ESP exit *and* a
+  DAD-validated real-user desktop.
+* `AreUserEspAppsSettled` returns `true` for an empty list **only** with this explicit
+  observation — never for a merely empty list.
+
+# Fix 2 — do not fail while a completion gate is holding
+
+An independent defect, and the decisive one for the affected tenant. `advisory_completion` runs
+for 30 minutes. The RealmJoin completion gate blocks completion until phase 110 and carries its
+*own* bounded resolution: 60 minutes from detection, re-armed on deployment activity, hard-capped
+at 4 hours. The shorter timer always won.
+
+Session `75d6ae8e` installed **25 RealmJoin packages successfully inside the window**, the last
+one 2 minutes before the failure, while the engine's own `completion_waiting` still read
+`waiting on: realmjoin_resolution`.
+
+`HandleAdvisoryCompletionDeadlineFired` now re-arms instead of failing when the RealmJoin gate is
+closed *and* its deadline is still armed, emitting `completion_waiting` with trigger
+`DeadlineFired:advisory_completion:CompletionGateHolding`.
+
+Convergence comes from the gate itself: `Resolved`, `FirstDeploymentIncomplete` and `Timeout` all
+set `RealmJoinFacts.Outcome`, which opens `RealmJoinGateOpen` and stops the guard applying.
+Requiring the gate's deadline to still be armed keeps a gate that can no longer resolve itself
+from parking the session; `AgentMaxLifetimeMinutes` bounds it regardless.
+
+# Timeline evidence
+
+`ime_user_session_completed` carries an `evidence` field so the basis of the verdict is legible
+without the diagnostics archive:
+
+* `user_session_completed` — IME wrote its completion line and no required app was pending.
+* `zero_user_apps_enumerated` — IME reported zero targeted apps; the user phase had nothing to
+  enforce.
+
+No new event type: the fact is the same, only the observation behind it differs.
+
+# Deployment
+
+The pattern ships through the config API and reaches existing agents without a rebuild; an agent
+that does not know the `userSessionZeroApps` action logs one Debug line and ignores it. The
+*behaviour* needs an agent release. Sessions already stamped `Failed` are not reclassified — the
+backend mirrors the agent verdict (`VerdictPaths.AgentFailed`) and has no independent judgement
+here by design.
+
+# Citations
+
+* `rules/ime-log-patterns/IME-USER-SESSION-ZERO-APPS.json`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Handlers.cs` — `HandleUserSessionZeroApps`, the phase replay in `HandleEspPhaseDetected`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs` — `AreUserEspAppsSettled`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/SignalAdapters/ImeLogTrackerAdapter.cs` — `EmitUserSessionCompleted`, evidence labels
+* `src/Shared/AutopilotMonitor.DecisionCore/Engine/DecisionEngine.Edge.cs` — `HandleAdvisoryCompletionDeadlineFired`
+* [decision-engine.md](decision-engine.md), [post-reboot-completion-recovery.md](post-reboot-completion-recovery.md)

docs/backend/admin-identity-binding.md

@@ -0,0 +1,165 @@
+---
+type: Concept
+title: Admin Identity Binding — tid + oid behind every cross-tenant-role UPN
+description: Why a GlobalAdmins or DelegatedAdmins row keyed on a UPN string must never confer access by itself in an API that accepts tokens from every Entra tenant, the AdminIdentityBindings table that pins each such UPN to its immutable home tenant id and object id, the fail-closed resolution order in both role services, the first-sign-in object-id pin, and the explicit rebind surface.
+resource: src/Backend/AutopilotMonitor.Functions/Services/AdminIdentityBindingService.cs
+tags:
+  - backend
+  - security
+  - authorization
+  - multi-tenant
+  - global-admin
+  - delegated-admin
+timestamp: 2026-08-29T00:00:00+02:00
+---
+
+# Problem
+
+The API is a multi-tenant Entra application on purpose: `AuthenticationMiddleware` accepts a token from
+any tenant (issuer prefix `login.microsoftonline.com/` or `sts.windows.net/`), and signature, audience,
+lifetime and algorithm are validated strictly. Tenant-member roles (`TenantAdmins`) are keyed on
+`(tid, upn)` and therefore bound to the verified tenant.
+
+The two cross-tenant tiers were not. `GlobalAdmins` (GlobalAdmin / GlobalReader) and the delegated MSP
+tier (`DelegatedAdmins` + `TenantGroupAssignments`) resolved their role from the **UPN string alone**
+(`upn`, falling back to `preferred_username`). Both claims are mutable and reusable across tenants:
+
+* **Domain re-registration**: if the domain behind a platform admin's UPN lapses or moves, whoever
+  verifies it in a fresh tenant can mint the identical UPN; the token is genuine, only `tid` differs.
+* **UPN recycling**: a User Administrator in the home tenant can re-assign the UPN to another account;
+  same `tid`, different `oid`.
+* **MSP variant**: the delegated tier was gated only on the caller's home tenant being Pro — which any
+  tenant can self-provision via the trial endpoint.
+
+Any of these yielded full platform scope: raw table dumps including `TenantConfiguration` secrets,
+tenant offboarding, GA management. Microsoft's own guidance (post-nOAuth) is explicit: authorization
+data must be keyed on the immutable `tid` + `oid` pair, never on `upn` / `preferred_username`.
+
+# Mechanism
+
+## One binding per UPN
+
+`AdminIdentityBindings` (PK `Bindings`, RK = lowercase UPN) holds, for every UPN that carries a
+cross-tenant role, the identity that may use it:
+
+| Column | Meaning |
+| --- | --- |
+| `TenantId` | The admin's **home** Entra tenant — must equal the JWT `tid`. Mandatory at grant time. |
+| `ObjectId` | The admin's Entra object id — must equal the JWT `oid`. Empty until pinned. |
+| `BoundBy`, `BoundDate` | Operator provenance. |
+| `ObjectIdPinnedDate` | When the object id was fixed (grant time, or the first matching sign-in). |
+
+A single table rather than columns on three role tables: a UPN string belongs to exactly one identity
+at a time, a person may hold a GlobalAdmins row *and* delegated assignments, and the role rows stay
+what they are — grants. The binding says whose grants they are.
+
+## Resolution order (both role services)
+
+`AdminIdentity` is the record `(Upn, TenantId, ObjectId)` built from a validated principal; it is
+`null` when any of the three claims is missing (app-only tokens, foreign IdP shapes). Both
+`GlobalAdminService.GetGlobalRoleAsync(AdminIdentity?)` and
+`DelegatedAdminService.GetScopeAsync(AdminIdentity?)` follow the same order:
+
+1. `null` identity → no role, no storage read.
+2. Resolve the **row** by UPN (cached 30 s, unchanged from before).
+3. No row / empty scope → return; the binding is not even read. Ordinary tenant users cost one cached
+   read and never produce a binding log line.
+4. `AdminIdentityBindingService.IsBoundAsync(identity)` → false ⇒ no role / empty scope.
+5. Delegated only: the Pro home-tenant entitlement gate, **after** the binding check — an unbound caller
+   never triggers an edition lookup.
+
+`IsBoundAsync` is the single choke-point: no binding ⇒ false; `TenantId` mismatch ⇒ false (checked
+before anything else, so a foreign-tenant token can never claim the pin below); pinned `ObjectId`
+mismatch ⇒ false; unpinned binding + matching tenant ⇒ **pin** the caller's `oid` and verify against
+what was actually stored afterwards. Every false outcome is logged at Warning with its reason
+(`[IdentityBinding] TENANT MISMATCH …` / `OBJECT-ID MISMATCH …` / `holds no identity binding`), the
+one level the worker forwards to Application Insights; matches are silent. Pins are logged at Warning
+once — they are one-off, operator-relevant events.
+
+The pin is a conditional update in the repository (`TryPinIdentityObjectIdAsync`: only onto an unpinned
+row homed in the caller's tenant, ETag-guarded; a 412 re-reads and the caller compares against the
+winner). Two accounts racing the first sign-in inside the home tenant therefore leave exactly one bound.
+
+Row lookups stay cached by UPN; the binding has its own 30 s cache keyed by UPN and is invalidated on
+pin, rebind and removal. A rebind on one scaled-out instance converges on the others within seconds.
+
+## Grants bind first — and resolve the identity themselves
+
+Granting is "type the UPN". The three grant endpoints (`POST auth/global-admins`,
+`POST global/delegated-admins`, `POST global/tenant-groups/{id}/assignees`) accept `homeTenantId` /
+`objectId` only as optional overrides; normally `AdminIdentityResolver` supplies them:
+
+1. **Sign-in history** (`UserActivity`, filtered on the UPN): the person has signed in before ⇒ tid + oid
+   are known, both from validated tokens. The most recent sign-in wins for the oid. A UPN seen under
+   **more than one tenant** is never auto-resolved — that is the attack shape the binding exists for.
+2. **UPN domain → onboarded tenant** (`TenantConfiguration.DomainName`, exactly one match): tid only; the
+   oid is pinned on the first sign-in.
+3. Neither ⇒ **422 `HomeTenantUnresolved`**; the portal then shows a home-tenant picker (onboarded
+   tenants) and retries with `homeTenantId`. This is the only manual step, and only for a UPN whose
+   domain the platform has never seen.
+
+`AddGlobalAdminAsync`, `DelegatedAdminService.UpsertAsync` and `AssignGroupAsync` then take the resolved
+`homeTenantId` / `objectId` and call `EnsureBoundAsync` **before** writing the role row. `EnsureBoundAsync` creates the binding, keeps a compatible one (same tenant; the
+supplied object id equals the pin or upgrades an unpinned one), and throws
+`IdentityBindingConflictException` for a different tenant or a different pinned object id — the
+functions map that to **409**. A grant can therefore never silently re-home a UPN.
+
+Why the object id may be unknown: a person who has never signed in has no history to resolve from, and
+the operator granting an external MSP admin has no directory access to the partner tenant. The first
+sign-in from the bound tenant pins it; from then on a recycled UPN in the same tenant is refused.
+
+## Explicit rebind surface
+
+| Route | Policy | Purpose |
+| --- | --- | --- |
+| `GET global/identity-bindings` | GlobalReadOrAdmin | Audit which tenant / object id each grant is usable from. |
+| `PUT global/identity-bindings/{upn}` | GlobalAdminOnly | Replace the binding: move a UPN to another tenant, or re-pin after a legitimate account re-creation (omit `objectId` to clear the pin). |
+| `DELETE global/identity-bindings/{upn}` | GlobalAdminOnly | Make every role row of the UPN inert without touching the rows. Self-removal is refused. |
+
+Both mutations are audited under the binding's home tenant (`AdminIdentityBinding` entity, previous
+values in the details) and logged at Warning. The portal surfaces this in **Tenant Management → Edit
+Tenant Configuration → Identity bindings** (collapsed): the bindings homed in that tenant, with inline
+edit (re-home / re-pin; empty object id ⇒ re-pinned on the next sign-in) and remove. The grant forms
+themselves carry no identity fields — the binding is a background property of the grant.
+
+## Lifecycle and secondary effects
+
+* `AdminIdentityBindings` is in `TableNames.All`, in `CriticalBackupTables.All` and in
+  `AuthTablesFullRestoreForbidden` (single-row restore only, like the other auth tables).
+* Tenant offboarding wipes bindings whose `TenantId` is the offboarded tenant (property-only bucket):
+  once a home tenant is gone, its admins' grants become inert.
+* `RequestContext.ObjectId` carries the JWT `oid`; `AdminIdentity.FromRequestContext` serves the
+  handlers that resolve roles outside the middleware (SignalR group join/leave, health checks).
+* The throttle identity (`GetCallerId`) now prefers `oid` over the UPN, so two accounts in different
+  tenants that share a UPN string no longer share a rate-limit bucket. Audit and presence rows keep the
+  UPN as their display key; they already carry the tenant id.
+* Legacy role rows without a binding are **inert, not grandfathered**. Rolling this out therefore means
+  seeding the binding rows for the existing admin UPNs (their `tid` and `oid` are recorded per login in
+  `UserActivity`) *before* the backend deploy — an unseeded platform admin locks themselves out of every
+  GlobalAdminOnly route, including the rebind surface.
+
+# Examples
+
+A GlobalAdmin row for `admin@vendor.example` bound to tenant `1111…` with object id `aaaa…`:
+
+| Token | Result |
+| --- | --- |
+| `tid=1111… oid=aaaa… upn=admin@vendor.example` | GlobalAdmin |
+| `tid=2222… oid=aaaa… upn=admin@vendor.example` | no role — `TENANT MISMATCH` warning |
+| `tid=1111… oid=bbbb… upn=admin@vendor.example` | no role — `OBJECT-ID MISMATCH` warning |
+| `tid=1111… upn=admin@vendor.example` (no `oid`) | no role — identity incomplete |
+
+Same row, binding without an object id: the first `tid=1111…` sign-in pins its `oid` and is admitted; a
+`tid=2222…` sign-in before that is refused **and does not pin**.
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Security/AdminIdentity.cs` — the identity record and its factories.
+* `src/Backend/AutopilotMonitor.Functions/Services/AdminIdentityBindingService.cs` — verdict, pin, grant-time binding, rebind; the table entity.
+* `src/Backend/AutopilotMonitor.Functions/Services/AdminIdentityResolver.cs` — sign-in-history / UPN-domain resolution at grant time (`AdminIdentityResolverTests`).
+* `src/Web/autopilot-monitor-web/app/admin/components/IdentityBindingsSection.tsx` — the per-tenant inspect/correct panel.
+* `src/Backend/AutopilotMonitor.Functions/Services/GlobalAdminService.cs`, `DelegatedAdminService.cs` — resolution order.
+* `src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableAdminRepository.cs` — `TryPinIdentityObjectIdAsync` and the binding CRUD.
+* `src/Backend/AutopilotMonitor.Functions/Functions/Admin/IdentityBindingManagementFunction.cs` — the rebind surface and the shared `IdentityBindingRequest.Validate`.
+* `src/Backend/AutopilotMonitor.Functions.Tests/AdminIdentityBindingServiceTests.cs`, `AdminIdentityBindingAuthorizationTests.cs` — verdict matrix, race semantics, and the middleware-level denials for foreign-tenant and recycled-UPN tokens.
+* [Client-Certificate Tenant Binding](client-cert-tenant-binding.md) — the same "chain-valid is not tenant-bound" argument on the device side.

docs/backend/client-cert-tenant-binding.md

@@ -0,0 +1,270 @@
+---
+type: Concept
+title: Client-Certificate Tenant Binding — Closing the Cross-Tenant Gap
+description: Why a chain-valid Intune MDM certificate does not prove the caller belongs to the tenant it claims, which certificate extension carries the Entra tenant id (and which two look like it but do not), and the shadow-then-enforce rollout that measures field coverage before it can lock devices out.
+resource: src/Backend/AutopilotMonitor.Functions/Security/CertTenantBinding.cs
+tags:
+  - backend
+  - security
+  - authentication
+  - certificates
+  - intune
+  - multi-tenant
+timestamp: 2026-08-29T00:00:00+02:00
+---
+
+# Problem
+
+Agent requests authenticate with mTLS. `CertificateValidator` pins the chain to the embedded
+Intune roots (`X509ChainTrustMode.CustomRootTrust`), checks the validity window and requires the
+Client-Authentication EKU. All of that together proves exactly one thing: **the certificate was
+issued by the Microsoft Intune MDM Device CA to some tenant**.
+
+Those roots are shared by every Intune tenant on the planet. Nothing in the certificate stage ties
+the caller to the tenant in the request. The tenant scoping came entirely from the downstream
+device validators — the serial number must appear in that tenant's Autopilot / imported-device /
+Cloud PC inventory. Device serial numbers are not secrets; they are printed on the chassis.
+
+So the pre-existing attack was: enroll a device in your own Intune tenant, obtain a legitimate
+device certificate, learn one serial number of the victim tenant, and submit telemetry as that
+tenant. Certificate validation passes, device validation passes.
+
+# Mechanism
+
+The Intune MDM Device CA stamps the customer's identifiers into the leaf certificate. Since the
+agent presents this certificate in the TLS handshake, its contents are proof of possession and the
+backend can compare them against the requested tenant — no Graph call, no additional consent, and
+nothing the agent has to send.
+
+## Which extension carries what
+
+Verified by decoding a real field certificate (issued 2026-05-08, `Functions.Tests/device-cert-sample.pem`):
+
+| OID | Encoding | Content |
+| --- | --- | --- |
+| `1.2.840.113556.5.14` | nested OCTET STRING (`04 10` + 16 bytes) | **Entra tenant id** — the one to compare |
+| `1.2.840.113556.5.6` | nested OCTET STRING (`04 10` + 16 bytes) | Intune **Account** id — a *different* GUID, never equal to the tenant id |
+| `1.2.840.113556.5.4` | **16 raw bytes, no wrapper** | Intune device id, identical to the certificate's Subject CN |
+
+Two traps are worth stating explicitly, because both cost real debugging time:
+
+1. `…5.6` is widely described as "the tenant id (AccountID)". It is not the Entra tenant id.
+   Comparing it against the requested tenant would reject every request in production.
+2. The encodings are not uniform. `…5.4` holds the GUID bare while the other two nest it in a
+   second OCTET STRING, so a decoder written against one shape silently fails on the other.
+   `MsDeviceCertificateOids.TryParseGuid` accepts both, and all GUIDs are Microsoft
+   little-endian (what `new Guid(byte[])` expects).
+
+A 16-byte input is inherently ambiguous — it is indistinguishable from a truncated wrapper and is
+always read as a bare GUID. That is harmless here: the value is only ever compared for equality
+against a known tenant id, never trusted as a standalone claim.
+
+## Where it is NOT
+
+`EntraDeviceCertHelper` reads tenant and device ids from the **MS-Organization-Access** certificate
+(`1.2.840.113556.1.5.284.*`). That certificate is not part of the authentication path at all — the
+agent selects the Intune MDM certificate by exact issuer match (`CN=Microsoft Intune MDM Device CA`,
+see `CertificateHelper.SelectMdmCertificate`) and the backend pins only the MDM chain. The Entra
+certificate is used purely as a local fallback for `TenantIdResolver`; it never leaves the device.
+
+Sending it in a header instead would prove nothing: only the certificate used in the TLS handshake
+demonstrates possession of a private key. A certificate copied into a custom header can be replayed
+by anyone who has seen it once.
+
+# Rollout
+
+Enforcing immediately would be reckless: any device population whose certificates predate the
+extension, or whose CA behaves differently (sovereign clouds), would be locked out at once. The
+rollout therefore has staged consequences.
+
+**Stage 1 — shadow (completed, kept as the measurement that justified stage 2).** `SecurityValidator.ObserveCertTenantBinding` evaluates the binding
+after certificate validation and logs the outcome. It returns `void`, changes no state, and swallows
+its own exceptions, so it cannot fail a request that would otherwise be accepted. The pure comparison
+lives in `CertTenantBinding.Evaluate`; the outcome codes (`Match`, `Mismatch`, `ExtensionMissing`,
+`Unparseable`, `RequestTenantNotAGuid`) are stable and queried by exact match in KQL.
+`WouldRejectUnderEnforcement` records what stage 2 *would* have done, so the telemetry can be read
+without re-deriving the rule at query time.
+
+The telemetry uses two carriers, because the numerator and the denominator have very different
+costs and answer different questions:
+
+* **Every** outcome, `Match` included, is stamped onto the request row as the `CertTenantBinding`
+  dimension — `SecurityValidator` writes it into `FunctionContext.Items`
+  (`CertTenantBinding.RequestItemKey`) and `RequestTelemetryMiddleware` copies it onto the
+  `RequestTelemetry` it already emits. That row exists per request and is unsampled, so the
+  denominator costs no additional telemetry at all.
+* Outcomes that need an enforcement decision (mismatch, missing, undecodable) are **additionally**
+  logged at Warning with the full context — thumbprint, certificate tenant, session.
+
+`Match` is deliberately not a trace line. Worker-side `LogInformation` never reaches App Insights
+(the ApplicationInsightsLoggerProvider default rule is Warning+ and host-forwarding of worker logs
+is disabled), so a `Match` trace is dead code that silently costs the denominator. The first
+deployment of this feature made exactly that mistake: it emitted zero rows across 32k requests,
+which is indistinguishable from the code never running.
+
+**Stage 2 — enforced since 2026-08-25.** `Mismatch` returns 403 and is recorded through the shared
+`LogRequestRejection` path (`stage=certtenant`) so it lands in the same KQL raster as every other
+rejection reason. The switch was made against measured data: 35,684 requests across 32 tenants,
+every one a `Match`, with the Warning channel independently verified to be carrying other traffic so
+the zero could not be a telemetry artefact.
+
+The rule lives in one place, `CertTenantBinding.Rejects`, and only `Mismatch` blocks. Everything
+else means "cannot tell" and is deliberately tolerated:
+
+* `ExtensionMissing` — the sample only covers devices active in the measurement window, so older
+  certificates or a sovereign-cloud CA could still lack the extension. Rejecting on absence would
+  lock those devices out for something they cannot control. **This is the one to tighten later**,
+  once the `ExtensionMissing` rate is provably zero across a wider window; a test pins the current
+  tolerance so removing it has to be a deliberate decision rather than a drive-by edit.
+* `Unparseable` — a decoder or encoding surprise is our problem, not the device's.
+* `RequestTenantNotAGuid` — nothing to compare against, and such a request fails the tenant lookup
+  in §0 long before reaching this point.
+
+The evaluation fails open on its own exception: this gate exists to stop a cross-tenant certificate,
+and a defect on our side is not evidence of one. The 403 body deliberately does not echo which
+tenant the certificate belongs to — that pair is in the rejection log, not in the response.
+
+Grep marker for every site involved: `CERT-TENANT-BINDING`.
+
+The bootstrap-token path (`X-Bootstrap-Token`) bypasses certificate validation by design and is
+unaffected by either stage.
+
+# Certificate transport and proof of possession
+
+Every stage above validates certificate *content*: chain, validity window, EKU, tenant extension.
+None of them proves the caller holds the private key — a certificate is public material (sent in
+clear in a TLS 1.2 client-auth handshake, readable from the machine store by any local user, present
+on resold hardware). Proof of possession comes from the TLS handshake alone: the platform runs
+`clientCertMode=Required` on every path not listed in its `clientCertExclusionPaths`, forwards the
+handshake certificate as `X-ARR-ClientCert`, and **strips any inbound copy of that header — on
+excluded paths too** (verified 2026-08-29 with a spoofed header against `/api/bootstrap/config`:
+the validator saw "No certificate provided"). So `X-ARR-ClientCert` is trustworthy exactly because
+the caller cannot write it.
+
+Two consequences shape `SecurityValidator`:
+
+* **No other certificate header is ever read.** A former local-dev fallback (`X-Client-Certificate`)
+  accepted certificate bytes from a client-writable header, which decouples the certificate from
+  key possession: anyone holding a device's public certificate would authenticate as that device.
+  Removed 2026-08-29. Local development sets `X-ARR-ClientCert` directly — Core Tools does not strip
+  it.
+* **Bootstrap routes are token-only, fail-closed.** `/api/bootstrap/*` is in the platform's
+  exclusion list so cert-less OOBE agents can reach it — which also means nothing on those paths
+  proves a handshake happened. The token is therefore the sole credential there:
+  `SecurityValidator.IsBootstrapRoute` (path prefix, mirroring the exclusion entry so no function
+  can forget to opt in) rejects a missing or **empty** `X-Bootstrap-Token`, and a missing
+  `BootstrapSessionService`, with 401 before the certificate stage can run. The live gap this
+  closes: the function-level `Headers.Contains` gate accepted an empty header while the validator
+  treated it as "no token" and fell through to the certificate stage, where the fallback header
+  above was parsed. Bootstrap tokens are never accepted as a *replacement* for the certificate on
+  platform-enforced routes either — there the cert requirement is already satisfied by the
+  handshake before the request reaches code.
+
+The exclusion list is portal-only state (no IaC). Adding `/api/agent` to it, or moving a
+device-authenticated function under an excluded prefix, would silently reopen the header path;
+`BootstrapRouteFailClosedTests` pins the code half of this contract.
+
+**Stage 3 — device binding (Global-Admin-only preview).** Tenant binding proves the certificate was
+issued to this tenant; it does not prove the certificate belongs to a device the tenant still has.
+`IntuneDeviceBindingValidator` closes that by resolving the Intune managedDevice id from the
+certificate's Subject CN against the tenant's own `deviceManagement/managedDevices` inventory
+(point-GET on `managedDevices/{id}` — no OData filter to inject into, and a 404 is unambiguous).
+
+It is modelled on `CloudPcDeviceValidator` and shares its cache/retry/transient contract, with one
+important difference in how it is wired: the lookup is fire-and-forget, like the DevPrep
+association shadow, because a cold Graph round-trip can take seconds and must never sit in the
+agent's request path. That rules out the request-row dimension stage 1 uses — the row is written
+the moment the function returns, before the detached task finishes — so the outcome is logged at
+Warning instead. Volume stays bounded because only Global Admins can see the toggle
+(`user?.isGlobalAdmin === true`, the same gate as the DevPrep preview). Widening it beyond preview
+should move to an inline call plus a request dimension.
+
+Outcomes: `Match`, `NotFound`, `NoDeviceIdInCert`, `PermissionMissing`, `Transient`. Only
+`Transient` is retried and left uncached — a missing grant or a foreign device is a state, not an
+outage.
+
+Graph cost is not a concern, and that is measured rather than assumed: the first live enrollment
+produced **136 requests and exactly one Graph call**, because the 30-minute positive cache absorbs
+the rest. For comparison, the per-request Autopilot serial validator made 25 calls in the same
+window. Lengthening the positive TTL would buy nothing and would delay noticing a device that has
+been wiped or removed; shortening the 5-minute negative TTL matters more, since that is how quickly
+a device object appearing late is picked up.
+
+What the 136 requests *did* cost was log lines saying the same thing 136 times, so the shadow log is
+gated on `IntuneDeviceBindingResult.ServedFromCache`: one line per real Graph lookup. Cached repeats
+add nothing — the reported age just counts up mechanically from the same `enrolledDateTime`.
+Outcomes that are never cached (`Transient`, `NoDeviceIdInCert`) still log every time, which is the
+right behaviour for an anomaly.
+
+The open question this preview exists to answer is a race, not an attack: a device object can in
+principle appear in Intune *after* the agent's first call, and enforcing before that is understood
+would reject legitimate enrollments. Every result therefore carries `enrolledDateTime`, and the log
+line records `enrolledAgeSeconds` — a device whose object was created seconds before the request
+looks completely different from a certificate that never belonged to the tenant. Grep marker:
+`CERT-DEVICE-BINDING-SHADOW`.
+
+Enabling it needs the optional Graph permission `DeviceManagementManagedDevices.Read.All`, granted
+per tenant with the customer script — it is not in the default-consent set:
+
+```powershell
+.\Grant-AutopilotMonitorAddOn.ps1 -ClientId "<client-id>" -Features IntuneDeviceBinding
+```
+
+`GraphFeatureCatalog` (feature `IntuneDeviceBinding`) and the script's catalog, `ValidateSet` and
+help block are pinned to each other by `GraphFeatureCatalogSyncTests`.
+
+# Examples
+
+Coverage — the question stage 2 depends on ("would enforcing lock anyone out?"):
+
+```kusto
+requests
+| where isnotempty(customDimensions.CertTenantBinding)
+| summarize Requests = sum(itemCount)
+    by Outcome = tostring(customDimensions.CertTenantBinding),
+       Tenant  = tostring(customDimensions.TenantId)
+| order by Requests desc
+```
+
+Detail on the individually actionable ones:
+
+```kusto
+traces
+| where message has "AgentCertTenantBinding"
+| extend Outcome = tostring(customDimensions.Outcome),
+         Tenant  = tostring(customDimensions.TenantId)
+| summarize count() by Outcome, Tenant
+```
+
+Anything in `Mismatch` is a cross-tenant certificate; anything in `ExtensionMissing` is a device
+that stage-2 enforcement would have to make a policy decision about. Note that the trace query
+alone can never show `Match`, so it cannot tell "everything matched" apart from "nothing ran" —
+use the request-row query for that.
+
+Stage 3, including the enrollment-race measurement:
+
+```kusto
+traces
+| where message has "AgentCertDeviceBinding"
+| extend Outcome  = tostring(customDimensions.Outcome),
+         AgeSecs  = toint(customDimensions.EnrolledAgeSeconds)
+| summarize Requests = count(),
+            MinAgeSecs = min(AgeSecs),
+            P05AgeSecs = percentile(AgeSecs, 5)
+    by Outcome
+```
+
+`NotFound` is the row that decides whether this can ever become a gate. A small `MinAgeSecs` on
+`Match` means device objects are appearing only just in time — the race is real and enforcement
+would need a grace path.
+
+# Citations
+
+* `src/Shared/AutopilotMonitor.Shared/Security/MsDeviceCertificateOids.cs` — OID catalog and the
+  shared ASN.1 GUID decoder (one implementation for agent and backend).
+* `src/Backend/AutopilotMonitor.Functions/Security/CertificateValidator.cs` — extension extraction
+  alongside chain validation, cached per thumbprint.
+* `src/Backend/AutopilotMonitor.Functions/Security/CertTenantBinding.cs` — the pure comparison.
+* `src/Backend/AutopilotMonitor.Functions/Security/SecurityValidator.cs` — shadow observation.
+* [W365 Cloud PC Device Validation](cloudpc-device-validation.md) — the other consumer of this
+  certificate's identity fields (Subject CN = Intune device id).

docs/backend/ime-msi-archive.md

@@ -0,0 +1,114 @@
+---
+type: Concept
+title: IME Installer Archive (version-verified, multi-host)
+description: How every fleet-observed Intune Management Extension build is archived as its MSI - the ime_agent_version sighting that queues the job, the candidate hosts, the ProductVersion check that keeps a wrong ring's build out of the version folder, the re-queue on later sightings, and the manual skill-side backfill.
+resource: src/Backend/AutopilotMonitor.Functions/Services/Ime/ImeMsiArchiver.cs
+tags:
+  - backend
+  - ime
+  - archive
+  - blob
+  - queue
+timestamp: 2026-08-29T17:30:00+02:00
+---
+
+# IME Installer Archive
+
+The platform keeps every Intune Management Extension build it has ever seen in the fleet
+as the original installer, so any IME version can be decompiled and diffed later
+(`ime-decompiles` repository, `/ime-decompile` skill) even after Microsoft's CDN has moved
+on. Two stores:
+
+| Store | Content | Written by |
+| --- | --- | --- |
+| Blob container `ime-archive` (private, kept by design, not tenant-scoped) | `{version}/IntuneWindowsAgent.msi` (write-once) + `{version}/provenance.json` (derived, overwritable) | `ImeMsiArchiver` via the `ime-msi-archive` queue; `/ime-decompile` skill as manual backfill |
+| Table `ImeVersionHistory` (partition `Global`, RowKey = version) | first/last seen, session count, `MsiArchiveStatus`, `MsiArchiveUpdatedAt`, `MsiArchiveBlobPath`, `MsiSha256`, `MsiBytes`, `MsiSourceUrl` | `RecordImeVersionAsync` (sighting), `UpdateImeVersionArchiveInfoAsync` (archive outcome / queued stamp) |
+
+# Schema
+
+## Sighting → job
+
+`EventIngestProcessor` looks at the batch's `ime_agent_version` event (`agentVersion`, plus
+the agent's CSP-registry enrichment `msiDownloadUrl` / `msiMatchedBy` when present).
+`RecordImeVersionAsync` returns an `ImeVersionSighting`:
+
+* `IsNew` — the insert succeeded: first fleet-wide sighting → ops event + enqueue.
+* otherwise the row's `MsiArchiveStatus` / `MsiArchiveUpdatedAt`, read in the same point
+  read that bumps `SessionCount` (no second table read).
+
+A known version is **re-queued** (`ImeMsiArchiver.ShouldRequeueOnSighting`) only when all
+of these hold: the event URL passes the allowlist **and** `msiMatchedBy == productVersion`
+(the CSP row's ProductVersion equals the observed version, so the URL is authoritative),
+the status is neither `Archived` nor `Failed:BadVersion`, and the last archive activity is
+older than 24 h (`RequeueBackoff`) or never happened. The ingest path then merges
+`MsiArchiveStatus = Queued` (stamping `MsiArchiveUpdatedAt`) before enqueueing, so the other
+sessions of that version see "in flight" and do not pile on. Worst case for a version no
+host serves any more: one walk over the hosts per day, not one per enrollment.
+
+## Candidate hosts and the version check
+
+Microsoft distributes IME from several versionless URLs that carry **different rollout
+rings at the same time**. Observed 2026-08-29: `imeswdb-afd-secondary` served 1.104.102.0,
+`imeswda-afd-primary` 1.105.101.0, `imeswda-afd-hotfix` 1.105.103.0. "A new version is by
+definition what the canonical URL serves right now" is therefore false, and the first
+version of the archiver filed a 1.104.102.0 package under `1.105.103.0/` (fixed by hand:
+blob overwritten, row merged).
+
+The archiver walks `BuildCandidateUrls(eventUrl)`: the allowlisted event URL first (HTTPS,
+host `*.manage.microsoft.com`, filename exactly `IntuneWindowsAgent.msi`), then
+`FallbackMsiUrls` = primary, secondary, hotfix — de-duplicated. For each candidate:
+
+1. Download with the admin size cap (Content-Length preflight + mid-stream cap) into a
+   delete-on-close temp file while SHA-256 hashing.
+2. Read the package's `ProductVersion` with `MsiProductVersionReader` — a pure managed OLE
+   compound-file reader (v3 512-byte and v4 4096-byte sectors, DIFAT/FAT/mini-FAT, MSI
+   stream-name decoding, `_StringPool`/`_StringData` incl. long strings and holes, the
+   column-major `Property` table with 2- or 3-byte string refs). It never throws; anything
+   unreadable is `null`. Needed because the Function host is Linux — no `msiexec`.
+3. `VersionsMatch(observed, productVersion)` (component-count tolerant: `1.105.103` ==
+   `1.105.103.0`). Mismatch or unreadable → log, record the attempt, next candidate.
+4. Match → write-once upload (If-None-Match:*), then `provenance.json` with
+   `productVersion`, the chosen `url`, `urlFromEvent`, hash/size and the full `candidates`
+   walk (`url`, `outcome` ∈ match / version-mismatch / too-large / download-failed /
+   timeout, `productVersion`).
+
+Outcome precedence when no candidate archived: any transient failure (download/timeout)
+→ `Failed:Download` / `Failed:Timeout`, retryable via the queue's visibility ladder (the
+down host might have had it); every candidate over the cap → `Failed:TooLarge`; otherwise
+`Failed:VersionMismatch` — **not** retryable by the queue (retrying in minutes changes
+nothing), left to the sighting re-queue above. Storage/unexpected errors stay
+`Failed:Error`, retryable. A 409 on the write-once upload means an earlier attempt
+archived the version: the provenance sidecar is healed from the archived bytes (hash,
+size, ProductVersion) if missing — this is also how a manual skill backfill turns a null
+row into `Archived` on the next authoritative sighting.
+
+## Manual path (skill)
+
+`/ime-decompile` downloads from the blob (`ime-blob.sh download`), and
+`fetch-ime-decompile.py` names the decompile folder after the **actual** FileVersion of
+the extracted binaries — so the decompile repo can never be poisoned, only the blob folder.
+When the blob's version mismatches, look for `msiDownloadUrl` in *other* sessions of the
+version (the first-seen session often lacks the enrichment) and fetch from that host.
+`ime-blob.sh upload … --overwrite` replaces a blob known to hold the wrong build; merge the
+row's `MsiSha256` / `MsiBytes` / `MsiSourceUrl` afterwards.
+
+# Examples
+
+* First sighting of 1.105.103.0 with no URL: primary → 1.105.101.0 (mismatch), secondary →
+  1.104.102.0 (mismatch), hotfix → 1.105.103.0 (match) → archived from hotfix, provenance
+  lists all three.
+* Hotfix host down during the walk, others mismatching → `Failed:Download`, queue retries.
+* Version 1.101.111.0 (predates the archiver, row status null): a session whose CSP row
+  matches by ProductVersion arrives → status `Queued`, job runs; if no host serves it any
+  more → `Failed:VersionMismatch`, next try no sooner than 24 h later.
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Services/Ime/ImeMsiArchiver.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/Ime/MsiProductVersionReader.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/Ime/ImeMsiArchiveQueueWorker.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/EventIngestProcessor.cs` (ime_agent_version block)
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Sessions.cs` (`RecordImeVersionAsync`, `UpdateImeVersionArchiveInfoAsync`)
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ImeMsiInstallSourceProbe.cs` (event enrichment)
+* `.claude/commands/scripts/ime-blob.sh`, `.claude/commands/scripts/fetch-ime-decompile.py`
+* Tests: `ImeMsiArchiverTests`, `MsiProductVersionReaderTests` (synthetic packages + local sweep over `ime-files/`)

docs/backend/session-owner-binding.md

@@ -0,0 +1,157 @@
+---
+type: Concept
+title: Session Owner Binding — Session-Level Authorization for Agent Writes
+description: Why tenant-level agent authentication (any device certificate, or a bootstrap token) was enough to rewrite every session in the tenant, how each Sessions row is now bound to the device identity that created it, the rule matrix that keeps every legitimate lifecycle working, the shadow-then-enforce rollout, and why enforcement needs the agent to rotate its session id rather than count an auth failure.
+resource: src/Backend/AutopilotMonitor.Functions/Security/SessionOwnershipPolicy.cs
+tags:
+  - backend
+  - security
+  - authorization
+  - sessions
+  - agent
+  - multi-tenant
+timestamp: 2026-08-29T00:00:00+02:00
+---
+
+# Problem
+
+Agent endpoints authenticate at **tenant** granularity: a chain-valid Intune MDM certificate whose
+tenant stamp matches the request (see [client-cert-tenant-binding.md](client-cert-tenant-binding.md)),
+or a bootstrap token minted for the tenant. They authorize writes at **session** granularity using a
+session id the caller supplies — `IngestTelemetryFunction` takes it from the `PartitionKey` of the
+first item, `RegisterSessionFunction` from the body, `ReportAgentErrorFunction` from the body. Until
+2026-08-29 nothing on the Sessions row recorded which device created it, so nothing could be compared.
+
+The consequence: one enrolled device — or anyone who saw a 6-character bootstrap short code — could,
+for every other session of the tenant, forge `enrollment_complete` / failure events (flipping the live
+status, firing webhooks and SLA logic), pollute the timeline, re-register the session with different
+device metadata (which also redirects the Progress-Portal serial-knowledge proof), and — worst — send a
+Signal-only batch that **fetches and clears the victim's pending ServerActions**, silently stealing
+admin commands such as diagnostics collection. Session ids are GUIDs, but they travel in portal URLs
+and tenant SignalR messages; they were never meant to be a capability.
+
+# Mechanism
+
+## Owner on the row
+
+`SessionOwner` (Shared) is stamped by the backend from the validated caller identity — never from
+agent input — and lives in six primary-only Sessions columns (`OwnerKind`, `OwnerThumbprint`,
+`OwnerDeviceId`, `OwnerBootstrapCode`, `OwnerSerial`, `OwnerBoundAt`). They are listed in
+`SessionIndexFieldManifest.PrimaryOnly`: never mirrored to `SessionsIndex`, never on `SessionSummary`,
+so no certificate identity travels to clients.
+
+| Auth path | Identity that binds | Proven by |
+|---|---|---|
+| Certificate | `OwnerThumbprint` + `OwnerDeviceId` (Intune device id from the certificate CN, lower-case GUID) | TLS handshake; the CN survives a certificate re-issue |
+| Bootstrap token | `OwnerBootstrapCode` + `OwnerSerial` | Token possession + the serial the caller announced (header, unverified) |
+
+`SecurityValidationResult.IntuneDeviceId` is new: the CN was already extracted for the Cloud PC
+validator, now it is surfaced on the result for every certificate-authenticated request.
+
+## Rule matrix
+
+`SessionOwnershipPolicy.Evaluate(existingRow, validation, now)` is pure. It returns an outcome, the
+owner to stamp (if any) and whether the caller's serial equals the row's serial.
+
+| Caller | Row owner | Outcome | Stamps | Would reject |
+|---|---|---|---|---|
+| any | no row | `Fresh` | caller | no |
+| any | no owner columns (legacy), serial equal | `ClaimLegacy` | caller | no |
+| any | no owner columns, serial differs | `LegacySerialMismatch` | — | **yes** |
+| any | — (validation carried neither thumbprint nor code) | `CallerUnidentified` | — | no |
+| Cert | Cert, same thumbprint | `Match` | — | no |
+| Cert | Cert, other thumbprint, same device id | `RebindCertRotation` | caller | no |
+| Cert | Cert, other thumbprint and device id | `MismatchCert` (+ `serialMatch`) | — | **yes** |
+| Cert | Bootstrap, same serial | `RebindBootstrapHandoff` | caller | no |
+| Cert | Bootstrap, other serial | `MismatchBootstrapOwned` | — | **yes** |
+| Bootstrap | Bootstrap, same code + serial | `Match` | — | no |
+| Bootstrap | Bootstrap, otherwise | `MismatchBootstrap` | — | **yes** |
+| Bootstrap | Cert | `DowngradeToBootstrap` | — | **yes** |
+
+The tolerated rows are the legitimate lifecycle: agent restart and reboot (same certificate),
+WhiteGlove Part 2 (same certificate), the install→runtime handoff where a bootstrap-registered session
+continues under the MDM certificate once it exists, a re-issued certificate of the same Intune device,
+and rows that predate the binding.
+
+`MismatchCert` with `serialMatch=true` is the one shape that is *not* an attack: an Intune
+re-enrollment **without a wipe**. `session.id` survives in `%ProgramData%\AutopilotMonitor`, but the
+device gets a new Intune device id and therefore a new certificate identity. Under enforcement this
+would be refused — which is why enforcement needs the agent-side rotation below.
+
+## Where it runs
+
+`SessionOwnerBindingObserver` is the single side-effect carrier; the three call sites hand it the
+row they already hold:
+
+* `RegisterSessionFunction.ProcessRegisterAsync` — the cascade-delete guard now returns the row
+  (`EnsureWritableAndGetRowAsync`); the decision's owner goes into `StoreSessionAsync(registration,
+  ownerToStamp)`, whose Replace preserves an existing owner when nothing new is stamped (including a
+  Merge-stamped owner that landed after the initial read — the CAS re-read selects the owner columns).
+  The bootstrap wrapper inherits this.
+* `IngestTelemetryFunction.Run` — evaluated against `guardSessionRow` (zero extra reads) before
+  `PersistItemsAsync`, so the Signal-only path that serves pending ServerActions is covered. Legacy
+  claims and rebinds are written with `UpdateSessionOwnerAsync` (Merge, fail-soft).
+* `ReportAgentErrorFunction` and its bootstrap wrapper — one point-read, observe only.
+
+## Shadow telemetry (stage 1)
+
+Same three carriers as the cert-tenant binding:
+
+* **Denominator** — `requests | extend o = tostring(customDimensions.SessionOwnerBinding) | where
+  isnotempty(o) | summarize count() by o` (request-row dimension via `RequestTelemetryMiddleware`;
+  worker `LogInformation` never reaches App Insights).
+* **Numerator** — `traces | where message startswith "AgentSessionOwnerBinding"` — one Warning per
+  non-Match/non-Fresh request with `outcome`, `wouldReject`, `callerKind`, `ownerKind`, `serialMatch`,
+  `endpoint`, `ver`.
+* **Operator signal** — ops event `SessionOwnerMismatch` (Security / Warning, dual-registered in the
+  admin alert-rule catalog) for would-reject outcomes, throttled to one per session+outcome per hour.
+  `serialMatch=true` counts re-enrollments without wipe; `serialMatch=false` is a foreign device.
+
+Nothing is refused in stage 1. `SessionOwnershipPolicy` deliberately has no `Rejects` member
+(pinned by `SessionOwnershipPolicyTests.Stage1_has_no_Rejects_rule`).
+
+## Enforcement contract (stage 2, not yet built)
+
+* Backend: `Rejects(outcome)` = the would-reject set; register/ingest/error answer 403 with
+  `RegisterSessionResponse.ErrorCode = Constants.AgentErrorCodes.SessionOwnerMismatch`
+  (`"session_owner_mismatch"`). The code and field already exist so the agent could ship first.
+* Agent (shipped dormant with this change): `BackendApiClient` reads `errorCode` off a JSON 401/403
+  body into `BackendAuthException.ErrorCode`; `SessionRegistrationHelper` reacts to exactly that code
+  by calling `rotateSession` once and re-registering immediately — **without** feeding
+  `AuthFailureTracker` (five consecutive 403s would otherwise soft-shutdown a perfectly authorized
+  agent). `BackendSessionRegistration.RotateSession` rotates `session.id` (keeping
+  `whiteglove.complete`), re-targets `agentConfig.SessionId` and the `EmergencyReporter`, and drops
+  `spool.jsonl` + `upload-cursor.json` because their lines carry the refused partition key. The
+  `agent_started` event then reports `sessionRotated=true` + `previousSessionId`.
+* Registration is the first session-scoped call of every agent start and everything after Phase 6
+  reads `agentConfig.SessionId` live, so a mismatch on ingest can only mean an agent older than the
+  rotation logic or a genuinely foreign caller.
+
+Switch on only after: the shadow distribution has run for weeks, every `wouldReject=true` is
+explained, and the fleet's `X-Agent-Version` is at or above the rotation-capable release. Then add
+`Rejects`, delete the stage-1 pin test, update the trust pages (isolation model) and bump their
+"Last reviewed" date.
+
+# Residual risk (accepted)
+
+* The serial is a caller-supplied header on both paths. A certificate holder who also knows a victim's
+  serial can still claim a **legacy** row, or a **bootstrap-owned** row during its handoff window.
+* One bootstrap token serves many devices; two devices on the same short code can still write into
+  each other's session until the certificate handoff closes it.
+* `SupersedeOrphanedPredecessorsAsync` is keyed on the announced serial and can still resolve foreign
+  open sessions to `Incomplete`. Follow-up: restrict to rows without owner or with the same
+  `OwnerSerial`, and require a minimum age.
+
+None of these are closable without a signature scheme over the request body, which is deliberately
+not built (it would duplicate the TLS proof).
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Security/SessionOwnershipPolicy.cs` — matrix, `WouldRejectUnderEnforcement`, row (de)serialization
+* `src/Backend/AutopilotMonitor.Functions/Services/SessionOwnerBindingObserver.cs` — carriers, throttle, stamping
+* `src/Shared/AutopilotMonitor.Shared/Models/Enrollment/SessionOwner.cs` — column names and kinds
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Sessions.cs` — `StoreSessionAsync(…, ownerToStamp)`, `UpdateSessionOwnerAsync`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Security/SessionRegistrationHelper.cs` — rotation branch
+* `src/Agent/AutopilotMonitor.Agent.V2/Runtime/BackendSessionRegistration.cs` — `RotateSession`
+* Tests: `SessionOwnershipPolicyTests`, `SessionOwnerBindingObserverTests`, `StoreSessionReregistrationPreserveTests`, agent `SessionRegistrationHelperTests`, `BackendSessionRegistrationTests`, `SessionIdPersistenceTests`, `BackendApiClientAuthClassificationTests`
+* Grep marker: `SESSION-OWNER-BINDING`

docs/backend/silent-session-classification.md

@@ -10,7 +10,7 @@ tags:
   - classification
   - whiteglove
   - self-deploying
-timestamp: 2026-08-23T18:00:00+02:00
+timestamp: 2026-08-27T20:00:00+02:00
 ---
 
 # Silent-Session Classification
@@ -30,7 +30,10 @@ so a session gets the same verdict regardless of which path noticed the silence
 subcategory counts (incl. the 30s fallback-confirmed messages), `HasExplicitFailure`,
 `HasEnrollmentComplete` vs. `HasTerminalComplete` (the Part-1 `whiteglove_complete`),
 `HasAgentEmergencyBreak`, `DesktopArrived`, `HelloResolved`, `HelloPolicyDisabled`,
-`SkipUserEsp`, RealmJoin detection/resolution. Session-row flags are passed alongside:
+`SkipUserEsp`, RealmJoin detection/resolution, `HasAppInstallFailure` (any
+`app_install_failed`), and `HasAgentMaxLifetimeTimeout` (either max-lifetime shape:
+`enrollment_failed`/`agent_timeout` or `agent_shutting_down`/`max_lifetime` — the agent is
+provably gone). Session-row flags are passed alongside:
 `IsPreProvisioned` + `ResumedAt` (WhiteGlove Part 2) and `IsSelfDeployingProfile`
 (registry-confirmed `CloudAssignedOobeConfig 0x20|0x40`, set at registration).
 
@@ -44,7 +47,9 @@ subcategory counts (incl. the 30s fallback-confirmed messages), `HasExplicitFail
 | 2 | Account Setup all-succeeded, or `enrollment_complete`, or `whiteglove_complete` on a **non-resumed** session | Succeeded |
 | 3 | `HasAgentEmergencyBreak` | Incomplete immediately (agent self-destructed, nothing can arrive) |
 | 4 | `DesktopArrived` + (Hello terminal, or Hello disabled + SkipUserEsp) | Succeeded (user provably finished) |
-| 5 | Device Setup done | AwaitingUser within grace, Incomplete past grace |
+| 5 | Device Setup done + within grace + **no** max-lifetime watchdog observed | AwaitingUser |
+| 5a | Device Setup done + past grace (or watchdog observed) + `DesktopArrived` + no `app_install_failed` | **Succeeded** — completed (assumed), `r5_assumed` |
+| 5b | Device Setup done, otherwise past grace (or watchdog observed) | Incomplete |
 | 6 | otherwise | Incomplete |
 
 Grace = `ResolveGraceHours(SessionGraceHours, AbsoluteMaxSessionHours)` (~51h default),
@@ -65,7 +70,12 @@ budget on a Wi-Fi link still associating), and rule 5 labeled finished kiosks
 Incomplete turned a working rollout into a red wall. Other self-deploying tenants completed
 normally in the same window, so this is a classification gap, not a profile-wide agent bug.
 Agent-side companion fix: `SessionRegistrationHelper` now waits up to 15s for a network link
-and retries 6× (~62s backoff) instead of 5× (~30s).
+and retries 6× (~62s backoff) instead of 5× (~30s). Measured 2026-08-27 (builds
+2.0.1428/1429, both carrying the fix): the reconcile share did not move, and the backend saw
+no registration attempt from any relaunch — no success, no 4xx, zero `register:superseded`
+in the tenant — so the relaunch never reaches the network at all (device powered off after
+ESP, or the relaunch never runs). The sweep reconcile is the permanent completion path for
+this profile, not a stopgap.
 
 ## Callers (all pass both gate inputs)
 
@@ -78,13 +88,33 @@ and retries 6× (~62s backoff) instead of 5× (~30s).
 | Agent stall probe (`session_stalled`) | `EventIngestProcessor.TryMapStallToWhiteGloveAwaitingUserAsync` | Only the WG gate (1b); a stall probe on a self-deploying device with Device Setup done means the agent is alive and something else blocks — stays Stalled. |
 | Admin retro-reconcile | `LegacyReclassificationService` | Modes `legacy_timeouts`, `pending_orphans`, `self_deploying_silent` (Incomplete/AwaitingUser/Stalled rows with the profile flag, heal-only to Succeeded, admin-marked rows skipped). `POST /api/maintenance/reclassify-legacy?mode=…&dryRun=false&tenantId=…&maxSessions=…`, dry-run by default. |
 
-## Known gap (decided, not built)
+## Why rule 5a exists (calibration read 2026-08-27)
+
+The verdict-calibration matrix showed r5-Incomplete devices re-enrolling at 2.6 % within
+7 days — the succeeded background (`agent:complete_soft` sits at 2.8 %), not the ~29 %
+failure level — consistently across tenants, and half the sampled sessions were healthy
+desktops with a clean app record whose agent died before the Hello terminal (some with the
+agent's own "AccountSetup treated as complete" synthesis as the literally last event). Past
+the full grace, "the user phase is still running" is no longer a possible explanation, so
+desktop + zero `app_install_failed` + no explicit failure now reconciles to Succeeded
+("completed (assumed)") instead of a red Incomplete. Sessions without a desktop (user never
+began sign-in: battery-drained, powered off, max-lifetime) and sessions with any failed app
+stay Incomplete — "completed" must not overclaim. Rule 4 remains the IMMEDIATE reconcile
+(desktop + Hello proof); 5a only fires where waiting is over. Desktop arrival alone is still
+rejected as a live completion signal.
+
+## Closed gap: max-lifetime AwaitingUser (2026-08-27)
 
 After max-lifetime the agent writes `enrollment-complete.marker` and self-destructs, so an
-AwaitingUser verdict from that path can never heal — it is a 51h countdown to Incomplete.
-The emergency-break path (rule 3) already terminalizes immediately; max-lifetime still goes
-through the grace window by design ("user simply absent"). Revisit if customers read
-AwaitingUser as "still possible".
+AwaitingUser verdict from that path could never heal — the calibration correction stream
+confirmed it: all five observed `maxlife:r5_awaiting` episodes expired to Incomplete
+unhealed, while live-agent `sweep:r5_awaiting` parks upgraded 7 of 26 to Succeeded. Rule 5
+therefore skips the grace once `HasAgentMaxLifetimeTimeout` is in the stream and decides the
+terminal fork (5a/5b) immediately; the max-lifetime ingest appends its trigger event to the
+read stream so the fact is never missed, and late straggler telemetry still heals a terminal
+verdict via `TryLateTelemetryReconcileAsync`. WhiteGlove rule 1b deliberately keeps its
+park — sealed/boxed devices do heal (the observed `maxlife:r1b_awaiting` episode resolved to
+Succeeded).
 
 # Examples
 

docs/backend/telemetry-ingest-shaping.md

@@ -0,0 +1,89 @@
+---
+type: Concept
+title: Telemetry Ingest Shaping (App Insights / Log Analytics)
+description: What the backend deliberately keeps out of Application Insights and why - one canonical request record (worker copy, per-item sampling bypass; host HTTP duplicate dropped by a workspace transformation), expected storage outcomes (404/412/409) and successful SignalR REST calls filtered in the worker, and the query rules that follow.
+resource: /src/Backend/AutopilotMonitor.Functions/Telemetry/StorageDependencyFilterProcessor.cs
+tags:
+  - backend
+  - telemetry
+  - application-insights
+  - cost
+timestamp: 2026-08-23
+---
+
+# Telemetry Ingest Shaping
+
+The backend is storage-I/O heavy and runs on the Functions isolated worker, which emits telemetry from TWO processes (host and worker). Left alone, Log Analytics ingestion is dominated by rows nobody reads. This document records what is removed, where, and what that means for queries.
+
+# Schema
+
+## Request telemetry — one canonical record
+
+| Source | Emitted by | Content | Fate |
+|---|---|---|---|
+| Host HTTP request (`Properties.Source` empty, `Url` set) | Functions host process | Name, duration, status — no tenant/user/correlation | **Dropped at ingestion** by the workspace transformation on `AppRequests` (`infra/appinsights-workspace-transforms.bicep`) |
+| Host non-HTTP invocation (`Url` empty) | Functions host process | Timer / queue executions | Kept (the worker middleware never sees them) |
+| Worker request (`Properties.Source == 'WorkerMiddleware'`) | `RequestTelemetryMiddleware` | TenantId, UserId, UserRole, CorrelationId, ClientSource, McpToolName, HttpPath | **Kept, unsampled** — the canonical record |
+
+Why two mechanisms:
+
+* The host request item cannot be suppressed from worker code or from `host.json` (`Host.Results` controls log traces, not the request item; verified 2026-06-09). The only lever is a Log Analytics workspace transformation: `source | where tostring(Properties.Source) == 'WorkerMiddleware' or isempty(Url)`.
+* `host.json` `samplingSettings.excludedTypes: "Request;Event"` only applies to the host process. The worker's `AddApplicationInsightsTelemetryWorkerService` runs its own adaptive sampling; before 2026-08-23 worker request rows carried `ItemCount` 2–5 on weekdays (≈30 % of individual requests missing, `count()` undercounting by the same share — `sum(ItemCount)` matched the host copy to 1.00 per day). Re-configuring the worker sampling chain did not take effect in the isolated worker (see the L4 note in `Program.cs`). The per-item opt-out does: the middleware sets `SamplingPercentage = 100` on its own `RequestTelemetry`, and the SDK sampling processor passes through every item whose sampling percentage is already set.
+
+## Dependency telemetry — keep only signal
+
+`StorageDependencyFilterProcessor` (worker pipeline) drops:
+
+* successful Azure Storage calls (Table/Queue/Blob) in both shapes — the HTTP shape (`Azure table`, target `*.table.core.windows.net`) and the Azure SDK ActivitySource shape (`InProc | Microsoft.Tables`, `InProc | Microsoft.Storage`);
+* storage calls with an **expected outcome**: `404` (point-read miss — EventTypeIndex, BlockedDevices lookups), `412` (ETag precondition), `409` (idempotent insert conflict). HTTP-shape rows carry the code in `ResultCode`; InProc rows only in `Properties["Error"]` (`Status: 404 (`). Before this filter these were 100 % of the remaining "failed" storage rows (~540 MB/week, two rows per call);
+* successful Azure SignalR Service REST calls the worker makes itself (`*.service.signalr.net`).
+
+The bulk of SignalR REST traffic (group add/remove per connection, ~470 MB/week) is emitted by the **host** process for the SignalR output binding (`SDKVersion rdddsc:*`) and never passes the worker pipeline — live-verified after the 2026-08-23 deploy (worker rows: 0, host rows: ~560/h). Those are removed by the second data flow of the same workspace transformation: `AppDependencies | where not(Success == true and Target endswith '.service.signalr.net')`.
+
+Everything else passes: storage 429/5xx/auth/timeouts, failed SignalR calls, all HTTP/Graph/NVD/MSRC dependencies, the worker's own `InProc Invoke` span, and every non-dependency item.
+
+## Measured baseline (7 days before the change, `_BilledSize`, `autopilotmonitor-api-eu`)
+
+| Table | Rows | MB | After |
+|---|---|---|---|
+| AppDependencies | 976k | 1248 | ≈ 240 (SignalR + expected-outcome rows gone) |
+| AppRequests host copy | 274k | 323 | ≈ 0 (only timer/queue rows) |
+| AppRequests worker copy | 189k | 208 | ≈ 300 (now 100 % of requests) |
+| AppTraces | 142k | 137 | unchanged |
+| AppEvents | 6k | 4 | unchanged — not worth touching |
+
+Net ≈ −1.3 GB/week with MORE usable data (every request now has tenant context).
+
+# Examples
+
+Counting requests (exact since 2026-08-23; for older data replace `count()` with `sum(itemCount)`):
+
+```kql
+requests
+| where customDimensions.Source == 'WorkerMiddleware'
+| summarize total=count(), failed=countif(success == false) by name
+```
+
+Real storage trouble only:
+
+```kql
+dependencies
+| where type startswith 'InProc | Microsoft.Tables' or target endswith '.table.core.windows.net'
+| summarize count() by resultCode, tostring(customDimensions.Error)
+```
+
+Post-deploy verification of the per-item sampling bypass (must be `ItemCount == 1` only):
+
+```kql
+AppRequests
+| where TimeGenerated > ago(1h) and tostring(Properties.Source) == 'WorkerMiddleware'
+| summarize rows=count() by ItemCount
+```
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Middleware/RequestTelemetryMiddleware.cs` — `SamplingPercentage = 100` before `TrackRequest`.
+* `src/Backend/AutopilotMonitor.Functions/Telemetry/StorageDependencyFilterProcessor.cs` + `StorageDependencyFilterProcessorTests.cs` — the filter contract.
+* `src/Backend/AutopilotMonitor.Functions/Program.cs` — the failed L4 worker-sampling attempt and why it must not be retried.
+* `infra/appinsights-workspace-transforms.bicep` — the AppRequests transformation DCR, apply/verify/rollback commands.
+* `.claude/commands/backend-logs.md`, `session-debug.md` — query conventions.

docs/backend/tenant-activation-welcome-mail.md

@@ -58,6 +58,24 @@ The Global-Admin resend endpoint (`POST /api/preview/send-welcome-email/{tenantI
 always sends (explicit intent) and consumes the marker best-effort so the automatic
 paths never duplicate afterwards.
 
+## Finding the tenant behind an address
+
+The provider's delivery log names only the recipient — never the tenant it belonged to. The
+reverse lookup is therefore part of the tenant console: its search matches `tenantId`,
+`domainName`, `ContactEmail` **and** the notification address. No other address is searchable
+(an admin UPN never receives platform mail and would only widen the PII surface of the list).
+
+The addresses live in a different table than the tenant configs the list is built from, so the
+console loads them as a map from `GET /api/preview/notification-emails` (GA + read-only Global
+Reader, `excludeDelegated`) — one cross-partition scan of `RowKey eq 'notification-email'`
+instead of a point read per tenant. Keys are lowercased on both sides of the join: the address
+rows are written from the JWT `tid` (lowercase) while a config PartitionKey's casing is not
+guaranteed. Stored addresses keep the casing the user typed, so matching is case-insensitive.
+
+The map is **best-effort** in the portal: it powers only the search-by-address, so a failed read
+degrades that one capability instead of taking the tenant list down. The addresses are not
+rendered in the list — they are a search key, and stay visible in the tenant editor.
+
 ## Mail transport
 
 Both transactional mails (welcome, post-offboarding farewell) go through the
@@ -89,6 +107,13 @@ properties `Html`, `UpdatedBy`, `UpdatedUtc`), cached 5 minutes, invalidated on
 
 * The only placeholder is `{{domainName}}`; an empty domain renders as "your organization",
   matching the built-ins. Subjects are not editable (pinned constants).
+* The domain is HTML-encoded at the point of substitution (`EmailTemplateService.Render` and the
+  built-in template builders) — the mail goes out under the product's signed sender to a
+  tenant-chosen recipient, so no writer of `DomainName` may ever inject markup into it.
+  `DomainName` itself is tenant identity: seeded once at first login from the UPN domain
+  (`AuthFunction`, only when it passes `TenantConfigValidation.IsValidDomainName` — a strict
+  dotted host name), preserved from the stored row on the full-model config PUT for every
+  caller, and "never writable" in the field-patch flow.
 * Limit 30 000 characters (Table string property cap is 32K UTF-16 chars).
 * The send path is fail-soft: a storage error falls back to the built-in body. The admin
   read path is not — a broken store surfaces as an error instead of silently showing the
@@ -118,3 +143,4 @@ properties `Html`, `UpdatedBy`, `UpdatedUtc`), cached 5 minutes, invalidated on
 * `src/Backend/AutopilotMonitor.Functions/Services/EmailTemplateService.cs` — override resolution, placeholder rendering, cache
 * `src/Backend/AutopilotMonitor.Functions/Functions/Admin/EmailTemplatesFunction.cs` — GA endpoints (read / override / reset / test send)
 * `src/Web/autopilot-monitor-web/app/admin/settings/sections/SectionEmailTemplates.tsx` — portal editor, preview frame, test send
+* `src/Web/autopilot-monitor-web/app/admin/components/tenantSearch.ts` — the console's match rules (searchable fields, quoted exact mode, lowercased join)

docs/backend/verdict-calibration.md

@@ -9,7 +9,7 @@ tags:
   - classifier
   - calibration
   - regression-radar
-timestamp: 2026-08-23T18:00:00+02:00
+timestamp: 2026-08-27T20:00:00+02:00
 ---
 
 # Verdict Calibration (classifier thermometer)
@@ -114,15 +114,18 @@ and is wiped with the tenant on offboarding.
 ## Drift radar — `VerdictCalibrationRadar`
 
 Same statistics as the [rule regression radar](rule-regression-radar.md) (7-day window vs the
-prior 28 days, ≥ 5 window hits, ≥ 20 window sessions, lift ≥ 2, `MetricsMath.
-RateIncreaseSeparated`), anchored on yesterday, over every partition with rows (each tenant
-and `global`):
+prior 28 days, ≥ 20 window sessions, lift ≥ 2, `MetricsMath.RateIncreaseSeparated`), with
+stricter floors since the first-month tuning (2026-08-27): **≥ 10 window hits** (verdict
+shares on single-digit counts are noise — a 3-hit episode survived as such), and a per-path
+share regression additionally needs **≥ 5 baseline hits** — a path with no established
+baseline is new (or renamed) vocabulary, not a regression. Anchored on yesterday, over every
+partition with rows (each tenant and `global`):
 
 | Kind | Signal | Re-arm |
 | --- | --- | --- |
-| `share_regression` | one **backend-decided** path's share of all sessions doubled (`sweep`/`maxlife`/`late`/`retro`/`rule`/`manual`/`ingest`; `agent:*` and `register:*` mirror customer workflow mix — first prod pass fired on `agent:whiteglove_pending` rollout weeks — and `legacy:*` is derived, all excluded) | share < 1.5× baseline, the path stops occurring, or the path is no longer eligible |
-| `silence_share_regression` | the `sweep:*` + `maxlife:*` share doubled — the backend had to decide more often because the agent went silent (a liveness signal, not a classifier one) | same |
-| `evidence_gap` | absolute: `r6` (pure fallthrough) decides ≥ 20 % of the window's classifier verdicts, ≥ 20 verdicts | < 15 % or < 20 verdicts |
+| `share_regression` | one **backend-decided** path's share of all sessions doubled (`sweep`/`maxlife`/`late`/`retro`/`rule`/`manual`/`ingest`; `agent:*` and `register:*` mirror customer workflow mix — first prod pass fired on `agent:whiteglove_pending` rollout weeks — and `legacy:*` is derived, all excluded per-path) | share < 1.5× baseline, the path stops occurring, the path is no longer eligible, or the current numbers fall below the fire floors |
+| `silence_share_regression` | the `sweep:*` + `maxlife:*` share doubled — the backend had to decide more often because the agent went silent (a liveness signal, not a classifier one). Rule-shaped `legacy:*` paths count into BOTH sums (window and baseline): they were the same backend decisions before the 2026-08-23 instrumentation, and without that continuity the group had a near-zero baseline by construction and fired a lift-124 rollout artifact | share < 1.5× baseline or hits stop |
+| `evidence_gap` | absolute: `r6` (pure fallthrough) decides ≥ 20 % of the window's classifier verdicts (stamped rule paths plus rule-shaped `legacy:*`, same continuity), ≥ 20 verdicts | < 15 % or < 20 verdicts |
 
 Episodes are tracker rows `verdictcalibration|{kind}|{path}|{status}` (register = `AddEntity`,
 409 = already burning, fail-closed; refresh carries `FirstNotifiedAt`; 30-day tracker
@@ -140,6 +143,15 @@ Kill switch `VerdictCalibrationRadarDisabled`.
   re-enrollment within 7 days after Succeeded 8.9 % (lab background), after Failed 24.3 %,
   after Incomplete 10.6 % — Incomplete behaves like Succeeded, so rules 5/6 are probably too
   cautious; the matrix now shows this per rule instead of per status.
+* **First real calibration read (2026-08-27, four days instrumented):** the per-rule and
+  per-tenant split resolved that hand analysis — `legacy:r5_incomplete` re-enrolled at 2.6 %
+  (the `agent:complete_soft` background), spread across tenants, while `legacy:r6`'s 29 %
+  was concentrated in one tenant that disciplinedly redoes failed enrollments (48.5 % there,
+  6.7 % elsewhere — so r6 stays untouched, it correctly flags that tenant). Consequences
+  shipped the same day: rule 5a "completed (assumed)" (see
+  [Silent-Session Classification](silent-session-classification.md)), the max-lifetime grace
+  skip, and the radar floors + legacy group continuity above — the first production month
+  had produced nine standing alerts, every one an instrumentation-rollout artifact.
 * **Correction stream:** a session swept to `sweep:r5_incomplete`, later completed by the
   agent → row `agent:complete` with `PriorVerdictPath = sweep:r5_incomplete`; the aggregate
   increments `OverriddenByLateCompletion` on the `sweep:r5_incomplete / Incomplete` bucket.

docs/backend/vulnerability-correlation-sources.md

@@ -0,0 +1,160 @@
+---
+type: Concept
+title: Vulnerability Correlation Sources (NVD, KEV, MSRC, EPSS)
+description: How the software inventory is turned into CVE findings - CPE mapping, the per-CPE NVD cache with its budget and TTLs, KEV/MSRC/EPSS enrichment, the throttle contract that keeps a refused NVD answer out of the cache, and the act/attend/track priority.
+resource: src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/VulnerabilityCorrelationService.cs
+tags:
+  - backend
+  - vulnerability
+  - nvd
+  - epss
+  - kev
+  - msrc
+  - cache
+timestamp: 2026-08-29T18:00:00+02:00
+---
+
+# Vulnerability Correlation Sources
+
+The Software Inventory & Vulnerability Analyzer (tenant opt-in) ships the installed-software
+list with the session; the backend turns it into CVE findings entirely from cached public
+reference data. Four sources, all trustworthy primaries, no aggregators:
+
+| Source | What it contributes | Fetch shape | Cache |
+| --- | --- | --- | --- |
+| NVD 2.0 (NIST) | CVE records per product: CVSS v3.1 (v3.0 fallback) score, severity, **vector**, description, affected version ranges; CPE dictionary for auto-mapping | `cves/2.0?virtualMatchString={cpe}` per product, `cpes/2.0?keywordSearch=` for unmapped titles; optional API key (`AdminConfiguration.NvdApiKey`) | Azure Table `VulnerabilityCache`, one row per CPE (`cve_{cpe}` / `cache_result`), `CveDataJson` chunked; soft TTL 7 d (serve + background refresh), hard 14 d |
+| CISA KEV | "Exploited in the wild" flag, due date, required action, ransomware use | Whole catalog JSON | In-memory dictionary, 24 h, blob mirror `kev-catalog.json` |
+| MSRC | Microsoft-side confirmation: document id/title, release date, Microsoft severity / score / vector | CVRF v3.0 index of the last six Patch Tuesdays | In-memory index, blob mirror `msrc-index.json` |
+| FIRST EPSS | Probability (0..1) that the CVE is exploited within 30 days + percentile + scoring date | `api.first.org/data/v1/epss?cve=a,b,c` - 100 ids per request, unauthenticated | Stored **on the cached CVE** (no separate table): filled when a CPE row is (re)fetched, re-scored for every row by the nightly sync |
+
+Nothing about a tenant leaves the backend. The one outbound query that carries content is the
+EPSS lookup, and its payload is the list of public CVE ids held in the shared, tenant-agnostic
+CPE cache. Customer-facing wording: `autopilotmonitor-docs/trust/data-flows.md` and the
+terms page attribution block.
+
+# Schema
+
+## Cached CVE (`CachedCve`, serialised into `CveDataJson`)
+
+```
+CveId, CvssScore, CvssSeverity, CvssVector?, Description (<=500), PublishedDate,
+EpssScore?, EpssPercentile?, EpssDate?, AffectedVersions[] {Criteria, VersionStart/End Incl/Excl}
+```
+
+`JsonOptions` is `WhenWritingNull` + case-insensitive, so rows written before the vector / EPSS
+properties existed deserialise with those as `null`, and a row is never rewritten just to add
+nulls. `CveCacheBudget` bounds the row (24 months, or CVSS >= 7 within 60 months; max 100 CVEs
+per CPE, 50 ranges per CVE) - which is also why one CPE fill is exactly one EPSS request.
+
+`ProjectNvdResponse` is the single NVD -> `CachedCve` projection; the live fill and the nightly
+refresh both call it, so both write the same shape. `BuildCveCacheRow(cpe, cves, cachedAt)` is the
+single row builder; `cachedAt` is the **NVD** freshness stamp, an EPSS-only rewrite passes the
+existing value through so it does not look like a fresh NVD fetch to the 7-day TTL.
+
+## Per-finding output (report `findings[].vulnerabilities[]`)
+
+```
+cveId, cvssScore, cvssSeverity, cvssVector?, description, publishedDate, source ("NVD" | "NVD+MSRC"),
+isKev, kevDueDate, kevRequiredAction, knownRansomware,
+epssScore?, epssPercentile?, epssDate?,
+priority ("act" | "attend" | "track"),
+msrc* (when MSRC confirmed), versionMatchConfidence ("low" on wildcard CPE matches)
+```
+
+Finding level: `riskLevel` (unchanged CVSS+KEV bands), `priority` (highest band), `maxEpssScore?`.
+`scan_summary` additionally carries `act_cves` / `attend_cves`. `MergeReports` (Part 1 + Part 2)
+recomputes all of these. The `CveIndex` row (one per tenant/CVE/session) carries `EpssScore`
+(max over occurrences, absent when unscored) and `Priority` (highest), which the fleet summary
+(`TopCve.epssScore` / `priority`) reads.
+
+## Priority (`CvePriority.Compute`)
+
+* `act` - in CISA KEV.
+* `attend` - EPSS >= 0.1 **or** CVSS >= 9.0.
+* `track` - everything else.
+
+Three visible rules instead of a weighted composite: severity (`riskLevel`) keeps saying how bad,
+priority says how soon. A CVE without an EPSS score is "unknown likelihood" - it can still reach
+`attend` via CVSS, never via a defaulted 0. The thresholds are constants; changing them is a
+product decision, not a tuning knob.
+
+# Throttle contract (NVD)
+
+The typed `HttpClient` runs under the `ExternalDataApi` Polly policy: 429/5xx/timeouts are retried
+three times (1/2/4 s + jitter) with a circuit breaker. A 429 that reaches `NvdApiClient` therefore
+means NVD is refusing us for real. Two things then happen, and one deliberately does not:
+
+1. `NvdFetchResult<T>` reports `Succeeded = false`, `Throttled = true`. `Data` is an empty object
+   so enumerating callers keep working, but **nothing that persists may treat it as an answer**:
+   the CPE cache fill returns null and writes no row; the negative auto-resolve cache is not
+   touched; the admin auto-resolve reports `nvd_throttled`. Before this contract an empty response
+   was cached as "0 CVEs" for seven days - a product NVD happened to throttle disappeared from
+   every report for a week.
+2. A process-wide cooldown opens: `Retry-After` when present (delta or date, capped at 120 s),
+   otherwise 30 s. During the cooldown every NVD call fails fast with `Throttled` - no wait, no
+   retry chain. Worst case added latency per cooldown window is one Polly chain (~7.5 s), never
+   a per-item stall; the nightly refresh breaks out of its loop on the first throttled answer and
+   reports the remainder as `cveSkippedThrottled`.
+3. Not done on purpose: no in-process retry beyond Polly, no VulnCheck-style mirror, no separate
+   "throttled" cache state. Hard-expired cache rows keep serving while NVD is unavailable
+   (better than nothing, logged); a product with no row at all is reported without CVE data for
+   that run and gets a real attempt on the next correlation.
+
+# Nightly sync (`VulnerabilityDataSync`, 03:00 UTC) and the manual buttons
+
+1. KEV catalog refresh (blob mirror updated).
+2. MSRC index refresh (last six Patch Tuesdays).
+3. NVD refresh of cache rows older than 7 days (sequential, breaks on throttle).
+4. **EPSS re-score of every `cve_*` row** - all ids batched through FIRST, only rows whose score /
+   percentile / date changed are rewritten (with their original `CachedAt`). A missing id in the
+   response keeps yesterday's score: a failed batch never erases data.
+
+Steps 3 and 4 live in `VulnerabilityCacheRefreshService` (singleton, one in-flight slot per walk),
+which the timer and the Global-Admin buttons share, so a manual run writes exactly what the nightly
+run writes. Four endpoints, one per source, each with its own "Last … Sync" line on the admin page
+(`GET vulnerability/sync-status`):
+
+| Button | Endpoint | Shape | Timestamp |
+| --- | --- | --- | --- |
+| Sync KEV | `POST vulnerability/sync` | synchronous | `VulnerabilityDataLastSyncUtc` |
+| Sync MSRC | `POST vulnerability/sync-msrc` | synchronous | `MsrcLastSyncUtc` |
+| Refresh NVD Cache | `POST vulnerability/sync-nvd` | **202 + background** (minutes, NVD-rate-limited); 409 while running; the page polls `nvdRefreshRunning` / `nvdLastRun` every 10 s | `NvdCacheLastRefreshUtc` - stamped only for a walk that reached every stale row (no throttle cut-off) |
+| Sync EPSS | `POST vulnerability/sync-epss` | synchronous (seconds); 409 while running | `EpssLastSyncUtc` |
+
+The timer skips a walk whose slot a manual run currently holds (`cveSkippedBusy` in telemetry)
+rather than queueing a duplicate. `nvdLastRun` / `epssLastRun` are in-memory on the answering
+instance (null after a cold start); the persisted timestamps are the durable signal.
+
+Telemetry event `VulnerabilityDataSyncCompleted` carries `epssRows / epssCves / epssScored /
+epssRowsRewritten / epssError` next to the KEV / MSRC / CVE counters; the manual EPSS run emits
+`ManualEpssSyncCompleted`.
+
+# Examples
+
+* Chrome 126 finding: `CVE-2024-4947` CVSS 8.8 HIGH, `AV:N/AC:L/PR:N/UI:R`, KEV yes -> `priority =
+  act`, riskLevel `critical` (KEV) - unchanged severity semantics, priority now explicit.
+* A 5.5 MEDIUM local-privilege CVE with EPSS 0.31 -> `attend`; the same CVE with EPSS 0.004 ->
+  `track`. Same severity band, different order of work.
+* Nightly sync while NVD throttles: `[VulnSync] NVD throttled - leaving 37 stale entries for the
+  next run`, then `[VulnSync] EPSS refresh: 1412/1450 CVEs scored across 212 rows, 180 rows
+  rewritten` - EPSS is independent of NVD's mood.
+
+# Not done (recorded)
+
+* **ExploitDB CSV** as a "public exploit exists" flag (static file, daily, same shape as the KEV
+  mirror) - useful, cheap, deliberately not added: four primary sources are enough for now and
+  each additional outbound dependency is a trust-page line. Revisit if customers ask "is there a
+  public exploit?".
+* GitHub / Nuclei PoC search, composite 0-100 risk scores, CWE -> ATT&CK mapping - noise for an
+  Intune admin, not adopted.
+
+# Citations
+
+* `src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/NvdApiClient.cs` - `NvdFetchResult`, cooldown, `ComputeCooldown`
+* `src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/EpssApiClient.cs` - batching, `ParseResponse`
+* `src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/CvePriority.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/Vulnerability/VulnerabilityCorrelationService.cs` - `ProjectNvdResponse`, `ApplyEpssScores`, `BuildCveCacheRow`, `StampFindingPriority`, `FetchAndCacheCvesFromNvdAsync`
+* `src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/VulnerabilityDataSyncFunction.cs` - `RefreshStaleCveCacheAsync`, `RefreshEpssScoresAsync`
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.AgentApi.cs` - `BuildCveIndexEntities`, `ScanCveIndexAsync`
+* `src/Backend/AutopilotMonitor.Functions.Tests/EpssAndNvdThrottleTests.cs`
+* FIRST EPSS API: https://api.first.org/epss/ - CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

docs/index.md

@@ -25,6 +25,7 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Gather Rule Debug Log](agent/gather-rule-debug-log.md) - EnableGatherRuleDebugLog (ConfigVersion 36): the per-tenant local trace file that explains every gather-rule evaluation decision — scope skips, on_change suppression, empty collector results, logparser position/parse-mode outcomes — for rules that produce no timeline events.
 * [MDM Reboot Coalescing](agent/mdm-reboot-coalescing.md) - Attributing the mid-ESP coalesced reboot ("second sign-in") to the device-assigned policy URIs that forced it: aggregated DM-Enterprise 2800 observations (neutral, flush-time watermark) + the ANALYZE-ESP-005 advisory gated on an actually-observed reboot.
 * [ESP Completion Starvation — the sits-d Cloud-PC complex](agent/post-reboot-completion-recovery.md) - Why a SkipUser=true flow (no user ESP page → no Shell-Core 62407, no AccountSetup registry) left the completion gate satisfied but never evaluated — five Cloud PCs idled six hours at "waiting on: hello_resolution" — and the fix: the observed skip stands in for the final-exit evidence in the IME user-session completion attempt. Plus the two adjacent defects fixed alongside: the edge-only user-apps-settled synthesis (now level-triggered) and the never-wired Shell-Core restart replay (now Hello-wizard-only, with the reasoning why a replayed 62407 must never reach the reducer).
+* [Zero User-Targeted Apps — the starved user-phase completion gate](agent/zero-user-apps-completion-gate.md) - Why a device with no user-targeted Intune apps could never satisfy the IME user-session gate — IME skips its "Completed user session" line entirely in the zero-app branch — turning the 30-minute completion backstop into `esp_exit_without_completion_evidence` on a third of one tenant's enrollments, with the user at the desktop and RealmJoin still installing. The two fixes: read the line IME does write (IME-USER-SESSION-ZERO-APPS), and never fail a session while a completion gate with its own armed deadline is deliberately holding it.
 * [Secure Boot CA-2023 Detection](agent/secureboot-ca2023-detection.md) - Why ANALYZE-SEC-001 v3 reads the UEFI db/KEK variables directly instead of trusting the SecureBoot\Servicing registry, and how the one-sided uefiCa2023FirmwareConfirmed marker plus a not_exists precondition give absence-tolerant suppression across old and new agents.
 * [Continue-Anyway Observation Mode](agent/continue-anyway-observation.md) - EnableEspContinueAnywayObservation (ConfigVersion 37, operator-set): Device-phase ESP terminal failures on Continue-Anyway profiles get a bounded 60-min observation instead of an immediate hard fail; the DAD-validated real-user desktop + Hello gate detect the true end, the session completes Succeeded + EspSoftFailure (amber "with issues" badge), expiry un-defangs to the original esp_terminal_failure.
 * [CMTrace Time Resolution](agent/cmtrace-time-resolution.md) - Converting bias-less CMTrace local times to UTC without trusting any process's timezone belief: per-line self-anchoring on the 15-minute offset grid for provably fresh lines, uniform marked reader-zone fallback for backlog, and the provenance vocabulary (bias / line-anchored / reader-zone-fallback) that keeps every event re-derivable.
@@ -34,6 +35,7 @@ https://docs.autopilotmonitor.com (separate repository).
 * [System Timeline Watcher](agent/system-timeline-watcher.md) - Ground truth for two timeline blind spots from one System-channel EventLogWatcher with pre-agent backfill: system_clock_changed (Kernel-General 1 — oldTime/newTime/signed timeDeltaMs/reason/setting process; 2 s micro-slew floor, ≥5 min Warning+immediate) and system_sleep_episode (Power-Troubleshooter 1 sleep/hibernate + Kernel-Power 507 Modern Standby; authoritative enteredAt/exitedAt payload instants, 60 s Modern-Standby floor). Consumed by the TimeJumpBadge clock-set cause, the SessionInfoCard standby note, time-attribution SleepSpans (AttributionVersion 3) and ANALYZE-DEV-012.
 * [DO GroupId Auto-Set](agent/do-group-id-auto-set.md) - EnableDoGroupIdAutoSet (ConfigVersion 40): the agent seeds the Delivery Optimization DOGroupId policy with a deterministic network-fingerprint GUID (default gateway IPv4 + SendARP MAC, RealmJoin-compatible byte layout) so same-network devices form one DO peering group during ESP; ownership-tracked via the StartupEventGate fingerprint, foreign DOGroupId/DOGroupIdSource policies always win, no random-GUID fallback.
 * [ESP Policy-Provider Stall Detection](agent/esp-policy-provider-stall.md) - The EnrollmentStatusTracking CSP's no-timeout Setup/Apps wait is keyed to the Intune-registered "Sidecar" provider by NAME: co-management's "ConfigMgr" parks the user ESP at "Apps (Identifying)" for days even with TrackingPoliciesCreated=1 (issue #106); the always-on two-arm esp_policy_provider_stalled tripwire (provider_incomplete | sidecar_provider_missing) and the SOFTWARE\Microsoft\Windows\Autopilot gather-rule allowlist entry that surface it.
+* [WiFi SSID and the Windows 24H2 Location Gate](agent/wifi-ssid-location-gate.md) - Why wifi_signal_info vanished on Windows 11 24H2+: WlanQueryInterface(wlan_intf_opcode_current_connection) is gated behind precise-location consent, the prompt only fires in a user context outside System32, and SYSTEM in session 0 falls back to the device-level ConsentStore value - so netsh (same gate) could never cover for it. The tiered WifiInfoProvider (native, then ungated WinRT GetConnectedSsid, then netsh), SSID-only semantics on tier 2, and the Warning-level rc=5 diagnostic that names the gate.
 
 # Rules
 
@@ -45,6 +47,7 @@ https://docs.autopilotmonitor.com (separate repository).
 
 # Backend
 
+* [Telemetry Ingest Shaping](backend/telemetry-ingest-shaping.md) - One canonical App Insights request record (worker copy with tenant context, per-item sampling bypass; host HTTP duplicate dropped by a workspace transformation DCR), expected storage outcomes 404/412/409 and successful SignalR REST calls filtered in the worker, and the count()/sum(itemCount) query rules that follow.
 * [Table Schema Sentinel](backend/table-schema-sentinel.md) - Startup no longer issues one CreateTableIfNotExists per table: a SHA-256 over TableNames.All in AdminConfiguration gates the full pass (derived, never hand-maintained), the SessionsIndex backfill runs only after a full pass behind a conditional-insert claim, and daily maintenance repairs out-of-band deletions.
 * [Business Timestamps](backend/business-timestamps.md) - Why the Azure Tables system Timestamp is never authoritative (migrations reset it), and the OccurredUtc + RowKey-decode compensation for AuditLogs/OpsEvents/Events after the 2026-07-18 migration.
 * [Send-Time Frame Separation](backend/send-time-frame-separation.md) - One device-clock send timestamp per upload batch (X-Send-Time-Utc → SentAt on Events) splits ReceivedAt − OccurredUtc into pure spool delay and pure device-vs-server clock offset; the clock_skew condition measures SentAt batches directly (spool-immune), the CMTrace tripwire deliberately stays on its differential math.
@@ -56,6 +59,7 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Rule Regression Radar](backend/rule-regression-radar.md) - How analyze-rule hit-rate regressions are detected (7-day window ≥2× the 28-day baseline with disjoint Wilson intervals), which suppressions keep the radar quiet (grace period, edit-in-window, kill switch), how alert episodes live in the ruleregression tracker keyspace with re-arm semantics, and the on-fire dimension correlation with its "correlated, not necessarily causal" wording contract.
 * [Verdict Calibration](backend/verdict-calibration.md) - How every session status write declares its VerdictPath (origin:detail vocabulary incl. classifier rule ids), how overriding a verdict preserves PriorStatus/PriorVerdictPath as the correction stream, the daily per-path calibration aggregate with the 7-day re-enrollment proxy and read-side legacy derivation, the GA endpoint / MCP tool / admin matrix, and the drift radar (share, silence-share, r6 evidence gap) with its operator-only ops events.
 * [App Version Duration Regression Radar](backend/app-version-regression-radar.md) - How app versions whose median install duration regressed vs. the previous version are detected (first-seen-ordered versions, median lift ≥2× plus a 5-minute absolute floor over measured installs only), how alert episodes live in the appversionregression tracker keyspace with drain/median re-arm semantics, and the bell/ops-event/analytics surfaces.
+* [Session Owner Binding](backend/session-owner-binding.md) - Agent endpoints authenticate per tenant but write per caller-supplied session id; each Sessions row is now bound to the device identity that created it (cert thumbprint + Intune device id from the CN, or bootstrap code + serial), the rule matrix that keeps restart / WhiteGlove Part 2 / bootstrap→cert handoff / cert re-issue working, the shadow telemetry (`SessionOwnerBinding` request dimension, `AgentSessionOwnerBinding` warning, `SessionOwnerMismatch` ops event), and the enforcement contract where a 403 `session_owner_mismatch` makes the agent rotate its session id instead of counting an auth failure.
 * [Plan Downgrade Policy & the Retention Grace Period](backend/plan-downgrade-retention-grace.md) - What happens when a tenant loses Pro: every entitlement gates read-time and reversibly ("gate, don't destroy"), except retention — a 30-day grace keeps the Pro cap before the Community cap starts hard-deleting; the ProDowngradedUtc/trial-expiry anchor model, the TenantPlanDowngraded/RetentionGrace* ops events, and the deliberate non-grace of everything else.
 * [Tenant Activation & the Once-Only Welcome Mail](backend/tenant-activation-welcome-mail.md) - How a signup becomes an activated tenant (manual approve or the auto-approve queue), and the write-then-read + conditional-marker arbitration that sends the welcome mail exactly once even though activation and the user-typed notification address race each other.
 * [W365 Cloud PC Device Validation](backend/cloudpc-device-validation.md) - Why Cloud PCs can never pass the Autopilot serial lookup, and the cert-CN-bound CloudPc fallback validator: Subject CN (= Intune device id) matched against the tenant's Graph virtualEndpoint/cloudPCs inventory — admits exactly the service-provisioned Cloud PCs, nothing else.
@@ -65,6 +69,7 @@ https://docs.autopilotmonitor.com (separate repository).
 
 # MCP Server
 
+* [MCP Protocol Eras & Client ID Metadata Documents](mcp/protocol-eras-and-cimd.md) - One per-request factory serving the 2026-07-28 stateless revision (server/discover, ttlMs/cacheScope, Mcp-Method routing) and 2025-era initialize clients side by side, why the legacy leg stays a hand-wired JSON+gzip transport, the never-public cache-hint contract, and the CIMD client-registration path (SSRF-gated document fetch, same redirect allowlist) next to the deprecated dynamic registration.
 * [MCP Docs Corpus](mcp/docs-corpus.md) - How the published customer documentation becomes the `search_docs` corpus: CRLF-safe heading chunking, build-time embedding as a third precomputed section, and why a docs edit needs an MCP redeploy.
 * [MCP Tool Telemetry](mcp/tool-telemetry.md) - The three telemetry layers for judging tool quality: backend App Insights via X-MCP-Tool-Name, the per-user usage table, and the MCP_TOOL_LOGGING stderr lines (soft errors, result size vs. cap, zero-hit searches, Zod rejections).
 
@@ -75,6 +80,10 @@ https://docs.autopilotmonitor.com (separate repository).
 # Security & Identity
 
 * [MCP OAuth Flow](mcp-oauth-flow.md) - Who authenticates where when connecting an AI client to the MCP server; two identities, three parties plus Entra ID.
+* [Vulnerability Correlation Sources](backend/vulnerability-correlation-sources.md) - How the software inventory becomes CVE findings from four cached primaries (NVD per-CPE cache with budget and TTLs, CISA KEV, MSRC, FIRST EPSS stored on the cached CVE and re-scored nightly), the NVD throttle contract (a refused answer is never cached as "0 CVEs"; bounded process-wide cooldown honouring Retry-After), the persisted CVSS vector, and the act/attend/track priority that keeps severity and likelihood as two visible signals instead of one composite score.
+* [Client-Certificate Tenant Binding](backend/client-cert-tenant-binding.md) - Why a chain-valid Intune MDM certificate only proves "issued to some tenant", which extension actually carries the Entra tenant id (`…5.14`) versus the two that look like it (`…5.6` Intune Account id, `…5.4` device id, different encodings), why the Entra join certificate is not part of the auth path, the shadow-then-enforce rollout with its volume-controlled telemetry, and why `X-ARR-ClientCert` is the only certificate transport (TLS handshake = proof of possession; bootstrap routes token-only, fail-closed).
+* [Admin Identity Binding](backend/admin-identity-binding.md) - Why a GlobalAdmins / DelegatedAdmins row keyed on a UPN string must never confer access by itself in an API that accepts tokens from every Entra tenant (domain re-registration, UPN recycling), the AdminIdentityBindings table pinning each cross-tenant-role UPN to its immutable home tid + oid, the fail-closed resolution order in both role services (row → binding → entitlement), the first-sign-in object-id pin with its race semantics, the 409 on grant-time conflicts, and the explicit GET/PUT/DELETE rebind surface.
+* [IME Installer Archive](backend/ime-msi-archive.md) - How every fleet-observed IME build is archived as its MSI: the ime_agent_version sighting that queues the job (first sighting, or a later sighting with a version-authoritative CSP URL after a 24 h backoff), the primary/secondary/hotfix candidate walk, the managed MSI ProductVersion check that keeps another ring's build out of the version folder (Failed:VersionMismatch), provenance with the full candidate walk, and the skill-side overwrite path for corrections.
 
 # Conventions for this bundle
 

docs/log.md

@@ -1,7 +1,97 @@
 # Log
 
+## 2026-08-29 (10)
+
+* **Update**: `backend/tenant-activation-welcome-mail.md` — welcome/farewell mails HTML-encode the domain at substitution; `DomainName` is frozen on the full-model config PUT (was persisted verbatim) and the first-login seed only accepts a strict DNS host name.
+
+## 2026-08-29 (9)
+
+* **Update**: `agent/decision-engine.md`, `agent/overview.md` — `SignalIngress.Post` is worker-thread re-entrancy-safe: signals the worker posts to itself from inside `ApplyStep` (EffectRunner `ClassifierVerdictIssued`) go to a worker-local follow-up queue drained ahead of the bounded channel instead of blocking on it, so a full channel can no longer deadlock the single consumer.
+
+## 2026-08-29 (8)
+
+* **Creation**: Added `backend/session-owner-binding.md` — SESSION-OWNER-BINDING stage 1 (shadow): Sessions rows carry the creating device identity (`OwnerKind/OwnerThumbprint/OwnerDeviceId/OwnerBootstrapCode/OwnerSerial/OwnerBoundAt`, primary-only), `SessionOwnershipPolicy` evaluates every register / telemetry / error-report request against it, outcomes ride on the request row (`SessionOwnerBinding`), warnings and a throttled `SessionOwnerMismatch` ops event; nothing is refused yet. Agent ships the dormant counterpart: `errorCode` parsing on 401/403, one-shot session rotation on `session_owner_mismatch` without feeding the auth-failure tracker, spool drop, `agent_started.sessionRotated`.
+
+## 2026-08-29 (7)
+
+* **Update**: `backend/client-cert-tenant-binding.md` — new "Certificate transport and proof of possession" section: `X-ARR-ClientCert` (platform-set after the mTLS handshake, inbound copies stripped even on excluded paths) is the only certificate source; the client-writable `X-Client-Certificate` fallback is gone; `/api/bootstrap/*` routes are token-only and fail closed on a missing/empty token or unwired token service instead of falling through to the certificate stage.
+
+## 2026-08-29 (6)
+
+* **Update**: `backend/admin-identity-binding.md` — grants are self-maintaining: `AdminIdentityResolver` derives the home tenant + object id from sign-in history (`UserActivity`), falls back to the UPN domain of an onboarded tenant, refuses to guess when a UPN was seen under two tenants; 422 `HomeTenantUnresolved` + portal tenant picker only for a never-seen domain. Identity fields and pills removed from the delegated / tenant-group forms; inspect/correct lives in Tenant Management → Edit Tenant Configuration → Identity bindings (collapsed).
+
+## 2026-08-29 (5)
+
+* **Creation**: Added `backend/admin-identity-binding.md` — cross-tenant roles (GlobalAdmin / GlobalReader, delegated MSP) were resolved from the UPN string alone while the API accepts tokens from every Entra tenant. New `AdminIdentityBindings` table (RK = UPN → home `TenantId` + `ObjectId`), `AdminIdentity` (upn + tid + oid) as the key both role services resolve on, binding checked after the row and before the Pro gate, object id pinned on the first sign-in from the bound tenant (ETag-guarded), grants require `homeTenantId` and refuse to re-home (409), `global/identity-bindings` GET/PUT/DELETE as the audited rebind path, `RequestContext.ObjectId`, throttle bucket keyed on oid. Legacy rows are inert until bound — seed bindings before the backend deploy.
+
+## 2026-08-29 (4)
+
+* **Creation**: Added `backend/ime-msi-archive.md` — the version-verified, multi-host IME installer archive: MsiProductVersionReader (managed CFB/MSI Property reader), candidate host walk, Failed:VersionMismatch, sighting re-queue with 24 h backoff, and the 2026-08-29 1.105.103.0 poisoning that motivated it.
+
+## 2026-08-29 (3)
+
+* **Update**: `backend/vulnerability-correlation-sources.md` - the admin page's Data Sync Status is complete: next to Sync KEV / Sync MSRC there are now Refresh NVD Cache and Sync EPSS, each with its own last-sync line (`NvdCacheLastRefreshUtc`, `EpssLastSyncUtc` on AdminConfiguration; shared manifest regenerated). The NVD and EPSS walks moved out of the timer into `VulnerabilityCacheRefreshService` (singleton, one in-flight slot per walk) so the button and the nightly run are literally the same code; the NVD walk is minutes long and rate-limited, so `POST vulnerability/sync-nvd` answers 202 and the page polls `sync-status` (`nvdRefreshRunning`, `nvdLastRun`) while it runs, `sync-epss` runs synchronously. 409 while a walk is in flight; the timer skips a slot a manual run holds. Operator-only surface - no customer docs.
+
+## 2026-08-29 (2)
+
+* **New**: `backend/vulnerability-correlation-sources.md` - FIRST EPSS joins NVD / CISA KEV / MSRC as the fourth vulnerability source: the probability + percentile + date live on the cached CVE (one batch of <= 100 ids per CPE fill, every `cve_*` row re-scored by the nightly sync, only changed rows rewritten and with their original `CachedAt`), the CVSS vector is persisted instead of dropped, and each CVE carries an act / attend / track priority (KEV; EPSS >= 0.1 or CVSS >= 9.0; rest) next to the unchanged severity bands - two visible signals, no composite score. The comparison with an open-source CVE MCP server surfaced the real 429 defect: Polly already retried, but a refused NVD answer came back as an empty response and was cached as "0 CVEs" for seven days. `NvdFetchResult` now separates "answered" from "refused" (nothing persists a refusal - CPE cache, negative auto-resolve cache, admin auto-resolve), and a 429 opens a process-wide cooldown (`Retry-After` capped at 120 s, else 30 s) so the run fails fast instead of paying a retry chain per software item; hard-expired rows keep serving meanwhile. NVD -> cache projection and the row builder are now single functions shared by the live fill and the sync. CveIndex / fleet summary carry `epssScore` + `priority`; portal shows EPSS pill, priority pill, vector; MCP tool descriptions and the CVE-audit prompt name the fields. ExploitDB recorded as a deliberate not-now. Backend before web; trust pages (terms attribution, privacy, data-flows), settings and portal-guide docs updated in the same change.
+
+## 2026-08-29
+
+* **New**: `mcp/protocol-eras-and-cimd.md` - the MCP server moved to the 2026-07-28 protocol revision (TypeScript SDK v2: `@modelcontextprotocol/server` + `/node`, zod 4; the monolithic `@modelcontextprotocol/sdk` is gone). One per-request factory (`mcp-server-factory.ts`) feeds both eras through `mcp-http.ts`: 2026 clients are served by the SDK entry (`createMcpHandler`, `legacy: 'reject'`, JSON response mode), 2025 clients keep the existing stateless transport with `enableJsonResponse` - routed on the SDK's own `isLegacyRequest` predicate, because the built-in stateless fallback would answer today's Claude/VS Code clients with SSE and lose the gzip win. Capabilities now declare `listChanged: false` (the SDK default advertised a notification a per-request server cannot send); `cacheHints` stamp `ttlMs`/`cacheScope: 'private'` on discover/list results (5 min) and resource reads (60 min) - never public, the catalog is role-dependent. Client registration: `client_id_metadata_document_supported: true`; an https `client_id` is a Client ID Metadata Document resolved by `cimd.ts` (SSRF gate on the resolved addresses before any request, no redirects, 5 s / 16 KB, exact `client_id` match, bounded `redirect_uris`, 10-60 min cache), the requested redirect_uri still has to pass the dynamic-registration allowlist; HMAC-signed DCR client_ids stay as the fallback. `mcp-oauth-flow.md` updated. Package version 1.5 -> 1.6. Pinned by `mcp-http.test.ts` (real v2 client over loopback HTTP, both eras, role parity), `cimd.test.ts`, `oauth-cimd.test.ts`.
+
+## 2026-08-28
+
+* **Update**: `CmTraceSkewTripwire` - the backend regression tripwire additionally requires >= 80 % of the individual IME deltas (relative to the other side's median) to sit within 2 min of some 15-minute grid multiple before `CmTraceTimeSkewRegression` fires; the ops event and its details now carry that fraction. Motivation: the first soak week produced 7 fires, all backlog replays - a relaunched agent re-tailing the IME log uploads one burst holding most of the session's IME samples with a continuum of ages whose median hit the grid by chance (session d832560a: 508 of 627 samples, 46...733 min, median 91). Era-mixing regressions (every line on the grid) still fire. Doc: `docs/agent/cmtrace-time-resolution.md`.
+
+## 2026-08-27 (2)
+
+* **Update**: `SecurityValidator` / `DeviceAssociationValidator` - Microsoft released Windows Autopilot device association on 2026-08-25 (learn.microsoft.com/autopilot/device-preparation/device-association/overview: TPM-backed UEFI marker, device-targeted device preparation policies, associated devices are marked corporate-owned by Intune with no corporate identifier upload). The DevPrep association lookup therefore leaves shadow mode and becomes the third accepting method of the device-validation gate, evaluated inline after the Autopilot and Corporate Identifier lookups and before the Cloud PC fallback; a match sets `ValidatedBy = DeviceAssociation`, a miss joins the combined 403 detail, a transient failure the 503 Retry-After - the same contract as its siblings, so enabling it can only widen acceptance, never reject a device the other methods would have taken. `ValidateDeviceAssociation` counts toward "at least one validation enabled" and is no longer GA-only anywhere (`UpdateTenantConfigurationFunction` revert, `TenantConfigPatchService.GaOnlyFields`, the Global-Admin gate on the settings toggle); the toggle sits under Device Preparation next to Corporate Identifier and follows the shared consent rule (first serial-based validation carries the consent, any further one is a plain persisted toggle). Known gap carried over from the shadow phase: the `/beta/deviceManagement/tenantAssociatedDevices` endpoint is still undocumented in Graph reference and every production lookup so far answered `matched=False` for Autopilot v1 devices, i.e. the positive match path is unproven in the field - first associated enrollment must be checked for `ValidatedBy = DeviceAssociation` on the session row. Landing hero carries a release pill linking to the customer docs; dashboard tip added. Backend before web; customer docs updated in `autopilotmonitor-docs`.
+
+## 2026-08-27
+
+* **Update**: `backend/silent-session-classification.md`, `backend/verdict-calibration.md` - the first real calibration read tuned what it measures. Rule 5 grew a past-grace fork 5a: Device Setup done + real-user desktop + zero `app_install_failed` reconciles to Succeeded "completed (assumed)" (`r5_assumed`) - r5-Incomplete devices re-enrolled at 2.6 %, the succeeded background, and the sampled desktop half had clean app records; no desktop or any failed app stays Incomplete. The max-lifetime watchdog (either event shape) now skips the AwaitingUser grace entirely - all five observed maxlife parks expired unhealed, and late telemetry heals a terminal verdict anyway - while WhiteGlove rule 1b keeps its park (its one episode healed). The drift radar got floors (≥ 10 window hits; per-path share regression needs ≥ 5 baseline hits, so new/renamed vocabulary cannot "regress") and legacy continuity: rule-shaped `legacy:*` paths count into the silence and classifier-verdict group sums on both sides of the 2026-08-23 cutover, which dissolves the lift-124 silence artifact and lets sub-floor episodes clear themselves. Backend only; the new path shows up in the matrix on its own.
+
+* **Update**: `backend/tenant-activation-welcome-mail.md` - the reverse lookup. A delivery log names only the recipient, so an address had to lead back to its tenant: the tenant console's search now matches the notification and contact address as well as domain and tenant id, with the quoted exact mode unchanged. The addresses sit in `PreviewWhitelist`, not on the tenant config, so a new GA/Reader-only `GET /api/preview/notification-emails` returns them as one map (single cross-partition scan of `RowKey eq 'notification-email'`) instead of a point read per tenant; both sides join on the lowercased tenant id because the address rows carry the JWT `tid` while a config PartitionKey's casing is not guaranteed, and matching is case-insensitive because stored addresses keep the casing the user typed. The map is best-effort in the portal - a failed read costs only the search-by-address, never the tenant list - and the addresses stay out of the list rows (search key, not a column). Match rules moved into `tenantSearch.ts` with unit pins. Backend before web.
+
+
+## 2026-08-26
+
+* **Update**: `agent/wifi-ssid-location-gate.md` - the network timeline now explains its blank signal too, with no agent change: `buildSegments` already merges `wifi_signal_info` into the covering WiFi segment, so `wifiDataLimitedReason` rides in with the sample. Segments that never got a sample (a mid-session reconnect emits none) inherit it - the gate is a device-level setting and cannot flip mid-enrollment - while a segment with a real reading is never overwritten. Tooltip shows `Signal: unavailable - Location services off on this device`; the "Avg WiFi signal" stat reads `n/a (Location services off)` instead of vanishing. `network_state_change` is deliberately left alone: it has never carried `signalPercent` or `radioType` (only `before_/after_wifiSsid` reaches its payload), so there is no absent field there for a reason to explain, and the SSID it does carry is unaffected by the gate. Web-only change.
+
+
+## 2026-08-26
+
+* **Update**: `agent/wifi-ssid-location-gate.md` - the gate is now surfaced instead of only logged. When the WinRT tier wins and the native tier reported `rc=5`, `wifi_signal_info` carries `wifiDataLimitedReason = "location_services_off"` and the message gains `- signal unavailable, Location services off`, so the reason is readable straight from the timeline; the portal WiFi card (`DeviceDetailsCard`) matches that literal and names the Intune setting that restores the full payload. The claim is evidence-only - any other native failure leaves the field null rather than blaming a privacy setting, with `IsLocationGateDenied` pinned at its boundaries. New `wifi_signal_info` group in the MCP `DEVICE_PROPERTIES_CATALOG` so a fleet can be sized via `search_sessions` before any policy changes. Agent release + web deploy + MCP redeploy; backend untouched (the payload is opaque DataJson).
+
+
+## 2026-08-26
+
+* **New**: `agent/wifi-ssid-location-gate.md` - `wifi_signal_info` was missing on most Windows 11 24H2+ WiFi enrollments (build 22631 3/3, 26100 37/178, 26200 43/95 over n=276 sessions from 08-01). Not a parser or language problem: every event that exists carries a full SSID, so the failure is binary at the reader. Cause is the 24H2 location gate on `WlanQueryInterface` with `wlan_intf_opcode_current_connection` - the only opcode the agent uses - which returns `ERROR_ACCESS_DENIED`; the consent prompt only fires for a process in the user context outside `System32`, so the agent (SYSTEM, session 0, pre-privacy-page) is denied silently, and it resolves consent from the HKLM ConsentStore because the `S-1-5-18` hive has none - while the interactive user on the same box reads the SSID fine via the per-user NonPackaged value. `netsh wlan` hangs off the same gate, so the 2026-07 netsh fallback (and its multi-language labels) never covered the case it was built for; more labels cannot fix it. New `WinRtWifiSsidReader` uses the documented replacement `WlanConnectionProfileDetails.GetConnectedSsid` (ungated, SSID only), bound via the CLR WinRT projection with no winmd/NuGet like `OobeStateReader`; new `WifiInfoProvider` owns the tier order (native, WinRT, netsh) that both collectors had duplicated. The step diagnostics added in 2026-07 were logged at `Debug` while the default level is `Info`, so they never reached a field log - the all-tiers-failed case is now a Warning that decodes `rc=5` into the location-gate explanation. Agent-only change; needs an agent release.
+
+
+## 2026-08-25
+
+* **Update**: `backend/client-cert-tenant-binding.md` — stage 2 enforced: `Mismatch` now returns 403 via `LogRequestRejection(stage=certtenant)`. Switched on against 35,684 requests / 32 tenants at 100 % `Match`, with the Warning channel verified to be carrying other traffic so the zero was not an artefact. The rule is one function (`CertTenantBinding.Rejects`) and only `Mismatch` blocks; `ExtensionMissing` / `Unparseable` / `RequestTenantNotAGuid` are tolerated on purpose (the first is the candidate for later tightening and has a test pinning the tolerance). Evaluation fails open on its own exception, and the 403 body does not echo the certificate's tenant. Device binding (stage 3) stays shadow + Global-Admin-only and is unaffected.
+
+## 2026-08-25
+
+* **New**: `agent/zero-user-apps-completion-gate.md` — a Classic enrollment whose user has zero targeted Intune Win32 apps could not produce the evidence any user-phase completion path required: IME's zero-app branch (`ApplicationPoller`, verified against decompiled 1.104.102.0 and three older builds) `continue`s before its `Completed user session` statement, so `ImeUserSessionCompletedUtc` stayed null, all four arms of `ShouldTransitionToAwaitingHello` were dead, and the 30-min `advisory_completion` backstop resolved the session as `esp_exit_without_completion_evidence` — with a DAD-validated desktop, Hello provisioned and RealmJoin still installing. One tenant: 10 of 30 enrollments in a week, all false positives. Two fixes. (1) New pattern `IME-USER-SESSION-ZERO-APPS` reads the line IME *does* write and routes it through the same `OnUserSessionCompleted` callback, guarded to the AccountSetup phase and replayed if the observation predates the phase marker; `AreUserEspAppsSettled` now accepts an empty app list only with that explicit observation. (2) `HandleAdvisoryCompletionDeadlineFired` re-arms instead of failing while the RealmJoin gate is closed and its own deadline is still armed — session 75d6ae8e installed 25 RealmJoin packages inside the window, the last 2 min before the failure. `ime_user_session_completed` gains an `evidence` field (`zero_user_apps_enumerated` / `user_session_completed`); no new event type. The pattern reaches existing agents via the config API (an unknown action is a Debug line), the behaviour needs an agent release.
+
+## 2026-08-24
+
+* **Change**: `DeviceAssociationValidator` / `SecurityValidator` — the DevPrep association shadow now logs one line per real Graph lookup instead of one per request (`DeviceAssociationResult.ServedFromCache`, `AsCacheHit()` copies rather than marking the shared cached instance), the same gate the cert-device-binding shadow uses. Measured: one enrollment produced 263 identical lines off a handful of calls. Status of that preview, for the record: the `/beta/deviceManagement/tenantAssociatedDevices` endpoint answers (6 calls, all HTTP 200, `transient=False`), but every result so far is `matched=False` from a single Autopilot **v1** device — which is the correct answer for a device that was never part of a Device Preparation policy. The matching itself is therefore still unproven, and the endpoint remains undocumented in both v1.0 and beta Graph reference, so it is not a basis for enforcement.
+
+* **Update**: `backend/client-cert-tenant-binding.md` — stage 3 verified live (`ea6a375`, gktatooine): 136 requests, all `Match`, device object ~72 s older than the session start, so no enrollment race in that run. Measured Graph cost: **1 call for 136 requests** (30 min positive cache), versus 25 for the per-request Autopilot validator — the positive TTL needs no change. The shadow log is now gated on `ServedFromCache` (one line per real lookup instead of per request); never-cached outcomes still log every time.
+
+* **Update**: `backend/client-cert-tenant-binding.md` — stage 3, the cert-to-device binding: new `IntuneDeviceBindingValidator` resolves the Subject-CN managedDevice id against the tenant's own `deviceManagement/managedDevices` (point-GET, no filter literal), modelled on `CloudPcDeviceValidator` and wired fire-and-forget like the DevPrep shadow so a cold Graph round-trip never enters the agent request path. New GA-only tenant toggle `ValidateIntuneDeviceBinding` (shadow — never touches `deviceValidated`), new optional Graph feature `IntuneDeviceBinding` → `DeviceManagementManagedDevices.Read.All` in `GraphFeatureCatalog` + the customer grant script, and `enrolledAgeSeconds` on every log line so the enrollment race can be measured before this could ever become a gate. Grep marker: `CERT-DEVICE-BINDING-SHADOW`.
+
+* **Update**: `backend/client-cert-tenant-binding.md` — shadow telemetry moved off the dead `LogInformation` path: the `Match` outcome now rides on the request row as the `CertTenantBinding` dimension (`SecurityValidator` → `FunctionContext.Items` → `RequestTelemetryMiddleware`), which is unsampled and already exists per request, so the denominator costs nothing. Non-Match outcomes keep their Warning trace. Post-deploy verification of 249e39bc found zero rows across 32k requests — worker `LogInformation` never reaches App Insights (provider default rule Warning+), making "everything matched" indistinguishable from "never ran". `CertificateValidationResult.FromCache` removed with the sampling path it existed for.
+* **New**: `backend/client-cert-tenant-binding.md` — the agent's mTLS certificate chains to Microsoft's shared Intune roots, so certificate validation alone never proved tenant membership; tenant scoping rested entirely on the (non-secret) device serial in the downstream validators. The Intune MDM leaf carries the Entra tenant id in OID `1.2.840.113556.5.14` (nested OCTET STRING), which is NOT `…5.6` (Intune Account id, a different GUID) and NOT `…5.4` (device id, stored as 16 bare bytes) — all decoded by one shared `MsDeviceCertificateOids.TryParseGuid` now used by agent and backend. Stage 1 ships as shadow only: `CertTenantBinding.Evaluate` (pure) plus `SecurityValidator.ObserveCertTenantBinding` (returns void, swallows its own exceptions, cannot change an authorization outcome), with `Match` sampled via `CertificateValidationResult.FromCache` so the denominator survives without per-request volume. Grep marker for the stage-2 enforcement change: `CERT-TENANT-BINDING-SHADOW`.
+
 ## 2026-08-23
 
+* **New**: `backend/telemetry-ingest-shaping.md` — `RequestTelemetryMiddleware` sets `SamplingPercentage=100` on its own item (worker request rows were adaptively sampled, ItemCount 2–5 on weekdays, despite host.json `excludedTypes`), the redundant host HTTP request copy is dropped by a workspace transformation DCR (`infra/appinsights-workspace-transforms.bicep`, timer/queue rows kept), and `StorageDependencyFilterProcessor` now also drops expected storage outcomes (404/412/409, both InProc and HTTP shapes) and successful SignalR REST calls; the host-emitted SignalR binding calls (bulk of the volume, SDK `rdddsc`) are dropped by a second `AppDependencies` flow in the same DCR. Measured ≈ −1.3 GB/week.
 * **Update**: `backend/table-schema-sentinel.md` — "Measuring it": `StartupTelemetryService` emits `BackendStartupMs` (process start → ApplicationStarted) and `BackendTableInitMs` as App Insights custom metrics with version/commit/fullPass dimensions; the MCP server writes one `{"type":"boot","readyMs"}` stderr line per start (query in `.claude/commands/mcp-telemetry.md` §A2).
 * **New**: `backend/table-schema-sentinel.md` — startup table initialization gated by a schema sentinel (SHA-256 over `TableNames.All` in `AdminConfiguration`/`SchemaSentinel`/`tables`): matching sentinel ⇒ zero `CreateTableIfNotExists` calls on a cold start, missing/stale ⇒ one full pass + sentinel rewrite. SessionsIndex startup backfill only after a full pass, `IsSessionIndexEmptyAsync` no longer treats errors as "empty", conditional-insert claim so one scaled-out instance backfills. Daily maintenance runs `IStorageInitializer.EnsureAllAsync` to repair out-of-band table deletions.
 * **Update**: `backend/verdict-calibration.md` — MCP `get_verdict_calibration` response shaping: per-row trend denominators dropped, explicit nulls, `minSharePct` / `top` with an `omitted` report.

docs/mcp-oauth-flow.md

@@ -8,7 +8,7 @@ tags:
   - oauth
   - entra-id
   - security
-timestamp: 2026-07-11T10:59:31+02:00
+timestamp: 2026-08-29T08:45:00+02:00
 ---
 
 # MCP OAuth Flow — Who Authenticates Where
@@ -41,9 +41,12 @@ The two identities never mix:
    in the vendor's backend, not on the user's machine.
 2. **MCP server** (Container App) — acts as a stateless **OAuth proxy /
    authorization-server façade** in front of Entra ID. It is *not* an IdP:
-   it registers clients dynamically (RFC 7591, HMAC-signed stateless
-   `client_id`), enforces the redirect-URI allowlist and PKCE, and exchanges
-   codes at Entra using its confidential client secret.
+   it establishes the client's identity statelessly — a Client ID Metadata
+   Document (MCP spec 2026-07-28: the `client_id` is an HTTPS URL the server
+   fetches and validates) or, for older clients, dynamic registration
+   (RFC 7591, HMAC-signed stateless `client_id`) — enforces the redirect-URI
+   allowlist and PKCE, and exchanges codes at Entra using its confidential
+   client secret. See [Protocol Eras & CIMD](mcp/protocol-eras-and-cimd.md).
 3. **Entra ID** — the real identity provider. This is where `adm.luke` lives.
 
 ## Full sequence
@@ -54,9 +57,10 @@ Claude Desktop        Browser (user's           MCP server              Entra ID
      │                      │                        │                      │
  1.  │─ POST /mcp ──────────┼───────────────────────▶│ 401 + WWW-Auth       │
  2.  │─ Discovery ──────────┼───────────────────────▶│ RFC 9728/8414 docs   │
- 3.  │─ POST /oauth/register┼───────────────────────▶│ client_id (HMAC-     │
-     │                      │                        │ signed, embeds the   │
-     │                      │                        │ registered callback) │
+ 3.  │─ client identity ────┼───────────────────────▶│ CIMD: client_id is a │
+     │   (CIMD, or legacy   │                        │ URL, doc fetched at  │
+     │    POST /oauth/      │                        │ /authorize; DCR:     │
+     │    register)         │                        │ HMAC-signed client_id│
      │                      │                        │                      │
  4.  │─ opens browser ─────▶│─ GET /oauth/authorize ▶│─ 302 to Entra ──────▶│
      │                      │  (PKCE challenge)      │  app-reg client_id,  │

docs/mcp/protocol-eras-and-cimd.md

@@ -0,0 +1,129 @@
+---
+type: Concept
+title: MCP Protocol Eras & Client ID Metadata Documents
+description: How the MCP server serves the 2026-07-28 stateless revision and 2025-era clients from one per-request factory, why the legacy leg is hand-wired (JSON + gzip), the cache-hint and capability contract, and the CIMD client-registration path next to the deprecated dynamic registration.
+resource: /src/McpServer/autopilot-monitor-mcp/src/mcp-http.ts
+tags:
+  - mcp
+  - protocol
+  - oauth
+  - cimd
+  - security
+timestamp: 2026-08-29T08:40:00+02:00
+---
+
+# MCP Protocol Eras & Client ID Metadata Documents
+
+**Status:** Concept · **Owner:** MCP Server · **Code:** [`mcp-http.ts`](../../src/McpServer/autopilot-monitor-mcp/src/mcp-http.ts), [`mcp-server-factory.ts`](../../src/McpServer/autopilot-monitor-mcp/src/mcp-server-factory.ts), [`cimd.ts`](../../src/McpServer/autopilot-monitor-mcp/src/cimd.ts), [`oauth.ts`](../../src/McpServer/autopilot-monitor-mcp/src/oauth.ts)
+
+# Schema
+
+## The two eras
+
+MCP revision **2026-07-28** turned the protocol into a stateless request/response
+protocol: no `initialize` handshake, no `Mcp-Session-Id`, every request carries its
+protocol version, client identity and capabilities in `_meta`, capabilities and
+instructions are fetched with `server/discover`, list results carry `ttlMs` /
+`cacheScope`, and `Mcp-Method` / `Mcp-Name` HTTP headers let gateways route without
+parsing bodies. Roots, Sampling, Logging and the HTTP+SSE transport are deprecated
+(twelve-month window); Dynamic Client Registration is deprecated in favour of Client
+ID Metadata Documents.
+
+The server was already stateless by design (scale-to-zero Container App, no
+server→client traffic), so the revision cost no architecture — only wiring:
+
+| Concern | 2026-07-28 ("modern") | 2025-era ("legacy") |
+| --- | --- | --- |
+| Routing decision | `isLegacyRequest()` from the SDK — the exact classifier `createMcpHandler` uses internally | same predicate, inverse |
+| Serving | `createMcpHandler(factory, { legacy: 'reject', responseMode: 'json' })` via `toNodeHandler` | fresh `NodeStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true })` per POST |
+| Response shape | single `application/json` body | single `application/json` body |
+| Instructions | `server/discover` result | `initialize` result |
+| Cache fields | `ttlMs` + `cacheScope` stamped by the SDK from `cacheHints` | none (2025 codec has no cache path) |
+
+Both legs are fed by **one** factory (`createServerForCaller`), so the tool catalog,
+resource set, prompts and instructions can never drift between eras — the
+`mcp-http.test.ts` suite pins that a Global Admin and a plain tenant user see the
+same catalog on either path.
+
+## Why the legacy leg is hand-wired
+
+`createMcpHandler`'s built-in `legacy: 'stateless'` fallback constructs its transport
+with only `sessionIdGenerator: undefined`, i.e. it answers every 2025 client with an
+SSE frame. Every production client today (Claude Code, Claude.ai, VS Code) is a 2025
+client, and their large tool results are gzipped by the compression middleware only
+because the response is a plain JSON body (measured 5–30×). Routing on the SDK's own
+predicate in user land keeps that behaviour while still running the 2026 path through
+the SDK entry unchanged — no re-implementation of the classification, no second
+catalog.
+
+## Capability and cache contract
+
+* `capabilities` are declared explicitly with `listChanged: false` for tools,
+  resources and prompts. The SDK's default (`?? true`) would advertise a
+  notification a per-request server can never emit.
+* `cacheHints`: `server/discover`, `tools/list`, `prompts/list`, `resources/list`,
+  `resources/templates/list` → `{ ttlMs: 300_000, cacheScope: 'private' }`;
+  `resources/read` → `{ ttlMs: 3_600_000, cacheScope: 'private' }`. **Never
+  `public`**: the catalog and the instructions are role-dependent (Global Admin /
+  Global Reader / delegated MSP / tenant user), so a shared cache would leak one
+  caller's surface to another. Five minutes is the bound on how long a role change
+  can go unnoticed by a caching client; resources are static per deployment.
+* No Roots / Sampling / Logging / elicitation / subscriptions are used anywhere, so
+  nothing on the deprecation list has to be migrated.
+
+## Client registration: CIMD first, DCR as fallback
+
+The authorization-server metadata now advertises
+`client_id_metadata_document_supported: true` next to the (deprecated)
+`registration_endpoint`. Clients following the spec's priority order use a
+**Client ID Metadata Document**: their `client_id` *is* an HTTPS URL that serves a
+JSON document (`client_id`, `client_name`, `redirect_uris`, …). `oauth.ts` resolves
+every `client_id` through one helper: an HTTPS URL goes to `cimd.ts`, anything else
+must be one of our HMAC-signed dynamic-registration tokens. Both yield the same shape
+(`redirectUris`), and the rest of the authorize/callback logic is unchanged.
+
+What the document decides — and what it does not:
+
+* It only asserts **which** redirect URIs the client claims. The requested
+  `redirect_uri` must still pass the host/path allowlist that gates dynamic
+  registration (`isAllowedRedirectUri`), checked *before* the document is fetched. A
+  self-hosted document cannot widen the destinations an authorization code may be
+  sent to. Loopback remains allowed for every client (RFC 8252 §7.3);
+  `application_type: "native"` is informational.
+* Fetching a caller-chosen URL is an SSRF surface, so the fetch is: HTTPS only, path
+  component required, no fragment/userinfo, no loopback or IP-literal host, every
+  resolved address must be public (RFC 1918/4193/3927/6598, CGNAT, multicast,
+  IPv4-mapped all refused — checked before any request leaves), `redirect: 'error'`,
+  5 s budget, 16 KB body cap (declared *and* streamed), JSON media type required.
+  Nothing from the response reaches the caller beyond an OAuth error code.
+* The document's `client_id` must equal the URL by simple string comparison — no
+  normalization, per the draft. `redirect_uris` is bounded exactly like a dynamic
+  registration (`oauth-limits.ts`). A missing `client_name` falls back to the host:
+  it only ever reaches a log line, and failing a login over a label would be wrong.
+* Cache: positive entries live for the document's `Cache-Control: max-age`, clamped
+  to 10–60 min so the `/oauth/callback` re-check within the 10-min signed-state
+  window is a cache hit on the same replica; rejections are cached for 60 s; the map
+  is bounded to 256 entries.
+
+RFC 9207 `iss` (already emitted since 2026-07-29) completes the authorization side
+of the 2026-07-28 revision.
+
+# Examples
+
+* A 2026 client: `POST /mcp` with `_meta["io.modelcontextprotocol/protocolVersion"] = "2026-07-28"`
+  and `Mcp-Method: tools/list` → `{ tools: [...], ttlMs: 300000, cacheScope: "private", _meta: { "io.modelcontextprotocol/serverInfo": { name: "Autopilot-Monitor", version: "1.6.<build>" } } }`.
+* A 2025 client: `POST /mcp` `initialize` → `application/json` body with
+  `protocolVersion: "2025-11-25"` and the role-tailored `instructions`; no
+  `Mcp-Session-Id` header.
+* `GET /oauth/authorize?client_id=https://app.example.test/oauth/client.json&redirect_uri=http://127.0.0.1:49152/callback&code_challenge=…` →
+  document fetched (or served from cache) → 302 to Entra. `client_id=https://10.0.0.8/x` → `400 invalid_client`
+  without any outbound request.
+
+# Citations
+
+* MCP spec 2026-07-28 — https://blog.modelcontextprotocol.io/posts/2026-07-28/ ; authorization / client registration:
+  https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration
+* TypeScript SDK v2 (`@modelcontextprotocol/server` 2.0.0) — `createMcpHandler`, `isLegacyRequest`, `cacheHints`.
+* draft-ietf-oauth-client-id-metadata-document-00 §6 (security considerations, SSRF).
+* Tests: `src/__tests__/mcp-http.test.ts`, `src/__tests__/cimd.test.ts`, `src/__tests__/oauth-cimd.test.ts`.
+* Related: [MCP OAuth Flow](../mcp-oauth-flow.md), [MCP Docs Corpus](docs-corpus.md).

infra/appinsights-workspace-transforms.bicep

@@ -0,0 +1,78 @@
+// Autopilot-Monitor — Log Analytics workspace transformation (ingestion-time filter)
+//
+// Two ingestion-time filters. (2) Successful Azure SignalR REST dependencies emitted by the
+// HOST process for the SignalR output binding (SDKVersion rdddsc:*) — the worker-side
+// StorageDependencyFilterProcessor never sees those. Failed SignalR calls are kept.
+// (1) Drops the redundant HOST-side HTTP request record from AppRequests so that exactly one
+// canonical request row remains: the worker-side copy emitted by RequestTelemetryMiddleware
+// (Properties.Source == 'WorkerMiddleware', carries TenantId/UserId/CorrelationId and is
+// sampling-exempt per item). Non-HTTP host invocations (timer/queue triggers) have an empty
+// Url and are kept — the worker middleware never sees them.
+//
+// Why ingestion-time: the host request item is emitted by the Functions host process and
+// cannot be suppressed from worker code or host.json (verified 2026-06-09, see Program.cs).
+// Live numbers 2026-08-23 (7d): host copy 274k rows / 323 MB, worker copy 189k rows / 208 MB.
+//
+// Cost note: transformation filtering is free up to 50% of the table's incoming volume; the
+// portion beyond that (here ~11% of AppRequests) is billed at the (cheap) data-processing rate.
+//
+// Apply (two steps; the link is a CLI update = GET+PUT, which keeps retention/SKU intact):
+//   az deployment group create -g rg-autopilotmonitor-prd-gwc \
+//     --template-file infra/appinsights-workspace-transforms.bicep \
+//     --query properties.outputs.dcrId.value -o tsv
+//   az monitor log-analytics workspace update -g rg-autopilotmonitor-prd-gwc -n AutopilotMonitor \
+//     --data-collection-rule <dcrId-from-above>
+//
+// Verify after ~20 min (ingestion latency):
+//   AppRequests | where TimeGenerated > ago(15m) | where AppRoleName == 'autopilotmonitor-api-eu'
+//   | summarize rows=count() by source=tostring(Properties.Source), hasUrl=isnotempty(Url)
+//   → only (WorkerMiddleware, true) and ('', false) buckets remain.
+//
+// Rollback: az monitor log-analytics workspace update -g <rg> -n AutopilotMonitor
+//   --set properties.defaultDataCollectionRuleResourceId=null   (then delete the DCR)
+
+@description('Log Analytics workspace that backs the workspace-based Application Insights resources.')
+param workspaceName string = 'AutopilotMonitor'
+
+param location string = resourceGroup().location
+
+resource workspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' existing = {
+  name: workspaceName
+}
+
+resource transforms 'Microsoft.Insights/dataCollectionRules@2023-03-11' = {
+  name: 'dcr-autopilotmonitor-ws-transforms'
+  location: location
+  kind: 'WorkspaceTransforms'
+  properties: {
+    description: 'AppRequests: keep the enriched worker request record (Properties.Source == WorkerMiddleware) and non-HTTP host invocations (empty Url); drop the host HTTP duplicate.'
+    destinations: {
+      logAnalytics: [
+        {
+          workspaceResourceId: workspace.id
+          name: 'ws'
+        }
+      ]
+    }
+    dataFlows: [
+      {
+        streams: [ 'Microsoft-Table-AppRequests' ]
+        destinations: [ 'ws' ]
+        transformKql: 'source | where tostring(Properties.Source) == \'WorkerMiddleware\' or isempty(Url)'
+      }
+      {
+        // Successful Azure SignalR REST calls (group add/remove per connection) are emitted by
+        // the HOST process for the SignalR output binding (SDKVersion rdddsc:*), so the worker's
+        // StorageDependencyFilterProcessor never sees them. Failed SignalR calls are kept.
+        streams: [ 'Microsoft-Table-AppDependencies' ]
+        destinations: [ 'ws' ]
+        transformKql: 'source | where not(Success == true and Target endswith \'.service.signalr.net\')'
+      }
+    ]
+  }
+}
+
+// A workspace has exactly one transformation DCR, activated by linking it as the workspace's
+// defaultDataCollectionRuleResourceId — deliberately NOT modelled here (see Apply above).
+
+output dcrId string = transforms.id

rules/analyze/ANALYZE-APP-017.json

@@ -0,0 +1,92 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-APP-017",
+  "title": "App Install Blocked by Another Installer (0x80070652)",
+  "description": "Detects Win32 app installs that failed because the Windows Installer was busy with another installation (HRESULT 0x80070652 / MSI exit code 1618, ERROR_INSTALL_ALREADY_RUNNING). The IME retries on a fixed budget (~15-17 minutes across several attempts) and then reports the app as failed; when the app is ESP-blocking, the Device Setup Apps subcategory terminates with it.",
+  "severity": "high",
+  "category": "apps",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "baseConfidence": 70,
+  "conditions": [
+    {
+      "signal": "mutex_blocked_install",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "hresultFromWin32",
+      "operator": "equals",
+      "value": "-2147023278",
+      "required": true
+    },
+    {
+      "signal": "installer_exit_1618",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "exitCode",
+      "operator": "equals",
+      "value": "1618",
+      "required": false
+    },
+    {
+      "signal": "esp_failed_with_mutex_code",
+      "source": "event_data",
+      "eventType": "esp_failure_settle_started",
+      "dataField": "errorCode",
+      "operator": "equals",
+      "value": "0x80070652",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "installer_exit_1618",
+      "condition": "exists",
+      "weight": 10
+    },
+    {
+      "signal": "esp_failed_with_mutex_code",
+      "condition": "exists",
+      "weight": 20
+    }
+  ],
+  "confidenceThreshold": 65,
+  "explanation": "App **{{appName}}** failed to install because the Windows Installer service was already busy with another installation — HRESULT **0x80070652** / MSI exit code **1618** (`ERROR_INSTALL_ALREADY_RUNNING`). Only one Windows Installer transaction can run at a time; the Intune Management Extension retried on its fixed budget (typically ~15-17 minutes across several attempts) and then reported the app as failed. If this app is required in the Enrollment Status Page, the Device Setup Apps subcategory fails with it and the enrollment terminates.\n\nThis failure is **deterministic per attempt**: as long as the competing installer keeps winning the race, a plain re-enrollment fails again at roughly the same minute mark — retrying without fixing the collision only churns devices.\n\nCommon sources of the competing installation:\n\n- The **preceding Win32 app in the install order**: its installer exits 0 (so IME moves on) but leaves a child `msiexec` transaction or post-install MSI work running. Security agents and proxy clients that chain multiple MSIs are frequent offenders.\n- **OEM factory software** installing on first boot (factory-image provisioning packages, vendor updaters) — typical on brand-new hardware batches.\n- **Microsoft 365 Apps (C2R), driver updaters or Windows servicing** running installations in parallel outside IME's control.",
+  "remediation": [
+    {
+      "title": "Identify the competing installer",
+      "steps": [
+        "In this session's timeline, note which app finished installing immediately before {{appName}} started — its installer is the prime suspect for holding the Windows Installer mutex",
+        "On a reproduction device, when the failure window is active, check for running installers: Get-Process msiexec | Select-Object Id,StartTime and the in-progress marker key HKLM\\SOFTWARE\\Microsoft\\Windows\\Installer\\InProgress",
+        "Check the Application event log for MsiInstaller events around the failure timestamp to see which product held the transaction",
+        "On factory-fresh hardware, also look for OEM first-boot installers (vendor updater services, factory provisioning packages) that run outside Intune"
+      ]
+    },
+    {
+      "title": "Serialize the install chain",
+      "steps": [
+        "Add an Intune Win32 dependency so {{appName}} depends on the app whose installer causes the collision — IME then orders them explicitly instead of racing",
+        "Alternatively, wrap the offending predecessor so its install script waits until msiexec has fully finished (poll the InProgress registry key or the _MSIExecute mutex with a bounded timeout) before exiting",
+        "If the app does not have to gate the ESP, remove it from the blocking-app list so a transient 1618 no longer terminates the enrollment; Intune retries it after the desktop"
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: MsiExec.exe error messages (1618 = another installation is in progress)",
+      "url": "https://learn.microsoft.com/en-us/windows/win32/msi/error-codes"
+    },
+    {
+      "title": "Microsoft Learn: Troubleshoot Win32 app installations in Intune",
+      "url": "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/troubleshoot-win32-app-install"
+    }
+  ],
+  "tags": [
+    "apps",
+    "msiexec",
+    "mutex",
+    "0x80070652",
+    "1618",
+    "esp"
+  ]
+}

rules/analyze/ANALYZE-NET-001.json

@@ -0,0 +1,81 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-NET-001",
+  "title": "Diagnostics Upload Blocked by Web Security Gateway",
+  "description": "Detects diagnostics package uploads that were answered by a security appliance's HTML block page instead of the Autopilot Monitor backend. A forward proxy / secure web gateway (SWG) with SSL inspection is intercepting the upload endpoint, so exactly the sessions where diagnostics matter most (OnFailure uploads) are the ones losing them.",
+  "severity": "warning",
+  "category": "network",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "baseConfidence": 75,
+  "conditions": [
+    {
+      "signal": "foreign_html_response",
+      "source": "event_data",
+      "eventType": "diagnostics_upload_failed",
+      "dataField": "errorCode",
+      "operator": "contains",
+      "value": "HTML platform error page",
+      "required": true
+    },
+    {
+      "signal": "security_gateway_marker",
+      "source": "event_data",
+      "eventType": "diagnostics_upload_failed",
+      "dataField": "errorCode",
+      "operator": "regex",
+      "value": "mcafee|skyhigh|zscaler|netskope|blue ?coat|proxysg|forcepoint|websense|palo ?alto|fortigate|fortiguard|sophos|watchguard|barracuda|iboss|umbrella|lightspeed|smoothwall|contentkeeper|web ?gateway|web ?filter|content ?filter|secure ?gateway",
+      "required": true
+    },
+    {
+      "signal": "http_403_block",
+      "source": "event_data",
+      "eventType": "diagnostics_upload_failed",
+      "dataField": "errorCode",
+      "operator": "contains",
+      "value": "403",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "http_403_block",
+      "condition": "exists",
+      "weight": 15
+    }
+  ],
+  "confidenceThreshold": 70,
+  "explanation": "The agent collected a diagnostics package but the upload was answered with an **HTML block page from a web security gateway** instead of a response from the Autopilot Monitor backend — the event message names the product that served the page. A forward proxy / SWG with SSL inspection is intercepting HTTPS traffic from the enrollment network and blocking the upload endpoint.\n\nThe consequence is quietly painful: diagnostics upload is typically configured **OnFailure**, so the sessions that fail — the ones where the IME logs and diagnostics ZIP would explain the root cause — are exactly the sessions whose evidence never arrives. Enrollment telemetry itself may still flow (the agent often starts before the gateway's client enforcement does, or other endpoints are treated differently), which makes the gap easy to miss until a failure needs investigating.\n\nNote this rule only fires when the blocking page carries a recognizable security-product marker. A plain HTML error page without one usually means a stale or stopped endpoint instead — that is a different problem.",
+  "remediation": [
+    {
+      "title": "Exempt the upload endpoint in the web gateway",
+      "steps": [
+        "Identify the product from the block-page title quoted in this event's message (e.g. a Skyhigh/McAfee Web Gateway notification page)",
+        "In that gateway, add the Autopilot Monitor API host shown in the event message to the SSL-inspection bypass AND the URL allowlist for the enrollment network segment",
+        "Enrollment traffic often originates from a dedicated provisioning VLAN or from devices without the proxy client yet — make sure the exemption applies to that segment, not only to managed clients",
+        "If the gateway enforces per-user policy, remember ESP-phase traffic runs as SYSTEM/device before any user signs in — the exemption must cover unauthenticated device traffic"
+      ]
+    },
+    {
+      "title": "Verify the fix",
+      "steps": [
+        "Re-run an enrollment (or wait for the next failed one) and confirm a diagnostics package appears on the session in the portal",
+        "Optionally set diagnostics upload to Always temporarily to validate the path without needing a failure"
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Windows Autopilot networking requirements",
+      "url": "https://learn.microsoft.com/en-us/autopilot/networking-requirements"
+    }
+  ],
+  "tags": [
+    "network",
+    "proxy",
+    "ssl-inspection",
+    "swg",
+    "diagnostics"
+  ]
+}

rules/dist/analyze-rules.json

@@ -943,6 +943,97 @@
         "delivery-gap"
       ]
     },
+    {
+      "ruleId": "ANALYZE-APP-017",
+      "title": "App Install Blocked by Another Installer (0x80070652)",
+      "description": "Detects Win32 app installs that failed because the Windows Installer was busy with another installation (HRESULT 0x80070652 / MSI exit code 1618, ERROR_INSTALL_ALREADY_RUNNING). The IME retries on a fixed budget (~15-17 minutes across several attempts) and then reports the app as failed; when the app is ESP-blocking, the Device Setup Apps subcategory terminates with it.",
+      "severity": "high",
+      "category": "apps",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "baseConfidence": 70,
+      "conditions": [
+        {
+          "signal": "mutex_blocked_install",
+          "source": "event_type",
+          "eventType": "app_install_failed",
+          "dataField": "hresultFromWin32",
+          "operator": "equals",
+          "value": "-2147023278",
+          "required": true
+        },
+        {
+          "signal": "installer_exit_1618",
+          "source": "event_data",
+          "eventType": "app_install_failed",
+          "dataField": "exitCode",
+          "operator": "equals",
+          "value": "1618",
+          "required": false
+        },
+        {
+          "signal": "esp_failed_with_mutex_code",
+          "source": "event_data",
+          "eventType": "esp_failure_settle_started",
+          "dataField": "errorCode",
+          "operator": "equals",
+          "value": "0x80070652",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "installer_exit_1618",
+          "condition": "exists",
+          "weight": 10
+        },
+        {
+          "signal": "esp_failed_with_mutex_code",
+          "condition": "exists",
+          "weight": 20
+        }
+      ],
+      "confidenceThreshold": 65,
+      "explanation": "App **{{appName}}** failed to install because the Windows Installer service was already busy with another installation — HRESULT **0x80070652** / MSI exit code **1618** (`ERROR_INSTALL_ALREADY_RUNNING`). Only one Windows Installer transaction can run at a time; the Intune Management Extension retried on its fixed budget (typically ~15-17 minutes across several attempts) and then reported the app as failed. If this app is required in the Enrollment Status Page, the Device Setup Apps subcategory fails with it and the enrollment terminates.\n\nThis failure is **deterministic per attempt**: as long as the competing installer keeps winning the race, a plain re-enrollment fails again at roughly the same minute mark — retrying without fixing the collision only churns devices.\n\nCommon sources of the competing installation:\n\n- The **preceding Win32 app in the install order**: its installer exits 0 (so IME moves on) but leaves a child `msiexec` transaction or post-install MSI work running. Security agents and proxy clients that chain multiple MSIs are frequent offenders.\n- **OEM factory software** installing on first boot (factory-image provisioning packages, vendor updaters) — typical on brand-new hardware batches.\n- **Microsoft 365 Apps (C2R), driver updaters or Windows servicing** running installations in parallel outside IME's control.",
+      "remediation": [
+        {
+          "title": "Identify the competing installer",
+          "steps": [
+            "In this session's timeline, note which app finished installing immediately before {{appName}} started — its installer is the prime suspect for holding the Windows Installer mutex",
+            "On a reproduction device, when the failure window is active, check for running installers: Get-Process msiexec | Select-Object Id,StartTime and the in-progress marker key HKLM\\SOFTWARE\\Microsoft\\Windows\\Installer\\InProgress",
+            "Check the Application event log for MsiInstaller events around the failure timestamp to see which product held the transaction",
+            "On factory-fresh hardware, also look for OEM first-boot installers (vendor updater services, factory provisioning packages) that run outside Intune"
+          ]
+        },
+        {
+          "title": "Serialize the install chain",
+          "steps": [
+            "Add an Intune Win32 dependency so {{appName}} depends on the app whose installer causes the collision — IME then orders them explicitly instead of racing",
+            "Alternatively, wrap the offending predecessor so its install script waits until msiexec has fully finished (poll the InProgress registry key or the _MSIExecute mutex with a bounded timeout) before exiting",
+            "If the app does not have to gate the ESP, remove it from the blocking-app list so a transient 1618 no longer terminates the enrollment; Intune retries it after the desktop"
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: MsiExec.exe error messages (1618 = another installation is in progress)",
+          "url": "https://learn.microsoft.com/en-us/windows/win32/msi/error-codes"
+        },
+        {
+          "title": "Microsoft Learn: Troubleshoot Win32 app installations in Intune",
+          "url": "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/troubleshoot-win32-app-install"
+        }
+      ],
+      "tags": [
+        "apps",
+        "msiexec",
+        "mutex",
+        "0x80070652",
+        "1618",
+        "esp"
+      ]
+    },
     {
       "ruleId": "ANALYZE-CORR-003",
       "title": "Proxy Configuration Causing Download Failure",
@@ -2964,6 +3055,86 @@
         "esp"
       ]
     },
+    {
+      "ruleId": "ANALYZE-NET-001",
+      "title": "Diagnostics Upload Blocked by Web Security Gateway",
+      "description": "Detects diagnostics package uploads that were answered by a security appliance's HTML block page instead of the Autopilot Monitor backend. A forward proxy / secure web gateway (SWG) with SSL inspection is intercepting the upload endpoint, so exactly the sessions where diagnostics matter most (OnFailure uploads) are the ones losing them.",
+      "severity": "warning",
+      "category": "network",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "baseConfidence": 75,
+      "conditions": [
+        {
+          "signal": "foreign_html_response",
+          "source": "event_data",
+          "eventType": "diagnostics_upload_failed",
+          "dataField": "errorCode",
+          "operator": "contains",
+          "value": "HTML platform error page",
+          "required": true
+        },
+        {
+          "signal": "security_gateway_marker",
+          "source": "event_data",
+          "eventType": "diagnostics_upload_failed",
+          "dataField": "errorCode",
+          "operator": "regex",
+          "value": "mcafee|skyhigh|zscaler|netskope|blue ?coat|proxysg|forcepoint|websense|palo ?alto|fortigate|fortiguard|sophos|watchguard|barracuda|iboss|umbrella|lightspeed|smoothwall|contentkeeper|web ?gateway|web ?filter|content ?filter|secure ?gateway",
+          "required": true
+        },
+        {
+          "signal": "http_403_block",
+          "source": "event_data",
+          "eventType": "diagnostics_upload_failed",
+          "dataField": "errorCode",
+          "operator": "contains",
+          "value": "403",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "http_403_block",
+          "condition": "exists",
+          "weight": 15
+        }
+      ],
+      "confidenceThreshold": 70,
+      "explanation": "The agent collected a diagnostics package but the upload was answered with an **HTML block page from a web security gateway** instead of a response from the Autopilot Monitor backend — the event message names the product that served the page. A forward proxy / SWG with SSL inspection is intercepting HTTPS traffic from the enrollment network and blocking the upload endpoint.\n\nThe consequence is quietly painful: diagnostics upload is typically configured **OnFailure**, so the sessions that fail — the ones where the IME logs and diagnostics ZIP would explain the root cause — are exactly the sessions whose evidence never arrives. Enrollment telemetry itself may still flow (the agent often starts before the gateway's client enforcement does, or other endpoints are treated differently), which makes the gap easy to miss until a failure needs investigating.\n\nNote this rule only fires when the blocking page carries a recognizable security-product marker. A plain HTML error page without one usually means a stale or stopped endpoint instead — that is a different problem.",
+      "remediation": [
+        {
+          "title": "Exempt the upload endpoint in the web gateway",
+          "steps": [
+            "Identify the product from the block-page title quoted in this event's message (e.g. a Skyhigh/McAfee Web Gateway notification page)",
+            "In that gateway, add the Autopilot Monitor API host shown in the event message to the SSL-inspection bypass AND the URL allowlist for the enrollment network segment",
+            "Enrollment traffic often originates from a dedicated provisioning VLAN or from devices without the proxy client yet — make sure the exemption applies to that segment, not only to managed clients",
+            "If the gateway enforces per-user policy, remember ESP-phase traffic runs as SYSTEM/device before any user signs in — the exemption must cover unauthenticated device traffic"
+          ]
+        },
+        {
+          "title": "Verify the fix",
+          "steps": [
+            "Re-run an enrollment (or wait for the next failed one) and confirm a diagnostics package appears on the session in the portal",
+            "Optionally set diagnostics upload to Always temporarily to validate the path without needing a failure"
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Windows Autopilot networking requirements",
+          "url": "https://learn.microsoft.com/en-us/autopilot/networking-requirements"
+        }
+      ],
+      "tags": [
+        "network",
+        "proxy",
+        "ssl-inspection",
+        "swg",
+        "diagnostics"
+      ]
+    },
     {
       "ruleId": "ANALYZE-OFFICE-001",
       "title": "Microsoft 365 Apps Install Failed",

rules/dist/ime-log-patterns.json

@@ -675,6 +675,14 @@
       "description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
       "enabled": true
     },
+    {
+      "patternId": "IME-USER-SESSION-ZERO-APPS",
+      "category": "always",
+      "pattern": "\\[Win32App\\] Get 0 apps for user session (?<sessionId>\\d+), user id = (?<userId>[a-f0-9\\-]+)",
+      "action": "userSessionZeroApps",
+      "description": "Detects when IME enumerated a user session and found zero targeted Win32 apps. IME then skips its 'Completed user session' line entirely (the zero-app branch in ApplicationPoller continues before that log statement), so this line is the only evidence that user-phase enforcement finished on a device with no user-targeted apps. Treated as equivalent to a completed user session.",
+      "enabled": true
+    },
     {
       "patternId": "IME-WIN32-STATE-1",
       "category": "currentPhase",

rules/ime-log-patterns/IME-USER-SESSION-ZERO-APPS.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-USER-SESSION-ZERO-APPS",
+  "category": "always",
+  "pattern": "\\[Win32App\\] Get 0 apps for user session (?<sessionId>\\d+), user id = (?<userId>[a-f0-9\\-]+)",
+  "action": "userSessionZeroApps",
+  "description": "Detects when IME enumerated a user session and found zero targeted Win32 apps. IME then skips its 'Completed user session' line entirely (the zero-app branch in ApplicationPoller continues before that log statement), so this line is the only evidence that user-phase enforcement finished on a device with no user-targeted apps. Treated as equivalent to a completed user session.",
+  "enabled": true
+}

rules/schema/ime-log-pattern.schema.json

@@ -63,6 +63,7 @@
             "imeImpersonation",
             "imeTokenFailure",
             "enrollmentCompleted",
+            "userSessionZeroApps",
             "updateDoTelemetry",
             "scriptStarted",
             "scriptContext",

scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1

@@ -1,4 +1,4 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 <#
 .SYNOPSIS
     Grants additional Microsoft Graph application permissions to the Autopilot Monitor
@@ -28,6 +28,11 @@
         (validates Windows 365 Cloud PCs against the tenant's Cloud PC inventory --
          Cloud PCs are never Autopilot-registered, so this enables agent monitoring
          of Cloud PC first-connect enrollment)
+      - IntuneDeviceBinding     -> DeviceManagementManagedDevices.Read.All
+        (cert-to-device binding: verifies that the Intune device id carried in the
+         agent's client certificate is a device THIS tenant actually enrolled --
+         currently a Global-Admin-only preview that records telemetry and does not
+         block enrollment)
       - All                    -> every optional permission above, in one run
         (also works with -Revoke to remove all optional grants at once)
 
@@ -93,7 +98,7 @@ param(
     [string]$ClientId,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByFeatures')]
-    [ValidateSet('All', 'ScriptDisplayNames', 'W365CloudPcValidation')]
+    [ValidateSet('All', 'ScriptDisplayNames', 'W365CloudPcValidation', 'IntuneDeviceBinding')]
     [string[]]$Features,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'ByPermissions')]
@@ -116,6 +121,7 @@ $ErrorActionPreference = 'Stop'
 $FeatureCatalog = @{
     'ScriptDisplayNames'    = @('DeviceManagementScripts.Read.All')
     'W365CloudPcValidation' = @('CloudPC.Read.All')
+    'IntuneDeviceBinding'   = @('DeviceManagementManagedDevices.Read.All')
 }
 
 # Translate Features -> Permissions when caller used the high-level form.

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/BuiltInConfigCatalogTests.cs

@@ -0,0 +1,62 @@
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Configuration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
+{
+    /// <summary>
+    /// Pins the compiled-in fallback rule catalogs (<see cref="BuiltInConfigCatalog"/>):
+    /// the agent embeds the SAME CI-combined rules/dist artifacts the backend serves, so a
+    /// no-config/no-cache session still runs full IME tracking. These tests guard the
+    /// embedding + deserialization end-to-end — a broken LogicalName, a moved resource or a
+    /// shape change in the combined JSON must fail HERE, not silently strip the fallback
+    /// back down to zero patterns in the field.
+    /// </summary>
+    public class BuiltInConfigCatalogTests
+    {
+        [Fact]
+        public void ImeLogPatterns_LoadFromEmbeddedCatalog_EnabledOnly()
+        {
+            var patterns = BuiltInConfigCatalog.GetEnabledImeLogPatterns(logger: null);
+
+            Assert.NotEmpty(patterns);
+            Assert.All(patterns, p =>
+            {
+                Assert.True(p.Enabled);
+                Assert.False(string.IsNullOrWhiteSpace(p.PatternId));
+                Assert.False(string.IsNullOrWhiteSpace(p.Pattern));
+                Assert.False(string.IsNullOrWhiteSpace(p.Action));
+                Assert.False(string.IsNullOrWhiteSpace(p.Category));
+            });
+            Assert.Equal(patterns.Count, patterns.Select(p => p.PatternId).Distinct().Count());
+        }
+
+        [Fact]
+        public void ImeLogPatterns_CarryCoreTrackingActions()
+        {
+            // The app-tracking backbone: without these two actions the ImeLogTracker cannot
+            // attribute installs to apps or follow ESP phases. Their presence proves the
+            // deserialization actually populated the action field (a shape drift in the
+            // combined JSON would otherwise still pass the structural checks above).
+            var actions = BuiltInConfigCatalog.GetEnabledImeLogPatterns(logger: null)
+                .Select(p => p.Action).ToHashSet();
+
+            Assert.Contains("setCurrentApp", actions);
+            Assert.Contains("espPhaseDetected", actions);
+        }
+
+        [Fact]
+        public void GatherRules_LoadFromEmbeddedCatalog_EnabledOnly()
+        {
+            // The built-in gather-rule catalog ships mostly disabled rules — only the
+            // default-enabled ones may reach the fallback config.
+            var rules = BuiltInConfigCatalog.GetEnabledGatherRules(logger: null);
+
+            Assert.All(rules, r =>
+            {
+                Assert.True(r.Enabled);
+                Assert.False(string.IsNullOrWhiteSpace(r.RuleId));
+            });
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/RemoteConfigServiceRetryTests.cs

@@ -114,6 +114,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(1, svc.LastFetchAttempts);
         }
 
+        [Fact]
+        public async Task FetchConfig_DefaultsFallback_CarriesBuiltInCatalogs()
+        {
+            // A no-config/no-cache session must still get the compiled-in rule catalogs —
+            // an empty ImeLogPatterns list kills the entire IME tracking pipeline (the
+            // pre-catalog behaviour this pins against regressing to).
+            var svc = NewService(BackendBehaviour.AlwaysTransientFailure);
+
+            var result = await svc.FetchConfigAsync(retryOnTransientErrors: true);
+
+            Assert.Equal(0, result.ConfigVersion);
+            Assert.NotEmpty(result.ImeLogPatterns);
+            Assert.All(result.ImeLogPatterns, p => Assert.True(p.Enabled));
+            Assert.All(result.GatherRules, r => Assert.True(r.Enabled));
+        }
+
         [Fact]
         public async Task FetchConfig_EmptyResponse_TreatedAsTransient()
         {
@@ -128,6 +144,94 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(4, svc.LastFetchAttempts);
         }
 
+        // ── Network-link gate (tenant aebdce78 audit 2026-08-24) ────────────
+
+        [Fact]
+        public async Task FetchConfig_InitialFetch_WaitsForNetworkLink()
+        {
+            // The initial startup fetch must gate on the link-level signal so the retry
+            // budget isn't burned into a NIC that is provably still down (agent relaunched
+            // at boot, Wi-Fi still associating).
+            var svc = NewService(BackendBehaviour.SuccessImmediately);
+
+            await svc.FetchConfigAsync(retryOnTransientErrors: true);
+
+            Assert.Equal(1, svc.NetworkLinkWaits);
+        }
+
+        [Fact]
+        public async Task FetchConfig_RotatePath_SkipsNetworkLinkGate()
+        {
+            // rotate_config runs mid-session on a proven link and must stay latency-bounded.
+            var svc = NewService(BackendBehaviour.SuccessImmediately);
+
+            await svc.FetchConfigAsync(retryOnTransientErrors: false);
+
+            Assert.Equal(0, svc.NetworkLinkWaits);
+        }
+
+        // ── Post-registration recovery ──────────────────────────────────────
+
+        [Fact]
+        public async Task TryRecover_AfterFailedFetch_AppliesLiveConfig_KeepsFailureRecord()
+        {
+            // The core self-heal contract: registration proved the backend reachable, the
+            // recovery swaps in the live config — but the LastFetch* observability keeps
+            // describing the failed startup fetch so the wire event can report both.
+            var svc = NewService(BackendBehaviour.FailAllThenSucceed);
+            await svc.FetchConfigAsync(retryOnTransientErrors: true);
+            Assert.Equal(RemoteConfigFetchOutcome.UsedDefaults, svc.LastFetchOutcome);
+
+            var recovered = await svc.TryRecoverConfigAsync();
+
+            Assert.NotNull(recovered);
+            Assert.Equal(42, recovered.ConfigVersion);
+            Assert.Equal(42, svc.CurrentConfig.ConfigVersion);
+            Assert.True(svc.RecoveredAfterFetchFailure);
+            // Startup-failure record intact:
+            Assert.Equal(RemoteConfigFetchOutcome.UsedDefaults, svc.LastFetchOutcome);
+            Assert.Equal(1 + RemoteConfigService.InitialFetchRetryBackoff.Length, svc.LastFetchAttempts);
+            Assert.Equal(nameof(HttpRequestException), svc.LastFetchFailureType);
+        }
+
+        [Fact]
+        public async Task TryRecover_AfterSuccessfulFetch_IsNoOp()
+        {
+            var svc = NewService(BackendBehaviour.SuccessImmediately);
+            await svc.FetchConfigAsync(retryOnTransientErrors: true);
+
+            var recovered = await svc.TryRecoverConfigAsync();
+
+            Assert.Null(recovered);
+            Assert.False(svc.RecoveredAfterFetchFailure);
+        }
+
+        [Fact]
+        public async Task TryRecover_BeforeAnyFetch_IsNoOp()
+        {
+            var svc = NewService(BackendBehaviour.SuccessImmediately);
+
+            var recovered = await svc.TryRecoverConfigAsync();
+
+            Assert.Null(recovered);
+            Assert.False(svc.RecoveredAfterFetchFailure);
+        }
+
+        [Fact]
+        public async Task TryRecover_WhenBackendStillFailing_KeepsFallback_NeverThrows()
+        {
+            var svc = NewService(BackendBehaviour.AlwaysTransientFailure);
+            var fallback = await svc.FetchConfigAsync(retryOnTransientErrors: true);
+            Assert.Equal(0, fallback.ConfigVersion);
+
+            var recovered = await svc.TryRecoverConfigAsync();
+
+            Assert.Null(recovered);
+            Assert.False(svc.RecoveredAfterFetchFailure);
+            Assert.Equal(0, svc.CurrentConfig.ConfigVersion); // fallback config untouched
+            Assert.Equal(RemoteConfigFetchOutcome.UsedDefaults, svc.LastFetchOutcome);
+        }
+
         // ── Outcome state defaults ──────────────────────────────────────────
 
         [Fact]
@@ -145,6 +249,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             SuccessImmediately,
             AlwaysTransientFailure,
             FailTwiceThenSucceed,
+            /// <summary>All 4 initial attempts fail; the NEXT call (the recovery fetch) succeeds.</summary>
+            FailAllThenSucceed,
             AlwaysAuthFailure401,
             AlwaysReturnNull,
         }
@@ -177,6 +283,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
                 _behaviour = behaviour;
             }
 
+            /// <summary>Number of times the network-link gate seam was awaited.</summary>
+            public int NetworkLinkWaits { get; private set; }
+
             protected override Task<AgentConfigResponse> CallBackendAsync()
             {
                 _calls++;
@@ -188,6 +297,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
                         if (_calls < 3)
                             throw new HttpRequestException("simulated cold-start timeout");
                         return Task.FromResult(new AgentConfigResponse { ConfigVersion = 42 });
+                    case BackendBehaviour.FailAllThenSucceed:
+                        if (_calls <= 1 + RemoteConfigService.InitialFetchRetryBackoff.Length)
+                            throw new HttpRequestException("simulated dead network link");
+                        return Task.FromResult(new AgentConfigResponse { ConfigVersion = 42 });
                     case BackendBehaviour.AlwaysTransientFailure:
                         throw new HttpRequestException("simulated network failure");
                     case BackendBehaviour.AlwaysAuthFailure401:
@@ -202,6 +315,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             // Zero-delay so the suite finishes in ms instead of the live 10/30/60 s schedule.
             protected override Task DelayBetweenAttemptsAsync(TimeSpan delay) => Task.CompletedTask;
 
+            // Record + skip the real link poll so the suite is deterministic on offline CI.
+            protected override Task WaitForNetworkLinkAsync()
+            {
+                NetworkLinkWaits++;
+                return Task.CompletedTask;
+            }
+
             // In-memory + per-instance cache so a prior test's successful fetch can't
             // bleed into a later test that expects UsedDefaults.
             private AgentConfigResponse? _cached;

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerZeroUserAppsTests.cs

@@ -0,0 +1,199 @@
+using System.Collections.Generic;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Sessions 81daa77f / 75d6ae8e (2026-08-25) — zero user-targeted apps starved every
+    /// user-phase completion probe. The IME zero-app branch returns before it writes the
+    /// "Completed user session" line, so a device whose user has no targeted Win32 apps never
+    /// produced the evidence <c>IsImeUserSessionGenuine</c> requires, and the AdvisoryCompletion
+    /// window failed the enrollment 30 minutes later — with the user at the desktop, Hello
+    /// provisioned and RealmJoin still installing.
+    /// <para>
+    /// IME-USER-SESSION-ZERO-APPS reads the line IME does write in that branch and routes it
+    /// through the same <see cref="ImeLogTracker.OnUserSessionCompleted"/> callback.
+    /// </para>
+    /// </summary>
+    public sealed class ImeLogTrackerZeroUserAppsTests
+    {
+        // Mirrors rules/ime-log-patterns/IME-USER-SESSION-ZERO-APPS.json. The JSON itself is
+        // pinned against a real IME line by BuiltInRulesTests in the backend suite.
+        private const string ZeroAppsPattern =
+            @"\[Win32App\] Get 0 apps for user session (?<sessionId>\d+), user id = (?<userId>[a-f0-9\-]+)";
+
+        private const string EspPhasePattern =
+            @"\[Win32App\] (?:In|The) EspPhase: (?<espPhase>\w+)";
+
+        private const string ZeroAppsLine =
+            "[Win32App] Get 0 apps for user session 1, user id = 4a1ba5db-44ed-4e69-8477-47ed88e76020";
+
+        private static ImeLogTracker BuildTracker(TempDirectory tmp) =>
+            new ImeLogTracker(
+                logFolder: tmp.Path,
+                patterns: new List<ImeLogPattern>
+                {
+                    new ImeLogPattern
+                    {
+                        PatternId = "IME-USER-SESSION-ZERO-APPS",
+                        Category = "always",
+                        Pattern = ZeroAppsPattern,
+                        Action = "userSessionZeroApps",
+                    },
+                    new ImeLogPattern
+                    {
+                        PatternId = "IME-ESP-PHASE",
+                        Category = "always",
+                        Pattern = EspPhasePattern,
+                        Action = "espPhaseDetected",
+                    },
+                },
+                logger: new AgentLogger(tmp.Path, AgentLogLevel.Info));
+
+        [Fact]
+        public void ZeroApps_line_during_user_phase_fires_user_session_completed()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+            var fired = 0;
+            tracker.OnUserSessionCompleted = () => fired++;
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+
+            Assert.Equal(1, fired);
+            Assert.True(tracker.UserSessionZeroAppsObserved);
+        }
+
+        [Fact]
+        public void ZeroApps_line_before_user_phase_does_not_fire()
+        {
+            // Firing here would burn the adapter fire-once flag on a pre-sign-in timestamp that
+            // IsImeUserSessionGenuine (>= AccountSetupEnteredUtc) can never accept.
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+            var fired = 0;
+            tracker.OnUserSessionCompleted = () => fired++;
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: DeviceSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+
+            Assert.Equal(0, fired);
+            Assert.True(tracker.UserSessionZeroAppsObserved);
+        }
+
+        [Fact]
+        public void ZeroApps_observed_early_is_replayed_on_the_user_phase_transition()
+        {
+            // IME writes its check-in lines independently of when the agent first parses the ESP
+            // phase marker, so the evidence can legitimately arrive first. Dropping it would
+            // leave a zero-app device with no completion evidence at all.
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+            var fired = 0;
+            tracker.OnUserSessionCompleted = () => fired++;
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: DeviceSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+            Assert.Equal(0, fired);
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+
+            Assert.Equal(1, fired);
+        }
+
+        [Fact]
+        public void Repeated_user_phase_matches_do_not_replay_again()
+        {
+            // IME re-emits the phase string as it re-evaluates app sets. Only a real transition
+            // replays; the adapter fire-once flag is the outer guard, but the tracker must not
+            // spam the callback either.
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+            var fired = 0;
+            tracker.OnUserSessionCompleted = () => fired++;
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: DeviceSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+
+            Assert.Equal(1, fired);
+        }
+
+        [Fact]
+        public void Nonzero_app_count_lines_do_not_match_the_pattern()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+            var fired = 0;
+            tracker.OnUserSessionCompleted = () => fired++;
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+
+            tracker.ProcessLogMessageForTest(
+                "[Win32App] Get 3 apps for user session 1, user id = 4a1ba5db-44ed-4e69-8477-47ed88e76020");
+            tracker.ProcessLogMessageForTest(
+                "[Win32App] Get 10 apps for user session 1, user id = 4a1ba5db-44ed-4e69-8477-47ed88e76020");
+
+            Assert.Equal(0, fired);
+            Assert.False(tracker.UserSessionZeroAppsObserved);
+        }
+
+        [Fact]
+        public void AreUserEspAppsSettled_true_after_zero_apps_observation()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+
+            Assert.True(tracker.AreUserEspAppsSettled());
+        }
+
+        [Fact]
+        public void AreUserEspAppsSettled_stays_false_on_an_empty_list_without_the_observation()
+        {
+            // Mutation proof for the branch above: an empty live list on its own still means
+            // "phase just cleared / apps not surfaced yet", never vacuously settled.
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+
+            Assert.False(tracker.AreUserEspAppsSettled());
+        }
+
+        [Fact]
+        public void AreUserEspAppsSettled_false_outside_the_user_phase_even_after_the_observation()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: DeviceSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+
+            Assert.True(tracker.UserSessionZeroAppsObserved);
+            Assert.False(tracker.AreUserEspAppsSettled());
+        }
+
+        [Fact]
+        public void GetPendingRequiredUserEspInstallApps_is_empty_for_a_zero_app_user_session()
+        {
+            // The adapter deferral probe must not park the signal when there is nothing to wait
+            // for — otherwise the zero-app path would starve exactly like the old one.
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp);
+
+            tracker.ProcessLogMessageForTest("[Win32App] In EspPhase: AccountSetup");
+            tracker.ProcessLogMessageForTest(ZeroAppsLine);
+
+            Assert.Empty(tracker.GetPendingRequiredUserEspInstallApps());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Interop/WifiInfoProviderTests.cs

@@ -0,0 +1,140 @@
+#nullable enable
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Interop
+{
+    /// <summary>
+    /// Tests for the tiered WiFi reader. The WLAN state of the test machine is unknown (CI
+    /// runners have no WLAN service, dev boxes may be on WiFi with or without location consent),
+    /// so the live path only pins the fail-soft contract. The diagnostics composer is pinned
+    /// exactly — it is the only field evidence for a missing wifi_signal_info event, and the
+    /// ERROR_ACCESS_DENIED hint is what tells an operator that Windows 11 24H2's location gate,
+    /// not the hardware, swallowed the SSID.
+    /// </summary>
+    public sealed class WifiInfoProviderTests
+    {
+        [Fact]
+        public void TryRead_never_throws_and_reports_a_reason_when_it_yields_nothing()
+        {
+            var result = WifiInfoProvider.TryRead(null, out var diagnostics);
+
+            if (result == null)
+            {
+                Assert.False(string.IsNullOrWhiteSpace(diagnostics),
+                    "a null result must always explain itself — that string is the only field evidence");
+                Assert.Contains("native:", diagnostics);
+                Assert.Contains("WinRT:", diagnostics);
+                Assert.Contains("netsh:", diagnostics);
+            }
+            else
+            {
+                Assert.Null(diagnostics);
+                // Every tier either carries an SSID or was not supposed to return at all.
+                Assert.False(result.Ssid == null && result.SignalPercent == null
+                             && result.RadioType == null && result.Channel == null,
+                    "an all-null payload must surface as null, not as an empty connection");
+            }
+        }
+
+        // ----- BuildDiagnostics ---------------------------------------------
+
+        [Fact]
+        public void BuildDiagnostics_names_every_tier()
+        {
+            var text = WifiInfoProvider.BuildDiagnostics(null, null);
+
+            Assert.Contains("no WiFi info from any reader", text);
+            Assert.Contains("native: no connected WLAN interface", text);
+            Assert.Contains("WinRT: no SSID", text);
+            Assert.Contains("netsh: no parsable output", text);
+        }
+
+        [Fact]
+        public void BuildDiagnostics_passes_through_tier_reasons()
+        {
+            var text = WifiInfoProvider.BuildDiagnostics("WlanOpenHandle rc=1062", "WinRT NetworkInformation unavailable");
+
+            Assert.Contains("native: WlanOpenHandle rc=1062", text);
+            Assert.Contains("WinRT: WinRT NetworkInformation unavailable", text);
+        }
+
+        [Fact]
+        public void BuildDiagnostics_explains_access_denied_as_the_location_gate()
+        {
+            var text = WifiInfoProvider.BuildDiagnostics(
+                "[1cbc79c3-2e31-468a-b949-17fafa6e23ed] query(current_connection) rc=5; ", null);
+
+            Assert.Contains("ERROR_ACCESS_DENIED", text);
+            Assert.Contains("24H2", text);
+            Assert.Contains("Location services", text);
+        }
+
+        [Fact]
+        public void BuildDiagnostics_explains_access_denied_without_a_trailing_separator()
+        {
+            var text = WifiInfoProvider.BuildDiagnostics("WlanOpenHandle rc=5", null);
+
+            Assert.Contains("ERROR_ACCESS_DENIED", text);
+        }
+
+        // ----- IsLocationGateDenied -----------------------------------------
+        //
+        // This predicate decides whether the wifi_signal_info payload claims
+        // "location_services_off" to the operator. A false positive blames a privacy setting
+        // that is actually fine, so the boundaries are pinned exactly.
+
+        [Theory]
+        [InlineData("[guid] query(current_connection) rc=5; ")]
+        [InlineData("WlanOpenHandle rc=5")]
+        public void IsLocationGateDenied_true_only_for_error_access_denied(string nativeDiag)
+        {
+            Assert.True(WifiInfoProvider.IsLocationGateDenied(nativeDiag));
+        }
+
+        [Theory]
+        [InlineData(null)]
+        [InlineData("")]
+        [InlineData("query(current_connection) rc=50; ")]
+        [InlineData("query(current_connection) rc=5023; ")]
+        [InlineData("WlanEnumInterfaces rc=1062")]
+        [InlineData("no WLAN interfaces")]
+        [InlineData("[guid] state=wlan_interface_state_disconnected; ")]
+        public void IsLocationGateDenied_false_for_every_other_reason(string? nativeDiag)
+        {
+            Assert.False(WifiInfoProvider.IsLocationGateDenied(nativeDiag));
+        }
+
+        [Fact]
+        public void LocationServicesOff_literal_is_the_published_payload_contract()
+        {
+            // Matched verbatim by the portal's WiFi card (wifiDataLimitedReason) — renaming it
+            // silently drops the hint instead of breaking a build.
+            Assert.Equal("location_services_off", WifiInfoProvider.LocationServicesOff);
+        }
+
+        [Fact]
+        public void TryRead_never_claims_the_location_gate_on_the_native_tier()
+        {
+            // The native tier only returns when it succeeded, so a full payload must never carry
+            // a "data limited" reason.
+            var result = WifiInfoProvider.TryRead(null, out _);
+
+            if (result?.SignalPercent != null)
+                Assert.Null(result.DataLimitedReason);
+        }
+
+        [Theory]
+        [InlineData("query(current_connection) rc=50; ")]
+        [InlineData("query(current_connection) rc=5023; ")]
+        [InlineData("WlanEnumInterfaces rc=1062")]
+        [InlineData("[guid] state=wlan_interface_state_disconnected; ")]
+        public void BuildDiagnostics_does_not_blame_the_location_gate_for_other_codes(string nativeDiag)
+        {
+            var text = WifiInfoProvider.BuildDiagnostics(nativeDiag, null);
+
+            Assert.DoesNotContain("ERROR_ACCESS_DENIED", text);
+            Assert.Contains($"native: {nativeDiag}", text);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Interop/WinRtWifiSsidReaderTests.cs

@@ -0,0 +1,48 @@
+#nullable enable
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Interop
+{
+    /// <summary>
+    /// Tests for the WinRT SSID reader. Its whole value is that it keeps working where the
+    /// native WLAN API is denied, so the contract that matters here is fail-soft resolution:
+    /// the type is bound by name at runtime (no winmd), and every step must degrade to null
+    /// with a reason instead of throwing — a throw would take the Task.Run collector down
+    /// silently, which is precisely the failure mode this tier exists to end.
+    /// </summary>
+    public sealed class WinRtWifiSsidReaderTests
+    {
+        [Fact]
+        public void TryGetConnectedSsid_never_throws()
+        {
+            var ssid = WinRtWifiSsidReader.TryGetConnectedSsid(out var diagnostics);
+
+            if (ssid == null)
+                Assert.False(string.IsNullOrWhiteSpace(diagnostics), "a null SSID must carry a reason");
+            else
+                Assert.Null(diagnostics);
+        }
+
+        [Fact]
+        public void TryGetConnectedSsid_never_returns_an_empty_ssid()
+        {
+            // An AP broadcasting an empty SSID must surface as null, never as "" — the caller
+            // maps a non-null SSID straight into the wifi_signal_info payload.
+            var ssid = WinRtWifiSsidReader.TryGetConnectedSsid(out _);
+
+            Assert.True(ssid == null || ssid.Length > 0);
+        }
+
+        [Fact]
+        public void TryGetConnectedSsid_is_stable_across_calls()
+        {
+            // Reflection members are resolved once and cached; a second call must take the
+            // cached path and behave identically.
+            var first = WinRtWifiSsidReader.TryGetConnectedSsid(out _);
+            var second = WinRtWifiSsidReader.TryGetConnectedSsid(out _);
+
+            Assert.Equal(first, second);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/DiagnosticsPackageServiceTests.cs

@@ -527,7 +527,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
         {
             // On-demand mid-session (no outcome yet): the OnFailure gate must NOT skip —
             // there is no known success to skip on. Reaching the archive build (sentinel
-            // throw → error result) proves the gate was passed; a skip would return null.
+            // throw → error result) proves the gate was passed; a skip would return Skipped.
             using var rig = new Rig();
             var result = await BuildGateProbe(rig.Logger, "OnFailure")
                 .CreateAndUploadAsync(enrollmentSucceeded: null, fileNameSuffix: "server-requested");
@@ -543,7 +543,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
             var result = await BuildGateProbe(rig.Logger, "OnFailure")
                 .CreateAndUploadAsync(enrollmentSucceeded: true);
 
-            Assert.Null(result);
+            Assert.NotNull(result);
+            Assert.True(result!.Skipped);
+            Assert.False(result.Success);
+            Assert.Equal(DiagnosticsUploadResult.SkipOnFailureSucceeded, result.ErrorCode);
         }
 
         [Fact]
@@ -553,7 +556,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
             var result = await BuildGateProbe(rig.Logger, "Off")
                 .CreateAndUploadAsync(enrollmentSucceeded: null);
 
-            Assert.Null(result);
+            // The gate name travels in ErrorCode so the dispatcher's server_action_failed
+            // event says "mode_off" instead of a generic "diagnostics_upload_failed".
+            Assert.NotNull(result);
+            Assert.True(result!.Skipped);
+            Assert.Equal(DiagnosticsUploadResult.SkipModeOff, result.ErrorCode);
         }
 
         [Theory]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/ServerActionDispatcherTests.cs

@@ -122,6 +122,28 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
             Assert.Equal("config_fetch_failed", (string)typed["failureReason"]);
         }
 
+        [Fact]
+        public async Task Dispatch_request_diagnostics_skipped_by_gate_surfaces_gate_name_as_failure_reason()
+        {
+            // Session 2550bcea (2026-08-29): the on-demand collection was refused by the
+            // mode=Off gate and the portal only saw a generic "diagnostics_upload_failed".
+            // The gate name must travel through to the event so the operator can tell a
+            // config gate from a real upload error.
+            using var rig = new Rig();
+            rig.DiagnosticsResult = DiagnosticsUploadResult.SkippedBy(DiagnosticsUploadResult.SkipModeOff);
+
+            await rig.Build().DispatchAsync(new List<ServerAction>
+            {
+                new ServerAction { Type = ServerActionTypes.RequestDiagnostics, QueuedAt = DateTime.UtcNow },
+            });
+
+            Assert.Equal(1, rig.DiagnosticsCalls);
+            Assert.Empty(rig.EventsOfType("server_action_executed"));
+            var failed = rig.EventsOfType("server_action_failed").Single();
+            var typed = Assert.IsAssignableFrom<IReadOnlyDictionary<string, object>>(failed.TypedPayload!);
+            Assert.Equal(DiagnosticsUploadResult.SkipModeOff, (string)typed["failureReason"]);
+        }
+
         [Fact]
         public async Task Dispatch_unknown_action_type_emits_failed_with_unknown_action_type_reason()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/SignalIngressTests.cs

@@ -498,6 +498,207 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             Assert.Equal(5, observedCount);
         }
 
+        // ============================================================ Worker re-entrancy (2026-08-29)
+
+        [Fact]
+        public void Worker_thread_post_with_full_channel_does_not_deadlock_and_is_processed_next()
+        {
+            // Channel capacity 1, the worker is parked inside ApplyStep on a gate while a
+            // second producer keeps the channel full. When the gate opens, ApplyStep posts a
+            // verdict from the worker thread. Before the fix, Post would block in
+            // BlockingCollection.Add forever (the worker is the only consumer). After the fix,
+            // the verdict goes to the worker-local queue, is processed BEFORE the queued channel
+            // item, and the worker keeps draining.
+            using var tmp = new TempDirectory();
+            var log = new SignalLogWriter(tmp.File("signal-log.jsonl"));
+            SignalIngress? ingRef = null;
+            var gate = new ManualResetEventSlim(false);
+            var inApply = new ManualResetEventSlim(false);
+            var processor = new GatedReentrantProcessor(() => ingRef!, gate, inApply);
+            var ing = new SignalIngress(
+                engine: new DecisionEngine(),
+                signalLog: log,
+                traceCounter: new SessionTraceOrdinalProvider(),
+                processor: processor,
+                clock: new VirtualClock(At),
+                channelCapacity: 1);
+            ingRef = ing;
+            ing.Start();
+
+            // Item 0 — worker takes it and parks inside ApplyStep on the gate.
+            ing.Post(DecisionSignalKind.SessionStarted, At, "Collector", RawEvidence("s0"));
+            Assert.True(inApply.Wait(5000));
+
+            // Item 1 fills the single slot; item 2 blocks a foreign producer (channel full).
+            ing.Post(DecisionSignalKind.DesktopArrived, At.AddSeconds(1), "Collector", RawEvidence("s1"));
+            var blockedProducer = Task.Run(() =>
+                ing.Post(DecisionSignalKind.DesktopArrived, At.AddSeconds(2), "Collector", RawEvidence("s2")));
+            Assert.True(WaitFor(() => ing.ApproximateQueueLength == 1));
+            Assert.False(blockedProducer.Wait(200));   // genuinely blocked by back-pressure
+
+            // Release the worker: ApplyStep(s0) now posts the verdict from the worker thread
+            // into a full channel.
+            gate.Set();
+
+            Assert.True(blockedProducer.Wait(5000), "foreign producer must be released — worker must keep draining");
+            Assert.True(WaitFor(() => processor.CallCount == 4));
+            ing.Stop();
+
+            Assert.Equal(
+                new[]
+                {
+                    DecisionSignalKind.SessionStarted,
+                    DecisionSignalKind.ClassifierVerdictIssued,   // follow-up drained BEFORE the next channel item
+                    DecisionSignalKind.DesktopArrived,
+                    DecisionSignalKind.DesktopArrived,
+                },
+                processor.Kinds);
+            Assert.Equal(1, ing.ReentrantPostCount);
+            Assert.Equal(0, ing.PendingSignalCount);
+            // Same worker thread for every step — single-writer invariant intact.
+            Assert.Single(processor.ThreadIds.Distinct());
+            // Follow-up went through the normal path: ordinal assigned + durably logged.
+            var logged = log.ReadAll();
+            Assert.Equal(4, logged.Count);
+            Assert.Equal(DecisionSignalKind.ClassifierVerdictIssued, logged[1].Kind);
+            Assert.Equal(1, logged[1].SessionSignalOrdinal);
+        }
+
+        [Fact]
+        public void Worker_thread_post_chain_is_drained_iteratively_in_order()
+        {
+            // A follow-up whose own ApplyStep posts another follow-up: both are processed on
+            // the worker, in order, before the next channel item, without recursion.
+            using var tmp = new TempDirectory();
+            var log = new SignalLogWriter(tmp.File("signal-log.jsonl"));
+            SignalIngress? ingRef = null;
+            var processor = new ChainingProcessor(() => ingRef!);
+            var ing = new SignalIngress(
+                engine: new DecisionEngine(),
+                signalLog: log,
+                traceCounter: new SessionTraceOrdinalProvider(),
+                processor: processor,
+                clock: new VirtualClock(At));
+            ingRef = ing;
+            ing.Start();
+
+            ing.Post(DecisionSignalKind.SessionStarted, At, "Collector", RawEvidence("s0"));
+            ing.Post(DecisionSignalKind.DesktopArrived, At.AddSeconds(1), "Collector", RawEvidence("s1"));
+            ing.Stop();
+
+            Assert.Equal(
+                new[] { "Collector", "chain:1", "chain:2", "Collector" },
+                processor.Origins);
+            Assert.Equal(2, ing.ReentrantPostCount);
+            Assert.Equal(4, log.ReadAll().Count);
+        }
+
+        [Fact]
+        public void Worker_thread_post_during_Stop_drain_is_still_processed()
+        {
+            // Stop() completes adding, but a verdict posted by the worker while it finishes
+            // the last channel item must not be dropped — it belongs to that step.
+            using var tmp = new TempDirectory();
+            var log = new SignalLogWriter(tmp.File("signal-log.jsonl"));
+            SignalIngress? ingRef = null;
+            var gate = new ManualResetEventSlim(false);
+            var inApply = new ManualResetEventSlim(false);
+            var processor = new GatedReentrantProcessor(() => ingRef!, gate, inApply);
+            var ing = new SignalIngress(
+                engine: new DecisionEngine(),
+                signalLog: log,
+                traceCounter: new SessionTraceOrdinalProvider(),
+                processor: processor,
+                clock: new VirtualClock(At));
+            ingRef = ing;
+            ing.Start();
+
+            ing.Post(DecisionSignalKind.SessionStarted, At, "Collector", RawEvidence("s0"));
+            Assert.True(inApply.Wait(5000));
+            var stopTask = Task.Run(() => ing.Stop());
+            Assert.True(WaitFor(() => ing.ApproximateQueueLength == 0 && !stopTask.IsCompleted));
+            gate.Set();
+            Assert.True(stopTask.Wait(5000));
+
+            Assert.Equal(
+                new[] { DecisionSignalKind.SessionStarted, DecisionSignalKind.ClassifierVerdictIssued },
+                processor.Kinds);
+            Assert.Equal(2, log.ReadAll().Count);
+        }
+
+        /// <summary>
+        /// Parks inside ApplyStep(SessionStarted) on a gate, then posts a verdict back into the
+        /// ingress from the worker thread — the EffectRunner/RunClassifier shape.
+        /// </summary>
+        private sealed class GatedReentrantProcessor : IDecisionStepProcessor
+        {
+            private readonly Func<ISignalIngressSink> _sink;
+            private readonly ManualResetEventSlim _gate;
+            private readonly ManualResetEventSlim _inApply;
+            private readonly List<(DecisionSignalKind Kind, int ThreadId)> _calls = new List<(DecisionSignalKind, int)>();
+            private DecisionCore.State.DecisionState _state = DecisionCore.State.DecisionState.CreateInitial("S1", "T1");
+
+            public GatedReentrantProcessor(Func<ISignalIngressSink> sink, ManualResetEventSlim gate, ManualResetEventSlim inApply)
+            {
+                _sink = sink;
+                _gate = gate;
+                _inApply = inApply;
+            }
+
+            public int CallCount { get { lock (_calls) { return _calls.Count; } } }
+            public DecisionSignalKind[] Kinds { get { lock (_calls) { return _calls.Select(c => c.Kind).ToArray(); } } }
+            public int[] ThreadIds { get { lock (_calls) { return _calls.Select(c => c.ThreadId).ToArray(); } } }
+
+            public DecisionCore.State.DecisionState CurrentState => _state;
+
+            public EffectRunResult ApplyStep(DecisionStep step, DecisionSignal signal)
+            {
+                lock (_calls) { _calls.Add((signal.Kind, Thread.CurrentThread.ManagedThreadId)); }
+                _state = step.NewState;
+                if (signal.Kind == DecisionSignalKind.SessionStarted)
+                {
+                    _inApply.Set();
+                    _gate.Wait();
+                    _sink().Post(
+                        DecisionSignalKind.ClassifierVerdictIssued,
+                        signal.OccurredAtUtc,
+                        "effectrunner:classifier:test",
+                        new Evidence(EvidenceKind.Synthetic, "classifier:test:h", "Strong/90"),
+                        new Dictionary<string, string> { ["level"] = "Strong" });
+                }
+                return EffectRunResult.Empty();
+            }
+        }
+
+        private sealed class ChainingProcessor : IDecisionStepProcessor
+        {
+            private readonly Func<ISignalIngressSink> _sink;
+            private DecisionCore.State.DecisionState _state = DecisionCore.State.DecisionState.CreateInitial("S1", "T1");
+            public List<string> Origins { get; } = new List<string>();
+
+            public ChainingProcessor(Func<ISignalIngressSink> sink) { _sink = sink; }
+
+            public DecisionCore.State.DecisionState CurrentState => _state;
+
+            public EffectRunResult ApplyStep(DecisionStep step, DecisionSignal signal)
+            {
+                Origins.Add(signal.SourceOrigin);
+                _state = step.NewState;
+                string? next = signal.Kind == DecisionSignalKind.SessionStarted ? "chain:1"
+                    : signal.SourceOrigin == "chain:1" ? "chain:2"
+                    : null;
+                if (next != null)
+                {
+                    _sink().Post(
+                        DecisionSignalKind.ClassifierVerdictIssued,
+                        signal.OccurredAtUtc,
+                        next,
+                        new Evidence(EvidenceKind.Synthetic, next, next));
+                }
+                return EffectRunResult.Empty();
+            }
+        }
+
         [Fact]
         public void Post_via_ISignalIngressSink_reaches_reducer_like_any_signal()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/BackendSessionRegistrationTests.cs

@@ -58,6 +58,47 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.Same(registration, result.Registration);
         }
 
+        [Fact]
+        public void RotateSession_rotates_id_updates_config_drops_spool_and_keeps_whiteglove_marker()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp.Path);
+            var persistence = new SessionIdPersistence(tmp.Path);
+            var original = persistence.GetOrCreate();
+            persistence.SaveWhiteGloveComplete();
+            var config = new AgentConfiguration { ApiBaseUrl = "https://example.invalid", TenantId = "t", SessionId = original };
+
+            var transportDir = Path.Combine(tmp.Path, "Spool");
+            Directory.CreateDirectory(transportDir);
+            File.WriteAllText(Path.Combine(transportDir, "spool.jsonl"), "{}");
+            File.WriteAllText(Path.Combine(transportDir, "upload-cursor.json"), "{}");
+            File.WriteAllText(Path.Combine(transportDir, "unrelated.txt"), "keep");
+
+            var rotated = BackendSessionRegistration.RotateSession(config, persistence, auth: null, transportDir, logger);
+
+            Assert.NotEqual(original, rotated);
+            Assert.Equal(rotated, config.SessionId);
+            Assert.Equal(rotated, new SessionIdPersistence(tmp.Path).GetOrCreate());
+            Assert.True(persistence.IsWhiteGloveResume());
+            Assert.False(File.Exists(Path.Combine(transportDir, "spool.jsonl")));
+            Assert.False(File.Exists(Path.Combine(transportDir, "upload-cursor.json")));
+            Assert.True(File.Exists(Path.Combine(transportDir, "unrelated.txt")));
+        }
+
+        [Fact]
+        public void RotateSession_tolerates_a_missing_transport_directory()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp.Path);
+            var persistence = new SessionIdPersistence(tmp.Path);
+            var config = new AgentConfiguration { ApiBaseUrl = "https://example.invalid", TenantId = "t", SessionId = persistence.GetOrCreate() };
+
+            var rotated = BackendSessionRegistration.RotateSession(
+                config, persistence, auth: null, Path.Combine(tmp.Path, "does-not-exist"), logger);
+
+            Assert.Equal(rotated, config.SessionId);
+        }
+
         [Fact]
         public void Register_throws_on_null_arguments()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/LifecycleEmittersRemoteConfigTests.cs

@@ -182,6 +182,73 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.Equal("FromCache", data["outcome"]);
         }
 
+        // ── Post-registration recovery (Phase 6.5, tenant aebdce78 audit 2026-08-24) ─
+
+        [Fact]
+        public void EmitFetchFailedIfAny_AfterRecovery_MarksRecoveredAndDemotesToInfo()
+        {
+            using var rig = new EmitterRig();
+            // Startup fetch failed (network link not up yet), then the post-registration
+            // recovery fetched ConfigVersion 39. The event must keep the original failure
+            // details AND mark the heal.
+            rig.RemoteConfig.SetFakeOutcome(
+                RemoteConfigFetchOutcome.UsedDefaults,
+                configVersion: 39, // CurrentConfig now holds the recovered config
+                attempts: 4,
+                failureType: "HttpRequestException",
+                failureMessage: "simulated dead network link",
+                recovered: true);
+
+            LifecycleEmitters.EmitRemoteConfigFetchFailedIfAny(
+                rig.Post, rig.AgentConfig, rig.RemoteConfig, rig.Logger);
+
+            var data = AssertSingleEmit(rig.Sink, expectedEventType: "remote_config_fetch_failed");
+            Assert.Equal("UsedDefaults", data["outcome"]); // startup failure record intact
+            Assert.Equal(4, data["attempts"]);
+            Assert.Equal(true, data["recovered"]);
+            Assert.Equal(39, data["recoveredConfigVersion"]);
+            Assert.Equal(nameof(EventSeverity.Info), rig.Sink.Posted[0].Payload!["severity"]);
+        }
+
+        [Fact]
+        public void EmitFetchFailedIfAny_WithoutRecovery_StaysWarning()
+        {
+            using var rig = new EmitterRig();
+            rig.RemoteConfig.SetFakeOutcome(
+                RemoteConfigFetchOutcome.UsedDefaults,
+                configVersion: 0,
+                attempts: 4,
+                failureType: "HttpRequestException",
+                failureMessage: "still down");
+
+            LifecycleEmitters.EmitRemoteConfigFetchFailedIfAny(
+                rig.Post, rig.AgentConfig, rig.RemoteConfig, rig.Logger);
+
+            var data = AssertSingleEmit(rig.Sink, expectedEventType: "remote_config_fetch_failed");
+            Assert.False(data.ContainsKey("recovered"));
+            Assert.False(data.ContainsKey("recoveredConfigVersion"));
+            Assert.Equal(nameof(EventSeverity.Warning), rig.Sink.Posted[0].Payload!["severity"]);
+        }
+
+        [Fact]
+        public void EmitAgentStarted_AfterRecovery_FlagsLiveConfig()
+        {
+            using var rig = new EmitterRig();
+            rig.RemoteConfig.SetFakeOutcome(
+                RemoteConfigFetchOutcome.UsedDefaults,
+                configVersion: 39,
+                recovered: true);
+
+            LifecycleEmitters.EmitAgentStarted(
+                rig.Post, rig.AgentConfig, rig.PreviousExit, "2.0.806", rig.RemoteConfig, rig.Logger);
+
+            var data = AssertSingleEmit(rig.Sink, expectedEventType: "agent_started");
+            Assert.Equal(39, data["configVersion"]);
+            Assert.Equal(true, data["remoteConfigFetched"]); // running on a live-fetched config
+            Assert.Equal("UsedDefaults", data["remoteConfigOutcome"]); // startup outcome stays honest
+            Assert.Equal(true, data["remoteConfigRecovered"]);
+        }
+
         // ── Helpers ─────────────────────────────────────────────────────────
 
         private static Dictionary<string, object> AssertSingleEmit(
@@ -258,8 +325,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
                 int attempts = 1,
                 string? failureType = null,
                 string? failureMessage = null,
-                int? authStatusCode = null)
+                int? authStatusCode = null,
+                bool recovered = false)
             {
+                typeof(RemoteConfigService).GetProperty(nameof(RecoveredAfterFetchFailure))?.SetValue(this, recovered);
                 // CurrentConfig is set via the protected SetConfig path — easiest:
                 // a real FetchConfigAsync replacement that just stashes a canned config.
                 typeof(RemoteConfigService).GetMethod("SetConfig",

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/EntraDeviceCertHelperParseTests.cs

@@ -0,0 +1,146 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Security;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
+{
+    /// <summary>
+    /// Pins <see cref="EntraDeviceCertHelper.ParseGuidFromExtension"/>, the pure byte-level part of the
+    /// cert probe. Both encodings Microsoft actually ships are covered: the ASN.1 OCTET STRING wrapper
+    /// used by the MS-Organization-Access TenantId/DeviceId extensions (and Intune's
+    /// <c>1.2.840.113556.5.6</c> / <c>5.14</c>), and the BARE 16-byte payload used by Intune's DeviceId
+    /// extension <c>1.2.840.113556.5.4</c> — the latter was silently returning <c>null</c> before.
+    /// The store-iteration shell around it needs a real machine cert store and is not unit-tested.
+    /// </summary>
+    public sealed class EntraDeviceCertHelperParseTests
+    {
+        // Synthetic — never a real tenant/device id. ToByteArray() gives the MS little-endian layout
+        // that both cert encodings carry, so every expectation below is derived, not hand-transcribed.
+        private static readonly Guid Sample = new Guid("11223344-5566-7788-99aa-bbccddeeff00");
+
+        private static byte[] Wrap(byte[] payload, params byte[] header)
+        {
+            var buf = new byte[header.Length + payload.Length];
+            Buffer.BlockCopy(header, 0, buf, 0, header.Length);
+            Buffer.BlockCopy(payload, 0, buf, header.Length, payload.Length);
+            return buf;
+        }
+
+        [Fact]
+        public void OctetString_ShortForm_Parses()
+        {
+            var raw = Wrap(Sample.ToByteArray(), 0x04, 0x10);
+
+            Assert.Equal(Sample, EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        [Fact]
+        public void OctetString_LongForm_Parses()
+        {
+            var raw = Wrap(Sample.ToByteArray(), 0x04, 0x81, 0x10);
+
+            Assert.Equal(Sample, EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        /// <summary>
+        /// The regression this class exists for: Intune's <c>1.2.840.113556.5.4</c> extension value is
+        /// exactly 16 bytes with no <c>04 10</c> prefix, so the strict OCTET-STRING parser bailed on the
+        /// tag check and the DeviceId was unreadable.
+        /// </summary>
+        [Fact]
+        public void BareSixteenBytes_Parses()
+        {
+            var raw = Sample.ToByteArray();
+
+            Assert.Equal(Sample, EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        /// <summary>
+        /// A bare GUID may legitimately start with 0x04 (the OCTET STRING tag). That must not be
+        /// mistaken for a wrapper: a wrapped 16-byte GUID is always >= 18 bytes, so the two forms are
+        /// disjoint by length and the bare path has to win here.
+        /// </summary>
+        [Fact]
+        public void BareSixteenBytes_StartingWithOctetStringTag_StillParses()
+        {
+            var guid = new Guid("aabbcc04-0110-4020-8030-405060708090");
+            var raw = guid.ToByteArray();
+
+            Assert.Equal(0x04, raw[0]); // guard: the byte layout really does start with the ASN.1 tag
+            Assert.Equal(16, raw.Length);
+            Assert.Equal(guid, EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        [Fact]
+        public void OctetString_IsLittleEndianMsLayout()
+        {
+            // 04 10 + the canonical MS binary layout of {11223344-...} => first group byte-reversed.
+            var raw = new byte[]
+            {
+                0x04, 0x10,
+                0x44, 0x33, 0x22, 0x11,
+                0x66, 0x55,
+                0x88, 0x77,
+                0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x00
+            };
+
+            Assert.Equal(Sample, EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        [Fact]
+        public void Null_ReturnsNull()
+        {
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(null));
+        }
+
+        [Fact]
+        public void Empty_ReturnsNull()
+        {
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(new byte[0]));
+        }
+
+        [Theory]
+        [InlineData(15)]
+        [InlineData(17)]
+        public void BarePayload_OfWrongLength_ReturnsNull(int length)
+        {
+            var raw = new byte[length];
+            for (var i = 0; i < length; i++) raw[i] = (byte)(0x40 + i); // no 0x04 tag, no valid wrapper
+
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        [Fact]
+        public void NonOctetStringTag_ReturnsNull()
+        {
+            // e.g. Intune's 1.2.840.113556.5.15 => ASN.1 INTEGER 2.
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(new byte[] { 0x02, 0x01, 0x02 }));
+        }
+
+        [Fact]
+        public void OctetString_WithNonGuidContentLength_ReturnsNull()
+        {
+            var raw = Wrap(new byte[8], 0x04, 0x08);
+
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        [Fact]
+        public void OctetString_TruncatedContent_ReturnsNull()
+        {
+            // Declares 16 content bytes but only carries 10.
+            var raw = Wrap(new byte[10], 0x04, 0x10);
+
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+
+        [Fact]
+        public void OctetString_LongFormWithOversizedLengthHeader_ReturnsNull()
+        {
+            // 0x85 => 5 length bytes, above the 4 the parser accepts.
+            var raw = Wrap(Sample.ToByteArray(), 0x04, 0x85, 0x00, 0x00, 0x00, 0x00, 0x10);
+
+            Assert.Null(EntraDeviceCertHelper.ParseGuidFromExtension(raw));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/SessionIdPersistenceTests.cs

@@ -72,6 +72,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
             Assert.NotEqual(first, second);
         }
 
+        [Fact]
+        public void Rotate_writes_a_new_id_and_keeps_the_whiteglove_marker()
+        {
+            using var tmp = new TempDirectory();
+            var sut = new SessionIdPersistence(tmp.Path);
+            var first = sut.GetOrCreate();
+            sut.SaveWhiteGloveComplete();
+            var createdBefore = File.ReadAllText(Path.Combine(tmp.Path, "session.created"));
+
+            var rotated = sut.Rotate();
+
+            Assert.True(Guid.TryParse(rotated, out _));
+            Assert.NotEqual(first, rotated);
+            Assert.Equal(rotated, File.ReadAllText(Path.Combine(tmp.Path, "session.id")));
+            Assert.Equal(rotated, new SessionIdPersistence(tmp.Path).GetOrCreate());
+            Assert.True(sut.IsWhiteGloveResume(), "Rotate must not clear whiteglove.complete (unlike Delete)");
+            Assert.True(File.Exists(Path.Combine(tmp.Path, "session.created")));
+            Assert.NotEqual(createdBefore, File.ReadAllText(Path.Combine(tmp.Path, "session.created")));
+        }
+
         [Fact]
         public void Ctor_creates_data_directory_when_missing()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/SessionRegistrationHelperTests.cs

@@ -96,6 +96,112 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
             Assert.Equal(1, tracker.ConsecutiveFailures);
         }
 
+        // ── SESSION-OWNER-BINDING ────────────────────────────────────────────
+
+        private static BackendAuthException OwnerMismatch()
+            => new BackendAuthException("Backend returned 403 Forbidden.", statusCode: 403,
+                errorCode: AutopilotMonitor.Shared.Constants.AgentErrorCodes.SessionOwnerMismatch);
+
+        [Fact]
+        public async Task Owner_mismatch_rotates_once_and_re_registers_without_recording_an_auth_failure()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+            var originalSessionId = config.SessionId;
+            var rotatedTo = Guid.NewGuid().ToString();
+            var seenSessionIds = new System.Collections.Generic.List<string>();
+
+            var apiClient = new FakeApiClient(
+                attempt => attempt == 1
+                    ? throw OwnerMismatch()
+                    : new RegisterSessionResponse { Success = true, SessionId = rotatedTo, ValidatedBy = ValidatorType.AutopilotV1 },
+                onRegister: r => seenSessionIds.Add(r.SessionId));
+
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+            var rotations = 0;
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker,
+                backoffDelay: _ => throw new InvalidOperationException("rotation must retry without backoff"),
+                networkLinkWait: _ => Task.CompletedTask,
+                rotateSession: () => { rotations++; config.SessionId = rotatedTo; return rotatedTo; });
+
+            Assert.Equal(SessionRegistrationOutcome.Succeeded, result.Outcome);
+            Assert.Equal(2, apiClient.CallCount);
+            Assert.Equal(1, rotations);
+            Assert.Equal(0, tracker.ConsecutiveFailures);
+            Assert.Equal(new[] { originalSessionId, rotatedTo }, seenSessionIds);
+            Assert.Equal(originalSessionId, result.RotatedFromSessionId);
+        }
+
+        [Fact]
+        public async Task Second_owner_mismatch_after_rotation_is_an_auth_failure()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var apiClient = new FakeApiClient(_ => throw OwnerMismatch());
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker,
+                networkLinkWait: _ => Task.CompletedTask,
+                rotateSession: () => { config.SessionId = Guid.NewGuid().ToString(); return config.SessionId; });
+
+            Assert.Equal(SessionRegistrationOutcome.AuthFailed, result.Outcome);
+            Assert.Equal(403, result.HttpStatusCode);
+            Assert.Equal(2, apiClient.CallCount);
+            Assert.Equal(1, tracker.ConsecutiveFailures);
+        }
+
+        [Fact]
+        public async Task Owner_mismatch_without_rotation_hook_behaves_like_any_auth_failure()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var apiClient = new FakeApiClient(_ => throw OwnerMismatch());
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker, networkLinkWait: _ => Task.CompletedTask);
+
+            Assert.Equal(SessionRegistrationOutcome.AuthFailed, result.Outcome);
+            Assert.Equal(1, apiClient.CallCount);
+            Assert.Equal(1, tracker.ConsecutiveFailures);
+            Assert.Null(result.RotatedFromSessionId);
+        }
+
+        [Fact]
+        public async Task Rotation_hook_failure_falls_back_to_auth_failed()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var apiClient = new FakeApiClient(_ => throw OwnerMismatch());
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker, networkLinkWait: _ => Task.CompletedTask,
+                rotateSession: () => throw new IOException("disk full"));
+
+            Assert.Equal(SessionRegistrationOutcome.AuthFailed, result.Outcome);
+            Assert.Equal(1, apiClient.CallCount);
+            Assert.Equal(1, tracker.ConsecutiveFailures);
+        }
+
         [Fact]
         public async Task Fails_after_six_exceptions_without_auth_error()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterUserSessionGateTests.cs

@@ -163,5 +163,45 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             Assert.Single(f.DecisionSignals(DecisionSignalKind.ImeUserSessionCompleted));
             Assert.Single(f.InfoEvents(SharedEventTypes.ImeUserSessionCompleted));
         }
+
+        // ==================================================== zero-app evidence label ====
+
+        [Fact]
+        public void Zero_app_user_session_labels_the_evidence_on_signal_and_timeline()
+        {
+            // Sessions 81daa77f / 75d6ae8e: with no user-targeted apps IME never writes its
+            // "Completed user session" line at all, so the verdict rests on a different
+            // observation. Whoever reads the timeline later must be able to tell which.
+            using var f = new ImeLogTrackerAdapterFixture();
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+            f.Tracker.SeedCurrentPhaseForTesting("AccountSetup");
+            f.Tracker.SeedUserSessionZeroAppsForTesting();
+
+            adapter.TriggerUserSessionCompletedFromTest();
+
+            Assert.Single(f.DecisionSignals(DecisionSignalKind.ImeUserSessionCompleted));
+            var evt = Assert.Single(f.InfoEvents(SharedEventTypes.ImeUserSessionCompleted));
+            Assert.Equal(
+                ImeLogTrackerAdapter.EvidenceZeroUserApps,
+                evt.Payload!["evidence"]);
+        }
+
+        [Fact]
+        public void Ordinary_user_session_completion_keeps_the_default_evidence_label()
+        {
+            // Mutation proof for the branch above.
+            using var f = new ImeLogTrackerAdapterFixture();
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+            f.Tracker.SeedCurrentPhaseForTesting("AccountSetup");
+            AddApp(f.Tracker, "app-done", AppIntent.Install, AppInstallationState.Installed);
+
+            adapter.TriggerUserSessionCompletedFromTest();
+
+            var evt = Assert.Single(f.InfoEvents(SharedEventTypes.ImeUserSessionCompleted));
+            Assert.Equal(
+                ImeLogTrackerAdapter.EvidenceUserSessionCompleted,
+                evt.Payload!["evidence"]);
+        }
+
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Termination/SummaryDialogLauncherTests.cs

@@ -50,5 +50,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
 
             Assert.Equal(a, b);
         }
+
+        // The branding URL is tenant config; the dialog parses arguments last-occurrence-wins, so
+        // an embedded quote must never terminate the argument and inject extra flags (CWE-88).
+
+        private const string BaseArgs = "--status-file \"C:\\x\\final-status.json\" --timeout 30 --cleanup";
+
+        [Fact]
+        public void BuildDialogArguments_omits_branding_when_empty()
+        {
+            var args = SummaryDialogLauncher.BuildDialogArguments(@"C:\x\final-status.json", 30, null, null);
+
+            Assert.Equal(BaseArgs, args);
+        }
+
+        [Fact]
+        public void BuildDialogArguments_appends_clean_https_url_as_single_quoted_argument()
+        {
+            var args = SummaryDialogLauncher.BuildDialogArguments(@"C:\x\final-status.json", 30, "https://cdn.example/logo.png?v=2", null);
+
+            Assert.Equal(BaseArgs + " --branding-url \"https://cdn.example/logo.png?v=2\"", args);
+        }
+
+        [Theory]
+        [InlineData("x\" --status-file \"C:\\some\\file\" --timeout \"0")]
+        [InlineData("https://cdn.example/logo.png\" --cleanup")]
+        [InlineData("https://cdn.example/logo.png --timeout 0")]
+        [InlineData("https://cdn.example/lo'go.png")]
+        [InlineData("https://cdn.example/logo.png\r\n")]
+        [InlineData("http://cdn.example/logo.png")]
+        [InlineData("file:///C:/Windows/x.png")]
+        [InlineData("cdn.example/logo.png")]
+        public void BuildDialogArguments_drops_unsafe_branding_url(string url)
+        {
+            var args = SummaryDialogLauncher.BuildDialogArguments(@"C:\x\final-status.json", 30, url, null);
+
+            Assert.Equal(BaseArgs, args);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendApiClientAuthClassificationTests.cs

@@ -61,6 +61,46 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.Contains("The device is not authorized", ex.Message);
         }
 
+        [Fact]
+        public async Task Backend_json_403_carries_the_errorCode_when_present()
+        {
+            using var client = BuildClient(
+                HttpStatusCode.Forbidden,
+                "{\"success\":false,\"message\":\"Session belongs to another device\",\"errorCode\":\"session_owner_mismatch\"}",
+                "application/json");
+
+            var ex = await Assert.ThrowsAsync<BackendAuthException>(() => client.GetAgentConfigAsync("tenant-1"));
+
+            Assert.Equal(403, ex.StatusCode);
+            Assert.False(ex.EndpointUnavailable);
+            Assert.Equal("session_owner_mismatch", ex.ErrorCode);
+        }
+
+        [Fact]
+        public async Task Backend_json_403_without_errorCode_yields_null()
+        {
+            using var client = BuildClient(
+                HttpStatusCode.Forbidden,
+                "{\"success\":false,\"message\":\"Device validation failed\"}",
+                "application/json");
+
+            var ex = await Assert.ThrowsAsync<BackendAuthException>(() => client.GetAgentConfigAsync("tenant-1"));
+            Assert.Null(ex.ErrorCode);
+        }
+
+        [Theory]
+        [InlineData(null, null)]
+        [InlineData("", null)]
+        [InlineData("not json", null)]
+        [InlineData("<html><body>403</body></html>", null)]
+        [InlineData("{\"errorCode\":42}", null)]
+        [InlineData("{\"errorCode\":\"  \"}", null)]
+        [InlineData("{\"errorCode\":\"session_owner_mismatch\"}", "session_owner_mismatch")]
+        [InlineData("{\"ErrorCode\":\"session_owner_mismatch\"}", "session_owner_mismatch")]
+        [InlineData("  {\"success\":false,\"errorCode\":\" x \"}", "x")]
+        public void TryExtractErrorCode_is_tolerant(string? body, string? expected)
+            => Assert.Equal(expected, BackendApiClient.TryExtractErrorCode(body!));
+
         [Fact]
         public async Task Platform_html_403_is_reported_as_endpoint_unavailable_with_page_title()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core/AutopilotMonitor.Agent.V2.Core.csproj

@@ -52,6 +52,11 @@
          carries the V2 assembly namespace so GatherRuleGuards locates it under
          "AutopilotMonitor.Agent.V2.Core.Resources.guardrails.json". -->
     <EmbeddedResource Include="..\..\..\rules\guardrails.json" LogicalName="AutopilotMonitor.Agent.V2.Core.Resources.guardrails.json" />
+    <!-- Built-in fallback rule catalogs (BuiltInConfigCatalog): the SAME CI-combined
+         rules/dist artifacts the backend embeds and serves. Snapshotted per agent build so
+         the no-config/no-cache fallback still runs full IME tracking instead of nothing. -->
+    <EmbeddedResource Include="..\..\..\rules\dist\ime-log-patterns.json" LogicalName="AutopilotMonitor.Agent.V2.Core.Resources.ime-log-patterns.json" />
+    <EmbeddedResource Include="..\..\..\rules\dist\gather-rules.json" LogicalName="AutopilotMonitor.Agent.V2.Core.Resources.gather-rules.json" />
   </ItemGroup>
 
   <ItemGroup>

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/BuiltInConfigCatalog.cs

@@ -0,0 +1,74 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+
+namespace AutopilotMonitor.Agent.V2.Core.Configuration
+{
+    /// <summary>
+    /// Compiled-in fallback copies of the global rule catalogs, embedded from the same
+    /// CI-generated <c>rules/dist</c> artifacts the backend seeds and serves — single
+    /// source by construction: each agent release snapshots the catalog state of its own
+    /// build, so the offline fallback can never drift further than the running agent
+    /// version itself (no manually maintained default to forget).
+    /// <para>
+    /// Consumed only by <see cref="RemoteConfigService"/>'s built-in default config,
+    /// i.e. when a session has NO live config and NO cache. Before this existed, that
+    /// path shipped an empty <c>ImeLogPatterns</c> list, which left the entire IME
+    /// tracking pipeline (app installs, platform/remediation scripts, health-script
+    /// compliance, IME ESP-phase signals) dead for the whole session — the core of
+    /// enrollment monitoring. A live fetch (startup, post-registration recovery or
+    /// rotate_config) always wins over this catalog.
+    /// </para>
+    /// Fail-soft: any load/parse error returns an empty list (the pre-catalog behaviour).
+    /// </summary>
+    internal static class BuiltInConfigCatalog
+    {
+        /// <summary>Enabled built-in IME log patterns from the embedded catalog.</summary>
+        public static List<ImeLogPattern> GetEnabledImeLogPatterns(AgentLogger logger)
+            => LoadEnabled<ImeLogPattern>("ime-log-patterns.json", p => p.Enabled, logger);
+
+        /// <summary>Enabled built-in gather rules from the embedded catalog.</summary>
+        public static List<GatherRule> GetEnabledGatherRules(AgentLogger logger)
+            => LoadEnabled<GatherRule>("gather-rules.json", r => r.Enabled, logger);
+
+        private static List<T> LoadEnabled<T>(string name, Func<T, bool> isEnabled, AgentLogger logger)
+        {
+            try
+            {
+                var assembly = typeof(BuiltInConfigCatalog).Assembly;
+                using (var stream = assembly.GetManifestResourceStream(
+                    "AutopilotMonitor.Agent.V2.Core.Resources." + name))
+                {
+                    if (stream == null)
+                    {
+                        logger?.Warning($"Built-in config catalog resource '{name}' not found — fallback runs without it.");
+                        return new List<T>();
+                    }
+
+                    using (var reader = new StreamReader(stream))
+                    {
+                        var wrapper = JsonConvert.DeserializeObject<RulesFile<T>>(reader.ReadToEnd());
+                        var all = wrapper?.Rules ?? new List<T>();
+                        return all.Where(isEnabled).ToList();
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                logger?.Warning($"Built-in config catalog '{name}' failed to load ({ex.Message}) — fallback runs without it.");
+                return new List<T>();
+            }
+        }
+
+        /// <summary>Shape of the CI-combined catalog files: <c>{ "rules": [...] }</c>.</summary>
+        private sealed class RulesFile<T>
+        {
+            [JsonProperty("rules")]
+            public List<T> Rules { get; set; }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/RemoteConfigService.cs

@@ -42,6 +42,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
             TimeSpan.FromSeconds(60),
         };
 
+        /// <summary>
+        /// Upper bound for the pre-fetch network-link wait on the initial startup fetch.
+        /// Deliberately longer than the registration gate's 15s: the fetch runs FIRST after a
+        /// boot-time relaunch, when Wi-Fi may still be associating (802.1X, OOBE), and a fetch
+        /// burned into a dead link strands the whole session on built-in defaults — tenant aebdce78
+        /// audit 2026-08-24: ~50% of sessions lost their tenant config exactly this way.
+        /// </summary>
+        internal static readonly TimeSpan InitialFetchNetworkLinkWaitMax = TimeSpan.FromSeconds(60);
+
         /// <summary>
         /// Gets the current configuration (thread-safe)
         /// </summary>
@@ -76,6 +85,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         /// <summary>HTTP status for auth failures (401/403), null otherwise.</summary>
         public int? LastFetchAuthStatusCode { get; private set; }
 
+        /// <summary>
+        /// True once <see cref="TryRecoverConfigAsync"/> replaced a failed startup fetch with a
+        /// live config. The <c>LastFetch*</c> properties intentionally keep describing the failed
+        /// startup fetch so the wire event can report both the original failure and the recovery.
+        /// </summary>
+        public bool RecoveredAfterFetchFailure { get; private set; }
+
         public RemoteConfigService(BackendApiClient apiClient, string tenantId, AgentLogger logger, EmergencyReporter emergencyReporter = null, DistressReporter distressReporter = null, AuthFailureTracker authFailureTracker = null)
         {
             _apiClient = apiClient ?? throw new ArgumentNullException(nameof(apiClient));
@@ -116,6 +132,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
             LastFetchFailureMessage = null;
             LastFetchAuthStatusCode = null;
 
+            // Initial startup fetch only: give a still-associating NIC a chance to come up
+            // before the first attempt. Without this the retry budget (10/30/60s) is burned
+            // into a provably dead link — the agent starts at boot, Wi-Fi associates minutes
+            // later, and the session runs on defaults although the backend was never the
+            // problem. The rotate_config path (retryOnTransientErrors:false) runs mid-session
+            // on a proven link and must stay latency-bounded, so it skips the gate.
+            if (retryOnTransientErrors)
+            {
+                try { await WaitForNetworkLinkAsync().ConfigureAwait(false); }
+                catch (Exception ex) { _logger.Debug($"Pre-fetch network wait failed ({ex.Message}) — fetching anyway."); }
+            }
+
             var maxAttempts = retryOnTransientErrors ? InitialFetchRetryBackoff.Length + 1 : 1;
             Exception lastException = null;
 
@@ -203,14 +231,63 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                 return cached;
             }
 
-            // Fall back to defaults
-            _logger.Info("No cached config available, using defaults (all optional collectors disabled)");
+            // Fall back to built-in defaults (collector/analyzer defaults from the shared
+            // model initializers + the compiled-in rule catalogs).
             var defaults = CreateDefaultConfig();
+            _logger.Info($"No cached config available, using built-in defaults (ConfigVersion=0, " +
+                         $"{defaults.ImeLogPatterns?.Count ?? 0} built-in IME patterns, " +
+                         $"{defaults.GatherRules?.Count ?? 0} built-in gather rules)");
             SetConfig(defaults);
             LastFetchOutcome = RemoteConfigFetchOutcome.UsedDefaults;
             return defaults;
         }
 
+        /// <summary>
+        /// Single-attempt recovery fetch for a session whose startup fetch failed. Called right
+        /// after session registration succeeded — registration proves the backend is reachable,
+        /// so the config that Phase 4 could not get is one cheap call away instead of the whole
+        /// session being stranded on cache/defaults (only a manual <c>rotate_config</c> action
+        /// could rescue it before this existed).
+        /// <para>
+        /// Unlike <see cref="FetchConfigAsync"/> this does NOT reset the <c>LastFetch*</c>
+        /// observability state — those keep describing the failed startup fetch so
+        /// <c>remote_config_fetch_failed</c> can report the original failure AND the recovery.
+        /// Returns the recovered config, or null when there is nothing to recover (startup fetch
+        /// succeeded / never ran) or the recovery attempt itself failed. Never throws.
+        /// </para>
+        /// </summary>
+        public async Task<AgentConfigResponse> TryRecoverConfigAsync()
+        {
+            if (LastFetchOutcome != RemoteConfigFetchOutcome.FromCache &&
+                LastFetchOutcome != RemoteConfigFetchOutcome.UsedDefaults)
+                return null;
+
+            try
+            {
+                _logger.Info("Retrying remote config fetch after successful session registration...");
+                var config = await CallBackendAsync().ConfigureAwait(false);
+                if (config == null)
+                {
+                    _logger.Warning("Config recovery fetch returned empty response — keeping fallback config.");
+                    return null;
+                }
+
+                _logger.Info($"Remote config recovered: ConfigVersion={config.ConfigVersion}, " +
+                             $"GatherRules={config.GatherRules?.Count ?? 0}");
+                LogCollectorSettings(config.Collectors);
+                SetConfig(config);
+                CacheConfig(config);
+                _authFailureTracker?.RecordSuccess();
+                RecoveredAfterFetchFailure = true;
+                return config;
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"Config recovery fetch failed ({ex.Message}) — keeping fallback config.");
+                return null;
+            }
+        }
+
         private void SetConfig(AgentConfigResponse config)
         {
             lock (_configLock)
@@ -319,6 +396,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
 
         private AgentConfigResponse CreateDefaultConfig()
         {
+            // Everything not set here falls to the shared AgentConfigResponse property
+            // initializers — the same values the backend uses as its `??` fallbacks, so the
+            // scalar knobs cannot drift. The rule catalogs are the one thing initializers
+            // cannot supply: without them the whole IME tracking pipeline is dead, so they
+            // come from the compiled-in snapshot of the served catalogs (BuiltInConfigCatalog).
             return new AgentConfigResponse
             {
                 ConfigVersion = 0,
@@ -330,8 +412,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                 EnableGatherRuleDebugLog = false,
                 EnableEspContinueAnywayObservation = false,
                 Collectors = CollectorConfiguration.CreateDefault(),
-                GatherRules = new System.Collections.Generic.List<GatherRule>(),
-                ImeLogPatterns = new System.Collections.Generic.List<ImeLogPattern>()
+                GatherRules = BuiltInConfigCatalog.GetEnabledGatherRules(_logger),
+                ImeLogPatterns = BuiltInConfigCatalog.GetEnabledImeLogPatterns(_logger)
             };
         }
 
@@ -358,6 +440,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         protected virtual Task DelayBetweenAttemptsAsync(TimeSpan delay)
             => Task.Delay(delay);
 
+        /// <summary>
+        /// Awaits the pre-fetch network-link gate (initial startup fetch only). Production
+        /// polls the link-level signal via <see cref="NetworkLinkWait"/> bounded by
+        /// <see cref="InitialFetchNetworkLinkWaitMax"/>; tests subclass to record the call
+        /// and return immediately.
+        /// </summary>
+        protected virtual Task WaitForNetworkLinkAsync()
+            => NetworkLinkWait.WaitAsync(_logger, InitialFetchNetworkLinkWaitMax, "Remote config fetch");
+
         public void Dispose()
         {
             // Nothing to dispose

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Handlers.cs

@@ -1042,6 +1042,56 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// </summary>
         internal string LastEspPhaseDetected => _lastEspPhaseDetected;
 
+        /// <summary>
+        /// True while the user-scope ESP phase is the tracker's current phase. Every user-phase
+        /// probe and the zero-apps evidence gate on this — outside AccountSetup the IME lines
+        /// belong to the device phase or the pre-sign-in (defaultuser0) frame.
+        /// </summary>
+        private bool IsUserEspPhaseActive =>
+            string.Equals(_lastEspPhaseDetected, "AccountSetup", StringComparison.OrdinalIgnoreCase);
+
+        /// <summary>
+        /// True once IME reported zero targeted Win32 apps for a user session while the user ESP
+        /// phase was active. Read by the adapter to label the evidence behind
+        /// <c>ime_user_session_completed</c>.
+        /// </summary>
+        internal bool UserSessionZeroAppsObserved => _userSessionZeroAppsObserved;
+
+        /// <summary>
+        /// IME-USER-SESSION-ZERO-APPS: IME enumerated the user session and found no targeted
+        /// Win32 apps. Its zero-app branch then <c>continue</c>s past the "Completed user
+        /// session" log statement, so this line is the only completion evidence such a device
+        /// ever produces — and IME itself treats the same condition as finished
+        /// (<c>ProviderResult.ProvisioningComplete</c> in the user check-in path, and an ESP
+        /// lock-in with an empty application list in the poller path).
+        /// <para>
+        /// Deliberately routed through <see cref="OnUserSessionCompleted"/> rather than a
+        /// separate callback: downstream this IS a completed user session, and the adapter's
+        /// pending-apps deferral plus its fire-once flag then apply unchanged.
+        /// </para>
+        /// <para>
+        /// Phase guard: firing before AccountSetup would burn the adapter's fire-once flag on a
+        /// pre-sign-in timestamp that <c>IsImeUserSessionGenuine</c> can never accept. The
+        /// observation is remembered instead and replayed by
+        /// <see cref="HandleEspPhaseDetected"/> on the transition into the user phase.
+        /// </para>
+        /// </summary>
+        private void HandleUserSessionZeroApps()
+        {
+            _userSessionZeroAppsObserved = true;
+
+            if (!IsUserEspPhaseActive)
+            {
+                _logger.Debug(
+                    "ImeLogTracker: zero-app user session observed before the user ESP phase " +
+                    $"(current phase: {_lastEspPhaseDetected ?? "(none)"}) - deferring until AccountSetup");
+                return;
+            }
+
+            _logger.Info("ImeLogTracker: user session enumerated with zero targeted apps - treating as user session completed");
+            OnUserSessionCompleted?.Invoke();
+        }
+
         private void HandleEspPhaseDetected(string espPhaseString)
         {
             // Validate phase and get its ordinal for forward-only enforcement
@@ -1120,6 +1170,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             ActivatePatterns(logPhaseIsCurrentPhase);
 
             OnEspPhaseChanged?.Invoke(espPhaseString);
+
+            // Replay a zero-app user session observed before this phase was known. IME logs its
+            // check-in lines independently of when the agent first parses the ESP phase marker,
+            // so the evidence can legitimately arrive first; without this the only completion
+            // evidence a zero-app device produces would be dropped on the floor.
+            if (isFirstOrChangedPhase && IsUserEspPhaseActive && _userSessionZeroAppsObserved)
+            {
+                _logger.Info("ImeLogTracker: replaying zero-app user session evidence observed before the user ESP phase");
+                OnUserSessionCompleted?.Invoke();
+            }
         }
 
         private void HandleEspTrackStatus(Match match)

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -387,6 +387,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         OnUserSessionCompleted?.Invoke();
                         break;
 
+                    case "usersessionzeroapps":
+                        // IME found no targeted user apps — its zero-app branch skips the
+                        // "Completed user session" line, so this is the equivalent evidence.
+                        HandleUserSessionZeroApps();
+                        break;
+
                     case "updatestateinstalled":
                         if (!string.IsNullOrEmpty(id))
                             UpdateStateWithCallback(id, AppInstallationState.Installed);

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -129,6 +129,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         private CancellationTokenSource _cts;
         private bool _allAppsCompletedFired;
 
+        // Sticky: IME enumerated a user session and reported ZERO targeted Win32 apps
+        // (IME-USER-SESSION-ZERO-APPS). IME's zero-app branch returns before it writes the
+        // "Completed user session" line, so on a device with no user-targeted apps that line
+        // never appears and every user-phase completion probe would starve forever. This flag
+        // IS the user-phase completion evidence for that shape. Set only while the user ESP
+        // phase is active, or replayed on the transition into it.
+        private bool _userSessionZeroAppsObserved;
+
         // State persistence: saves tracker state to disk so agent restart continues
         // from the exact log position without re-parsing or re-building ignore lists.
         private readonly ImeTrackerStatePersistence _statePersistence;
@@ -341,6 +349,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             _lastEspPhaseDetected = phaseName;
         }
 
+        /// <summary>
+        /// Test-only seam: marks the zero-targeted-apps user session as observed without driving
+        /// the IME-USER-SESSION-ZERO-APPS pattern through a log line. The pattern-to-flag path
+        /// itself is covered end-to-end by <c>ImeLogTrackerZeroUserAppsTests</c>.
+        /// </summary>
+        internal void SeedUserSessionZeroAppsForTesting()
+        {
+            _userSessionZeroAppsObserved = true;
+        }
+
         /// <summary>
         /// Returns a deduped union of phase-snapshotted apps plus the live
         /// <see cref="PackageStates"/> (current phase). Live entries win on Id collision.
@@ -395,11 +413,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         {
             try
             {
-                if (!string.Equals(_lastEspPhaseDetected, "AccountSetup", StringComparison.OrdinalIgnoreCase))
+                if (!IsUserEspPhaseActive)
                     return false;
 
                 var apps = new List<AppPackageState>(_packageStates);
-                if (apps.Count == 0) return false;
+
+                // Zero user-targeted apps is the MOST settled state there is, but the
+                // conservative "at least one required app" rule below reads it as "not
+                // settled" and starves the AccountSetup synthesis. Only an explicit IME
+                // observation lifts that — never a merely empty list, which also means
+                // "phase just cleared" or "apps not surfaced yet".
+                if (apps.Count == 0)
+                    return _userSessionZeroAppsObserved;
 
                 var sawRequired = false;
                 foreach (var pkg in apps)
@@ -746,6 +771,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             _currentPhaseOrder = state.CurrentPhaseOrder;
             _lastEspPhaseDetected = state.LastEspPhaseDetected;
             _allAppsCompletedFired = state.AllAppsCompletedFired;
+            _userSessionZeroAppsObserved = state.UserSessionZeroAppsObserved;
             _logPhaseIsCurrentPhase = state.LogPhaseIsCurrentPhase;
 
             // Restore seen app IDs
@@ -861,6 +887,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 CurrentPhaseOrder = _currentPhaseOrder,
                 LastEspPhaseDetected = _lastEspPhaseDetected,
                 AllAppsCompletedFired = _allAppsCompletedFired,
+                UserSessionZeroAppsObserved = _userSessionZeroAppsObserved,
                 LogPhaseIsCurrentPhase = _logPhaseIsCurrentPhase,
                 SeenAppIds = _seenAppIds.ToList(),
                 IgnoreList = _packageStates.IgnoreList.ToList(),

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerStatePersistence.cs

@@ -109,6 +109,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         public int CurrentPhaseOrder { get; set; }
         public string LastEspPhaseDetected { get; set; }
         public bool AllAppsCompletedFired { get; set; }
+
+        /// <summary>
+        /// IME reported zero targeted Win32 apps for a user session. Absent in state files
+        /// written before this field existed — deserializing to false there is correct: the
+        /// tracker simply re-observes the line on the next IME check-in.
+        /// </summary>
+        public bool UserSessionZeroAppsObserved { get; set; }
         public bool LogPhaseIsCurrentPhase { get; set; }
         public List<string> SeenAppIds { get; set; }
         public List<string> IgnoreList { get; set; }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WifiInfoProvider.cs

@@ -0,0 +1,106 @@
+using System;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
+{
+    /// <summary>
+    /// The single entry point every collector uses to read the current WiFi connection. Owns the
+    /// tier order so the two callers (<c>DeviceInfoCollector</c>, <c>NetworkChangeDetector</c>)
+    /// cannot drift apart:
+    /// <list type="number">
+    /// <item><see cref="WifiInfoReader"/> — native WLAN API. Full payload (SSID, signal, PHY,
+    /// channel), but Windows 11 24H2+ requires precise-location consent for it.</item>
+    /// <item><see cref="WinRtWifiSsidReader"/> — WinRT <c>GetConnectedSsid</c>. SSID only, but
+    /// NOT location-gated; this is the tier that carries 24H2+ devices whose image has location
+    /// services off (the common OOBE case — see that class for the mechanism).</item>
+    /// <item><see cref="NetshWifiFallback"/> — process spawn, localized output parsing. Last
+    /// resort: it hangs off the same location gate as tier 1, so it only helps when the native
+    /// API failed for an unrelated reason.</item>
+    /// </list>
+    /// Never throws. Returns null when the device has no readable WiFi connection.
+    /// </summary>
+    internal static class WifiInfoProvider
+    {
+        /// <summary>
+        /// <see cref="WifiConnectionInfo.DataLimitedReason"/> value for a payload cut down to the
+        /// SSID by the Windows 11 24H2 location gate. Travels verbatim into the
+        /// <c>wifi_signal_info</c> payload as <c>wifiDataLimitedReason</c> and is matched by the
+        /// portal's WiFi card — a published contract, so do not rename it.
+        /// </summary>
+        internal const string LocationServicesOff = "location_services_off";
+
+        /// <summary>
+        /// True when the native tier reported <c>ERROR_ACCESS_DENIED</c> — "rc=5" but not
+        /// "rc=50"/"rc=5023"; the diagnostics string ends the code with ';' or end-of-line.
+        /// That is the 24H2 location gate, not a driver or hardware fault.
+        /// Internal for direct unit-testing via InternalsVisibleTo.
+        /// </summary>
+        internal static bool IsLocationGateDenied(string nativeDiag)
+            => !string.IsNullOrEmpty(nativeDiag) && Regex.IsMatch(nativeDiag, @"rc=5(?!\d)");
+
+        /// <summary>
+        /// Reads the current WiFi connection, walking the tiers until one yields something.
+        /// <paramref name="preferredInterfaceId"/> is the adapter GUID from
+        /// <c>NetworkInterface.Id</c> (tier 1 only). <paramref name="diagnostics"/> is null on
+        /// success and otherwise explains what every tier reported — log it at Warning: this is
+        /// the only field evidence for a missing <c>wifi_signal_info</c> event.
+        /// </summary>
+        internal static WifiConnectionInfo TryRead(Guid? preferredInterfaceId, out string diagnostics)
+        {
+            var native = WifiInfoReader.TryGetCurrentConnection(preferredInterfaceId, out var nativeDiag);
+            if (native != null)
+            {
+                diagnostics = null;
+                return native;
+            }
+
+            var ssid = WinRtWifiSsidReader.TryGetConnectedSsid(out var winRtDiag);
+            if (ssid != null)
+            {
+                diagnostics = null;
+                return new WifiConnectionInfo
+                {
+                    Ssid = ssid,
+                    // Only claim the location gate when the native tier actually said so. Any
+                    // other native failure (no WLAN service, no connected interface) leaves this
+                    // null rather than blaming a setting we did not observe.
+                    DataLimitedReason = IsLocationGateDenied(nativeDiag) ? LocationServicesOff : null,
+                };
+            }
+
+            var netsh = NetshWifiFallback.TryRead();
+            if (netsh != null)
+            {
+                diagnostics = null;
+                return netsh;
+            }
+
+            diagnostics = BuildDiagnostics(nativeDiag, winRtDiag);
+            return null;
+        }
+
+        /// <summary>
+        /// Composes the all-tiers-failed message. A native <c>rc=5</c> (ERROR_ACCESS_DENIED) is
+        /// spelled out: that is the 24H2 location gate, not a driver or hardware fault, and it
+        /// takes the netsh tier down with it — without this hint the log reads like a mystery.
+        /// Internal for direct unit-testing via InternalsVisibleTo.
+        /// </summary>
+        internal static string BuildDiagnostics(string nativeDiag, string winRtDiag)
+        {
+            var text = new StringBuilder("no WiFi info from any reader");
+            text.Append(" — native: ").Append(string.IsNullOrEmpty(nativeDiag) ? "no connected WLAN interface" : nativeDiag);
+            text.Append("; WinRT: ").Append(string.IsNullOrEmpty(winRtDiag) ? "no SSID" : winRtDiag);
+            text.Append("; netsh: no parsable output");
+
+            if (IsLocationGateDenied(nativeDiag))
+            {
+                text.Append(". rc=5 is ERROR_ACCESS_DENIED — Windows 11 24H2+ gates the current-connection "
+                          + "opcode (and netsh wlan) behind precise-location consent, which is off in this image; "
+                          + "enable Location services to restore signal/PHY/channel.");
+            }
+
+            return text.ToString();
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WifiInfoReader.cs

@@ -15,7 +15,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
 
         /// <summary>
         /// Signal quality 0–100 (same semantics as the netsh "Signal" percentage). Always set
-        /// on the native WLAN API path; null only when the netsh fallback could not parse it.
+        /// on the native WLAN API path; null when the netsh fallback could not parse it, and
+        /// always null on the WinRT tier (<see cref="WinRtWifiSsidReader"/> yields SSID only).
         /// </summary>
         public int? SignalPercent { get; internal set; }
 
@@ -24,6 +25,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
 
         /// <summary>Current 802.11 channel number; null when the channel query fails.</summary>
         public int? Channel { get; internal set; }
+
+        /// <summary>
+        /// Why the payload is incomplete, when that is known — currently only
+        /// <c>location_services_off</c>: the SSID came from the ungated WinRT tier because the
+        /// native API was denied by the Windows 11 24H2 location gate, so signal, PHY and
+        /// channel have no source. Null whenever the reason is unknown; never a guess.
+        /// </summary>
+        public string DataLimitedReason { get; internal set; }
     }
 
     /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WinRtWifiSsidReader.cs

@@ -0,0 +1,146 @@
+using System;
+using System.Collections;
+using System.Reflection;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
+{
+    /// <summary>
+    /// Reads the SSID of the current WLAN connection via WinRT
+    /// <c>Windows.Networking.Connectivity.WlanConnectionProfileDetails.GetConnectedSsid</c>.
+    /// <para>
+    /// <b>Why this exists.</b> Windows 11 24H2 put the native WLAN API behind precise-location
+    /// consent: <c>WlanQueryInterface</c> with <c>wlan_intf_opcode_current_connection</c> — the
+    /// exact opcode <see cref="WifiInfoReader"/> needs — returns <c>ERROR_ACCESS_DENIED</c>
+    /// without it, and <c>netsh wlan</c> is gated by the same rule, so
+    /// <see cref="NetshWifiFallback"/> fails in lockstep. The consent prompt only appears for
+    /// processes in the user's context outside <c>C:\Windows\System32</c>, so the agent — SYSTEM,
+    /// during OOBE, before the user ever sees the privacy page — is denied silently. Microsoft
+    /// names <c>GetConnectedSsid</c> as the replacement for exactly this case; it is not
+    /// location-gated.
+    /// </para>
+    /// <para>
+    /// Resolved through the CLR's built-in WinRT projection — no NuGet package, no winmd
+    /// reference — the same mechanism <see cref="OobeStateReader"/> uses (validated from the
+    /// SYSTEM service context). Available since Windows 10 1507. SSID only: signal quality,
+    /// PHY type and channel have no ungated source, so they stay null on this path.
+    /// </para>
+    /// </summary>
+    internal static class WinRtWifiSsidReader
+    {
+        // Resolved once per process. Benign race: concurrent first calls resolve the same
+        // members and the assignments are idempotent — no lock needed.
+        private static MethodInfo _getInternetConnectionProfile;
+        private static MethodInfo _getConnectionProfiles;
+        private static bool _initTried;
+
+        /// <summary>
+        /// Returns the SSID of the connected WLAN, or null when the device is not on WiFi, the
+        /// WinRT contract is unavailable, or any part of the read fails. Never throws.
+        /// <paramref name="diagnostics"/> carries the reason when the result is null.
+        /// </summary>
+        internal static string TryGetConnectedSsid(out string diagnostics)
+        {
+            try
+            {
+                EnsureInitialized();
+
+                if (_getInternetConnectionProfile == null)
+                {
+                    diagnostics = "WinRT NetworkInformation unavailable";
+                    return null;
+                }
+
+                // The internet-bearing profile is the one the device is actually enrolling over.
+                var ssid = ReadSsid(_getInternetConnectionProfile.Invoke(null, null));
+                if (ssid != null)
+                {
+                    diagnostics = null;
+                    return ssid;
+                }
+
+                // No internet profile (captive portal, limited connectivity) or it is not WLAN —
+                // fall back to the first connected profile that carries WLAN details.
+                ssid = ScanConnectionProfiles();
+                diagnostics = ssid == null ? "no connected WLAN profile" : null;
+                return ssid;
+            }
+            catch (Exception ex)
+            {
+                diagnostics = $"WinRT exception {ex.GetType().Name}: {ex.Message}";
+                return null;
+            }
+        }
+
+        private static void EnsureInitialized()
+        {
+            if (_initTried) return;
+
+            var type = Type.GetType(
+                "Windows.Networking.Connectivity.NetworkInformation, Windows.Networking.Connectivity, ContentType=WindowsRuntime",
+                throwOnError: false);
+
+            _getInternetConnectionProfile = type?.GetMethod(
+                "GetInternetConnectionProfile", BindingFlags.Public | BindingFlags.Static, null, Type.EmptyTypes, null);
+            _getConnectionProfiles = type?.GetMethod(
+                "GetConnectionProfiles", BindingFlags.Public | BindingFlags.Static, null, Type.EmptyTypes, null);
+
+            _initTried = true;
+        }
+
+        /// <summary>
+        /// Walks every known connection profile and returns the SSID of the first one that is
+        /// both connected and WLAN. Returns null when none qualifies.
+        /// </summary>
+        private static string ScanConnectionProfiles()
+        {
+            if (_getConnectionProfiles == null)
+                return null;
+
+            if (!(_getConnectionProfiles.Invoke(null, null) is IEnumerable profiles))
+                return null;
+
+            foreach (var profile in profiles)
+            {
+                if (!IsConnected(profile))
+                    continue;
+
+                var ssid = ReadSsid(profile);
+                if (ssid != null)
+                    return ssid;
+            }
+
+            return null;
+        }
+
+        /// <summary>
+        /// <c>ConnectionProfile.GetNetworkConnectivityLevel() != NetworkConnectivityLevel.None</c>.
+        /// A profile the device is not currently on would otherwise leak a stale SSID.
+        /// Unreadable level counts as not connected.
+        /// </summary>
+        private static bool IsConnected(object profile)
+        {
+            var level = profile?.GetType()
+                .GetMethod("GetNetworkConnectivityLevel", BindingFlags.Public | BindingFlags.Instance, null, Type.EmptyTypes, null)
+                ?.Invoke(profile, null);
+
+            return level != null && Convert.ToInt32(level) != 0; // NetworkConnectivityLevel.None
+        }
+
+        /// <summary>
+        /// <c>ConnectionProfile.WlanConnectionProfileDetails.GetConnectedSsid()</c>, or null when
+        /// the profile is not a WLAN profile or the SSID is empty (hidden network).
+        /// </summary>
+        private static string ReadSsid(object profile)
+        {
+            var details = profile?.GetType()
+                .GetProperty("WlanConnectionProfileDetails", BindingFlags.Public | BindingFlags.Instance)
+                ?.GetValue(profile);
+
+            var ssid = details?.GetType()
+                .GetMethod("GetConnectedSsid", BindingFlags.Public | BindingFlags.Instance, null, Type.EmptyTypes, null)
+                ?.Invoke(details, null) as string;
+
+            return string.IsNullOrEmpty(ssid) ? null : ssid;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/DiagnosticsPackageService.cs

@@ -45,10 +45,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
         /// </summary>
         public string SasUrlPrefix { get; set; }
 
-        /// <summary>Human-readable error code/message when upload failed. Null on success or skip.</summary>
+        /// <summary>Human-readable error code/message when upload failed or was skipped. Null on success.</summary>
         public string ErrorCode { get; set; }
 
+        /// <summary>
+        /// True when no package was built because a configuration gate said so (mode=Off,
+        /// destination not configured, OnFailure + known success). <see cref="ErrorCode"/>
+        /// then carries the machine-readable gate name so the emitted
+        /// <c>server_action_failed</c> / <c>diagnostics_upload_failed</c> event names the
+        /// actual reason instead of a generic "upload failed".
+        /// </summary>
+        public bool Skipped { get; set; }
+
         public bool Success => BlobName != null;
+
+        public const string SkipModeOff = "diagnostics_skipped_mode_off";
+        public const string SkipNotConfigured = "diagnostics_skipped_not_configured";
+        public const string SkipOnFailureSucceeded = "diagnostics_skipped_onfailure_success";
+
+        public static DiagnosticsUploadResult SkippedBy(string gate) =>
+            new DiagnosticsUploadResult { Skipped = true, ErrorCode = gate };
     }
 
     /// <summary>
@@ -191,7 +207,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
         /// <summary>
         /// Creates a diagnostics ZIP and uploads it to the configured Blob Storage container.
         /// Returns a DiagnosticsUploadResult with BlobName set on success, or ErrorCode set on failure.
-        /// Returns null if the upload was skipped (mode=Off, not configured, or OnFailure+succeeded).
+        /// A configuration gate (mode=Off, not configured, OnFailure+succeeded) returns a result
+        /// with <see cref="DiagnosticsUploadResult.Skipped"/> and the gate name in ErrorCode.
         /// This method is non-fatal: all exceptions are caught and logged.
         /// </summary>
         /// <param name="enrollmentSucceeded">
@@ -214,14 +231,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 var mode = _configuration.DiagnosticsUploadMode ?? "Off";
                 if (string.Equals(mode, "Off", StringComparison.OrdinalIgnoreCase))
                 {
-                    _logger.Debug("Diagnostics upload disabled (mode=Off)");
-                    return null;
+                    _logger.Info("Diagnostics upload skipped: DiagnosticsUploadMode=Off on the running agent.");
+                    return DiagnosticsUploadResult.SkippedBy(DiagnosticsUploadResult.SkipModeOff);
                 }
 
                 if (!_configuration.DiagnosticsUploadEnabled)
                 {
-                    _logger.Debug("Diagnostics upload skipped: not configured for this tenant");
-                    return null;
+                    _logger.Info($"Diagnostics upload skipped: no upload destination configured for this tenant (mode={mode}).");
+                    return DiagnosticsUploadResult.SkippedBy(DiagnosticsUploadResult.SkipNotConfigured);
                 }
 
                 // Null outcome (on-demand mid-session) passes through: the OnFailure gate only
@@ -229,7 +246,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 if (string.Equals(mode, "OnFailure", StringComparison.OrdinalIgnoreCase) && enrollmentSucceeded == true)
                 {
                     _logger.Info("Diagnostics upload skipped: enrollment succeeded and mode=OnFailure");
-                    return null;
+                    return DiagnosticsUploadResult.SkippedBy(DiagnosticsUploadResult.SkipOnFailureSucceeded);
                 }
 
                 _logger.Info($"Creating diagnostics package (mode={mode}, enrollmentSucceeded={(enrollmentSucceeded.HasValue ? enrollmentSucceeded.ToString() : "n/a")}{(fileNameSuffix != null ? $", suffix={fileNameSuffix}" : "")})...");

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/DeviceInfo/DeviceInfoCollector.NetworkAndSecurity.cs

@@ -926,22 +926,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
             Monitoring.NetworkInterfaceLocator.FindActiveNetworkInterface();
 
         /// <summary>
-        /// Collects WiFi signal info via the native WLAN API (<see cref="WifiInfoReader"/>,
-        /// language-neutral, no process spawn) and emits a separate wifi_signal_info event.
-        /// Designed to run as fire-and-forget via Task.Run — never blocks other collection.
-        /// VMs without WiFi service simply get no event.
+        /// Collects WiFi signal info via <see cref="WifiInfoProvider"/> (native WLAN API → WinRT
+        /// SSID → netsh, all language-neutral bar the last) and emits a separate
+        /// wifi_signal_info event. Designed to run as fire-and-forget via Task.Run — never blocks
+        /// other collection. VMs without WiFi service simply get no event.
         /// </summary>
         private void CollectWiFiSignalInfo(Guid? interfaceGuid)
         {
             try
             {
-                var wifi = WifiInfoReader.TryGetCurrentConnection(interfaceGuid, out var wifiDiag);
+                var wifi = WifiInfoProvider.TryRead(interfaceGuid, out var wifiDiag);
                 if (wifi == null)
                 {
-                    _logger.Debug($"EnrollmentTracker: native WLAN API returned no WiFi info ({wifiDiag ?? "no connected WLAN interface"}) — trying netsh fallback");
-                    wifi = NetshWifiFallback.TryRead();
-                    if (wifi == null)
-                        return;
+                    // Warning, not Debug: the caller only reaches here when the active NIC IS
+                    // WiFi, so a silent miss is a real gap — and Debug is off at the default
+                    // log level, which is what made this invisible in the field.
+                    _logger.Warning($"EnrollmentTracker: no wifi_signal_info — {wifiDiag}");
+                    return;
                 }
 
                 var data = new Dictionary<string, object>();
@@ -953,12 +954,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
                     data["wifiRadioType"] = wifi.RadioType;
                 if (wifi.Channel.HasValue)
                     data["wifiChannel"] = wifi.Channel.Value;
+                if (wifi.DataLimitedReason != null)
+                    data["wifiDataLimitedReason"] = wifi.DataLimitedReason;
 
                 var message = wifi.Ssid != null ? $"WiFi: {wifi.Ssid}" : "WiFi signal info";
                 if (wifi.SignalPercent.HasValue)
                     message += $", Signal: {wifi.SignalPercent.Value}%";
                 if (wifi.RadioType != null)
                     message += $" ({wifi.RadioType})";
+                // Say it in the timeline too — a missing signal reads like a bug otherwise, and
+                // this is the only place an admin ever learns that a privacy setting caused it.
+                if (wifi.DataLimitedReason == WifiInfoProvider.LocationServicesOff)
+                    message += " — signal unavailable, Location services off";
 
                 EmitDeviceInfoEvent(Constants.EventTypes.WifiSignalInfo, message, data);
             }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/NetworkChangeDetector.cs

@@ -390,23 +390,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
         }
 
         /// <summary>
-        /// Collects WiFi SSID, signal, and radio type via the native WLAN API
-        /// (<see cref="WifiInfoReader"/> — language-neutral, no process spawn).
-        /// Synchronous — needed before emitting the event.
+        /// Collects WiFi SSID, signal, and radio type via <see cref="WifiInfoProvider"/>
+        /// (native WLAN API → WinRT SSID → netsh). Synchronous — needed before emitting the event.
         /// </summary>
         private (string ssid, int? signal, string radioType) CollectWiFiInfo(Guid? interfaceGuid)
         {
             try
             {
-                var wifi = WifiInfoReader.TryGetCurrentConnection(interfaceGuid, out var wifiDiag);
-                if (wifi == null)
-                {
-                    _logger.Debug($"NetworkChangeDetector: native WLAN API returned no WiFi info ({wifiDiag ?? "no connected WLAN interface"}) — trying netsh fallback");
-                    wifi = NetshWifiFallback.TryRead();
-                }
-
+                var wifi = WifiInfoProvider.TryRead(interfaceGuid, out var wifiDiag);
                 if (wifi != null)
                     return (wifi.Ssid, wifi.SignalPercent, wifi.RadioType);
+
+                // Warning, not Debug: reached only when the active NIC IS WiFi, and Debug is off
+                // at the default log level — which is what hid this failure in the field.
+                _logger.Warning($"NetworkChangeDetector: no WiFi info for the active WLAN adapter — {wifiDiag}");
             }
             catch (Exception ex)
             {

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/BackendApiClient.cs

@@ -326,10 +326,39 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
                     endpointUnavailable: true);
             }
 
+            // Backend JSON bodies may carry a machine-readable errorCode (Shared
+            // Constants.AgentErrorCodes) that tells the caller how to react — e.g.
+            // session_owner_mismatch → rotate the session id instead of treating this as a
+            // certificate rejection. Absent/unparseable → null, classic auth failure.
+            var errorCode = TryExtractErrorCode(body);
             throw new BackendAuthException(
                 $"Backend returned {statusText}. " +
                 "The device is not authorized. Check client certificate and Autopilot device validation.",
-                (int)response.StatusCode);
+                (int)response.StatusCode,
+                errorCode: errorCode);
+        }
+
+        /// <summary>
+        /// Pulls <c>errorCode</c> out of a backend JSON error body. Tolerant: any parse failure
+        /// or a non-string value yields null, never an exception.
+        /// </summary>
+        internal static string TryExtractErrorCode(string body)
+        {
+            if (string.IsNullOrWhiteSpace(body) || body.TrimStart().Length == 0 || body.TrimStart()[0] != '{')
+                return null;
+            try
+            {
+                var obj = Newtonsoft.Json.Linq.JObject.Parse(body);
+                var token = obj["errorCode"] ?? obj["ErrorCode"];
+                if (token == null || token.Type != Newtonsoft.Json.Linq.JTokenType.String)
+                    return null;
+                var value = (string)token;
+                return string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+            }
+            catch
+            {
+                return null;
+            }
         }
 
         /// <summary>
@@ -429,10 +458,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
         /// </summary>
         public bool EndpointUnavailable { get; }
 
-        public BackendAuthException(string message, int statusCode = 0, bool endpointUnavailable = false) : base(message)
+        /// <summary>
+        /// Machine-readable code from the backend's JSON error body (see Shared
+        /// <c>Constants.AgentErrorCodes</c>), or null when the body carried none.
+        /// </summary>
+        public string ErrorCode { get; }
+
+        public BackendAuthException(string message, int statusCode = 0, bool endpointUnavailable = false, string errorCode = null) : base(message)
         {
             StatusCode = statusCode;
             EndpointUnavailable = endpointUnavailable;
+            ErrorCode = errorCode;
         }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/EmergencyReporter.cs

@@ -28,7 +28,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
         private const int MinIntervalMinutes = 10;
 
         private readonly BackendApiClient _apiClient;
-        private readonly string _sessionId;
+        private volatile string _sessionId;
         private readonly string _tenantId;
         private readonly string _agentVersion;
         private readonly AgentLogger _logger;
@@ -52,6 +52,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
             _logger = logger;
         }
 
+        /// <summary>
+        /// SESSION-OWNER-BINDING: the reporter is built before registration and snapshots the
+        /// SessionId; a rotation during registration must be reflected here or later reports
+        /// would name the refused session.
+        /// </summary>
+        public void UpdateSessionId(string sessionId)
+        {
+            if (!string.IsNullOrWhiteSpace(sessionId))
+                _sessionId = sessionId;
+        }
+
         /// <summary>
         /// Attempts to send an emergency report. Returns immediately without awaiting
         /// (intended to be called as fire-and-forget via <c>_ = reporter.TrySendAsync(...)</c>).

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/NetworkLinkWait.cs

@@ -0,0 +1,38 @@
+using System;
+using System.Net.NetworkInformation;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
+{
+    /// <summary>
+    /// Boot-time NIC grace shared by every first-contact backend call (remote-config fetch,
+    /// session registration, emergency-break reporter pattern): polls the cheap link-level
+    /// signal once per second for at most <paramref name="maxWait"/>. It cannot prove backend
+    /// reachability — the callers' retry loops handle that — it only keeps retry budgets from
+    /// being burned into a link that is provably still down (BootTrigger relaunch after a
+    /// mid-enrollment reboot, Wi-Fi still associating; tenant aebdce78 audits 2026-08-23/24).
+    /// Free on the normal path — a live link returns immediately. Probe errors end the wait,
+    /// never the caller's operation.
+    /// </summary>
+    internal static class NetworkLinkWait
+    {
+        internal static async Task WaitAsync(AgentLogger logger, TimeSpan maxWait, string context)
+        {
+            if (NetworkInterface.GetIsNetworkAvailable()) return;
+
+            logger?.Info($"{context}: no network link yet — waiting up to {maxWait.TotalSeconds:F0}s.");
+            var deadline = DateTime.UtcNow + maxWait;
+            while (DateTime.UtcNow < deadline)
+            {
+                await Task.Delay(1000).ConfigureAwait(false);
+                if (NetworkInterface.GetIsNetworkAvailable())
+                {
+                    logger?.Info($"{context}: network link is up.");
+                    return;
+                }
+            }
+            logger?.Warning($"{context}: still no network link after {maxWait.TotalSeconds:F0}s — attempting anyway.");
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/DecisionStepProcessor.cs

@@ -88,9 +88,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         private int _passThroughStepsSinceSnapshot; // H1a — pass-through steps skipped since last snapshot
         private bool _parkedTripwireFired; // liveness PR1 — one-shot per agent run, no state-schema touch
 
-        // M1 — parked-tripwire dwell machinery. The timer thread is also what fixes L8: the
+        // M1 — parked-tripwire dwell machinery. The timer thread is also what fixed L8: the
         // tripwire post no longer runs on the ingress worker, so a full channel cannot
-        // self-deadlock on it. Guarded by _parkedLock because the callback races ApplyStep.
+        // self-deadlock on it. (Since 2026-08-29 SignalIngress.Post itself is re-entrancy-safe
+        // — worker-thread posts go to a worker-local queue — so the EffectRunner's
+        // ClassifierVerdictIssued post from inside ApplyStep is covered too.) Guarded by
+        // _parkedLock because the callback races ApplyStep.
         private readonly object _parkedLock = new object();
         private readonly TimeSpan _parkedTripwireDwell;
         private Timer? _parkedDwellTimer;

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/SignalIngress.cs

@@ -27,6 +27,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
     /// Die Back-Pressure-Emission läuft NICHT durch den Signal-Channel (würde deadlocken).
     /// </para>
     /// <para>
+    /// <b>Worker re-entrancy</b>: a <see cref="Post"/> issued ON the worker thread itself
+    /// (EffectRunner posting a <c>ClassifierVerdictIssued</c> from inside
+    /// <c>ApplyStep</c>) must never touch the bounded channel — the worker is the channel's
+    /// only consumer, so a full channel would block the consumer as a producer and freeze
+    /// the whole pipeline for the rest of the run. Such posts go to a worker-local
+    /// follow-up queue that the worker drains (ahead of the channel) right after the
+    /// current item finishes. Same processing path, same ordinal/log/reduce semantics —
+    /// just never blocking.
+    /// </para>
+    /// <para>
     /// <b>Shutdown</b>: <see cref="Stop"/> ruft <see cref="BlockingCollection{T}.CompleteAdding"/>,
     /// wartet auf das Drain-Ende via <c>Thread.Join</c>. Nach <c>Stop</c> wirft jeder
     /// weitere <see cref="Post"/> <see cref="InvalidOperationException"/>.
@@ -79,6 +89,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         private readonly object _backPressureLock = new object();
 
         private Thread? _worker;
+        // Worker-thread-only: signals posted re-entrantly from ApplyStep (EffectRunner
+        // classifier verdicts). Drained by WorkerLoop after every channel item, before the
+        // next channel item is taken. Only the worker enqueues and dequeues — no lock.
+        private readonly Queue<IngressItem> _workerLocalQueue = new Queue<IngressItem>();
+        private long _reentrantPostCount;
         private long _nextSignalOrdinal;     // worker-thread-only after Start; seeded from SignalLog
         private int _started;                 // 0 = not started, 1 = running
         private int _stopRequested;           // 0 = live, 1 = Stop called
@@ -135,6 +150,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// </summary>
         public long PendingSignalCount => Interlocked.Read(ref _unprocessedCount);
 
+        /// <summary>
+        /// Signals that were posted from the worker thread itself and routed through the
+        /// worker-local follow-up queue instead of the bounded channel. Observability/tests.
+        /// </summary>
+        public long ReentrantPostCount => Interlocked.Read(ref _reentrantPostCount);
+
         /// <summary>
         /// Fires synchronously from <see cref="Post"/> after a signal has been accepted into
         /// the channel (for both the fast-path <see cref="BlockingCollection{T}.TryAdd"/> and
@@ -218,6 +239,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// Reicht ein Raw-/Derived-/Synthetic-Signal in den Ingress ein. Thread-safe; darf von
         /// beliebig vielen Collector-Threads (und vom <see cref="EffectRunner"/>) parallel
         /// gerufen werden. Blockiert, wenn der Channel voll ist — Plan §2.1a Back-Pressure.
+        /// Ausnahme: Aufrufe vom Worker-Thread selbst blockieren nie (worker-local queue).
         /// </summary>
         public void Post(
             DecisionSignalKind kind,
@@ -228,10 +250,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             int kindSchemaVersion = 1,
             object? typedPayload = null)
         {
-            if (Volatile.Read(ref _stopRequested) == 1 || _channel.IsAddingCompleted)
-            {
-                throw new InvalidOperationException("SignalIngress has been stopped.");
-            }
             if (evidence == null)
             {
                 throw new ArgumentNullException(nameof(evidence));
@@ -243,6 +261,30 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
 
             var item = new IngressItem(kind, kindSchemaVersion, occurredAtUtc, sourceOrigin, evidence, payload, typedPayload);
 
+            // Worker re-entrancy (see class doc): a post from the worker thread itself goes to
+            // the worker-local follow-up queue, never into the bounded channel. Checked before
+            // the stop gate on purpose — while Stop() drains the channel the worker may still
+            // produce verdicts for the items it is finishing, and those must not be lost.
+            if (ReferenceEquals(Thread.CurrentThread, _worker))
+            {
+                Interlocked.Increment(ref _unprocessedCount);
+                _workerLocalQueue.Enqueue(item);
+                Interlocked.Increment(ref _reentrantPostCount);
+                if (_workerLocalQueue.Count > 1)
+                {
+                    // One follow-up per step is the expected shape (one RunClassifier effect).
+                    // More means effects are chaining on the worker — worth seeing in the log.
+                    _logger?.Debug($"SignalIngress: worker-local follow-up queue depth={_workerLocalQueue.Count} kind={kind} origin={sourceOrigin}");
+                }
+                RaiseSignalPosted(kind, payload);
+                return;
+            }
+
+            if (Volatile.Read(ref _stopRequested) == 1 || _channel.IsAddingCompleted)
+            {
+                throw new InvalidOperationException("SignalIngress has been stopped.");
+            }
+
             // Codex Finding 2 (2026-04-30): bump the pending-counter BEFORE handing the item
             // to the channel. Decrement in three places: (a) when TryAdd throws because
             // CompleteAdding raced between the post-stop check and the enqueue, (b) when
@@ -353,6 +395,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 foreach (var item in _channel.GetConsumingEnumerable())
                 {
                     ProcessItem(item);
+                    DrainWorkerLocalQueue();
                 }
             }
             catch (Exception ex)
@@ -366,6 +409,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             }
         }
 
+        /// <summary>
+        /// Processes signals the worker posted to itself during the previous item (see class
+        /// doc, worker re-entrancy). Iterative, not recursive: a follow-up that produces
+        /// another follow-up is simply appended and handled in the same loop.
+        /// </summary>
+        private void DrainWorkerLocalQueue()
+        {
+            while (_workerLocalQueue.Count > 0)
+            {
+                ProcessItem(_workerLocalQueue.Dequeue());
+            }
+        }
+
         private void ProcessItem(IngressItem item)
         {
             // Codex Finding 2 (2026-04-30): match the Interlocked.Increment that Post()

src/Agent/AutopilotMonitor.Agent.V2.Core/Security/EntraDeviceCertHelper.cs

@@ -2,6 +2,7 @@ using System;
 using System.Linq;
 using System.Security.Cryptography.X509Certificates;
 using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Shared.Security;
 
 namespace AutopilotMonitor.Agent.V2.Core.Security
 {
@@ -23,6 +24,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
     /// <item><description><c>1.2.840.113556.1.5.284.2</c> → DeviceId (same encoding)</description></item>
     /// </list>
     /// <para>
+    /// The sibling <c>Microsoft Intune MDM Device CA</c> client cert (the one the agent authenticates
+    /// with, see <see cref="CertificateHelper"/>) carries a DIFFERENT OID arc that identifies the same
+    /// device from Intune's side. Observed on a live Intune-enrolled Windows 11 device:
+    /// </para>
+    /// <list type="table">
+    /// <listheader><term>OID</term><description>Meaning / encoding</description></listheader>
+    /// <item><term><c>1.2.840.113556.5.4</c></term><description>Intune DeviceId — BARE 16-byte GUID, no ASN.1 wrapper. Equals the cert's Subject CN.</description></item>
+    /// <item><term><c>1.2.840.113556.5.6</c></term><description>Intune AccountId (the Intune tenant account, NOT the Entra TenantId) — OCTET STRING GUID.</description></item>
+    /// <item><term><c>1.2.840.113556.5.14</c></term><description>Entra TenantId — OCTET STRING GUID. This is the one to compare against an Entra tenant id.</description></item>
+    /// <item><term><c>1.2.840.113556.5.11</c></term><description>Further GUID, OCTET STRING; semantics not documented by Microsoft and not verified here.</description></item>
+    /// <item><term><c>1.2.840.113556.5.15/.16/.17/.18/.19/.23</c></term><description>ASN.1 INTEGER enums (platform / enrollment flavour); semantics undocumented.</description></item>
+    /// </list>
+    /// <para>
+    /// The bare-GUID encoding of <c>1.2.840.113556.5.4</c> is why
+    /// <see cref="ParseGuidFromExtension"/> accepts an unwrapped 16-byte payload as well —
+    /// a strict OCTET-STRING parser silently returns <c>null</c> for that extension.
+    /// </para>
+    /// <para>
     /// All probes are best-effort: never throw, return <c>null</c> on miss, log a Warning
     /// with the specific failure reason (no matching cert / extension missing / ASN.1
     /// parse failed) so the agent log explains why the fallback didn't help.
@@ -31,8 +50,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
     public static class EntraDeviceCertHelper
     {
         public const string MsOrganizationAccessIssuer = "MS-Organization-Access";
-        public const string TenantIdOid = "1.2.840.113556.1.5.284.5";
-        public const string DeviceIdOid = "1.2.840.113556.1.5.284.2";
+        public const string TenantIdOid = MsDeviceCertificateOids.EntraJoinCertTenantIdOid;
+        public const string DeviceIdOid = MsDeviceCertificateOids.EntraJoinCertDeviceIdOid;
 
         /// <summary>
         /// Reads the Entra TenantId from the MS-Organization-Access device cert.
@@ -88,7 +107,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
                             continue;
                         }
 
-                        var guid = ParseGuidFromAsn1OctetString(ext.RawData);
+                        var guid = ParseGuidFromExtension(ext.RawData);
                         if (guid != null)
                         {
                             logger?.Info(
@@ -98,7 +117,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
                         }
 
                         logger?.Warning(
-                            $"EntraDeviceCertHelper: failed to parse {label} ASN.1 OCTET STRING in cert thumbprint={cert.Thumbprint} " +
+                            $"EntraDeviceCertHelper: failed to parse {label} GUID extension in cert thumbprint={cert.Thumbprint} " +
                             $"(raw {ext.RawData.Length} bytes); trying next candidate.");
                     }
 
@@ -116,46 +135,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
 
         /// <summary>
         /// Parses a 16-byte MS-format binary GUID (little-endian for the first three groups,
-        /// per <see cref="Guid(byte[])"/>) wrapped in an ASN.1 OCTET STRING. Handles both
-        /// short-form (<c>04 10 ...</c>) and long-form (<c>04 81 10 ...</c>) length encoding.
+        /// per <see cref="Guid(byte[])"/>) out of a certificate extension's raw value.
+        /// Two encodings are accepted, because Microsoft uses both:
+        /// <list type="number">
+        /// <item><description>Wrapped in an ASN.1 OCTET STRING — short-form (<c>04 10 ...</c>) or
+        /// long-form (<c>04 81 10 ...</c>) length. Used by the MS-Organization-Access TenantId/DeviceId
+        /// extensions and by the Intune <c>…5.6</c> / <c>…5.14</c> extensions.</description></item>
+        /// <item><description>A bare, unwrapped 16-byte payload. Used by the Intune DeviceId extension
+        /// <c>1.2.840.113556.5.4</c> — verified against a live Intune MDM device cert, whose raw value is
+        /// exactly 16 bytes with no <c>04 10</c> prefix.</description></item>
+        /// </list>
+        /// A valid OCTET-STRING wrapper around 16 bytes is at least 18 bytes long, so the two forms
+        /// never collide for well-formed input. A 16-byte value is always read as the bare form —
+        /// a truncated wrapper of exactly that length is indistinguishable from it.
         /// Returns <c>null</c> on any structural mismatch — never throws.
+        /// <para>
+        /// The decoding itself lives in <see cref="MsDeviceCertificateOids.TryParseGuid"/> so the agent
+        /// and the backend's client-cert tenant binding share one implementation; this stays as the
+        /// agent-side nullable-returning façade.
+        /// </para>
         /// </summary>
-        public static Guid? ParseGuidFromAsn1OctetString(byte[] raw)
-        {
-            if (raw == null || raw.Length < 2) return null;
-
-            // ASN.1 OCTET STRING tag.
-            if (raw[0] != 0x04) return null;
-
-            int contentStart;
-            int contentLen;
-
-            if (raw[1] < 0x80)
-            {
-                // short-form length
-                contentLen = raw[1];
-                contentStart = 2;
-            }
-            else
-            {
-                // long-form length: lower 7 bits = number of following length bytes.
-                int numLenBytes = raw[1] & 0x7F;
-                if (numLenBytes < 1 || numLenBytes > 4 || raw.Length < 2 + numLenBytes) return null;
-
-                contentLen = 0;
-                for (int i = 0; i < numLenBytes; i++)
-                    contentLen = (contentLen << 8) | raw[2 + i];
-
-                contentStart = 2 + numLenBytes;
-            }
-
-            if (contentLen != 16 || contentStart + 16 > raw.Length) return null;
-
-            var guidBytes = new byte[16];
-            Buffer.BlockCopy(raw, contentStart, guidBytes, 0, 16);
-
-            try { return new Guid(guidBytes); }
-            catch { return null; }
-        }
+        public static Guid? ParseGuidFromExtension(byte[] raw) =>
+            MsDeviceCertificateOids.TryParseGuid(raw, out var value) ? value : (Guid?)null;
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Security/SessionIdPersistence.cs

@@ -175,6 +175,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
             }
         }
 
+        /// <summary>
+        /// Replaces the persisted SessionId with a fresh GUID and restarts the session-age clock.
+        /// Used when the backend answers register-session with <c>session_owner_mismatch</c>
+        /// (SESSION-OWNER-BINDING): the id on disk belongs to a session bound to a different device
+        /// identity — the re-enroll-without-wipe shape — so this run must become a new session.
+        /// Unlike <see cref="Delete"/> this leaves <c>whiteglove.complete</c> untouched: a Part-2
+        /// resume that has to rotate is still a Part-2 resume.
+        /// </summary>
+        /// <returns>The new SessionId.</returns>
+        public string Rotate(AgentLogger logger = null)
+        {
+            lock (_lockObject)
+            {
+                var fresh = Guid.NewGuid().ToString();
+                WriteAtomic(fresh, logger);
+                SaveSessionCreatedAtInternal(DateTime.UtcNow);
+                logger?.Info($"SessionIdPersistence: rotated SessionId to {fresh}.");
+                return fresh;
+            }
+        }
+
         private static void TryDelete(string path, AgentLogger logger)
         {
             try { if (File.Exists(path)) File.Delete(path); }

src/Agent/AutopilotMonitor.Agent.V2.Core/Security/SessionRegistrationHelper.cs

@@ -1,10 +1,10 @@
 using System;
-using System.Net.NetworkInformation;
 using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Configuration;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Security
@@ -34,6 +34,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
     ///     <see cref="AuthFailureTracker"/> (which fires the first-failure distress + may trip
     ///     the shutdown threshold) and return <see cref="SessionRegistrationOutcome.AuthFailed"/>
     ///     without retrying — the backend has definitively rejected the device cert.</item>
+    ///   <item>Exception to the above — a 403 carrying error code
+    ///     <c>session_owner_mismatch</c> (SESSION-OWNER-BINDING): the persisted SessionId names a
+    ///     session bound to another device identity (typically an Intune re-enrollment without a
+    ///     wipe, where <c>session.id</c> survived but the certificate identity changed). That is
+    ///     not an auth failure: the session is rotated through <c>rotateSession</c> and
+    ///     registration retried exactly once. The tracker is NOT fed — five of these would
+    ///     otherwise soft-shutdown a perfectly authorized agent.</item>
     ///   <item>Any other exception on the last attempt → <see cref="EmergencyReporter.TrySendAsync"/>
     ///     with <c>AgentErrorType.RegisterSessionFailed</c> so operators see the final cause.</item>
     /// </list>
@@ -73,7 +80,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
             Func<int, Task> backoffDelay = null,
             Func<Exception, Task> onTerminalTransportFailure = null,
             (string Manufacturer, string Model, string SerialNumber)? deviceHardware = null,
-            Func<AgentLogger, Task> networkLinkWait = null)
+            Func<AgentLogger, Task> networkLinkWait = null,
+            Func<string> rotateSession = null)
         {
             if (apiClient == null) throw new ArgumentNullException(nameof(apiClient));
             if (agentConfig == null) throw new ArgumentNullException(nameof(agentConfig));
@@ -87,6 +95,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
             catch (Exception ex) { logger.Debug($"Pre-registration network wait failed ({ex.Message}) — registering anyway."); }
             string lastError = null;
             Exception lastException = null;
+            string rotatedFromSessionId = null;
 
             for (int attempt = 1; attempt <= MaxAttempts; attempt++)
             {
@@ -98,12 +107,38 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
                     if (response != null && response.Success)
                     {
                         logger.Info($"Session registered successfully: {response.SessionId} (validatedBy={response.ValidatedBy}, adminAction={response.AdminAction ?? "(none)"})");
-                        return SessionRegistrationResult.Succeeded(response);
+                        return SessionRegistrationResult.Succeeded(response, rotatedFromSessionId);
                     }
 
                     lastError = response?.Message ?? "(null response)";
                     logger.Warning($"Session registration failed: {lastError}");
                 }
+                catch (BackendAuthException ex) when (
+                    ex.ErrorCode == Constants.AgentErrorCodes.SessionOwnerMismatch
+                    && rotateSession != null
+                    && rotatedFromSessionId == null)
+                {
+                    // SESSION-OWNER-BINDING: the id on disk belongs to a session this device
+                    // identity does not own. Become a new session and register once more —
+                    // immediately, no backoff, no auth-failure bookkeeping.
+                    rotatedFromSessionId = registration.SessionId;
+                    string newSessionId;
+                    try
+                    {
+                        newSessionId = rotateSession();
+                    }
+                    catch (Exception rotateEx)
+                    {
+                        logger.Error($"Session owner mismatch reported by backend but session rotation failed: {rotateEx.Message}", rotateEx);
+                        authFailureTracker?.RecordFailure(ex.StatusCode, "agent/register-session", ex.EndpointUnavailable);
+                        return SessionRegistrationResult.AuthFailed(ex.StatusCode, ex.Message);
+                    }
+                    logger.Warning(
+                        $"Backend refused registration with {Constants.AgentErrorCodes.SessionOwnerMismatch}: session {rotatedFromSessionId} " +
+                        $"is bound to another device identity (re-enrollment without wipe?). Rotated to {newSessionId}; re-registering.");
+                    registration = BuildRegistration(agentConfig, agentVersion, deviceHardware);
+                    continue;
+                }
                 catch (BackendAuthException ex)
                 {
                     logger.Error($"Session registration authentication failed ({ex.StatusCode}): {ex.Message}");
@@ -165,29 +200,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
             => Task.Delay(((int)Math.Pow(2, attempt)) * 1000);
 
         /// <summary>
-        /// Boot-time NIC grace (same pattern as the emergency-break reporter): polls the cheap
-        /// link-level signal once per second for at most <see cref="NetworkLinkWaitMax"/>. It
-        /// cannot prove backend reachability — the retry loop handles that — it only keeps the
-        /// first attempts from being burned into a link that is provably still down. Probe
+        /// Boot-time NIC grace before the first registration attempt — shared polling loop in
+        /// <see cref="NetworkLinkWait"/>, bounded by <see cref="NetworkLinkWaitMax"/>. Probe
         /// errors end the wait, never the registration.
         /// </summary>
-        internal static async Task WaitForNetworkLinkAsync(AgentLogger logger)
-        {
-            if (NetworkInterface.GetIsNetworkAvailable()) return;
-
-            logger?.Info($"Session registration: no network link yet — waiting up to {NetworkLinkWaitMax.TotalSeconds:F0}s.");
-            var deadline = DateTime.UtcNow + NetworkLinkWaitMax;
-            while (DateTime.UtcNow < deadline)
-            {
-                await Task.Delay(1000).ConfigureAwait(false);
-                if (NetworkInterface.GetIsNetworkAvailable())
-                {
-                    logger?.Info("Session registration: network link is up.");
-                    return;
-                }
-            }
-            logger?.Warning($"Session registration: still no network link after {NetworkLinkWaitMax.TotalSeconds:F0}s — attempting anyway.");
-        }
+        internal static Task WaitForNetworkLinkAsync(AgentLogger logger)
+            => NetworkLinkWait.WaitAsync(logger, NetworkLinkWaitMax, "Session registration");
 
         private static SessionRegistration BuildRegistration(
             AgentConfiguration agentConfig,
@@ -255,20 +273,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
         public string AdminAction => Response?.AdminAction;
         public ValidatorType ValidatedBy => Response?.ValidatedBy ?? ValidatorType.Unknown;
 
+        /// <summary>
+        /// SESSION-OWNER-BINDING: the SessionId this run started with when the backend refused it
+        /// with <c>session_owner_mismatch</c> and the session was rotated before the successful
+        /// registration. Null on the normal path.
+        /// </summary>
+        public string RotatedFromSessionId { get; }
+
         private SessionRegistrationResult(
             SessionRegistrationOutcome outcome,
             RegisterSessionResponse response,
             int httpStatusCode,
-            string errorMessage)
+            string errorMessage,
+            string rotatedFromSessionId = null)
         {
             Outcome = outcome;
             Response = response;
             HttpStatusCode = httpStatusCode;
             ErrorMessage = errorMessage;
+            RotatedFromSessionId = rotatedFromSessionId;
         }
 
-        public static SessionRegistrationResult Succeeded(RegisterSessionResponse response)
-            => new SessionRegistrationResult(SessionRegistrationOutcome.Succeeded, response, 200, null);
+        public static SessionRegistrationResult Succeeded(RegisterSessionResponse response, string rotatedFromSessionId = null)
+            => new SessionRegistrationResult(SessionRegistrationOutcome.Succeeded, response, 200, null, rotatedFromSessionId);
 
         public static SessionRegistrationResult AuthFailed(int statusCode, string message)
             => new SessionRegistrationResult(SessionRegistrationOutcome.AuthFailed, null, statusCode, message);

src/Agent/AutopilotMonitor.Agent.V2.Core/SignalAdapters/ImeLogTrackerAdapter.cs

@@ -56,6 +56,13 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
     {
         private const string SourceLabel = "ImeLogTracker";
 
+        /// <summary>Timeline label: IME wrote its "Completed user session" line and no required user-scope app was pending.</summary>
+        internal const string EvidenceUserSessionCompleted = "user_session_completed";
+
+        /// <summary>Timeline label: IME reported zero targeted apps for the user session, so it never wrote a
+        /// "Completed user session" line at all. The user phase had nothing to enforce.</summary>
+        internal const string EvidenceZeroUserApps = "zero_user_apps_enumerated";
+
         private readonly ImeLogTracker _tracker;
         private readonly ISignalIngressSink _ingress;
         private readonly IClock _clock;
@@ -591,9 +598,24 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
 
             var now = ResolveOccurredAt(out var derivedFromClock, out var rawSourceTs);
 
+            // Which observation carried the completion. The zero-app variant matters to whoever
+            // reads the timeline later: the verdict then rests on IME reporting that this user
+            // had no targeted apps at all, not on watching enforcement finish.
+            var zeroApps = _tracker.UserSessionZeroAppsObserved;
+            var evidenceLabel = zeroApps ? EvidenceZeroUserApps : EvidenceUserSessionCompleted;
+            var summary = zeroApps
+                ? "IME enumerated the user session with zero targeted apps"
+                : "IME user session completed (no required user-scope apps pending)";
+            var message = zeroApps
+                ? "IME enumerated the user session with zero targeted apps - no user-phase enforcement to wait for"
+                : "IME user session completed";
+
             var derivationInputs = new Dictionary<string, string>(StringComparer.Ordinal)
             {
-                ["detectionSource"] = "IME log pattern (UserSessionCompleted)",
+                ["detectionSource"] = zeroApps
+                    ? "IME log pattern (UserSessionZeroApps)"
+                    : "IME log pattern (UserSessionCompleted)",
+                ["evidence"] = evidenceLabel,
             };
             TagDerivedTimestamp(derivationInputs, derivedFromClock, rawSourceTs);
 
@@ -604,12 +626,13 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                 evidence: new Evidence(
                     kind: EvidenceKind.Derived,
                     identifier: "ime-log-tracker-v1",
-                    summary: "IME user session completed (no required user-scope apps pending)",
+                    summary: summary,
                     derivationInputs: derivationInputs));
 
             var data = new Dictionary<string, string>(StringComparer.Ordinal)
             {
                 ["detectedAt"] = now.ToString("o"),
+                ["evidence"] = evidenceLabel,
             };
             var patternId = _tracker.LastMatchedPatternId;
             if (!string.IsNullOrEmpty(patternId))
@@ -619,12 +642,12 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
             _post.Emit(
                 eventType: SharedEventTypes.ImeUserSessionCompleted,
                 source: SourceLabel,
-                message: "IME user session completed",
+                message: message,
                 data: data,
                 occurredAtUtc: now);
 
             // PR3-D4: terminal-ish lifecycle marker — INFO so it's visible at the default level.
-            _logger?.Info($"ImeAdapter: user session completed -> posting ImeUserSessionCompleted (patternId={patternId ?? "(none)"})");
+            _logger?.Info($"ImeAdapter: user session completed ({evidenceLabel}) -> posting ImeUserSessionCompleted (patternId={patternId ?? "(none)"})");
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Termination/SummaryDialogLauncher.cs

@@ -132,10 +132,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
             }
 
             // 4) Compose args. Legacy contract: --status-file <path> --timeout <s> --cleanup [--branding-url <url>].
-            var tempStatusArg = Path.Combine(tempDir, FinalStatusFileName);
-            var args = $"--status-file \"{tempStatusArg}\" --timeout {configuration.EnrollmentSummaryTimeoutSeconds} --cleanup";
-            if (!string.IsNullOrWhiteSpace(configuration.EnrollmentSummaryBrandingImageUrl))
-                args += $" --branding-url \"{configuration.EnrollmentSummaryBrandingImageUrl}\"";
+            var args = BuildDialogArguments(
+                Path.Combine(tempDir, FinalStatusFileName),
+                configuration.EnrollmentSummaryTimeoutSeconds,
+                configuration.EnrollmentSummaryBrandingImageUrl,
+                logger);
 
             // 5) Launch in user session with retry.
             var retrySeconds = configuration.EnrollmentSummaryLaunchRetrySeconds > 0
@@ -151,6 +152,44 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
             return launched;
         }
 
+        /// <summary>
+        /// Composes the dialog command line. The branding URL is tenant-supplied config and the
+        /// dialog parses arguments last-occurrence-wins, so a value carrying a double quote could
+        /// terminate its argument and override <c>--status-file</c>/<c>--timeout</c>/<c>--cleanup</c>
+        /// (CWE-88). The backend rejects such values, but the agent is the last line of defence:
+        /// only a plain absolute HTTPS URL without quotes, whitespace or control characters is
+        /// ever placed on the command line — anything else is dropped (the dialog then simply
+        /// shows no branding image).
+        /// </summary>
+        internal static string BuildDialogArguments(string statusFilePath, int timeoutSeconds, string brandingImageUrl, AgentLogger logger)
+        {
+            var args = $"--status-file \"{statusFilePath}\" --timeout {timeoutSeconds} --cleanup";
+            if (string.IsNullOrWhiteSpace(brandingImageUrl))
+                return args;
+
+            if (IsSafeBrandingImageUrl(brandingImageUrl))
+                return args + $" --branding-url \"{brandingImageUrl}\"";
+
+            logger?.Warning("SummaryDialogLauncher: EnrollmentSummaryBrandingImageUrl is not a plain absolute HTTPS URL — ignoring it.");
+            return args;
+        }
+
+        internal static bool IsSafeBrandingImageUrl(string url)
+        {
+            if (string.IsNullOrEmpty(url) || url.Length > 2048)
+                return false;
+
+            foreach (var ch in url)
+            {
+                if (ch == '"' || ch == '\'' || char.IsWhiteSpace(ch) || char.IsControl(ch))
+                    return false;
+            }
+
+            return Uri.TryCreate(url, UriKind.Absolute, out var uri)
+                && uri.Scheme == Uri.UriSchemeHttps
+                && !string.IsNullOrEmpty(uri.Host);
+        }
+
         private static void TryCopy(string source, string destination)
         {
             try { if (File.Exists(source)) File.Copy(source, destination, overwrite: true); }

src/Agent/AutopilotMonitor.Agent.V2/Program.cs

@@ -269,11 +269,22 @@ namespace AutopilotMonitor.Agent.V2
             // mapping + on-failure client disposal) is encapsulated in BackendSessionRegistration.
             // Exit codes: 6 = AuthFailed, 7 = anything else. See Runtime/BackendSessionRegistration.cs.
             var registration = Runtime.BackendSessionRegistration.Register(
-                bootstrap.AgentConfig, auth, telemetry.MtlsHttpClient, GetAgentVersion(), consoleMode, logger);
+                bootstrap.AgentConfig, auth, telemetry.MtlsHttpClient, GetAgentVersion(), consoleMode, logger,
+                rotateSession: () => Runtime.BackendSessionRegistration.RotateSession(
+                    bootstrap.AgentConfig, bootstrap.SessionPersistence, auth, transportDir, logger));
             if (registration.ShouldExit)
             {
                 return registration.ExitCode;
             }
+
+            // Phase 6.5 (config self-heal): when the Phase 4 fetch ran before the network link
+            // was up, registration has just proven the backend reachable — retry the fetch once
+            // so the session runs on the live tenant config instead of cache/defaults.
+            // See AgentRuntimeConfig.TryRecoverAfterRegistration for what is deliberately
+            // NOT re-run here (kill-signal check, endpoint migration).
+            Runtime.AgentRuntimeConfig.TryRecoverAfterRegistration(
+                bootstrap.AgentConfig, auth, runtimeConfig, GetAgentVersion(), consoleMode, logger);
+
             // Phase 7+8 (orchestrator + shutdown lifecycle + onIngressReady wiring +
             // initial signal posts + analyzer/probes startup + shutdown.Wait + finally)
             // is encapsulated in AgentRuntimeHost. See Runtime/AgentRuntimeHost.cs.

src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeConfig.cs

@@ -69,6 +69,64 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 }
             }
 
+            var configMergeResult = ApplyFetchedConfig(agentConfig, remoteConfig, auth, agentVersion, consoleMode, logger);
+
+            return new RuntimeConfigBundle(remoteConfigService, remoteConfig, configMergeResult, pendingMigrationTarget: null);
+        }
+
+        /// <summary>
+        /// Phase 6.5 — config self-heal. When the Phase 4 fetch ran before the network link was
+        /// up (agent relaunched at boot, Wi-Fi still associating — tenant aebdce78 audit 2026-08-24:
+        /// ~50% of sessions ran on ConfigVersion=0 exactly this way), a successful session
+        /// registration has just proven the backend reachable. Retry the fetch once and apply
+        /// the live tenant config instead of stranding the whole session on cache/defaults.
+        /// <para>
+        /// Deliberately NOT re-run here: the kill-signal check (post-registration kills arrive
+        /// via the telemetry-channel control signals on every upload response) and endpoint
+        /// migration (registration already succeeded against the current base URL; a migration
+        /// signal is honoured at the next agent start). Never throws — recovery is strictly
+        /// best-effort on top of an already-degraded-but-working fallback.
+        /// </para>
+        /// </summary>
+        public static void TryRecoverAfterRegistration(
+            AgentConfiguration agentConfig,
+            BackendAuthBundle auth,
+            RuntimeConfigBundle bundle,
+            string agentVersion,
+            bool consoleMode,
+            AgentLogger logger)
+        {
+            try
+            {
+                var service = bundle?.RemoteConfigService;
+                if (service == null) return;
+
+                var recovered = service.TryRecoverConfigAsync().GetAwaiter().GetResult();
+                if (recovered == null) return;
+
+                var mergeResult = ApplyFetchedConfig(agentConfig, recovered, auth, agentVersion, consoleMode, logger);
+                bundle.ApplyRecovered(recovered, mergeResult);
+            }
+            catch (Exception ex)
+            {
+                logger.Warning($"Post-registration config recovery failed: {ex.Message}");
+            }
+        }
+
+        /// <summary>
+        /// Applies a live-fetched config to the runtime: merge, tracker ceilings, log level,
+        /// integrity SHA + check, bootstrap-config cleanup. Shared by the Phase 4 startup path,
+        /// the post-registration recovery path and the live <c>rotate_config</c> ServerAction
+        /// (<see cref="ServerControlPlane.BuildDispatcher"/>) so all three apply identical semantics.
+        /// </summary>
+        internal static RemoteConfigMergeResult ApplyFetchedConfig(
+            AgentConfiguration agentConfig,
+            AgentConfigResponse remoteConfig,
+            BackendAuthBundle auth,
+            string agentVersion,
+            bool consoleMode,
+            AgentLogger logger)
+        {
             // Project remote tenant-controlled knobs onto the runtime AgentConfiguration so that
             // downstream consumers (CleanupService, SummaryDialogLauncher, StartupEnvironmentProbes,
             // DiagnosticsPackageService, EnrollmentTerminationHandler, the logger, the watchdog)
@@ -91,7 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
 
             TryCleanupBootstrapConfig(agentConfig, agentVersion, logger);
 
-            return new RuntimeConfigBundle(remoteConfigService, remoteConfig, configMergeResult, pendingMigrationTarget: null);
+            return configMergeResult;
         }
 
         /// <summary>
@@ -175,10 +233,21 @@ namespace AutopilotMonitor.Agent.V2.Runtime
     internal sealed class RuntimeConfigBundle
     {
         public RemoteConfigService RemoteConfigService { get; }
-        public AgentConfigResponse RemoteConfig { get; }
-        public RemoteConfigMergeResult MergeResult { get; }
+        public AgentConfigResponse RemoteConfig { get; private set; }
+        public RemoteConfigMergeResult MergeResult { get; private set; }
         public string PendingMigrationTarget { get; }
 
+        /// <summary>
+        /// Swaps in the config recovered by <see cref="AgentRuntimeConfig.TryRecoverAfterRegistration"/>
+        /// so Phase 7+8 (orchestrator, collectors, gather rules, IME patterns, the
+        /// unrestricted-mode audit) run on the live tenant config instead of the fallback.
+        /// </summary>
+        public void ApplyRecovered(AgentConfigResponse recoveredConfig, RemoteConfigMergeResult mergeResult)
+        {
+            RemoteConfig = recoveredConfig;
+            MergeResult = mergeResult;
+        }
+
         public RuntimeConfigBundle(
             RemoteConfigService remoteConfigService,
             AgentConfigResponse remoteConfig,

src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs

@@ -344,7 +344,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                         orchestrator.Start(ingress =>
                         {
                             lifecyclePost = new InformationalEventPost(ingress, SystemClock.Instance, logger);
-                            LifecycleEmitters.EmitAgentStarted(lifecyclePost, agentConfig, previousExit, agentVersion, remoteConfigService, logger);
+                            LifecycleEmitters.EmitAgentStarted(lifecyclePost, agentConfig, previousExit, agentVersion, remoteConfigService, logger,
+                                rotatedFromSessionId: registrationResult?.RotatedFromSessionId);
                             // Wire-visible signal that the agent is running on defaults/cache
                             // rather than the live tenant config — closes the cold-start
                             // blind spot observed in session 8f2bef72 (2026-05-19).
@@ -420,6 +421,9 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                                 terminationHandler: terminationHandler,
                                 remoteConfigService: remoteConfigService,
                                 diagnosticsService: diagnosticsService,
+                                auth: auth,
+                                agentVersion: agentVersion,
+                                consoleMode: consoleMode,
                                 shutdown: shutdown,
                                 shutdownComplete: shutdownComplete,
                                 post: lifecyclePost,

src/Agent/AutopilotMonitor.Agent.V2/Runtime/BackendSessionRegistration.cs

@@ -27,7 +27,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             HttpClient mtlsHttpClient,
             string agentVersion,
             bool consoleMode,
-            AgentLogger logger)
+            AgentLogger logger,
+            Func<string> rotateSession = null)
         {
             if (agentConfig == null) throw new ArgumentNullException(nameof(agentConfig));
             if (auth == null) throw new ArgumentNullException(nameof(auth));
@@ -43,7 +44,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 onTerminalTransportFailure: ex => DiagnoseTerminalTransportFailure(ex, auth, logger),
                 // Reuse the single hardened hardware read from the auth bundle so the session row
                 // matches the security headers the backend validated against (no second WMI query).
-                deviceHardware: (auth.Manufacturer, auth.Model, auth.SerialNumber))
+                deviceHardware: (auth.Manufacturer, auth.Model, auth.SerialNumber),
+                rotateSession: rotateSession)
                 .GetAwaiter().GetResult();
 
             if (registrationResult.Outcome != SessionRegistrationOutcome.Succeeded)
@@ -63,6 +65,48 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             return SessionRegistrationOutcomeResult.Continue(registrationResult);
         }
 
+        /// <summary>
+        /// SESSION-OWNER-BINDING: the one place that turns "backend says this session id is not
+        /// ours" into a new session. Rotates the persisted id, points the runtime config at it,
+        /// drops the transport spool (its lines carry the refused session's partition key and
+        /// would otherwise be uploaded against it after the rotation) and re-targets the
+        /// emergency reporter, which snapshotted the id before registration. Everything else
+        /// reads <c>agentConfig.SessionId</c> live after Phase 6.
+        /// </summary>
+        internal static string RotateSession(
+            AgentConfiguration agentConfig,
+            SessionIdPersistence sessionPersistence,
+            BackendAuthBundle auth,
+            string transportDir,
+            AgentLogger logger)
+        {
+            var newSessionId = sessionPersistence.Rotate(logger);
+            agentConfig.SessionId = newSessionId;
+            auth?.EmergencyReporter?.UpdateSessionId(newSessionId);
+            DropTransportSpool(transportDir, logger);
+            return newSessionId;
+        }
+
+        private static void DropTransportSpool(string transportDir, AgentLogger logger)
+        {
+            if (string.IsNullOrWhiteSpace(transportDir)) return;
+            foreach (var name in new[] { "spool.jsonl", "upload-cursor.json" })
+            {
+                var path = System.IO.Path.Combine(transportDir, name);
+                try
+                {
+                    if (!System.IO.File.Exists(path)) continue;
+                    var size = new System.IO.FileInfo(path).Length;
+                    System.IO.File.Delete(path);
+                    logger.Info($"Session rotation: dropped {name} ({size} bytes) — its items belonged to the refused session.");
+                }
+                catch (Exception ex)
+                {
+                    logger.Warning($"Session rotation: could not drop {name}: {ex.Message}");
+                }
+            }
+        }
+
         /// <summary>
         /// Off-hot-path diagnostic invoked once after all session-registration retries fail.
         /// Detects whether the terminal exception was a TLS-layer <c>SecureChannelFailure</c>

src/Agent/AutopilotMonitor.Agent.V2/Runtime/LifecycleEmitters.cs

@@ -42,7 +42,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             Program.PreviousExitSummary previousExit,
             string agentVersion,
             RemoteConfigService remoteConfigService,
-            AgentLogger logger)
+            AgentLogger logger,
+            string rotatedFromSessionId = null)
         {
             try
             {
@@ -52,6 +53,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 // prior to this, ConfigVersion=0 was only deducible by inferring from
                 // the absence of tenant-controlled knobs in the DataJson.
                 var outcome = remoteConfigService?.LastFetchOutcome ?? RemoteConfigFetchOutcome.NotAttempted;
+                var recovered = remoteConfigService?.RecoveredAfterFetchFailure == true;
                 var configVersion = remoteConfigService?.CurrentConfig?.ConfigVersion ?? 0;
 
                 var data = new Dictionary<string, object>
@@ -66,8 +68,17 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                     { "diagnosticsUploadMode", agentConfig.DiagnosticsUploadMode ?? "Off" },
                     { "previousExitType", previousExit?.ExitType ?? "unknown" },
                     { "unrestrictedMode", agentConfig.UnrestrictedMode },
+                    // SESSION-OWNER-BINDING: true when the backend refused the persisted session
+                    // id (session_owner_mismatch) and this run rotated to a new session before
+                    // registering — the re-enroll-without-wipe shape, made visible on the timeline.
+                    { "sessionRotated", rotatedFromSessionId != null },
+                    { "previousSessionId", rotatedFromSessionId ?? string.Empty },
+                    // remoteConfigFetched answers "is the agent running on a live-fetched
+                    // config" — true also when the post-registration recovery replaced a
+                    // failed startup fetch (remoteConfigOutcome then still names the startup
+                    // failure; remoteConfigRecovered marks the heal).
                     { "configVersion", configVersion },
-                    { "remoteConfigFetched", outcome == RemoteConfigFetchOutcome.Succeeded },
+                    { "remoteConfigFetched", outcome == RemoteConfigFetchOutcome.Succeeded || recovered },
                     { "remoteConfigOutcome", outcome.ToString() },
                     // WinRT OOBE state sampled at this start. Together with previousExitType
                     // this makes late starts provable: "completed" on a first_run means OOBE
@@ -75,6 +86,9 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                     { "oobeStateAtAgentStart", OobeStateReader.Read() },
                 };
 
+                if (recovered)
+                    data["remoteConfigRecovered"] = true;
+
                 if (!string.IsNullOrEmpty(previousExit?.CrashExceptionType))
                     data["previousCrashException"] = previousExit.CrashExceptionType;
 
@@ -135,12 +149,25 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                     ? $"Remote config fetch failed after {remoteConfigService.LastFetchAttempts} attempt(s); using cached config."
                     : $"Remote config fetch failed after {remoteConfigService.LastFetchAttempts} attempt(s); running with built-in defaults (ConfigVersion=0).";
 
+                // Post-registration recovery (Phase 6.5) replaced the fallback with a live
+                // fetch before this emitter ran: keep the failure details (the network-late
+                // condition is worth surfacing) but mark the heal and demote to Info — the
+                // session is NOT degraded.
+                var recovered = remoteConfigService.RecoveredAfterFetchFailure;
+                if (recovered)
+                {
+                    var recoveredVersion = remoteConfigService.CurrentConfig?.ConfigVersion ?? 0;
+                    data["recovered"] = true;
+                    data["recoveredConfigVersion"] = recoveredVersion;
+                    msg += $" Recovered after session registration (ConfigVersion={recoveredVersion}).";
+                }
+
                 post.Emit(new EnrollmentEvent
                 {
                     SessionId = agentConfig.SessionId,
                     TenantId = agentConfig.TenantId,
                     EventType = SharedConstants.EventTypes.RemoteConfigFetchFailed,
-                    Severity = EventSeverity.Warning,
+                    Severity = recovered ? EventSeverity.Info : EventSeverity.Warning,
                     Source = "Agent",
                     Phase = EnrollmentPhase.Unknown,
                     Message = msg,

src/Agent/AutopilotMonitor.Agent.V2/Runtime/ServerControlPlane.cs

@@ -33,6 +33,9 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             EnrollmentTerminationHandler terminationHandler,
             RemoteConfigService remoteConfigService,
             DiagnosticsPackageService diagnosticsService,
+            BackendAuthBundle auth,
+            string agentVersion,
+            bool consoleMode,
             ManualResetEventSlim shutdown,
             ManualResetEventSlim shutdownComplete,
             InformationalEventPost post,
@@ -41,9 +44,31 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             return new ServerActionDispatcher(
                 configuration: agentConfig,
                 logger: logger,
+                // rotate_config = fetch AND apply. FetchConfigAsync only stores the response
+                // in RemoteConfigService.CurrentConfig; the projection onto the live
+                // AgentConfiguration (DiagnosticsUploadMode, LogLevel, SelfDestruct, ...)
+                // is ApplyFetchedConfig — the same path the startup fetch uses. Without it
+                // the portal's "enable diagnostics, then collect" flow fetched the new
+                // config and still ran the diagnostics gate against the stale mode.
+                // FetchConfigAsync never throws: a failed fetch falls back to cache/defaults
+                // and reports it via LastFetchOutcome — that is NOT an executed rotation.
                 rotateConfigAsync: async () =>
                 {
-                    try { var _ = await remoteConfigService.FetchConfigAsync(); return true; }
+                    try
+                    {
+                        var fetched = await remoteConfigService.FetchConfigAsync();
+                        if (remoteConfigService.LastFetchOutcome != RemoteConfigFetchOutcome.Succeeded)
+                        {
+                            logger.Warning($"ServerAction rotate_config: live fetch failed (outcome={remoteConfigService.LastFetchOutcome}, {remoteConfigService.LastFetchFailureMessage}) — runtime config unchanged.");
+                            return false;
+                        }
+
+                        var mergeResult = AgentRuntimeConfig.ApplyFetchedConfig(
+                            agentConfig, fetched, auth, agentVersion, consoleMode, logger);
+                        LifecycleEmitters.EmitUnrestrictedModeAuditIfChanged(post, agentConfig, mergeResult, logger);
+                        logger.Info($"ServerAction rotate_config: applied ConfigVersion={fetched.ConfigVersion} to the running agent.");
+                        return true;
+                    }
                     catch (Exception ex) { logger.Warning($"ServerAction rotate_config failed: {ex.Message}"); return false; }
                 },
                 // On-demand request mid-enrollment — the session has no outcome yet. Null keeps

src/Agent/AutopilotMonitor.DecisionCore.Tests/AdvisoryCompletionGateHoldingTests.cs

@@ -0,0 +1,242 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using Xunit;
+
+namespace AutopilotMonitor.DecisionCore.Tests
+{
+    /// <summary>
+    /// Sessions 81daa77f / 75d6ae8e (2026-08-25) — the 30-min <c>advisory_completion</c> window
+    /// overran a completion gate that was deliberately holding the session. The RealmJoin gate
+    /// blocks completion until phase 110 and carries its own bounded resolution (60 min from
+    /// detection, re-armed on deployment activity, hard-capped at 4 h), so on every device whose
+    /// first deployment outlives 30 minutes the enrollment was failed while the engine own
+    /// <c>completion_waiting</c> still read "waiting on: realmjoin_resolution". 75d6ae8e
+    /// installed 25 RealmJoin packages successfully inside the window, the last one 2 min before
+    /// the failure; the customer tenant hit this on 10 of 30 enrollments in one week.
+    /// <para>
+    /// The guard re-arms while the gate holds. Convergence comes from the gate itself: Resolved,
+    /// FirstDeploymentIncomplete and Timeout all set <c>RealmJoinFacts.Outcome</c>, which opens
+    /// <c>RealmJoinGateOpen</c> and stops the guard applying.
+    /// </para>
+    /// </summary>
+    public sealed class AdvisoryCompletionGateHoldingTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 8, 25, 6, 10, 0, DateTimeKind.Utc);
+
+        private static DecisionSignal MakeSignal(
+            long ordinal,
+            DecisionSignalKind kind,
+            DateTime occurredAtUtc,
+            IReadOnlyDictionary<string, string>? payload = null)
+        {
+            return new DecisionSignal(
+                sessionSignalOrdinal: ordinal,
+                sessionTraceOrdinal: ordinal,
+                kind: kind,
+                kindSchemaVersion: 1,
+                occurredAtUtc: occurredAtUtc,
+                sourceOrigin: "test",
+                evidence: new Evidence(EvidenceKind.Synthetic, $"{kind}-{ordinal}", "test"),
+                payload: payload);
+        }
+
+        private static DecisionSignal DeadlineFired(long ordinal, DateTime occurredAtUtc, string deadlineName) =>
+            MakeSignal(ordinal, DecisionSignalKind.DeadlineFired, occurredAtUtc,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = deadlineName });
+
+        private static ActiveDeadline? FindDeadline(DecisionState state, string name) =>
+            state.Deadlines.FirstOrDefault(d => d.Name == name);
+
+        private static DecisionEffect SingleTimelineEffect(DecisionStep step, string eventType) =>
+            step.Effects.Single(e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry
+                && e.Parameters != null
+                && e.Parameters.TryGetValue("eventType", out var et)
+                && et == eventType);
+
+        /// <summary>
+        /// Replays the shape both field sessions shared: Classic user-driven, full ESP, Hello
+        /// policy enabled, AccountSetup entered, then a guard-blocked post-AccountSetup ESP exit
+        /// (Shell-Core 62407, "Exiting page normally", errorCode 0) that arms the 30-min window.
+        /// The ESP registry froze at "1 of 5" and the device had zero user-targeted Intune apps,
+        /// so no arm of ShouldTransitionToAwaitingHello could ever open.
+        /// </summary>
+        private static DecisionState SetupEspExitDeadEnd(DecisionEngine engine)
+        {
+            var state = DecisionState.CreateInitial("sess-81daa77f", "tenant-81daa77f", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(
+                5, DecisionSignalKind.EspConfigDetected, T0.AddMinutes(1),
+                new Dictionary<string, string>
+                {
+                    [SignalPayloadKeys.SkipUserEsp] = "false",
+                    [SignalPayloadKeys.SkipDeviceEsp] = "false",
+                    [SignalPayloadKeys.EspAllowContinueAnyway] = "false",
+                })).NewState;
+            state = engine.Reduce(state, MakeSignal(
+                10, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(2),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "DeviceSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(
+                20, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(2.5),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "AccountSetup" })).NewState;
+
+            // Guard-blocked post-AccountSetup exit — arms advisory_completion at exit + 30 min.
+            state = engine.Reduce(state, MakeSignal(30, DecisionSignalKind.EspExiting, T0.AddMinutes(3))).NewState;
+            Assert.NotNull(FindDeadline(state, DeadlineNames.AdvisoryCompletion));
+            Assert.Null(state.Outcome);
+            return state;
+        }
+
+        /// <summary>Desktop (DAD-validated real user), RealmJoin detected, Hello provisioned.</summary>
+        private static DecisionState AddDesktopRealmJoinAndHello(DecisionEngine engine, DecisionState state)
+        {
+            state = engine.Reduce(state, MakeSignal(40, DecisionSignalKind.DesktopArrived, T0.AddMinutes(3.5))).NewState;
+            state = engine.Reduce(state, MakeSignal(
+                50, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(6),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "0" })).NewState;
+            state = engine.Reduce(state, MakeSignal(
+                60, DecisionSignalKind.HelloResolved, T0.AddMinutes(14),
+                new Dictionary<string, string> { [SignalPayloadKeys.HelloOutcome] = "Success" })).NewState;
+            return state;
+        }
+
+        // ==================================================== the gate-holding guard ====
+
+        [Fact]
+        public void DeadlineFired_WhileRealmJoinGateHolds_RearmsInsteadOfFailing()
+        {
+            var engine = new DecisionEngine();
+            var state = SetupEspExitDeadEnd(engine);
+            state = AddDesktopRealmJoinAndHello(engine, state);
+
+            // Preconditions: the gate is closed and owns an armed deadline of its own.
+            Assert.False(DecisionEngine.RealmJoinGateOpen(state));
+            Assert.NotNull(FindDeadline(state, DeadlineNames.RealmJoinTimeout));
+
+            var fireAt = T0.AddMinutes(33);
+            var step = engine.Reduce(state, DeadlineFired(70, fireAt, DeadlineNames.AdvisoryCompletion));
+
+            Assert.True(step.Transition.Taken);
+            Assert.Null(step.NewState.Outcome);
+            Assert.NotEqual(SessionStage.Failed, step.NewState.Stage);
+
+            var rearmed = FindDeadline(step.NewState, DeadlineNames.AdvisoryCompletion);
+            Assert.NotNull(rearmed);
+            Assert.Equal(fireAt.AddMinutes(30), rearmed!.DueAtUtc);
+
+            var schedule = step.Effects.Single(e => e.Kind == DecisionEffectKind.ScheduleDeadline);
+            Assert.Equal(DeadlineNames.AdvisoryCompletion, schedule.Deadline!.Name);
+
+            var waiting = SingleTimelineEffect(step, "completion_waiting");
+            Assert.Contains("CompletionGateHolding", waiting.Parameters!["trigger"]);
+            Assert.Contains("realmjoin_resolution", waiting.Parameters!["missingPrerequisites"]);
+            Assert.Equal(rearmed.DueAtUtc.ToString("o"), waiting.Parameters!["resolutionDeadlineDueAtUtc"]);
+        }
+
+        [Fact]
+        public void Session81daa77f_RealmJoinResolvesAfterTheWindow_CompletesInsteadOfFailing()
+        {
+            // End-to-end proof against the real field shape: before this guard the session was
+            // stamped Failed at exit+30 min with esp_exit_without_completion_evidence, 34 min
+            // before the RealmJoin gate would have released it.
+            var engine = new DecisionEngine();
+            var state = SetupEspExitDeadEnd(engine);
+            state = AddDesktopRealmJoinAndHello(engine, state);
+
+            var fired = engine.Reduce(state, DeadlineFired(70, T0.AddMinutes(33), DeadlineNames.AdvisoryCompletion));
+            Assert.Null(fired.NewState.Outcome);
+
+            // RealmJoin reaches phase 110 — the gate opens and the session completes.
+            var resolved = engine.Reduce(fired.NewState, MakeSignal(
+                80, DecisionSignalKind.RealmJoinResolved, T0.AddMinutes(50),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "110" }));
+
+            Assert.Equal(SessionStage.Finalizing, resolved.NewState.Stage);
+            Assert.Equal("Resolved", resolved.NewState.RealmJoinFacts.Outcome!.Value);
+
+            var grace = FindDeadline(resolved.NewState, DeadlineNames.FinalizingGrace);
+            Assert.NotNull(grace);
+            var completed = engine.Reduce(resolved.NewState,
+                DeadlineFired(90, grace!.DueAtUtc, DeadlineNames.FinalizingGrace));
+            Assert.Equal(SessionStage.Completed, completed.NewState.Stage);
+            Assert.Equal(SessionOutcome.EnrollmentComplete, completed.NewState.Outcome);
+        }
+
+        // ============================================================== convergence ====
+
+        [Fact]
+        public void DeadlineFired_AfterTheGateOpened_ResolvesNormallyAgain()
+        {
+            // Convergence proof: the guard is not an escape hatch. Once RealmJoin timed out the
+            // gate is open, the guard stops applying, and a session with no completion evidence
+            // fails exactly as before.
+            var engine = new DecisionEngine();
+            var state = SetupEspExitDeadEnd(engine);
+            state = engine.Reduce(state, MakeSignal(
+                50, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(6),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "0" })).NewState;
+
+            var rjDeadline = FindDeadline(state, DeadlineNames.RealmJoinTimeout);
+            Assert.NotNull(rjDeadline);
+            state = engine.Reduce(state,
+                DeadlineFired(60, rjDeadline!.DueAtUtc, DeadlineNames.RealmJoinTimeout)).NewState;
+
+            Assert.True(DecisionEngine.RealmJoinGateOpen(state));
+            Assert.Null(FindDeadline(state, DeadlineNames.RealmJoinTimeout));
+
+            // No desktop, no Hello, no IME evidence — the genuine dead-end shape.
+            var step = engine.Reduce(state,
+                DeadlineFired(70, T0.AddMinutes(80), DeadlineNames.AdvisoryCompletion));
+
+            Assert.Equal(SessionStage.Failed, step.NewState.Stage);
+            Assert.Equal(SessionOutcome.EnrollmentFailed, step.NewState.Outcome);
+            var failed = SingleTimelineEffect(step, "enrollment_failed");
+            Assert.Equal("esp_exit_without_completion_evidence", failed.Parameters!["reason"]);
+        }
+
+        // =========================================================== mutation proofs ====
+
+        [Fact]
+        public void DeadlineFired_WithoutRealmJoin_StillFails()
+        {
+            // The guard must key on an actually-held gate, never on the absence of evidence.
+            var engine = new DecisionEngine();
+            var state = SetupEspExitDeadEnd(engine);
+
+            var step = engine.Reduce(state,
+                DeadlineFired(70, T0.AddMinutes(33), DeadlineNames.AdvisoryCompletion));
+
+            Assert.Equal(SessionStage.Failed, step.NewState.Stage);
+            Assert.Equal(SessionOutcome.EnrollmentFailed, step.NewState.Outcome);
+            var failed = SingleTimelineEffect(step, "enrollment_failed");
+            Assert.Equal("esp_exit_without_completion_evidence", failed.Parameters!["reason"]);
+        }
+
+        [Fact]
+        public void DeadlineFired_GateClosedButItsDeadlineNoLongerArmed_StillFails()
+        {
+            // A gate that can no longer resolve itself must not park the session forever. The
+            // hand-built state drops only the RealmJoin deadline, leaving the gate closed.
+            var engine = new DecisionEngine();
+            var state = SetupEspExitDeadEnd(engine);
+            state = AddDesktopRealmJoinAndHello(engine, state);
+
+            var builder = state.ToBuilder();
+            builder.CancelDeadline(DeadlineNames.RealmJoinTimeout);
+            state = builder.Build();
+
+            Assert.False(DecisionEngine.RealmJoinGateOpen(state));
+            Assert.Null(FindDeadline(state, DeadlineNames.RealmJoinTimeout));
+
+            var step = engine.Reduce(state,
+                DeadlineFired(70, T0.AddMinutes(33), DeadlineNames.AdvisoryCompletion));
+
+            Assert.Equal(SessionStage.Failed, step.NewState.Stage);
+            Assert.Equal(SessionOutcome.EnrollmentFailed, step.NewState.Outcome);
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AdminIdentityBindingAuthorizationTests.cs

@@ -0,0 +1,231 @@
+using System.Security.Claims;
+using AutopilotMonitor.Functions.Middleware;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// End-to-end authorization effect of identity binding through <see cref="PolicyEnforcementMiddleware"/>:
+/// a validly-signed token from a FOREIGN Entra tenant (the API accepts every tenant) whose upn matches a
+/// GlobalAdmins / DelegatedAdmins row must resolve NO platform or delegated role — and likewise a token
+/// from the home tenant under a different object id, a token without an oid, and any UPN whose role row
+/// has no binding at all. Also pins the ordering inside <see cref="DelegatedAdminService"/>: binding is
+/// checked before the Pro entitlement gate, and an unbound caller never triggers the edition lookup.
+/// </summary>
+public class AdminIdentityBindingAuthorizationTests
+{
+    private const string HomeTenant = "11111111-1111-1111-1111-111111111111";
+    private const string AttackerTenant = "22222222-2222-2222-2222-222222222222";
+    private const string ManagedTenant = "33333333-3333-3333-3333-333333333333";
+    private const string GaUpn = "cloudadmin@vendor.example";
+    private const string MspUpn = "msp@partner.example";
+    private const string Oid = "aaaaaaaa-1111-1111-1111-aaaaaaaaaaaa";
+    private const string OtherOid = "bbbbbbbb-2222-2222-2222-bbbbbbbbbbbb";
+
+    private sealed class Harness
+    {
+        public required PolicyEnforcementMiddleware Middleware { get; init; }
+        public required Mock<IAdminRepository> Repo { get; init; }
+    }
+
+    private static Harness Build(AdminIdentityBinding? binding, string? globalRole = null, string? delegatedTenant = null)
+    {
+        var repo = new Mock<IAdminRepository>();
+        repo.Setup(r => r.GetGlobalRoleAsync(It.IsAny<string>())).ReturnsAsync(globalRole);
+        repo.Setup(r => r.GetTenantMemberAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync((TenantMember?)null);
+        repo.Setup(r => r.GetDelegatedTenantsAsync(It.IsAny<string>())).ReturnsAsync(
+            delegatedTenant == null
+                ? new List<DelegatedAdminEntry>()
+                : new List<DelegatedAdminEntry>
+                {
+                    new()
+                    {
+                        Upn = MspUpn, TenantId = delegatedTenant.ToLowerInvariant(),
+                        Role = Constants.DelegatedRoles.DelegatedReader, IsEnabled = true,
+                        Status = Constants.DelegatedStatus.Active, Source = Constants.DelegatedSource.OperatorGranted,
+                    },
+                });
+        repo.Setup(r => r.GetGroupAssignmentsForUpnAsync(It.IsAny<string>())).ReturnsAsync(new List<TenantGroupAssignment>());
+        repo.Setup(r => r.GetIdentityBindingAsync(It.IsAny<string>())).ReturnsAsync(() => binding);
+        repo.Setup(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
+            .ReturnsAsync((string _, string tid, string oid) =>
+            {
+                if (binding != null && !binding.IsObjectIdPinned && binding.TenantId == tid)
+                    binding.ObjectId = oid;
+                return binding;
+            });
+
+        var configRepo = new Mock<IConfigRepository>();
+        configRepo.Setup(r => r.GetTenantConfigurationAsync(It.IsAny<string>())).ReturnsAsync((TenantConfiguration?)null);
+
+        var cache = new MemoryCache(new MemoryCacheOptions());
+        var bindings = new AdminIdentityBindingService(repo.Object, cache, NullLogger<AdminIdentityBindingService>.Instance);
+        var globalAdmin = new GlobalAdminService(repo.Object, bindings, cache, NullLogger<GlobalAdminService>.Instance);
+        var delegatedAdmin = new DelegatedAdminService(
+            repo.Object, bindings,
+            new StubTenantEntitlementService(TenantEdition.Pro),
+            cache, NullLogger<DelegatedAdminService>.Instance);
+        var tenantAdmins = new TenantAdminsService(repo.Object, cache, NullLogger<TenantAdminsService>.Instance);
+        var tenantConfig = new TenantConfigurationService(configRepo.Object, NullLogger<TenantConfigurationService>.Instance, cache);
+
+        return new Harness
+        {
+            Middleware = new PolicyEnforcementMiddleware(
+                NullLogger<PolicyEnforcementMiddleware>.Instance, globalAdmin, delegatedAdmin, tenantAdmins, tenantConfig),
+            Repo = repo,
+        };
+    }
+
+    private static ClaimsPrincipal Token(string tenantId, string upn, string? oid = Oid)
+    {
+        var claims = new List<Claim> { new("tid", tenantId), new("upn", upn) };
+        if (oid != null) claims.Add(new Claim("oid", oid));
+        return new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
+    }
+
+    private static AdminIdentityBinding Bound(string upn, string tenantId, string objectId = Oid)
+        => new() { Upn = upn, TenantId = tenantId, ObjectId = objectId };
+
+    // ── Global Admin tier ─────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task BoundGlobalAdmin_FromHomeTenant_IsAdmitted()
+    {
+        var h = Build(Bound(GaUpn, HomeTenant), globalRole: Constants.GlobalRoles.GlobalAdmin);
+        var r = await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn));
+        Assert.True(r.Allowed);
+        Assert.True(r.Context!.IsGlobalAdmin);
+    }
+
+    [Theory]
+    [InlineData("GET", "/api/global/raw/tables")]       // GlobalAdminOnly — raw table dump incl. tenant secrets
+    [InlineData("POST", "/api/auth/global-admins")]     // GlobalAdminOnly — persist access
+    [InlineData("GET", "/api/config/all")]              // GlobalReadOrDelegatedSubset
+    [InlineData("GET", "/api/auth/global-admins")]      // GlobalReadOrAdmin
+    public async Task ForeignTenantToken_WithGlobalAdminUpn_IsDenied(string method, string path)
+    {
+        // The finding: attacker registers the lapsed GA domain in their own tenant, creates the same UPN,
+        // signs in (any tenant is accepted) — the token is genuine, only the tid differs.
+        var h = Build(Bound(GaUpn, HomeTenant), globalRole: Constants.GlobalRoles.GlobalAdmin);
+        var r = await h.Middleware.DecideAsync(method, path, null, Token(AttackerTenant, GaUpn));
+        Assert.False(r.Allowed, $"{method} {path} must deny a foreign-tenant token even with a matching GA UPN");
+    }
+
+    [Fact]
+    public async Task ForeignTenantToken_WithGlobalAdminUpn_CannotReachAnotherTenant()
+    {
+        // Cross-tenant read on a tenant-scoped route: no GlobalScope ⇒ the cross-tenant guard blocks.
+        var h = Build(Bound(GaUpn, HomeTenant), globalRole: Constants.GlobalRoles.GlobalAdmin);
+        var r = await h.Middleware.DecideAsync("GET", $"/api/config/{ManagedTenant}", null, Token(AttackerTenant, GaUpn));
+        Assert.False(r.Allowed);
+    }
+
+    [Fact]
+    public async Task HomeTenantToken_DifferentObjectId_IsDenied()
+    {
+        // UPN recycled inside the home tenant (User Administrator re-assigns it to another account).
+        var h = Build(Bound(GaUpn, HomeTenant, Oid), globalRole: Constants.GlobalRoles.GlobalAdmin);
+        var r = await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn, OtherOid));
+        Assert.False(r.Allowed);
+    }
+
+    [Fact]
+    public async Task TokenWithoutObjectId_ResolvesNoPlatformRole()
+    {
+        var h = Build(Bound(GaUpn, HomeTenant), globalRole: Constants.GlobalRoles.GlobalAdmin);
+        var r = await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn, oid: null));
+        Assert.False(r.Allowed);
+    }
+
+    [Fact]
+    public async Task UnboundGlobalAdminRow_IsInert()
+    {
+        // Legacy row, no binding yet: fail-closed until the operator seeds the binding — never "first come".
+        var h = Build(binding: null, globalRole: Constants.GlobalRoles.GlobalAdmin);
+        Assert.False((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn))).Allowed);
+        Assert.False((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(AttackerTenant, GaUpn))).Allowed);
+    }
+
+    [Fact]
+    public async Task UnpinnedBinding_HomeTenantFirstSignIn_Pins_ThenForeignAndRecycledAreDenied()
+    {
+        var h = Build(Bound(GaUpn, HomeTenant, objectId: ""), globalRole: Constants.GlobalRoles.GlobalAdmin);
+
+        // First sign-in from the bound tenant pins the oid and is admitted.
+        Assert.True((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn, Oid))).Allowed);
+        h.Repo.Verify(r => r.TryPinIdentityObjectIdAsync(GaUpn, HomeTenant, Oid), Times.Once);
+
+        // From then on: same account ok, another account in the home tenant denied, foreign tenant denied.
+        Assert.True((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn, Oid))).Allowed);
+        Assert.False((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn, OtherOid))).Allowed);
+        Assert.False((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(AttackerTenant, GaUpn, Oid))).Allowed);
+    }
+
+    [Fact]
+    public async Task UnpinnedBinding_ForeignTenantCannotClaimThePin()
+    {
+        var h = Build(Bound(GaUpn, HomeTenant, objectId: ""), globalRole: Constants.GlobalRoles.GlobalAdmin);
+
+        Assert.False((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(AttackerTenant, GaUpn, OtherOid))).Allowed);
+        h.Repo.Verify(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+
+        // The real admin still gets the pin afterwards.
+        Assert.True((await h.Middleware.DecideAsync("GET", "/api/global/raw/tables", null, Token(HomeTenant, GaUpn, Oid))).Allowed);
+    }
+
+    // ── Delegated (MSP) tier ──────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task BoundDelegatedAdmin_FromHomeTenant_IsRescuedOnManagedTenantRead()
+    {
+        var h = Build(Bound(MspUpn, HomeTenant), delegatedTenant: ManagedTenant);
+        var r = await h.Middleware.DecideAsync("GET", $"/api/config/{ManagedTenant}", null, Token(HomeTenant, MspUpn));
+        Assert.True(r.Allowed);
+        Assert.True(r.Context!.IsDelegatedReader);
+    }
+
+    [Fact]
+    public async Task ForeignTenantToken_WithDelegatedUpn_ResolvesEmptyScope()
+    {
+        // The finding's MSP variant: an attacker tenant (Pro via self-service trial) mints the delegated UPN.
+        var h = Build(Bound(MspUpn, HomeTenant), delegatedTenant: ManagedTenant);
+        var r = await h.Middleware.DecideAsync("GET", $"/api/config/{ManagedTenant}", null, Token(AttackerTenant, MspUpn));
+        Assert.False(r.Allowed);
+        Assert.False((await h.Middleware.DecideAsync("GET", "/api/config/all", null, Token(AttackerTenant, MspUpn))).Allowed);
+    }
+
+    [Fact]
+    public async Task DelegatedService_ChecksBindingBeforeEntitlementGate()
+    {
+        var repo = new Mock<IAdminRepository>();
+        repo.Setup(r => r.GetDelegatedTenantsAsync(It.IsAny<string>())).ReturnsAsync(new List<DelegatedAdminEntry>
+        {
+            new()
+            {
+                Upn = MspUpn, TenantId = ManagedTenant, Role = Constants.DelegatedRoles.DelegatedReader,
+                IsEnabled = true, Status = Constants.DelegatedStatus.Active, Source = Constants.DelegatedSource.OperatorGranted,
+            },
+        });
+        repo.Setup(r => r.GetGroupAssignmentsForUpnAsync(It.IsAny<string>())).ReturnsAsync(new List<TenantGroupAssignment>());
+        var editionLookups = 0;
+        var svc = new DelegatedAdminService(
+            repo.Object,
+            new StubAdminIdentityBindingService(bound: false),
+            new StubTenantEntitlementService(_ => { editionLookups++; return TenantEdition.Pro; }),
+            new MemoryCache(new MemoryCacheOptions()),
+            NullLogger<DelegatedAdminService>.Instance);
+
+        var scope = await svc.GetScopeAsync(new AdminIdentity(MspUpn, AttackerTenant, Oid));
+
+        Assert.True(scope.IsEmpty);
+        Assert.Equal(0, editionLookups);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AdminIdentityBindingServiceTests.cs

@@ -0,0 +1,242 @@
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins <see cref="AdminIdentityBindingService"/> — the one place that decides whether a caller IS the
+/// identity a cross-tenant-role UPN was granted for. The API accepts tokens from any Entra tenant and
+/// upn/preferred_username are mutable, so a UPN string alone must never resolve a platform or delegated
+/// role: only the (upn, tid, oid) triple matching the stored binding does. Covers the verdict matrix
+/// (no binding / tenant mismatch / first-sign-in pin / pinned mismatch / concurrent-pin loss), the cache
+/// invalidation after a pin, and the grant-time conflict rules (a grant never silently re-homes a UPN).
+/// </summary>
+public class AdminIdentityBindingServiceTests
+{
+    private const string Upn = "admin@vendor.example";
+    private const string HomeTenant = "11111111-1111-1111-1111-111111111111";
+    private const string ForeignTenant = "22222222-2222-2222-2222-222222222222";
+    private const string Oid = "aaaaaaaa-1111-1111-1111-aaaaaaaaaaaa";
+    private const string OtherOid = "bbbbbbbb-2222-2222-2222-bbbbbbbbbbbb";
+
+    private static (AdminIdentityBindingService Svc, Mock<IAdminRepository> Repo) Build(AdminIdentityBinding? stored)
+    {
+        var repo = new Mock<IAdminRepository>();
+        // Stateful stand-in for the row: reads return `stored`, a pin mutates it under the repo's contract
+        // (only onto an unpinned row homed in the caller's tenant), upserts replace it.
+        repo.Setup(r => r.GetIdentityBindingAsync(It.IsAny<string>())).ReturnsAsync(() => stored);
+        repo.Setup(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
+            .ReturnsAsync((string _, string tid, string oid) =>
+            {
+                if (stored != null && !stored.IsObjectIdPinned && stored.TenantId == tid)
+                    stored.ObjectId = oid;
+                return stored;
+            });
+        repo.Setup(r => r.UpsertIdentityBindingAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string>()))
+            .ReturnsAsync((string upn, string tid, string? oid, string by) =>
+            {
+                stored = new AdminIdentityBinding { Upn = upn, TenantId = tid, ObjectId = oid ?? string.Empty, BoundBy = by };
+                return true;
+            });
+        var svc = new AdminIdentityBindingService(
+            repo.Object, new MemoryCache(new MemoryCacheOptions()), NullLogger<AdminIdentityBindingService>.Instance);
+        return (svc, repo);
+    }
+
+    private static AdminIdentityBinding Binding(string tenantId, string objectId = "") =>
+        new() { Upn = Upn, TenantId = tenantId, ObjectId = objectId };
+
+    private static AdminIdentity Caller(string tenantId = HomeTenant, string oid = Oid) => new(Upn, tenantId, oid);
+
+    // ── Verdict matrix ────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task NullIdentity_IsNeverBound_AndReadsNothing()
+    {
+        var (svc, repo) = Build(Binding(HomeTenant, Oid));
+        Assert.False(await svc.IsBoundAsync(null));
+        repo.Verify(r => r.GetIdentityBindingAsync(It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task NoBindingRow_IsNotBound()
+    {
+        // A legacy role row without a binding is inert — fail-closed, never "bind whoever shows up first".
+        var (svc, _) = Build(stored: null);
+        Assert.False(await svc.IsBoundAsync(Caller()));
+    }
+
+    [Fact]
+    public async Task ForeignTenant_WithMatchingUpn_IsNotBound()
+    {
+        // The finding's primary exploit: same UPN string minted by another Entra tenant (domain re-registered,
+        // or a lookalike verified elsewhere). The tid is the immutable discriminator.
+        var (svc, repo) = Build(Binding(HomeTenant, Oid));
+        Assert.False(await svc.IsBoundAsync(Caller(tenantId: ForeignTenant)));
+        // And it must not pin anything onto the real admin's binding.
+        repo.Verify(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task ForeignTenant_AgainstUnpinnedBinding_DoesNotPin()
+    {
+        // Unpinned binding + foreign-tenant token: tenant mismatch is checked BEFORE the pin, so the
+        // attacker cannot "claim" the object-id slot of an admin who has not signed in yet.
+        var (svc, repo) = Build(Binding(HomeTenant));
+        Assert.False(await svc.IsBoundAsync(Caller(tenantId: ForeignTenant)));
+        repo.Verify(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task PinnedBinding_MatchingTidAndOid_IsBound()
+    {
+        var (svc, _) = Build(Binding(HomeTenant, Oid));
+        Assert.True(await svc.IsBoundAsync(Caller()));
+    }
+
+    [Fact]
+    public async Task PinnedBinding_SameTenantDifferentOid_IsNotBound()
+    {
+        // UPN recycling inside the home tenant: a User Administrator re-assigns the UPN to another account.
+        // Same tid, new oid — refused until an operator explicitly rebinds.
+        var (svc, _) = Build(Binding(HomeTenant, Oid));
+        Assert.False(await svc.IsBoundAsync(Caller(oid: OtherOid)));
+    }
+
+    [Fact]
+    public async Task UnpinnedBinding_FirstSignInFromHomeTenant_PinsAndIsBound_ThenEnforced()
+    {
+        var (svc, repo) = Build(Binding(HomeTenant));
+
+        Assert.True(await svc.IsBoundAsync(Caller()));
+        repo.Verify(r => r.TryPinIdentityObjectIdAsync(Upn, HomeTenant, Oid), Times.Once);
+
+        // Pinned now: the same account stays bound, any other account in the same tenant is refused.
+        Assert.True(await svc.IsBoundAsync(Caller()));
+        Assert.False(await svc.IsBoundAsync(Caller(oid: OtherOid)));
+        // The pin happened exactly once — later calls verify against the stored (cached) binding.
+        repo.Verify(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task ConcurrentPin_LostRace_VerifiesAgainstStoredWinner()
+    {
+        // Two accounts in the home tenant race the first sign-in; the repository's conditional update lets
+        // exactly one win. The loser must be judged against what was STORED, never against its own intent.
+        var (svc, repo) = Build(Binding(HomeTenant));
+        repo.Setup(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
+            .ReturnsAsync(Binding(HomeTenant, OtherOid)); // someone else won
+
+        Assert.False(await svc.IsBoundAsync(Caller()));
+    }
+
+    [Fact]
+    public async Task PinResult_Null_MeansBindingVanished_IsNotBound()
+    {
+        // Binding removed between the cached read and the pin (operator DELETE racing the sign-in).
+        var (svc, repo) = Build(Binding(HomeTenant));
+        repo.Setup(r => r.TryPinIdentityObjectIdAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
+            .ReturnsAsync((AdminIdentityBinding?)null);
+
+        Assert.False(await svc.IsBoundAsync(Caller()));
+    }
+
+    [Fact]
+    public async Task Verdict_IsCached_ButPinInvalidates()
+    {
+        var (svc, repo) = Build(Binding(HomeTenant, Oid));
+        Assert.True(await svc.IsBoundAsync(Caller()));
+        Assert.True(await svc.IsBoundAsync(Caller()));
+        repo.Verify(r => r.GetIdentityBindingAsync(It.IsAny<string>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task Rebind_InvalidatesCache_SoNewTenantTakesEffectImmediately()
+    {
+        var (svc, _) = Build(Binding(HomeTenant, Oid));
+        Assert.True(await svc.IsBoundAsync(Caller()));
+
+        await svc.RebindAsync(Upn, ForeignTenant, OtherOid, "ga@vendor.example");
+
+        Assert.False(await svc.IsBoundAsync(Caller()));
+        Assert.True(await svc.IsBoundAsync(Caller(tenantId: ForeignTenant, oid: OtherOid)));
+    }
+
+    // ── Grant-time binding (EnsureBoundAsync) ─────────────────────────────────────
+
+    [Fact]
+    public async Task Ensure_NoExistingBinding_CreatesIt()
+    {
+        var (svc, repo) = Build(stored: null);
+        var b = await svc.EnsureBoundAsync(Upn, HomeTenant, null, "ga@vendor.example");
+        Assert.Equal(HomeTenant, b.TenantId);
+        Assert.False(b.IsObjectIdPinned);
+        repo.Verify(r => r.UpsertIdentityBindingAsync(Upn, HomeTenant, null, "ga@vendor.example"), Times.Once);
+    }
+
+    [Fact]
+    public async Task Ensure_SameTenant_KeepsExistingPin_NoWrite()
+    {
+        // A second grant (another managed tenant / a group) for an already-bound UPN is a no-op on the binding.
+        var (svc, repo) = Build(Binding(HomeTenant, Oid));
+        var b = await svc.EnsureBoundAsync(Upn, HomeTenant, null, "ga@vendor.example");
+        Assert.Equal(Oid, b.ObjectId);
+        repo.Verify(r => r.UpsertIdentityBindingAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task Ensure_SameTenant_UnpinnedThenObjectIdSupplied_Upgrades()
+    {
+        var (svc, repo) = Build(Binding(HomeTenant));
+        var b = await svc.EnsureBoundAsync(Upn, HomeTenant, Oid, "ga@vendor.example");
+        Assert.Equal(Oid, b.ObjectId);
+        repo.Verify(r => r.UpsertIdentityBindingAsync(Upn, HomeTenant, Oid, "ga@vendor.example"), Times.Once);
+    }
+
+    [Fact]
+    public async Task Ensure_DifferentTenant_Conflicts_NeverRehomes()
+    {
+        // A grant must not be a covert rebind: moving a UPN to another tenant is an explicit PUT.
+        var (svc, repo) = Build(Binding(HomeTenant, Oid));
+        await Assert.ThrowsAsync<IdentityBindingConflictException>(
+            () => svc.EnsureBoundAsync(Upn, ForeignTenant, null, "ga@vendor.example"));
+        repo.Verify(r => r.UpsertIdentityBindingAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task Ensure_DifferentPinnedObjectId_Conflicts()
+    {
+        var (svc, _) = Build(Binding(HomeTenant, Oid));
+        await Assert.ThrowsAsync<IdentityBindingConflictException>(
+            () => svc.EnsureBoundAsync(Upn, HomeTenant, OtherOid, "ga@vendor.example"));
+    }
+
+    [Fact]
+    public async Task Ensure_NormalizesCase()
+    {
+        var (svc, repo) = Build(stored: null);
+        await svc.EnsureBoundAsync("Admin@Vendor.Example", HomeTenant.ToUpperInvariant(), Oid.ToUpperInvariant(), "ga@vendor.example");
+        repo.Verify(r => r.UpsertIdentityBindingAsync(Upn, HomeTenant, Oid, "ga@vendor.example"), Times.Once);
+    }
+
+    // ── AdminIdentity construction ────────────────────────────────────────────────
+
+    [Theory]
+    [InlineData(null, HomeTenant, Oid)]
+    [InlineData(Upn, "", Oid)]
+    [InlineData(Upn, HomeTenant, "  ")]
+    public void AdminIdentity_Create_RequiresAllThree(string? upn, string? tid, string? oid)
+        => Assert.Null(AdminIdentity.Create(upn, tid, oid));
+
+    [Fact]
+    public void AdminIdentity_Create_Lowercases()
+    {
+        var id = AdminIdentity.Create("Admin@Vendor.Example", HomeTenant.ToUpperInvariant(), Oid.ToUpperInvariant());
+        Assert.Equal(new AdminIdentity(Upn, HomeTenant, Oid), id);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AdminIdentityResolverTests.cs

@@ -0,0 +1,104 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins <see cref="AdminIdentityResolver"/> — what makes granting a cross-tenant role "type the UPN":
+/// sign-in history first (tid + oid, both from validated tokens), then UPN domain → onboarded tenant
+/// (tid only, oid pinned on first sign-in), and NO answer when the history is ambiguous (same UPN under
+/// two tenants — exactly the situation the binding exists for) or the domain is unknown.
+/// </summary>
+public class AdminIdentityResolverTests
+{
+    private const string Upn = "msp@partner.example";
+    private const string TenantA = "11111111-1111-1111-1111-111111111111";
+    private const string TenantB = "22222222-2222-2222-2222-222222222222";
+    private const string OidOld = "aaaaaaaa-1111-1111-1111-aaaaaaaaaaaa";
+    private const string OidNew = "bbbbbbbb-2222-2222-2222-bbbbbbbbbbbb";
+
+    private static AdminIdentityResolver Build(
+        IEnumerable<UserSignInIdentity>? signIns = null,
+        params (string TenantId, string Domain)[] tenants)
+    {
+        var metrics = new Mock<IMetricsRepository>();
+        metrics.Setup(m => m.GetSignInIdentitiesByUpnAsync(It.IsAny<string>()))
+            .ReturnsAsync((signIns ?? Array.Empty<UserSignInIdentity>()).ToList());
+
+        var configRepo = new Mock<IConfigRepository>();
+        configRepo.Setup(r => r.GetAllTenantConfigurationsAsync())
+            .ReturnsAsync(tenants.Select(t => new TenantConfiguration { TenantId = t.TenantId, DomainName = t.Domain }).ToList());
+        var configService = new TenantConfigurationService(
+            configRepo.Object, NullLogger<TenantConfigurationService>.Instance, new MemoryCache(new MemoryCacheOptions()));
+
+        return new AdminIdentityResolver(metrics.Object, configService, NullLogger<AdminIdentityResolver>.Instance);
+    }
+
+    private static UserSignInIdentity SignIn(string tid, string oid, int daysAgo) => new()
+    {
+        TenantId = tid, ObjectId = oid, LastLoginAt = DateTime.UtcNow.AddDays(-daysAgo), LoginCount = 1,
+    };
+
+    [Fact]
+    public async Task SignInHistory_SingleTenant_ResolvesTidAndOid()
+    {
+        var r = await Build(new[] { SignIn(TenantA, OidOld, 3) }).ResolveAsync("MSP@Partner.Example");
+        Assert.NotNull(r);
+        Assert.Equal(TenantA, r!.TenantId);
+        Assert.Equal(OidOld, r.ObjectId);
+        Assert.Equal(ResolvedAdminIdentity.SourceSignIn, r.Source);
+    }
+
+    [Fact]
+    public async Task SignInHistory_SameTenantTwoOids_TakesMostRecent()
+    {
+        // Account re-created in the same tenant: the newer oid is the one that will sign in next.
+        var r = await Build(new[] { SignIn(TenantA, OidOld, 30), SignIn(TenantA, OidNew, 1) }).ResolveAsync(Upn);
+        Assert.Equal(OidNew, r!.ObjectId);
+    }
+
+    [Fact]
+    public async Task SignInHistory_TwoTenants_IsAmbiguous_NotResolved_EvenIfDomainMatches()
+    {
+        // The same UPN string seen under two tenants is the attack shape; never auto-pick, even when the
+        // domain fallback would have an answer.
+        var r = await Build(new[] { SignIn(TenantA, OidOld, 3), SignIn(TenantB, OidNew, 1) }, (TenantA, "partner.example"))
+            .ResolveAsync(Upn);
+        Assert.Null(r);
+    }
+
+    [Fact]
+    public async Task NoSignIns_DomainOfOnboardedTenant_ResolvesTidOnly()
+    {
+        var r = await Build(null, (TenantA, "Partner.Example"), (TenantB, "other.example")).ResolveAsync(Upn);
+        Assert.NotNull(r);
+        Assert.Equal(TenantA, r!.TenantId);
+        Assert.Null(r.ObjectId);
+        Assert.Equal(ResolvedAdminIdentity.SourceDomain, r.Source);
+    }
+
+    [Fact]
+    public async Task NoSignIns_TwoTenantsClaimTheDomain_NotResolved()
+    {
+        var r = await Build(null, (TenantA, "partner.example"), (TenantB, "partner.example")).ResolveAsync(Upn);
+        Assert.Null(r);
+    }
+
+    [Fact]
+    public async Task NoSignIns_UnknownDomain_NotResolved()
+    {
+        var r = await Build(null, (TenantA, "other.example")).ResolveAsync(Upn);
+        Assert.Null(r);
+    }
+
+    [Theory]
+    [InlineData("nodomain")]
+    [InlineData("trailing@")]
+    public async Task MalformedUpn_NotResolved(string upn)
+        => Assert.Null(await Build(null, (TenantA, "partner.example")).ResolveAsync(upn));
+}

src/Backend/AutopilotMonitor.Functions.Tests/AnalyzeRuleRelatedDocsUrlTests.cs

@@ -0,0 +1,92 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Stored-XSS guard for analyze-rule relatedDocs: the author-controlled URL is rendered as
+/// an anchor href for every viewer (including cross-tenant admins), so only absolute
+/// http(s) URLs may persist. Create and Update both reject anything else with an
+/// <see cref="ArgumentException"/> (400), and drop blank entries silently.
+/// </summary>
+public class AnalyzeRuleRelatedDocsUrlTests
+{
+    private const string TenantId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+
+    [Theory]
+    [InlineData("https://learn.microsoft.com/x", true)]
+    [InlineData("http://example.com/", true)]
+    [InlineData("  https://example.com/a?b=c#d ", true)]
+    [InlineData("javascript:alert(1)", false)]
+    [InlineData("JavaScript:fetch('https://example.com/'+localStorage.token)", false)]
+    [InlineData("data:text/html,<script>alert(1)</script>", false)]
+    [InlineData("vbscript:msgbox(1)", false)]
+    [InlineData("file:///etc/passwd", false)]
+    [InlineData("/relative/path", false)]
+    [InlineData("example.com", false)]
+    [InlineData("", false)]
+    [InlineData(null, false)]
+    public void IsAbsoluteHttpUrl_allows_only_absolute_http_and_https(string? url, bool expected)
+    {
+        Assert.Equal(expected, AnalyzeRuleService.IsAbsoluteHttpUrl(url));
+    }
+
+    [Fact]
+    public async Task CreateRuleAsync_rejects_javascript_url_and_never_persists()
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Strict);
+        repo.Setup(r => r.AnalyzeRuleExistsAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync(false);
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+
+        var rule = MakeRule(new RelatedDoc { Title = "Microsoft Docs: fix this error", Url = "javascript:alert(1)" });
+
+        var ex = await Assert.ThrowsAsync<ArgumentException>(() => service.CreateRuleAsync(TenantId, rule));
+        Assert.Contains("javascript:alert(1)", ex.Message);
+        repo.Verify(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task UpdateRuleAsync_rejects_data_url_for_custom_rule()
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Strict);
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+
+        var rule = MakeRule(new RelatedDoc { Title = "Docs", Url = "data:text/html,<script>alert(1)</script>" });
+
+        await Assert.ThrowsAsync<ArgumentException>(() => service.UpdateRuleAsync(TenantId, rule));
+        repo.Verify(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task CreateRuleAsync_keeps_https_docs_and_drops_blank_entries()
+    {
+        AnalyzeRule? stored = null;
+        var repo = new Mock<IRuleRepository>(MockBehavior.Strict);
+        repo.Setup(r => r.AnalyzeRuleExistsAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync(false);
+        repo.Setup(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), TenantId))
+            .Callback<AnalyzeRule, string>((r, _) => stored = r)
+            .ReturnsAsync(true);
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+
+        var rule = MakeRule(
+            new RelatedDoc { Title = "Good", Url = "https://learn.microsoft.com/x" },
+            new RelatedDoc { Title = "", Url = "" },          // editor "+ Add Link" default, untouched
+            new RelatedDoc { Title = "Blank", Url = "   " });
+
+        Assert.True(await service.CreateRuleAsync(TenantId, rule));
+        Assert.NotNull(stored);
+        var doc = Assert.Single(stored!.RelatedDocs);
+        Assert.Equal("https://learn.microsoft.com/x", doc.Url);
+    }
+
+    private static AnalyzeRule MakeRule(params RelatedDoc[] docs) => new()
+    {
+        RuleId = "TENANT-DOCS-URL-001",
+        IsBuiltIn = false,
+        IsCommunity = false,
+        RelatedDocs = docs.ToList(),
+    };
+}

src/Backend/AutopilotMonitor.Functions.Tests/AuthFunctionSideEffectTests.cs

@@ -1,4 +1,5 @@
 using AutopilotMonitor.Functions.Functions.Infrastructure;
+using AutopilotMonitor.Functions.Security;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.DataAccess;
 using AutopilotMonitor.Shared.Models;
@@ -39,16 +40,18 @@ public class AuthFunctionSideEffectTests
             configRepo, Mock.Of<ILogger<TenantConfigurationService>>(), cache)
         { CallBase = false };
 
+        var bindings = new StubAdminIdentityBindingService(bound: true);
         var globalAdminMock = new Mock<GlobalAdminService>(
-            adminRepo, cache, Mock.Of<ILogger<GlobalAdminService>>())
+            adminRepo, bindings, cache, Mock.Of<ILogger<GlobalAdminService>>())
         { CallBase = false };
 
         var delegatedAdminMock = new Mock<DelegatedAdminService>(
             adminRepo,
+            bindings,
             new StubTenantEntitlementService(AutopilotMonitor.Functions.Security.TenantEdition.Pro),
             cache, Mock.Of<ILogger<DelegatedAdminService>>())
         { CallBase = false };
-        delegatedAdminMock.Setup(x => x.GetScopeAsync(It.IsAny<string>(), It.IsAny<string?>()))
+        delegatedAdminMock.Setup(x => x.GetScopeAsync(It.IsAny<AdminIdentity?>()))
             .ReturnsAsync(DelegatedScope.Empty);
 
         _tenantAdminsMock = new Mock<TenantAdminsService>(
@@ -93,7 +96,9 @@ public class AuthFunctionSideEffectTests
             _autoApproveEnqueuerMock.Object,
             new AutopilotMonitor.Functions.Security.EntraAppRegistry(
                 new Microsoft.Extensions.Configuration.ConfigurationBuilder().Build(),
-                Mock.Of<ILogger<AutopilotMonitor.Functions.Security.EntraAppRegistry>>()));
+                Mock.Of<ILogger<AutopilotMonitor.Functions.Security.EntraAppRegistry>>()),
+            new Mock<AdminIdentityResolver>(
+                _metricsRepoMock.Object, _tenantConfigMock.Object, Mock.Of<ILogger<AdminIdentityResolver>>()) { CallBase = false }.Object);
 
         // Default: all fire-and-forget calls succeed
         _tenantConfigMock
@@ -118,6 +123,22 @@ public class AuthFunctionSideEffectTests
     // HandleNewTenantDomainAsync
     // -------------------------------------------------------------------------
 
+    [Fact]
+    public async Task HandleNewTenantDomain_WhenUpnDomainIsNotAHostName_DoesNotSeed()
+    {
+        var config = DefaultConfig();
+        config.DomainName = null!;
+        config.OnboardedBy = null;
+
+        // The seed is rendered into transactional mails: anything but a strict host name is refused.
+        await _sut.HandleNewTenantDomainAsync(config, TenantId, "user@<b>contoso.com</b>");
+
+        Assert.True(string.IsNullOrEmpty(config.DomainName));
+        Assert.Null(config.OnboardedBy);
+        _tenantConfigMock.Verify(x => x.SaveConfigurationAsync(It.IsAny<TenantConfiguration>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Never);
+        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+    }
+
     [Fact]
     public async Task HandleNewTenantDomain_WhenDomainEmpty_ExtractsAndSaves()
     {

src/Backend/AutopilotMonitor.Functions.Tests/AzureQueueImeMsiArchiveProducerTests.cs

@@ -35,7 +35,7 @@ public class AzureQueueImeMsiArchiveProducerTests
         Assert.Equal(2, sentBodies.Count);
         var roundTripped = JsonConvert.DeserializeObject<ImeMsiArchiveEnvelope>(sentBodies[0])!;
         Assert.Equal(Version, roundTripped.Version);
-        Assert.Equal(ImeMsiArchiver.CanonicalMsiUrl, roundTripped.MsiDownloadUrl);
+        Assert.Equal(ImeMsiArchiver.FallbackMsiUrls[1], roundTripped.MsiDownloadUrl);
         Assert.Equal("11111111-1111-1111-1111-111111111111", roundTripped.TenantId);
         // Queue existence is ensured once, then latched — not re-checked per message.
         queue.Verify(q => q.CreateIfNotExistsAsync(
@@ -92,7 +92,7 @@ public class AzureQueueImeMsiArchiveProducerTests
     private static ImeMsiArchiveEnvelope Envelope() => new()
     {
         Version = Version,
-        MsiDownloadUrl = ImeMsiArchiver.CanonicalMsiUrl,
+        MsiDownloadUrl = ImeMsiArchiver.FallbackMsiUrls[1],
         MsiMatchedBy = "productVersion",
         TenantId = "11111111-1111-1111-1111-111111111111",
         SessionId = "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",

src/Backend/AutopilotMonitor.Functions.Tests/BlobNameGuardTests.cs

@@ -0,0 +1,39 @@
+using AutopilotMonitor.Functions.Security;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Request-derived blob names must be flat. Azure.Storage.Blobs keeps '/' in the blob URI and
+/// System.Uri collapses '..' segments, so "x/../../other-container/y" would resolve outside the
+/// intended container. The guard is the last line at every GetBlobClient sink.
+/// </summary>
+public class BlobNameGuardTests
+{
+    [Theory]
+    [InlineData("11111111-1111-1111-1111-111111111111_aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa_diag_request_20260829_120000.zip")]
+    [InlineData("report.zip")]
+    [InlineData("a.b.c.zip")]
+    public void IsFlat_AcceptsFlatNames(string name)
+    {
+        Assert.True(BlobNameGuard.IsFlat(name));
+        Assert.Equal(name, BlobNameGuard.EnsureFlat(name, "name"));
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("TA_x/../../hosted-diagnostics/victim/payload_diag_request_1.zip")]
+    [InlineData("a/b.zip")]
+    [InlineData("a\\b.zip")]
+    [InlineData("..zip")]
+    [InlineData("a%2F..%2Fb.zip")]
+    [InlineData("a?b.zip")]
+    [InlineData("a#b.zip")]
+    public void IsFlat_RejectsPathShapedNames(string? name)
+    {
+        Assert.False(BlobNameGuard.IsFlat(name));
+        Assert.Throws<ArgumentException>(() => BlobNameGuard.EnsureFlat(name, "name"));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/BootstrapAuthDisabledTenantTests.cs

@@ -1,4 +1,4 @@
-using System.Net;
+using System.Net;
 using AutopilotMonitor.Functions.Security;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.DataAccess;
@@ -99,8 +99,9 @@ public sealed class BootstrapAuthDisabledTenantTests
     {
         // Sanity: a non-disabled tenant DOES reach the bootstrap branch (which will then
         // run its own validation against _bootstrapSessionService). With _bootstrapSessionService
-        // null in this test, the bootstrap branch falls through to the cert path — proving
-        // that the §0 gate did NOT block.
+        // null and no request URL (= not a /api/bootstrap/* route, where that combination is
+        // rejected fail-closed — see BootstrapRouteFailClosedTests), the branch falls through to
+        // the platform-cert path — proving that the §0 gate did NOT block.
         var enabled = TenantConfiguration.CreateDefault(TenantId);
         enabled.Disabled = false;
         enabled.ValidateAutopilotDevice = false;

src/Backend/AutopilotMonitor.Functions.Tests/BootstrapRouteFailClosedTests.cs

@@ -0,0 +1,161 @@
+using System.Net;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Bootstrap routes (<c>/api/bootstrap/*</c>) are excluded from the platform's TLS client-cert
+/// requirement, so nothing on those paths proves an mTLS handshake ever happened. The bootstrap
+/// token must therefore be the ONLY credential accepted there — a request that reaches the
+/// certificate stage on a bootstrap route would authenticate from header bytes alone (a public
+/// certificate is replayable without its private key). Live probe 2026-08-29: an empty
+/// <c>X-Bootstrap-Token</c> passed the function gate, skipped the token branch and had a
+/// client-supplied certificate header parsed. These tests pin the fail-closed behaviour.
+/// </summary>
+public sealed class BootstrapRouteFailClosedTests
+{
+    private const string TenantId = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+    private const string BootstrapRoute = "https://example.invalid/api/bootstrap/config";
+    private const string AgentRoute = "https://example.invalid/api/agent/telemetry";
+
+    // A well-formed DER certificate is not needed: what matters is whether the certificate stage
+    // ran at all, and the "No certificate provided" vs. parse-error details tell the two apart.
+    private const string JunkCertBase64 = "QUJD";
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public async Task BootstrapRoute_TokenMissingOrEmpty_Rejected401_BeforeCertificateStage(string? token)
+    {
+        var sut = BuildValidator(bootstrapService: null);
+        var req = BuildRequest(BootstrapRoute, token, ("X-ARR-ClientCert", JunkCertBase64));
+
+        var result = await sut.ValidateRequestAsync(req, TenantId);
+
+        Assert.False(result.IsValid);
+        Assert.Equal(HttpStatusCode.Unauthorized, result.StatusCode);
+        Assert.Equal("X-Bootstrap-Token header is required", result.ErrorMessage);
+    }
+
+    [Fact]
+    public async Task BootstrapRoute_ClientSuppliedCertificateHeader_NeverParsed()
+    {
+        var sut = BuildValidator(bootstrapService: null);
+        var req = BuildRequest(BootstrapRoute, token: "", ("X-Client-Certificate", JunkCertBase64));
+
+        var result = await sut.ValidateRequestAsync(req, TenantId);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, result.StatusCode);
+        Assert.Equal("X-Bootstrap-Token header is required", result.ErrorMessage);
+        Assert.DoesNotContain("certificate", result.ErrorMessage, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task AgentRoute_ClientCertificateHeader_IsIgnored()
+    {
+        // The removed X-Client-Certificate fallback: on a platform-enforced route the only
+        // certificate source is X-ARR-ClientCert. A client-writable header must read as "no cert".
+        var sut = BuildValidator(bootstrapService: null);
+        var req = BuildRequest(AgentRoute, token: null, ("X-Client-Certificate", JunkCertBase64));
+
+        var result = await sut.ValidateRequestAsync(req, TenantId);
+
+        Assert.False(result.IsValid);
+        Assert.Equal(HttpStatusCode.Unauthorized, result.StatusCode);
+        Assert.Equal("Invalid or missing client certificate", result.ErrorMessage);
+        Assert.Equal("No certificate provided", result.Details);
+    }
+
+    [Fact]
+    public async Task AgentRoute_ArrClientCertHeader_ReachesCertificateStage()
+    {
+        // Control: the platform-set header is still the one consulted (junk bytes → parse error,
+        // proving the certificate stage ran on the supplied value).
+        var sut = BuildValidator(bootstrapService: null);
+        var req = BuildRequest(AgentRoute, token: null, ("X-ARR-ClientCert", JunkCertBase64));
+
+        var result = await sut.ValidateRequestAsync(req, TenantId);
+
+        Assert.Equal(HttpStatusCode.Unauthorized, result.StatusCode);
+        Assert.Equal("Invalid or missing client certificate", result.ErrorMessage);
+        Assert.NotEqual("No certificate provided", result.Details);
+    }
+
+    [Fact]
+    public void GetBootstrapToken_TreatsEmptyAsAbsent()
+    {
+        Assert.Null(SecurityValidator.GetBootstrapToken(BuildRequest(BootstrapRoute, token: "")));
+        Assert.Null(SecurityValidator.GetBootstrapToken(BuildRequest(BootstrapRoute, token: null)));
+        Assert.Equal("abc", SecurityValidator.GetBootstrapToken(BuildRequest(BootstrapRoute, token: "abc")));
+    }
+
+    [Theory]
+    [InlineData("https://example.invalid/api/bootstrap/config", true)]
+    [InlineData("https://example.invalid/API/Bootstrap/register-session", true)]
+    [InlineData("https://example.invalid/api/bootstrapx/config", false)]
+    [InlineData("https://example.invalid/api/agent/telemetry", false)]
+    public void IsBootstrapRoute_MatchesPlatformExclusionPrefix(string url, bool expected)
+    {
+        Assert.Equal(expected, SecurityValidator.IsBootstrapRoute(BuildRequest(url, token: null)));
+    }
+
+    // ---------------------------------------------------------------- harness
+
+    private static SecurityValidator BuildValidator(BootstrapSessionService? bootstrapService)
+    {
+        var configRepo = Mock.Of<IConfigRepository>();
+        var cache = new MemoryCache(new MemoryCacheOptions());
+
+        // AllowInsecureAgentRequests clears the "at least one device validator" gate so agent-route
+        // requests reach the certificate stage — the stage these tests reason about.
+        var config = TenantConfiguration.CreateDefault(TenantId);
+        config.AllowInsecureAgentRequests = true;
+
+        var configServiceMock = new Mock<TenantConfigurationService>(
+            configRepo, Mock.Of<ILogger<TenantConfigurationService>>(), cache)
+        { CallBase = false };
+        configServiceMock
+            .Setup(x => x.TryGetConfigurationAsync(It.IsAny<string>()))
+            .ReturnsAsync((config, true));
+
+        var adminConfigServiceMock = new Mock<AdminConfigurationService>(
+            configRepo, Mock.Of<ILogger<AdminConfigurationService>>(), cache)
+        { CallBase = false };
+        adminConfigServiceMock
+            .Setup(x => x.GetConfigurationAsync())
+            .ReturnsAsync(new AdminConfiguration());
+
+        return new SecurityValidator(
+            configService: configServiceMock.Object,
+            adminConfigService: adminConfigServiceMock.Object,
+            rateLimitService: new RateLimitService(cache, Mock.Of<ILogger<RateLimitService>>()),
+            autopilotDeviceValidator: null!,
+            corporateIdentifierValidator: null!,
+            logger: Mock.Of<ILogger>(),
+            bootstrapSessionService: bootstrapService,
+            deviceAssociationValidator: null);
+    }
+
+    private static HttpRequestData BuildRequest(string url, string? token, params (string Name, string Value)[] extraHeaders)
+    {
+        var contextMock = new Mock<Microsoft.Azure.Functions.Worker.FunctionContext>();
+        contextMock.SetupGet(c => c.Items).Returns(new Dictionary<object, object>());
+        var reqMock = new Mock<HttpRequestData>(contextMock.Object);
+
+        var headers = new HttpHeadersCollection();
+        if (token != null) headers.Add("X-Bootstrap-Token", token);
+        foreach (var (name, value) in extraHeaders) headers.Add(name, value);
+
+        reqMock.SetupGet(r => r.Headers).Returns(headers);
+        reqMock.SetupGet(r => r.Url).Returns(new Uri(url));
+        return reqMock.Object;
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/BrandingImageUrlValidationTests.cs

@@ -0,0 +1,68 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests
+{
+    /// <summary>
+    /// The enrollment-summary branding image URL is delivered verbatim to every enrolling device,
+    /// fetched from the signed-in user's session and spliced into the summary-dialog command line.
+    /// The server must therefore only ever persist a plain absolute HTTPS URL — a value with an
+    /// embedded quote or a non-HTTPS scheme must fail the config PUT/PATCH.
+    /// </summary>
+    public class BrandingImageUrlValidationTests
+    {
+        [Theory]
+        [InlineData(null)]
+        [InlineData("")]
+        [InlineData("   ")]
+        [InlineData("https://cdn.example/logo.png")]
+        [InlineData("https://cdn.example:8443/assets/logo.png?v=2&x=y")]
+        [InlineData("https://cdn.example/logo%20one.png")]
+        public void ValidateBrandingImageUrl_WellFormed_ReturnsNull(string? url)
+        {
+            Assert.Null(TenantConfigValidation.ValidateBrandingImageUrl(url));
+        }
+
+        [Theory]
+        [InlineData("x\" --status-file \"C:\\some\\file\" --timeout \"0", "quotes")]
+        [InlineData("https://cdn.example/logo.png\"", "quotes")]
+        [InlineData("https://cdn.example/lo'go.png", "quotes")]
+        [InlineData("https://cdn.example/logo.png --cleanup", "whitespace")]
+        [InlineData("https://cdn.example/logo.png\r\n", "whitespace")]
+        [InlineData("http://cdn.example/logo.png", "HTTPS")]
+        [InlineData("file:///C:/Windows/logo.png", "HTTPS")]
+        [InlineData("ftp://cdn.example/logo.png", "HTTPS")]
+        [InlineData("cdn.example/logo.png", "absolute URL")]
+        [InlineData("https://localhost/logo.png", "localhost")]
+        [InlineData("https://10.0.0.1/logo.png", "IP address")]
+        public void ValidateBrandingImageUrl_Malformed_Rejected(string url, string expectedFragment)
+        {
+            var error = TenantConfigValidation.ValidateBrandingImageUrl(url);
+            Assert.NotNull(error);
+            Assert.Contains(expectedFragment, error);
+        }
+
+        [Fact]
+        public void ValidateBrandingImageUrl_Overlong_Rejected()
+        {
+            var url = "https://cdn.example/" + new string('a', TenantConfigValidation.MaxBrandingImageUrlLength);
+            Assert.Contains("characters", TenantConfigValidation.ValidateBrandingImageUrl(url));
+        }
+
+        [Fact]
+        public void ValidateModel_RejectsInjectedBrandingUrl()
+        {
+            var existing = new TenantConfiguration();
+            var candidate = new TenantConfiguration
+            {
+                EnrollmentSummaryBrandingImageUrl = "x\" --status-file \"C:\\some\\file\" --timeout \"0",
+            };
+
+            var error = TenantConfigValidation.ValidateModel(candidate, existing, isGlobalAdmin: true);
+
+            Assert.NotNull(error);
+            Assert.StartsWith("Invalid enrollment summary branding image URL", error);
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/BuiltInRulesTests.cs

@@ -1,3 +1,4 @@
+using System.Text.RegularExpressions;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
 
@@ -172,7 +173,7 @@ public class BuiltInRulesTests
             "policiesDiscovered", "ignoreCompletedApp", "imeAgentVersion",
             "espTrackStatus", "updateName", "updateWin32AppState",
             "cancelStuckAndSetCurrent", "imeSessionChange", "imeImpersonation", "imeTokenFailure",
-            "enrollmentCompleted", "updateDoTelemetry", "scriptStarted",
+            "enrollmentCompleted", "userSessionZeroApps", "updateDoTelemetry", "scriptStarted",
             "scriptContext", "scriptExitCode", "scriptOutput", "scriptCompleted",
             "resetPlatformScriptContext",
             "healthScriptResult", "healthScriptDetectionResult",
@@ -201,4 +202,38 @@ public class BuiltInRulesTests
                 $"Pattern {pattern.PatternId} has invalid category '{pattern.Category}'");
         }
     }
+
+    /// <summary>
+    /// Sessions 81daa77f / 75d6ae8e (2026-08-25). IME writes this line and then returns before
+    /// its "Completed user session" statement, so on a device with no user-targeted Win32 apps
+    /// it is the ONLY evidence that user-phase enforcement finished. The exact wording is
+    /// pinned here against the real IME line (verified against decompiled IME 1.104.102.0,
+    /// ApplicationPoller and AppWorkloadAbstraction) because a silent drift would bring back
+    /// the 30-min esp_exit_without_completion_evidence false positive with no test failing.
+    /// </summary>
+    [Fact]
+    public void BuiltInImeLogPatterns_ZeroUserAppsPattern_MatchesTheRealImeLine()
+    {
+        var pattern = Assert.Single(
+            BuiltInImeLogPatterns.GetAll(),
+            p => p.PatternId == "IME-USER-SESSION-ZERO-APPS");
+
+        Assert.Equal("userSessionZeroApps", pattern.Action);
+        Assert.Equal("always", pattern.Category);
+
+        var regex = new Regex(pattern.Pattern, RegexOptions.CultureInvariant);
+
+        var real = "[Win32App] Get 0 apps for user session 1, user id = 4a1ba5db-44ed-4e69-8477-47ed88e76020";
+        var match = regex.Match(real);
+        Assert.True(match.Success, "zero-app user session line must match");
+        Assert.Equal("1", match.Groups["sessionId"].Value);
+        Assert.Equal("4a1ba5db-44ed-4e69-8477-47ed88e76020", match.Groups["userId"].Value);
+
+        // Must not swallow a session that DOES have apps — that would fabricate completion
+        // evidence while enforcement is still running.
+        Assert.DoesNotMatch(regex,
+            "[Win32App] Get 3 apps for user session 1, user id = 4a1ba5db-44ed-4e69-8477-47ed88e76020");
+        Assert.DoesNotMatch(regex,
+            "[Win32App] Get 10 apps for user session 1, user id = 4a1ba5db-44ed-4e69-8477-47ed88e76020");
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/CertTenantBindingTests.cs

@@ -0,0 +1,430 @@
+using System.Net;
+using System.Security.Cryptography.X509Certificates;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Security;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// CERT-TENANT-BINDING — enforced since 2026-08-25.
+///
+/// The agent authenticates with the Intune MDM device certificate, whose chain is pinned to
+/// Microsoft's Intune roots. Those roots are shared by every Intune tenant, so a valid chain alone
+/// does not prove the caller belongs to the tenant it claims. The CA stamps the Entra tenant id
+/// into OID 1.2.840.113556.5.14, which lets the backend bind the two.
+///
+/// These tests pin four things:
+///   - the tenant id is actually extracted from a REAL field certificate (not a synthetic fixture),
+///     because if Microsoft ever changes that stamp, enforcement locks out the whole fleet,
+///   - the pure comparison covers every outcome the telemetry can report,
+///   - the enforcement rule rejects Mismatch and ONLY Mismatch — ExtensionMissing is tolerated on
+///     purpose, and that tolerance has its own test so removing it has to be a decision,
+///   - a rejected request still carries its telemetry and does not leak the certificate's tenant
+///     back to the caller.
+/// </summary>
+public class CertTenantBindingTests
+{
+    private const string DeviceSamplePem = "device-cert-sample.pem";
+
+    /// <summary>
+    /// Tenant stamped into <c>device-cert-sample.pem</c> by the Intune MDM Device CA. The sample is
+    /// a public-key-only cert from an internal test device; the GUID is the test tenant's own id.
+    /// </summary>
+    private static readonly Guid SampleCertTenantId = Guid.Parse("b54dc1af-5320-4f60-b5d4-821e0cf2a359");
+
+    private static string SampleCertBase64()
+    {
+        var assemblyDir = Path.GetDirectoryName(typeof(CertTenantBindingTests).Assembly.Location)!;
+        var pem = File.ReadAllText(Path.Combine(assemblyDir, DeviceSamplePem));
+        using var cert = X509Certificate2.CreateFromPem(pem);
+        return Convert.ToBase64String(cert.Export(X509ContentType.Cert));
+    }
+
+    // ---------------------------------------------------------------- extraction
+
+    [Fact]
+    public void ValidateCertificate_RealIntuneCert_ExtractsEntraTenantId()
+    {
+        // The load-bearing test for the whole feature: if Microsoft ever stops stamping OID
+        // 1.2.840.113556.5.14, or changes its encoding, enforcement would lock every device out.
+        var result = CertificateValidator.ValidateCertificate(SampleCertBase64());
+
+        Assert.True(result.IsValid, $"Real device cert rejected: {result.ErrorMessage}");
+        Assert.Equal(CertTenantIdStatus.Present, result.CertTenantIdStatus);
+        Assert.Equal(SampleCertTenantId, result.CertTenantId);
+    }
+
+    [Fact]
+    public void ValidateCertificate_CachedResult_KeepsTenantId()
+    {
+        // The tenant id is a pure function of the cert and is cached with the validation result,
+        // so a cache hit must not silently drop it and turn every repeat request into
+        // ExtensionMissing.
+        var b64 = SampleCertBase64();
+
+        _ = CertificateValidator.ValidateCertificate(b64);
+        var second = CertificateValidator.ValidateCertificate(b64);
+
+        Assert.True(second.IsValid);
+        Assert.Equal(CertTenantIdStatus.Present, second.CertTenantIdStatus);
+        Assert.Equal(SampleCertTenantId, second.CertTenantId);
+    }
+
+    // ---------------------------------------------------------------- encoding
+
+    [Fact]
+    public void TryParseGuid_PinsRealFieldEncodings()
+    {
+        // Exact bytes lifted from the sample cert. OID 5.14 nests the GUID in an OCTET STRING,
+        // OID 5.4 stores the 16 bytes bare — both shapes must decode, and both are little-endian.
+        var wrapped = Convert.FromHexString("0410afc14db52053604fb5d4821e0cf2a359");
+        var bare = Convert.FromHexString("6701bc076190b743b2430bb6aeda736e");
+
+        Assert.True(MsDeviceCertificateOids.TryParseGuid(wrapped, out var tenantId));
+        Assert.Equal(SampleCertTenantId, tenantId);
+
+        Assert.True(MsDeviceCertificateOids.TryParseGuid(bare, out var deviceId));
+        // The Intune device id is also the certificate's Subject CN.
+        Assert.Equal(Guid.Parse("07bc0167-9061-43b7-b243-0bb6aeda736e"), deviceId);
+    }
+
+    [Fact]
+    public void TryParseGuid_AccountIdOidIsNotTheTenantId()
+    {
+        // Guards the mistake this feature was nearly built on: OID 5.6 carries the Intune ACCOUNT
+        // id, a different GUID. Comparing it against the tenant id would reject every request.
+        var accountIdExt = Convert.FromHexString("04103d85dede74e26b409d0d46b6fe65b440");
+
+        Assert.True(MsDeviceCertificateOids.TryParseGuid(accountIdExt, out var accountId));
+        Assert.NotEqual(SampleCertTenantId, accountId);
+    }
+
+    [Theory]
+    [InlineData("")]                                            // empty
+    [InlineData("0400")]                                        // OCTET STRING, zero length
+    [InlineData("020102")]                                      // not an OCTET STRING
+    [InlineData("0411afc14db52053604fb5d4821e0cf2a35900")]      // wrapper claims 17 bytes
+    [InlineData("0410afc14db52053604fb5d4821e0cf2a3")]          // wrapper claims 16, only 15 present
+    public void TryParseGuid_RejectsMalformed(string hex)
+    {
+        Assert.False(MsDeviceCertificateOids.TryParseGuid(Convert.FromHexString(hex), out _));
+    }
+
+    [Fact]
+    public void TryParseGuid_AnySixteenBytesDecodeAsBareGuid()
+    {
+        // Documents a deliberate limit rather than a gap: the bare form (OID 5.4) is exactly 16
+        // bytes with no tag, so a 16-byte input is indistinguishable from a truncated wrapper and
+        // is always read as a GUID. Harmless here — the value is only ever compared for equality
+        // against a known tenant id, never trusted as a claim in its own right.
+        Assert.True(MsDeviceCertificateOids.TryParseGuid(
+            Convert.FromHexString("0410afc14db52053604fb5d4821e0cf2"), out _));
+    }
+
+    [Fact]
+    public void TryParseGuid_RejectsNull()
+    {
+        Assert.False(MsDeviceCertificateOids.TryParseGuid(null!, out _));
+    }
+
+    // ---------------------------------------------------------------- comparison
+
+    [Fact]
+    public void Evaluate_MatchingTenant_ReturnsMatch()
+    {
+        var outcome = CertTenantBinding.Evaluate(
+            SampleCertTenantId, CertTenantIdStatus.Present, SampleCertTenantId.ToString());
+
+        Assert.Equal(CertTenantBinding.Outcome.Match, outcome);
+        Assert.False(CertTenantBinding.WouldRejectUnderEnforcement(outcome));
+    }
+
+    [Fact]
+    public void Evaluate_MatchingTenant_IsCaseInsensitive()
+    {
+        // Tenant ids travel as strings in headers/routes and casing must not decide access.
+        var outcome = CertTenantBinding.Evaluate(
+            SampleCertTenantId, CertTenantIdStatus.Present, SampleCertTenantId.ToString().ToUpperInvariant());
+
+        Assert.Equal(CertTenantBinding.Outcome.Match, outcome);
+    }
+
+    [Fact]
+    public void Evaluate_ForeignTenantCert_ReturnsMismatch()
+    {
+        // The attack this feature exists for: a valid Intune cert from the attacker's own tenant,
+        // replayed against a victim tenant whose device serial the attacker knows.
+        var outcome = CertTenantBinding.Evaluate(
+            SampleCertTenantId, CertTenantIdStatus.Present, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
+
+        Assert.Equal(CertTenantBinding.Outcome.Mismatch, outcome);
+        Assert.True(CertTenantBinding.WouldRejectUnderEnforcement(outcome));
+    }
+
+    [Theory]
+    [InlineData(CertTenantIdStatus.ExtensionMissing, CertTenantBinding.Outcome.ExtensionMissing)]
+    [InlineData(CertTenantIdStatus.Unparseable, CertTenantBinding.Outcome.Unparseable)]
+    public void Evaluate_UndecodableCert_ReportsWhyWithoutClaimingMismatch(
+        CertTenantIdStatus status, string expected)
+    {
+        // These must stay distinguishable from Mismatch: they measure rollout readiness
+        // (how many field certs can be enforced against), not an attack.
+        var outcome = CertTenantBinding.Evaluate(null, status, SampleCertTenantId.ToString());
+
+        Assert.Equal(expected, outcome);
+        Assert.False(CertTenantBinding.WouldRejectUnderEnforcement(outcome));
+    }
+
+    [Fact]
+    public void Evaluate_PresentButNullGuid_FallsBackToExtensionMissing()
+    {
+        var outcome = CertTenantBinding.Evaluate(null, CertTenantIdStatus.Present, SampleCertTenantId.ToString());
+
+        Assert.Equal(CertTenantBinding.Outcome.ExtensionMissing, outcome);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("not-a-guid")]
+    public void Evaluate_NonGuidRequestTenant_IsReportedSeparately(string? requestedTenantId)
+    {
+        var outcome = CertTenantBinding.Evaluate(
+            SampleCertTenantId, CertTenantIdStatus.Present, requestedTenantId);
+
+        Assert.Equal(CertTenantBinding.Outcome.RequestTenantNotAGuid, outcome);
+        Assert.False(CertTenantBinding.WouldRejectUnderEnforcement(outcome));
+    }
+
+    // ---------------------------------------------------------------- enforcement rule
+
+    [Fact]
+    public void Rejects_OnlyMismatch()
+    {
+        // Mismatch is the only outcome that is evidence of a foreign certificate. The rest mean
+        // "cannot tell", and rejecting on those would cost legitimate devices their enrollment for
+        // something outside their control.
+        Assert.True(CertTenantBinding.Rejects(CertTenantBinding.Outcome.Mismatch));
+
+        Assert.False(CertTenantBinding.Rejects(CertTenantBinding.Outcome.Match));
+        Assert.False(CertTenantBinding.Rejects(CertTenantBinding.Outcome.ExtensionMissing));
+        Assert.False(CertTenantBinding.Rejects(CertTenantBinding.Outcome.Unparseable));
+        Assert.False(CertTenantBinding.Rejects(CertTenantBinding.Outcome.RequestTenantNotAGuid));
+    }
+
+    [Fact]
+    public void Rejects_ExtensionMissingIsDeliberatelyTolerated()
+    {
+        // Pinned on its own because it is the one that is expected to tighten later: certificates
+        // predating the extension, or a sovereign-cloud CA, must not be locked out today. Changing
+        // this is a decision, and this test is where that decision has to be made explicitly.
+        Assert.False(CertTenantBinding.Rejects(CertTenantBinding.Outcome.ExtensionMissing));
+    }
+
+    [Fact]
+    public void Rejects_AgreesWithTheTelemetryField()
+    {
+        // WouldRejectUnderEnforcement is what the log line reports. If the two ever diverge, the
+        // telemetry stops describing what actually happened.
+        foreach (var outcome in new[]
+                 {
+                     CertTenantBinding.Outcome.Match,
+                     CertTenantBinding.Outcome.Mismatch,
+                     CertTenantBinding.Outcome.ExtensionMissing,
+                     CertTenantBinding.Outcome.Unparseable,
+                     CertTenantBinding.Outcome.RequestTenantNotAGuid,
+                 })
+        {
+            Assert.Equal(CertTenantBinding.Rejects(outcome),
+                         CertTenantBinding.WouldRejectUnderEnforcement(outcome));
+        }
+    }
+
+    // ---------------------------------------------------------------- end-to-end
+
+    [Fact]
+    public async Task ValidateRequestAsync_ForeignTenantCert_IsRejected()
+    {
+        // The attack this whole feature exists for: a valid Intune certificate from the attacker's
+        // own tenant, replayed against a victim tenant whose device serial they know. Serials are
+        // printed on the chassis, so before this gate that was the entire barrier.
+        var logger = new CapturingLogger();
+        var validator = BuildValidator(logger);
+
+        var result = await validator.ValidateRequestAsync(
+            BuildRequestWithCert(SampleCertBase64()),
+            tenantId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
+
+        Assert.False(result.IsValid);
+        Assert.Equal(HttpStatusCode.Forbidden, result.StatusCode);
+
+        // The response must not reveal which tenant the certificate actually belongs to.
+        Assert.DoesNotContain(SampleCertTenantId.ToString(), result.Details ?? "", StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain(SampleCertTenantId.ToString(), result.ErrorMessage ?? "", StringComparison.OrdinalIgnoreCase);
+
+        var observed = Assert.Single(logger.Entries, e => e.Message.Contains("AgentCertTenantBinding"));
+        Assert.Equal(LogLevel.Warning, observed.Level);
+        Assert.Contains(CertTenantBinding.Outcome.Mismatch, observed.Message);
+        Assert.Contains("enforced=True", observed.Message);
+        Assert.Contains("wouldReject=True", observed.Message);
+
+        // The rejection must also land in the shared rejection log, so it shows up in the same KQL
+        // raster as every other reason a request was turned away.
+        Assert.Contains(logger.Entries, e => e.Message.Contains("AgentRequestRejected")
+                                             && e.Message.Contains("stage=certtenant"));
+    }
+
+    [Fact]
+    public async Task ValidateRequestAsync_MismatchStillStampsTheRequestRow()
+    {
+        // Enforcement must not cost us the telemetry: a blocked request is exactly the one an
+        // operator will go looking for afterwards.
+        var items = new Dictionary<object, object>();
+        var validator = BuildValidator(new CapturingLogger());
+
+        await validator.ValidateRequestAsync(
+            BuildRequestWithCert(SampleCertBase64(), items),
+            tenantId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
+
+        Assert.Equal(
+            CertTenantBinding.Outcome.Mismatch,
+            Assert.Contains(CertTenantBinding.RequestItemKey, items));
+    }
+
+    [Fact]
+    public async Task ValidateRequestAsync_MatchingTenantCert_IsAccepted()
+    {
+        var logger = new CapturingLogger();
+        var validator = BuildValidator(logger);
+
+        var result = await validator.ValidateRequestAsync(
+            BuildRequestWithCert(SampleCertBase64()),
+            tenantId: SampleCertTenantId.ToString());
+
+        Assert.True(result.IsValid, $"Matching-tenant request rejected: {result.ErrorMessage}");
+
+        // Match is deliberately NOT a trace line — worker-side LogInformation never reaches App
+        // Insights, so a Match trace would be dead code that silently costs us the denominator.
+        Assert.DoesNotContain(logger.Entries, e => e.Message.Contains("AgentCertTenantBinding"));
+    }
+
+    [Fact]
+    public async Task ValidateRequestAsync_StampsOutcomeOnTheRequestRow()
+    {
+        // The denominator lives here: RequestTelemetryMiddleware copies this item onto the request
+        // row, which already exists per request and is unsampled. Without it, "Match" is invisible
+        // and the shadow telemetry cannot say how often the binding held.
+        var items = new Dictionary<object, object>();
+        var validator = BuildValidator(new CapturingLogger());
+
+        var result = await validator.ValidateRequestAsync(
+            BuildRequestWithCert(SampleCertBase64(), items),
+            tenantId: SampleCertTenantId.ToString());
+
+        Assert.True(result.IsValid, $"Matching-tenant request rejected: {result.ErrorMessage}");
+        Assert.Equal(
+            CertTenantBinding.Outcome.Match,
+            Assert.Contains(CertTenantBinding.RequestItemKey, items));
+    }
+
+    [Fact]
+    public async Task ValidateRequestAsync_StampsMismatchOnTheRequestRowToo()
+    {
+        var items = new Dictionary<object, object>();
+        var validator = BuildValidator(new CapturingLogger());
+
+        await validator.ValidateRequestAsync(
+            BuildRequestWithCert(SampleCertBase64(), items),
+            tenantId: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee");
+
+        Assert.Equal(
+            CertTenantBinding.Outcome.Mismatch,
+            Assert.Contains(CertTenantBinding.RequestItemKey, items));
+    }
+
+    // ---------------------------------------------------------------- harness
+
+    private static SecurityValidator BuildValidator(ILogger logger)
+    {
+        var configRepo = Mock.Of<IConfigRepository>();
+        var cache = new MemoryCache(new MemoryCacheOptions());
+
+        // AllowInsecureAgentRequests clears the "at least one device validator" gate so the request
+        // reaches — and passes — the certificate stage without needing Graph mocks.
+        var config = new TenantConfiguration
+        {
+            AllowInsecureAgentRequests = true,
+            ManufacturerWhitelist = "*",
+            ModelWhitelist = "*",
+        };
+
+        var configServiceMock = new Mock<TenantConfigurationService>(
+            configRepo, Mock.Of<ILogger<TenantConfigurationService>>(), cache)
+        { CallBase = false };
+        configServiceMock
+            .Setup(x => x.TryGetConfigurationAsync(It.IsAny<string>()))
+            .ReturnsAsync((config, true));
+
+        var adminConfigServiceMock = new Mock<AdminConfigurationService>(
+            configRepo, Mock.Of<ILogger<AdminConfigurationService>>(), cache)
+        { CallBase = false };
+        adminConfigServiceMock
+            .Setup(x => x.GetConfigurationAsync())
+            .ReturnsAsync(new AdminConfiguration());
+
+        return new SecurityValidator(
+            configService: configServiceMock.Object,
+            adminConfigService: adminConfigServiceMock.Object,
+            rateLimitService: new RateLimitService(cache, Mock.Of<ILogger<RateLimitService>>()),
+            autopilotDeviceValidator: null!,
+            corporateIdentifierValidator: null!,
+            logger: logger,
+            bootstrapSessionService: null,
+            deviceAssociationValidator: null);
+    }
+
+    private static HttpRequestData BuildRequestWithCert(
+        string certBase64,
+        IDictionary<object, object>? items = null)
+    {
+        var contextMock = new Mock<Microsoft.Azure.Functions.Worker.FunctionContext>();
+        contextMock.SetupGet(c => c.Items).Returns(items ?? new Dictionary<object, object>());
+        var reqMock = new Mock<HttpRequestData>(contextMock.Object);
+
+        var headers = new HttpHeadersCollection
+        {
+            { "X-ARR-ClientCert", certBase64 },
+            // The hardware whitelist stage runs after the certificate stage and rejects requests
+            // with no hardware headers, which would mask what these tests are actually asserting.
+            { "X-Device-Manufacturer", "Contoso" },
+            { "X-Device-Model", "TestBook" },
+            { "X-Device-SerialNumber", "TESTSERIAL01" },
+        };
+        reqMock.SetupGet(r => r.Headers).Returns(headers);
+        reqMock.SetupGet(r => r.Url).Returns(new Uri("https://example.invalid/api/telemetry"));
+
+        return reqMock.Object;
+    }
+
+    private sealed record LogEntry(LogLevel Level, string Message);
+
+    private sealed class CapturingLogger : ILogger
+    {
+        public List<LogEntry> Entries { get; } = new();
+
+        public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+
+        public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+            Func<TState, Exception?, string> formatter)
+            => Entries.Add(new LogEntry(logLevel, formatter(state, exception)));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/CmTraceSkewTripwireTests.cs

@@ -119,6 +119,53 @@ public class CmTraceSkewTripwireTests
         Assert.Null(CmTraceSkewTripwire.Evaluate(scan));
     }
 
+    [Fact]
+    public void Silent_OnBacklogReplayBurstWhoseMedianLandsOnGrid()
+    {
+        // Field case 2026-08-28 (session d832560a): the agent died on auth failures, the relaunch
+        // re-tailed the IME log and uploaded 508 lines in one burst with a continuum of ages
+        // (46…733 min, quartiles 52 / 92 / 100) — median 91 min, i.e. 6×15 by pure chance.
+        // The other side was live. The per-sample grid-conformity guard must keep this silent.
+        var scan = MakeScan(imeDeltaMinutes: 0.1, otherDeltaMinutes: 0.1, imeSamples: 100, imeBatches: 80);
+        void AddRamp(double from, double to, int count)
+        {
+            for (int i = 0; i < count; i++)
+                scan.ImeDeltaMinutes.Add(from + i * (to - from) / count);
+        }
+        AddRamp(46.0, 88.0, 125);
+        AddRamp(88.0, 100.0, 250);
+        AddRamp(100.0, 733.0, 125);
+
+        var medianIme = scan.ImeDeltaMinutes.OrderBy(v => v).ElementAt(scan.ImeDeltaMinutes.Count / 2);
+        Assert.InRange(medianIme, 88.0, 92.0); // sanity: the median really does sit near 6×15
+
+        Assert.Null(CmTraceSkewTripwire.Evaluate(scan));
+        Assert.True(CmTraceSkewTripwire.ComputeGridConformantFraction(scan.ImeDeltaMinutes, 0.1) < 0.5);
+    }
+
+    [Fact]
+    public void Fires_OnTwoWriterErasBothOnGrid()
+    {
+        // e9753578 shape: one file mixing PDT (−420) and CEST (+120) lines relative to the agent
+        // zone. Every line is individually on the grid, so the conformity guard must NOT mask it.
+        var scan = MakeScan(imeDeltaMinutes: -420.0, otherDeltaMinutes: 0.0, imeSamples: 65);
+        for (int i = 0; i < 35; i++)
+            scan.ImeDeltaMinutes.Add(120.0);
+
+        var result = CmTraceSkewTripwire.Evaluate(scan);
+        Assert.NotNull(result);
+        Assert.Equal(-28, result!.GridSteps);
+        Assert.Equal(1.0, result.GridConformantFraction, 3);
+    }
+
+    [Fact]
+    public void GridConformantFraction_CountsZeroAndAnyMultiple()
+    {
+        var deltas = new List<double> { 0.5, 15.9, -30.1, 7.5, 37.5 }; // last two are off-grid
+        Assert.Equal(0.6, CmTraceSkewTripwire.ComputeGridConformantFraction(deltas, 0.0), 3);
+        Assert.Equal(0, CmTraceSkewTripwire.ComputeGridConformantFraction(new List<double>(), 0.0));
+    }
+
     // ── Bias suppression predicate ─────────────────────────────────────────
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/CollectLogsQuickConfigOpsEventTests.cs

@@ -0,0 +1,97 @@
+using System.Collections.Generic;
+using System.Net.Http;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Functions.Services.Notifications;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The targeted push signal: "someone clicked Collect Logs and switched on Hosted upload
+/// through the quick-config dialog" must land as its own ops event type, while every other
+/// enable path keeps the generic type — an alert rule filters by EventType only.
+/// </summary>
+public class CollectLogsQuickConfigOpsEventTests
+{
+    private static (OpsEventService Service, List<OpsEventEntry> Saved) Rig()
+    {
+        var saved = new List<OpsEventEntry>();
+        var opsRepo = new Mock<IOpsEventRepository>();
+        opsRepo.Setup(r => r.SaveOpsEventAsync(It.IsAny<OpsEventEntry>()))
+            .Callback<OpsEventEntry>(e => { lock (saved) saved.Add(e); })
+            .Returns(Task.CompletedTask);
+        var adminConfig = new Mock<AdminConfigurationService>(
+            Mock.Of<IConfigRepository>(), NullLogger<AdminConfigurationService>.Instance,
+            new MemoryCache(new MemoryCacheOptions())) { CallBase = false };
+        var alertDispatch = new OpsAlertDispatchService(
+            adminConfig.Object,
+            new TelegramNotificationService(new HttpClient(), Mock.Of<IConfigRepository>(),
+                NullLogger<TelegramNotificationService>.Instance),
+            new WebhookNotificationService(new HttpClient(), NullLogger<WebhookNotificationService>.Instance),
+            NullLogger<OpsAlertDispatchService>.Instance);
+        return (new OpsEventService(opsRepo.Object, NullLogger<OpsEventService>.Instance, alertDispatch), saved);
+    }
+
+    private static DiagnosticsUploadConfigChange EnableFlip() =>
+        DiagnosticsUploadConfigChange.Detect(
+            new TenantConfiguration { TenantId = "t1", DiagnosticsUploadMode = "Off" },
+            new TenantConfiguration { TenantId = "t1", DiagnosticsUploadMode = "OnFailure", DiagnosticsUploadDestination = "Hosted" })!;
+
+    [Theory]
+    [InlineData("collect-logs", UpdateTenantConfigurationFunction.CollectLogsSource)]
+    [InlineData("COLLECT-LOGS", UpdateTenantConfigurationFunction.CollectLogsSource)]
+    [InlineData(null, "portal-put")]
+    [InlineData("", "portal-put")]
+    [InlineData("something-else", "portal-put")]
+    public void ResolveWriteSource_only_honours_the_allow_listed_intent(string? intent, string expected)
+    {
+        Assert.Equal(expected, UpdateTenantConfigurationFunction.ResolveWriteSource(intent));
+    }
+
+    [Fact]
+    public async Task Quick_config_enable_lands_as_its_own_event_type()
+    {
+        var (service, saved) = Rig();
+
+        await service.RecordDiagnosticsUploadConfigChangedAsync(
+            "t1", "contoso.com", EnableFlip(), "admin@contoso.com", UpdateTenantConfigurationFunction.CollectLogsSource);
+
+        var evt = Assert.Single(saved);
+        Assert.Equal("CollectLogsQuickConfigEnabled", evt.EventType);
+        Assert.Equal(OpsEventCategory.Tenant, evt.Category);
+        Assert.Contains("admin@contoso.com", evt.Message);
+        Assert.Contains("Hosted", evt.Message);
+    }
+
+    [Theory]
+    [InlineData("portal-put")]
+    [InlineData("mcp-patch")]
+    public async Task Other_enable_paths_keep_the_generic_event_type(string source)
+    {
+        var (service, saved) = Rig();
+
+        await service.RecordDiagnosticsUploadConfigChangedAsync("t1", "contoso.com", EnableFlip(), "admin@contoso.com", source);
+
+        Assert.Equal("DiagnosticsUploadEnabled", Assert.Single(saved).EventType);
+    }
+
+    [Fact]
+    public async Task Quick_config_source_on_a_disable_is_the_generic_disabled_type()
+    {
+        var (service, saved) = Rig();
+        var disable = DiagnosticsUploadConfigChange.Detect(
+            new TenantConfiguration { TenantId = "t1", DiagnosticsUploadMode = "Always", DiagnosticsUploadDestination = "Hosted" },
+            new TenantConfiguration { TenantId = "t1", DiagnosticsUploadMode = "Off", DiagnosticsUploadDestination = "Hosted" })!;
+
+        await service.RecordDiagnosticsUploadConfigChangedAsync("t1", null, disable, "ga@x", UpdateTenantConfigurationFunction.CollectLogsSource);
+
+        Assert.Equal("DiagnosticsUploadDisabled", Assert.Single(saved).EventType);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/CriticalTableBackupServiceTests.cs

@@ -47,7 +47,7 @@ public class CriticalTableBackupServiceTests
 
         Assert.Equal(BackupOutcome.Success, result.Outcome);
         Assert.True(store.ManifestWritten, "manifest must be written LAST");
-        Assert.Equal(18, result.Manifest.Tables.Count);   // critical-tables catalog count (incl. DelegatedAdmins + ConfigurationBackups + SessionAnnotations)
+        Assert.Equal(19, result.Manifest.Tables.Count);   // critical-tables catalog count (incl. DelegatedAdmins + ConfigurationBackups + SessionAnnotations + AdminIdentityBindings)
         Assert.All(result.Manifest.Tables, t =>
             Assert.True(t.Status == TableBackupStatus.Ok || t.Status == TableBackupStatus.Empty));
     }

src/Backend/AutopilotMonitor.Functions.Tests/CveIndexEntityMergeTests.cs

@@ -0,0 +1,125 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Functions.Services;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// <see cref="TableStorageService.BuildCveIndexEntities"/> collapses report findings to one
+/// CveIndex entity per CVE. Production reports routinely list the same CVE under many
+/// findings (one RD CVE across 14 installed RD components), which previously produced
+/// 14 concurrent upserts racing on the same PK/RK.
+/// </summary>
+public class CveIndexEntityMergeTests
+{
+    private const string Tenant = "11111111-1111-1111-1111-111111111111";
+    private const string Session = "22222222-2222-2222-2222-222222222222";
+
+    private static Dictionary<string, object> Finding(string software, string risk, params Dictionary<string, object>[] vulns)
+        => new()
+        {
+            ["softwareName"] = software,
+            ["riskLevel"] = risk,
+            ["vulnerabilities"] = vulns.ToList(),
+        };
+
+    private static Dictionary<string, object> Vuln(string cve, double score, string severity, bool kev = false)
+        => new()
+        {
+            ["cveId"] = cve,
+            ["cvssScore"] = score,
+            ["cvssSeverity"] = severity,
+            ["isKev"] = kev,
+        };
+
+    [Fact]
+    public void SameCveAcrossManyFindings_CollapsesToOneEntity()
+    {
+        var findings = Enumerable.Range(0, 14)
+            .Select(i => Finding($"RD Component {i}", "high", Vuln("CVE-2025-29966", 8.8, "HIGH")))
+            .ToList();
+
+        var entities = TableStorageService.BuildCveIndexEntities(Tenant, Session, findings);
+
+        var e = Assert.Single(entities);
+        Assert.Equal($"{Tenant}_CVE-2025-29966", e.PartitionKey);
+        Assert.Equal(Session, e.RowKey);
+        Assert.Equal("RD Component 0", e.GetString("SoftwareName")); // tie keeps report order
+    }
+
+    [Fact]
+    public void Merge_HighestScoreWins_KevOrs_RiskMaxes()
+    {
+        var findings = new List<Dictionary<string, object>>
+        {
+            Finding("App A", "medium", Vuln("CVE-1", 5.0, "MEDIUM", kev: true)),
+            Finding("App B", "critical", Vuln("CVE-1", 9.1, "CRITICAL")),
+            Finding("App C", "low", Vuln("CVE-1", 3.0, "LOW")),
+        };
+
+        var e = Assert.Single(TableStorageService.BuildCveIndexEntities(Tenant, Session, findings));
+
+        Assert.Equal(9.1, e.GetDouble("CvssScore"));
+        Assert.Equal("CRITICAL", e.GetString("CvssSeverity"));
+        Assert.Equal("App B", e.GetString("SoftwareName"));
+        Assert.True(e.GetBoolean("IsKev"));
+        Assert.Equal("critical", e.GetString("OverallRisk"));
+    }
+
+    [Fact]
+    public void Merge_EpssMaxes_PriorityMaxes_AndUnscoredWritesNoEpssColumn()
+    {
+        var scoredLow = Vuln("CVE-1", 5.0, "MEDIUM"); scoredLow["epssScore"] = 0.02; scoredLow["priority"] = "track";
+        var scoredHigh = Vuln("CVE-1", 4.0, "MEDIUM"); scoredHigh["epssScore"] = 0.35; scoredHigh["priority"] = "attend";
+        var unscored = Vuln("CVE-1", 3.0, "LOW"); unscored["priority"] = "track";
+
+        var e = Assert.Single(TableStorageService.BuildCveIndexEntities(Tenant, Session, new List<Dictionary<string, object>>
+        {
+            Finding("App A", "medium", unscored),
+            Finding("App B", "medium", scoredLow),
+            Finding("App C", "medium", scoredHigh),
+        }));
+
+        Assert.Equal(0.35, e.GetDouble("EpssScore"));
+        Assert.Equal("attend", e.GetString("Priority"));
+
+        // A CVE nobody scored must not carry a fake 0.0 — the aggregate treats absent as "unknown".
+        var none = Assert.Single(TableStorageService.BuildCveIndexEntities(Tenant, Session, new List<Dictionary<string, object>>
+        {
+            Finding("App A", "low", Vuln("CVE-2", 3.0, "LOW")),
+        }));
+        Assert.False(none.ContainsKey("EpssScore"));
+        Assert.Equal("", none.GetString("Priority"));
+    }
+
+    [Fact]
+    public void DistinctCves_StayDistinct_AndInvalidEntriesAreSkipped()
+    {
+        var findings = new List<Dictionary<string, object>>
+        {
+            Finding("App A", "high", Vuln("CVE-1", 7.0, "HIGH"), Vuln("CVE-2", 6.0, "MEDIUM")),
+            Finding("App B", "high", new Dictionary<string, object> { ["cvssScore"] = 9.0 }), // no cveId
+            new() { ["softwareName"] = "No vulns" },
+        };
+
+        var entities = TableStorageService.BuildCveIndexEntities(Tenant, Session, findings);
+
+        Assert.Equal(2, entities.Count);
+        Assert.Contains(entities, x => x.GetString("CveId") == "CVE-1");
+        Assert.Contains(entities, x => x.GetString("CveId") == "CVE-2");
+    }
+
+    [Fact]
+    public void CveIdComparison_IsCaseInsensitive()
+    {
+        var findings = new List<Dictionary<string, object>>
+        {
+            Finding("A", "high", Vuln("CVE-2024-1", 7.0, "HIGH")),
+            Finding("B", "high", Vuln("cve-2024-1", 7.0, "HIGH")),
+        };
+
+        Assert.Single(TableStorageService.BuildCveIndexEntities(Tenant, Session, findings));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/DelegatedAdminEditionGateTests.cs

@@ -23,6 +23,10 @@ public class DelegatedAdminEditionGateTests
     private const string CommunityHomeTenant = "22222222-2222-2222-2222-222222222222";
     private const string ManagedTenantA = "33333333-3333-3333-3333-333333333333";
     private const string ManagedTenantB = "44444444-4444-4444-4444-444444444444";
+    private const string Oid = "aaaaaaaa-1111-1111-1111-aaaaaaaaaaaa";
+
+    /// <summary>Caller identity homed in <paramref name="homeTenantId"/>; null/blank ⇒ incomplete identity (null).</summary>
+    private static AdminIdentity? Id(string? homeTenantId) => AdminIdentity.Create(Upn, homeTenantId, Oid);
 
     private static DelegatedAdminEntry Row(string tenantId) => new()
     {
@@ -43,6 +47,8 @@ public class DelegatedAdminEditionGateTests
             .ReturnsAsync(new List<TenantGroupAssignment>());
         return new DelegatedAdminService(
             repo.Object,
+            // Binding stubbed to "bound": these tests pin the EDITION gate, not the identity check.
+            new StubAdminIdentityBindingService(bound: true),
             new StubTenantEntitlementService(
                 tenantId => tenantId == EnterpriseHomeTenant ? TenantEdition.Pro : TenantEdition.Community),
             new MemoryCache(new MemoryCacheOptions()),
@@ -55,7 +61,7 @@ public class DelegatedAdminEditionGateTests
         // Managed targets resolve Community in the stub — they must NOT be dropped.
         var svc = Build(Row(ManagedTenantA), Row(ManagedTenantB));
 
-        var scope = await svc.GetScopeAsync(Upn, EnterpriseHomeTenant);
+        var scope = await svc.GetScopeAsync(Id(EnterpriseHomeTenant));
 
         Assert.True(scope.Covers(ManagedTenantA));
         Assert.True(scope.Covers(ManagedTenantB));
@@ -66,7 +72,7 @@ public class DelegatedAdminEditionGateTests
     {
         var svc = Build(Row(ManagedTenantA), Row(ManagedTenantB));
 
-        var scope = await svc.GetScopeAsync(Upn, CommunityHomeTenant);
+        var scope = await svc.GetScopeAsync(Id(CommunityHomeTenant));
 
         Assert.True(scope.IsEmpty);
     }
@@ -76,8 +82,8 @@ public class DelegatedAdminEditionGateTests
     {
         var svc = Build(Row(ManagedTenantA));
 
-        Assert.True((await svc.GetScopeAsync(Upn, null)).IsEmpty);
-        Assert.True((await svc.GetScopeAsync(Upn, "")).IsEmpty);
+        Assert.True((await svc.GetScopeAsync(Id(null))).IsEmpty);
+        Assert.True((await svc.GetScopeAsync(Id(""))).IsEmpty);
     }
 
     [Fact]
@@ -89,9 +95,9 @@ public class DelegatedAdminEditionGateTests
         // practice but the cache must stay pure either way).
         var svc = Build(Row(ManagedTenantA));
 
-        Assert.True((await svc.GetScopeAsync(Upn, CommunityHomeTenant)).IsEmpty);
-        Assert.True((await svc.GetScopeAsync(Upn, EnterpriseHomeTenant)).Covers(ManagedTenantA));
-        Assert.True((await svc.GetScopeAsync(Upn, CommunityHomeTenant)).IsEmpty);
+        Assert.True((await svc.GetScopeAsync(Id(CommunityHomeTenant))).IsEmpty);
+        Assert.True((await svc.GetScopeAsync(Id(EnterpriseHomeTenant))).Covers(ManagedTenantA));
+        Assert.True((await svc.GetScopeAsync(Id(CommunityHomeTenant))).IsEmpty);
     }
 
     [Fact]
@@ -117,14 +123,16 @@ public class DelegatedAdminEditionGateTests
 
         var svc = new DelegatedAdminService(
             repo.Object,
+            // Binding stubbed to "bound": these tests pin the EDITION gate, not the identity check.
+            new StubAdminIdentityBindingService(bound: true),
             new StubTenantEntitlementService(
                 tenantId => tenantId == EnterpriseHomeTenant ? TenantEdition.Pro : TenantEdition.Community),
             new MemoryCache(new MemoryCacheOptions()),
             NullLogger<DelegatedAdminService>.Instance);
 
-        Assert.True((await svc.GetScopeAsync(Upn, CommunityHomeTenant)).IsEmpty);
+        Assert.True((await svc.GetScopeAsync(Id(CommunityHomeTenant))).IsEmpty);
 
-        var enterpriseScope = await svc.GetScopeAsync(Upn, EnterpriseHomeTenant);
+        var enterpriseScope = await svc.GetScopeAsync(Id(EnterpriseHomeTenant));
         Assert.True(enterpriseScope.Covers(ManagedTenantA));
         Assert.True(enterpriseScope.Covers(ManagedTenantB));
     }

src/Backend/AutopilotMonitor.Functions.Tests/DelegatedAdminServiceTests.cs

@@ -1,3 +1,4 @@
+using AutopilotMonitor.Functions.Security;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.DataAccess;
@@ -16,6 +17,8 @@ namespace AutopilotMonitor.Functions.Tests;
 public class DelegatedAdminServiceTests
 {
     private const string Upn = "msp-admin@partner.example";
+    private const string HomeTenant = "99999999-9999-9999-9999-999999999999";
+    private const string Oid = "aaaaaaaa-1111-1111-1111-aaaaaaaaaaaa";
     private const string TenantA = "11111111-1111-1111-1111-111111111111";
     private const string TenantB = "22222222-2222-2222-2222-222222222222";
 
@@ -34,14 +37,20 @@ public class DelegatedAdminServiceTests
         var cache = new MemoryCache(new MemoryCacheOptions());
         // Entitlements stubbed to Enterprise for every tenant — these tests pin ROLE resolution;
         // the edition filter has its own dedicated tests (DelegatedAdminEditionGateTests).
+        // Binding stubbed to "bound" — these tests pin ROW resolution; the identity check has its own
+        // tests (AdminIdentityBindingServiceTests / AdminIdentityBindingAuthorizationTests).
         var svc = new DelegatedAdminService(
             repo.Object,
+            new StubAdminIdentityBindingService(bound: true),
             new StubTenantEntitlementService(AutopilotMonitor.Functions.Security.TenantEdition.Pro),
             cache,
             NullLogger<DelegatedAdminService>.Instance);
         return (svc, repo);
     }
 
+    /// <summary>The caller identity for a UPN: homed in <see cref="HomeTenant"/> with <see cref="Oid"/>.</summary>
+    private static AdminIdentity Id(string upn) => new(upn.ToLowerInvariant(), HomeTenant, Oid);
+
     private static TenantGroupAssignment Assignment(
         string groupId,
         string role = Constants.DelegatedRoles.DelegatedReader,
@@ -78,13 +87,17 @@ public class DelegatedAdminServiceTests
         repo.Setup(r => r.GetDelegatedTenantsAsync(It.IsAny<string>())).ReturnsAsync(rows.ToList());
 
     [Theory]
-    [InlineData(null)]
-    [InlineData("")]
-    [InlineData("   ")]
-    public async Task GetScope_BlankUpn_ReturnsEmpty(string? upn)
+    [InlineData(null, HomeTenant, Oid)]
+    [InlineData("", HomeTenant, Oid)]
+    [InlineData("   ", HomeTenant, Oid)]
+    [InlineData(Upn, null, Oid)]
+    [InlineData(Upn, HomeTenant, null)]
+    public async Task GetScope_IncompleteIdentity_ReturnsEmpty_WithoutTouchingStorage(string? upn, string? tid, string? oid)
     {
+        // upn + tid + oid are all required: a token missing any of them (app-only, or a foreign IdP shape)
+        // resolves no delegated scope and does not even read the assignment rows.
         var (svc, repo) = Build();
-        var scope = await svc.GetScopeAsync(upn);
+        var scope = await svc.GetScopeAsync(AdminIdentity.Create(upn, tid, oid));
         Assert.True(scope.IsEmpty);
         repo.Verify(r => r.GetDelegatedTenantsAsync(It.IsAny<string>()), Times.Never);
     }
@@ -93,7 +106,7 @@ public class DelegatedAdminServiceTests
     public async Task GetScope_NoRows_ReturnsEmpty()
     {
         var (svc, _) = Build();
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
         Assert.True(scope.IsEmpty);
         Assert.False(scope.Covers(TenantA));
     }
@@ -104,7 +117,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA, Constants.DelegatedRoles.DelegatedReader));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.Covers(TenantA));
         Assert.Equal(Constants.DelegatedRoles.DelegatedReader, scope.RoleFor(TenantA));
@@ -118,7 +131,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA, Constants.DelegatedRoles.DelegatedAdmin));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.CanWrite(TenantA));
     }
@@ -131,7 +144,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA, status: status));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.False(scope.Covers(TenantA));
         Assert.True(scope.IsEmpty);
@@ -143,7 +156,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA, enabled: false));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.False(scope.Covers(TenantA));
     }
@@ -154,7 +167,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA, role: ""));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.Equal(Constants.DelegatedRoles.DelegatedReader, scope.RoleFor(TenantA));
     }
@@ -165,7 +178,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA, role: "SuperRoot"));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.False(scope.Covers(TenantA));
         Assert.True(scope.IsEmpty);
@@ -179,7 +192,7 @@ public class DelegatedAdminServiceTests
             Row(TenantA, Constants.DelegatedRoles.DelegatedReader),
             Row(TenantB, Constants.DelegatedRoles.DelegatedAdmin));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.Equal(2, scope.TenantIds.Count);
         Assert.False(scope.CanWrite(TenantA));
@@ -192,7 +205,7 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA.ToLowerInvariant()));
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.Covers(TenantA.ToUpperInvariant()));
     }
@@ -203,8 +216,8 @@ public class DelegatedAdminServiceTests
         var (svc, repo) = Build();
         Returns(repo, Row(TenantA));
 
-        await svc.GetScopeAsync(Upn);
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
+        await svc.GetScopeAsync(Id(Upn));
 
         repo.Verify(r => r.GetDelegatedTenantsAsync(It.IsAny<string>()), Times.Once);
     }
@@ -219,10 +232,11 @@ public class DelegatedAdminServiceTests
                 It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
             .ReturnsAsync(true);
 
-        await svc.GetScopeAsync(Upn); // primes cache
+        await svc.GetScopeAsync(Id(Upn)); // primes cache
         await svc.UpsertAsync(Upn, TenantB, Constants.DelegatedRoles.DelegatedReader,
-            Constants.DelegatedStatus.Active, Constants.DelegatedSource.OperatorGranted, "ga@vendor.example");
-        await svc.GetScopeAsync(Upn); // must re-query after invalidation
+            Constants.DelegatedStatus.Active, Constants.DelegatedSource.OperatorGranted, "ga@vendor.example",
+            HomeTenant, null);
+        await svc.GetScopeAsync(Id(Upn)); // must re-query after invalidation
 
         repo.Verify(r => r.GetDelegatedTenantsAsync(It.IsAny<string>()), Times.Exactly(2));
     }
@@ -235,9 +249,9 @@ public class DelegatedAdminServiceTests
         repo.Setup(r => r.SetDelegatedAdminStatusAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
             .ReturnsAsync(true);
 
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
         await svc.SetStatusAsync(Upn, TenantA, Constants.DelegatedStatus.Revoked);
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
 
         repo.Verify(r => r.GetDelegatedTenantsAsync(It.IsAny<string>()), Times.Exactly(2));
     }
@@ -251,7 +265,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1, Constants.DelegatedRoles.DelegatedReader));
         GroupTenants(repo, GroupId1, TenantA, TenantB);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.Equal(2, scope.TenantIds.Count);
         Assert.True(scope.Covers(TenantA));
@@ -267,7 +281,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1));
         GroupTenants(repo, GroupId1, TenantB, TenantC);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.Equal(3, scope.TenantIds.Count);
         Assert.True(scope.Covers(TenantA));
@@ -282,7 +296,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1, enabled: false));
         GroupTenants(repo, GroupId1, TenantA);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.IsEmpty);
         Assert.False(scope.Covers(TenantA));
@@ -295,7 +309,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1, role: "SuperRoot"));
         GroupTenants(repo, GroupId1, TenantA);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.IsEmpty);
     }
@@ -307,7 +321,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1));
         GroupTenants(repo, GroupId1); // no tenants
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.IsEmpty);
     }
@@ -320,7 +334,7 @@ public class DelegatedAdminServiceTests
         GroupTenants(repo, GroupId1, TenantA);
         GroupTenants(repo, GroupId2, TenantA, TenantB);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.Equal(2, scope.TenantIds.Count);
         Assert.True(scope.Covers(TenantA));
@@ -335,7 +349,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1, Constants.DelegatedRoles.DelegatedAdmin));
         GroupTenants(repo, GroupId1, TenantA);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.CanWrite(TenantA)); // stronger DelegatedAdmin wins across sources
     }
@@ -348,7 +362,7 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1, Constants.DelegatedRoles.DelegatedReader));
         GroupTenants(repo, GroupId1, TenantA);
 
-        var scope = await svc.GetScopeAsync(Upn);
+        var scope = await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(scope.CanWrite(TenantA)); // direct DelegatedAdmin not downgraded by group reader
     }
@@ -360,8 +374,8 @@ public class DelegatedAdminServiceTests
         ReturnsGroups(repo, Assignment(GroupId1));
         GroupTenants(repo, GroupId1, TenantA);
 
-        await svc.GetScopeAsync(Upn);
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
+        await svc.GetScopeAsync(Id(Upn));
 
         repo.Verify(r => r.GetGroupAssignmentsForUpnAsync(It.IsAny<string>()), Times.Once);
         repo.Verify(r => r.GetGroupTenantsAsync(GroupId1), Times.Once);
@@ -380,9 +394,9 @@ public class DelegatedAdminServiceTests
                 It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<bool>(), It.IsAny<string>()))
             .ReturnsAsync(true);
 
-        await svc.GetScopeAsync(Upn); // primes cache
-        await svc.AssignGroupAsync(Upn, GroupId2, Constants.DelegatedRoles.DelegatedReader, true, "ga@vendor.example");
-        await svc.GetScopeAsync(Upn); // must re-resolve after invalidation
+        await svc.GetScopeAsync(Id(Upn)); // primes cache
+        await svc.AssignGroupAsync(Upn, GroupId2, Constants.DelegatedRoles.DelegatedReader, true, "ga@vendor.example", HomeTenant, null);
+        await svc.GetScopeAsync(Id(Upn)); // must re-resolve after invalidation
 
         repo.Verify(r => r.GetGroupAssignmentsForUpnAsync(It.IsAny<string>()), Times.Exactly(2));
     }
@@ -397,7 +411,7 @@ public class DelegatedAdminServiceTests
             .ReturnsAsync(true);
 
         var assigned = await svc.AssignGroupAsync(
-            Upn, GroupId1, Constants.DelegatedRoles.DelegatedReader, true, "ga@vendor.example");
+            Upn, GroupId1, Constants.DelegatedRoles.DelegatedReader, true, "ga@vendor.example", HomeTenant, null);
 
         Assert.False(assigned);
         repo.Verify(r => r.AssignGroupAsync(
@@ -412,9 +426,9 @@ public class DelegatedAdminServiceTests
         GroupTenants(repo, GroupId1, TenantA);
         repo.Setup(r => r.UnassignGroupAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync(true);
 
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
         var unassigned = await svc.UnassignGroupAsync(Upn, GroupId1);
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
 
         Assert.True(unassigned);
         // Verify re-resolution via the tenant expansion (the unassign now also reads assignments itself,
@@ -459,11 +473,11 @@ public class DelegatedAdminServiceTests
             new() { Upn = upnB, GroupId = GroupId1, Role = Constants.DelegatedRoles.DelegatedReader, IsEnabled = true },
         });
 
-        await svc.GetScopeAsync(Upn);   // primes A
-        await svc.GetScopeAsync(upnB);  // primes B
+        await svc.GetScopeAsync(Id(Upn));   // primes A
+        await svc.GetScopeAsync(Id(upnB));  // primes B
         var removed = await svc.RemoveTenantFromGroupAsync(GroupId1, TenantA);
-        await svc.GetScopeAsync(Upn);   // re-resolves A
-        await svc.GetScopeAsync(upnB);  // re-resolves B
+        await svc.GetScopeAsync(Id(Upn));   // re-resolves A
+        await svc.GetScopeAsync(Id(upnB));  // re-resolves B
 
         Assert.True(removed);
         repo.Verify(r => r.GetGroupAssignmentsForUpnAsync(Upn), Times.Exactly(2));
@@ -536,9 +550,9 @@ public class DelegatedAdminServiceTests
             new() { Upn = Upn, GroupId = GroupId1, Role = Constants.DelegatedRoles.DelegatedReader, IsEnabled = true },
         });
 
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
         await svc.DeleteGroupAsync(GroupId1);
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
 
         repo.Verify(r => r.GetGroupAssignmentsForUpnAsync(Upn), Times.Exactly(2));
     }
@@ -555,7 +569,7 @@ public class DelegatedAdminServiceTests
             .ReturnsAsync(true);
 
         var assigned = await svc.AssignGroupAsync(
-            Upn, "TPL-LOWER", Constants.DelegatedRoles.DelegatedReader, true, "ga@vendor.example");
+            Upn, "TPL-LOWER", Constants.DelegatedRoles.DelegatedReader, true, "ga@vendor.example", HomeTenant, null);
 
         Assert.True(assigned);
         // Repo was looked up + written with the normalized (lowercase) id.
@@ -572,9 +586,9 @@ public class DelegatedAdminServiceTests
         GroupTenants(repo, GroupId1, TenantA);
         repo.Setup(r => r.RenameTenantGroupAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync(true);
 
-        await svc.GetScopeAsync(Upn);
+        await svc.GetScopeAsync(Id(Upn));
         await svc.RenameGroupAsync(GroupId1, "Renamed");
-        await svc.GetScopeAsync(Upn); // name-only change → scope stays cached
+        await svc.GetScopeAsync(Id(Upn)); // name-only change → scope stays cached
 
         repo.Verify(r => r.GetGroupAssignmentsForUpnAsync(It.IsAny<string>()), Times.Once);
     }

src/Backend/AutopilotMonitor.Functions.Tests/DeviceAssociationValidatorTests.cs

@@ -127,4 +127,47 @@ public class DeviceAssociationValidatorTests
         Assert.True(result.IsValid);
     }
 
+    [Fact]
+    public void AsCacheHit_FlagsTheCopyAndLeavesTheCachedInstanceAlone()
+    {
+        // The cached instance is shared across every request for that serial. Marking it in place
+        // would make the first (real) lookup look cached too, and the shadow log gate would then
+        // drop the one line per lookup that carries the finding.
+        var cached = new DeviceAssociationResult
+        {
+            IsValid = true,
+            SerialNumber = Serial,
+            AssociationState = "preassociated",
+            DevicePreparationPolicyId = "11111111-2222-3333-4444-555555555555",
+            AssignedToUserPrincipalName = "someone@example.invalid",
+            ManagedDeviceId = "66666666-7777-8888-9999-000000000000",
+        };
+
+        var hit = cached.AsCacheHit();
+
+        Assert.True(hit.ServedFromCache);
+        Assert.False(cached.ServedFromCache);
+        Assert.NotSame(cached, hit);
+
+        // Every field the shadow log reports must survive the copy.
+        Assert.Equal(cached.IsValid, hit.IsValid);
+        Assert.Equal(cached.IsTransient, hit.IsTransient);
+        Assert.Equal(cached.SerialNumber, hit.SerialNumber);
+        Assert.Equal(cached.AssociationState, hit.AssociationState);
+        Assert.Equal(cached.DevicePreparationPolicyId, hit.DevicePreparationPolicyId);
+        Assert.Equal(cached.AssignedToUserPrincipalName, hit.AssignedToUserPrincipalName);
+        Assert.Equal(cached.ManagedDeviceId, hit.ManagedDeviceId);
+    }
+
+    [Fact]
+    public void FreshlyParsedResult_IsNotFlaggedAsCached()
+    {
+        // A result straight from a Graph response must be loggable — that is the one line per lookup.
+        var body = $@"{{""value"":[{{""serialNumber"":""{Serial}"",""associationState"":""preassociated""}}]}}";
+
+        var result = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(body, Serial);
+
+        Assert.False(result.ServedFromCache);
+    }
+
 }

src/Backend/AutopilotMonitor.Functions.Tests/DiagnosticsUploadConfigChangeTests.cs

@@ -0,0 +1,73 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The Collect Logs capability flip that feeds the DiagnosticsUploadEnabled/Disabled ops
+/// events: only a change of "would an on-demand upload work" counts, never a plain edit.
+/// </summary>
+public class DiagnosticsUploadConfigChangeTests
+{
+    private static TenantConfiguration Cfg(string? mode, string? destination = null, string? sas = null) => new()
+    {
+        TenantId = "t1",
+        DiagnosticsUploadMode = mode!,
+        DiagnosticsUploadDestination = destination!,
+        DiagnosticsBlobSasUrl = sas!,
+    };
+
+    [Theory]
+    [InlineData(null, null, null, false)]
+    [InlineData("Off", "Hosted", null, false)]
+    [InlineData("OnFailure", null, null, false)]
+    [InlineData("OnFailure", "Hosted", null, true)]
+    [InlineData("Always", "CustomerSas", "https://x.blob.core.windows.net/c?sig=1", true)]
+    [InlineData("Always", null, "https://x.blob.core.windows.net/c?sig=1", true)]
+    public void IsConfigured_mirrors_the_feature_flag_semantics(string? mode, string? dest, string? sas, bool expected)
+    {
+        Assert.Equal(expected, DiagnosticsUploadConfigChange.IsConfigured(Cfg(mode, dest, sas)));
+        Assert.False(DiagnosticsUploadConfigChange.IsConfigured(null));
+    }
+
+    [Fact]
+    public void Detect_quick_config_flip_reports_enabled_with_destination_and_mode()
+    {
+        // The Collect Logs quick-config dialog: Off/unset -> Hosted + OnFailure.
+        var change = DiagnosticsUploadConfigChange.Detect(Cfg("Off"), Cfg("OnFailure", "Hosted"));
+
+        Assert.NotNull(change);
+        Assert.True(change!.Enabled);
+        Assert.Equal("Hosted", change.Destination);
+        Assert.Equal("OnFailure", change.Mode);
+    }
+
+    [Fact]
+    public void Detect_missing_before_row_counts_as_not_configured()
+    {
+        var change = DiagnosticsUploadConfigChange.Detect(null, Cfg("Always", "Hosted"));
+        Assert.True(change?.Enabled);
+    }
+
+    [Fact]
+    public void Detect_reports_disabled_when_mode_goes_off()
+    {
+        var change = DiagnosticsUploadConfigChange.Detect(Cfg("Always", "Hosted"), Cfg("Off", "Hosted"));
+
+        Assert.NotNull(change);
+        Assert.False(change!.Enabled);
+        Assert.Equal("Off", change.Mode);
+    }
+
+    [Fact]
+    public void Detect_ignores_edits_that_keep_the_capability_state()
+    {
+        // Mode change while staying on: no flip.
+        Assert.Null(DiagnosticsUploadConfigChange.Detect(Cfg("OnFailure", "Hosted"), Cfg("Always", "Hosted")));
+        // Destination not yet usable in both states: no flip.
+        Assert.Null(DiagnosticsUploadConfigChange.Detect(Cfg("Off"), Cfg("OnFailure")));
+        // Unchanged.
+        Assert.Null(DiagnosticsUploadConfigChange.Detect(Cfg("Off"), Cfg("Off")));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/EmailServiceTests.cs

@@ -75,11 +75,14 @@ public sealed class EmailServiceTests
     {
         var (sut, handler, logger) = Build(apiKey: "");
 
-        await sut.SendPreviewApprovedEmailAsync("it@contoso.invalid", "contoso.invalid");
+        var sent = await sut.SendPreviewApprovedEmailAsync("it@contoso.invalid", "contoso.invalid");
 
+        Assert.False(sent);
         Assert.Equal(0, handler.CallCount);
+        // Warning, not Debug: an unconfigured provider is operator misconfiguration, and worker
+        // logs below Warning never reach Application Insights — Debug made it invisible.
         Assert.Contains(logger.Entries,
-            e => e.Level == LogLevel.Debug && e.Message.Contains("Email:ApiKey not configured"));
+            e => e.Level == LogLevel.Warning && e.Message.Contains("Email:ApiKey not configured"));
     }
 
     // ----- wire format -----
@@ -244,6 +247,18 @@ public sealed class EmailServiceTests
         Assert.Contains("linkedin.com", html);
     }
 
+    [Fact]
+    public void BuiltInTemplates_HtmlEncodeDomain()
+    {
+        const string hostile = "<a href=\"https://evil.invalid\">x</a>";
+
+        foreach (var html in new[] { EmailTemplates.GetOffboardingFarewellHtml(hostile), EmailTemplates.GetPreviewApprovedHtml(hostile) })
+        {
+            Assert.DoesNotContain(hostile, html);
+            Assert.Contains("&lt;a href=&quot;https://evil.invalid&quot;&gt;x&lt;/a&gt;", html);
+        }
+    }
+
     [Fact]
     public void FarewellTemplate_EmptyDomain_FallsBackToGenericLabel()
     {

src/Backend/AutopilotMonitor.Functions.Tests/EmailTemplateServiceTests.cs

@@ -29,6 +29,30 @@ public sealed class EmailTemplateServiceTests
         Assert.DoesNotContain(EmailTemplateService.DomainPlaceholder, html);
     }
 
+    [Theory]
+    [InlineData("<b>x</b>", "&lt;b&gt;x&lt;/b&gt;")]
+    [InlineData("a\"b&c", "a&quot;b&amp;c")]
+    public void Render_HtmlEncodesDomain_ForOverrideTemplates(string domain, string expected)
+    {
+        var html = EmailTemplateService.Render("<p>{{domainName}}</p>", domain);
+
+        Assert.Equal($"<p>{expected}</p>", html);
+    }
+
+    [Theory]
+    [InlineData(EmailTemplateKind.Welcome)]
+    [InlineData(EmailTemplateKind.Farewell)]
+    public async Task BuiltIn_HtmlEncodesDomain_NoDoubleEncoding(EmailTemplateKind kind)
+    {
+        var (sut, _) = Build();
+
+        var html = await sut.GetHtmlAsync(kind, "<img src=x onerror=alert(1)>&\"");
+
+        Assert.DoesNotContain("<img", html);
+        Assert.Contains("&lt;img src=x onerror=alert(1)&gt;&amp;&quot;", html);
+        Assert.DoesNotContain("&amp;lt;", html);
+    }
+
     [Fact]
     public async Task Override_WinsAndRendersPlaceholder()
     {

src/Backend/AutopilotMonitor.Functions.Tests/EnrollmentTimeoutClassifierTests.cs

@@ -394,14 +394,91 @@ public class EnrollmentTimeoutClassifierTests
     }
 
     [Fact]
-    public void Classify_agent_timeout_failed_session_classifies_honestly()
+    public void Classify_agent_timeout_terminalizes_immediately_instead_of_parking()
     {
-        // WG Part-2 shape (session 1506ce9f): DeviceSetup 4/4, no user phase, watchdog fired at
-        // 6h — honest verdict is AwaitingUser (within grace), never Failed.
+        // The watchdog firing proves the agent is gone for good — an AwaitingUser park from this
+        // state is a countdown, not a wait: all 5 observed maxlife:r5_awaiting episodes expired
+        // unhealed (calibration read 2026-08-27). Still never Failed, and late straggler
+        // telemetry can heal the Incomplete (TryLateTelemetryReconcileAsync).
         var timeout = Evt("enrollment_failed",
             data: new Dictionary<string, object> { ["failureType"] = "agent_timeout" });
-        var (status, _) = Classify(new[] { Esp(DeviceSetup44), timeout }, hoursSinceStart: 6);
-        Assert.Equal(SessionStatus.AwaitingUser, status);
+        var (status, reason) = Classify(new[] { Esp(DeviceSetup44), timeout }, hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.Incomplete, status);
+        Assert.Contains("max-lifetime watchdog", reason);
+
+        // The V2 shutdown shape carries the same fact.
+        var shutdown = Evt("agent_shutting_down",
+            data: new Dictionary<string, object> { ["reason"] = "max_lifetime" });
+        var (viaShutdown, _) = Classify(new[] { Esp(DeviceSetup44), shutdown }, hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.Incomplete, viaShutdown);
+
+        // WhiteGlove Part 2 (rule 1b) is deliberately untouched: a sealed/powered-off device
+        // between technician and end user stays AwaitingUser — that park DOES heal
+        // (the observed maxlife:r1b_awaiting episode resolved to Succeeded).
+        var rollup = EnrollmentTimeoutClassifier.ExtractRollup(new[] { Esp(DeviceSetup44), timeout });
+        var (wgStatus, _, wgRule) = EnrollmentTimeoutClassifier.ClassifyTimedOutSession(
+            rollup, Start, Start.AddHours(6), 72, isPreProvisioned: true, resumedAt: Start.AddHours(1));
+        Assert.Equal(SessionStatus.AwaitingUser, wgStatus);
+        Assert.Equal(ClassifierRules.R1bWhiteGloveAwaiting, wgRule);
+    }
+
+    // -------- Rule 5a: completed (assumed) — calibration read 2026-08-27 --------
+
+    [Fact]
+    public void ExtractRollup_detects_app_failures_and_maxlife_timeout()
+    {
+        Assert.True(EnrollmentTimeoutClassifier.ExtractRollup(new[] { Evt("app_install_failed") }).HasAppInstallFailure);
+        var timeout = Evt("enrollment_failed", data: new Dictionary<string, object> { ["failureType"] = "agent_timeout" });
+        Assert.True(EnrollmentTimeoutClassifier.ExtractRollup(new[] { timeout }).HasAgentMaxLifetimeTimeout);
+        var shutdown = Evt("agent_shutting_down", data: new Dictionary<string, object> { ["reason"] = "max_lifetime" });
+        Assert.True(EnrollmentTimeoutClassifier.ExtractRollup(new[] { shutdown }).HasAgentMaxLifetimeTimeout);
+        // Other shutdown reasons say nothing about max lifetime.
+        var ctrlC = Evt("agent_shutting_down", data: new Dictionary<string, object> { ["reason"] = "ctrl_c" });
+        Assert.False(EnrollmentTimeoutClassifier.ExtractRollup(new[] { ctrlC }).HasAgentMaxLifetimeTimeout);
+        // A real failure event does not raise the app flag.
+        Assert.False(EnrollmentTimeoutClassifier.ExtractRollup(new[] { Evt("enrollment_failed") }).HasAppInstallFailure);
+    }
+
+    [Fact]
+    public void Classify_desktop_without_hello_past_grace_is_assumed_complete()
+    {
+        // The healthy half of the r5 population (drill-down 2026-08-27): desktop reached, apps
+        // clean, agent died before the Hello terminal. Past the full grace "user phase still
+        // running" is no longer a possible explanation — completed (assumed), not a red Incomplete.
+        var (status, reason, rule) = ClassifyWithRule(new[]
+        {
+            Esp(DeviceSetup44), Esp(AccountSetup15), Evt("desktop_arrived"),
+        }, hoursSinceStart: 80, grace: 72);
+        Assert.Equal(SessionStatus.Succeeded, status);
+        Assert.Equal(ClassifierRules.R5DesktopAssumed, rule);
+        Assert.Contains("treating the enrollment as completed", reason);
+        Assert.Contains("Agent last reported", reason); // silence-transparency clause
+    }
+
+    [Fact]
+    public void Classify_desktop_with_app_failure_past_grace_stays_Incomplete()
+    {
+        // "Completed" must not overclaim a session whose ESP payload provably failed
+        // (drill-down session b1edc6f8: desktop reached but .NET 3.5 install failed).
+        var (status, _) = Classify(new[]
+        {
+            Esp(DeviceSetup44), Evt("desktop_arrived"), Evt("app_install_failed"),
+        }, hoursSinceStart: 80, grace: 72);
+        Assert.Equal(SessionStatus.Incomplete, status);
+    }
+
+    [Fact]
+    public void Classify_maxlife_with_desktop_and_clean_apps_is_assumed_complete_within_grace()
+    {
+        // Agent provably gone + desktop + clean apps: no reason to park — the assumption is as
+        // good now as it would be after the 51h grace.
+        var timeout = Evt("enrollment_failed", data: new Dictionary<string, object> { ["failureType"] = "agent_timeout" });
+        var (status, _, rule) = ClassifyWithRule(new[]
+        {
+            Esp(DeviceSetup44), Evt("desktop_arrived"), timeout,
+        }, hoursSinceStart: 6);
+        Assert.Equal(SessionStatus.Succeeded, status);
+        Assert.Equal(ClassifierRules.R5DesktopAssumed, rule);
     }
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/EpssAndNvdThrottleTests.cs

@@ -0,0 +1,350 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services.Vulnerability;
+using Microsoft.Extensions.Logging.Abstractions;
+using Xunit;
+using static AutopilotMonitor.Functions.Services.Vulnerability.VulnerabilityCorrelationService;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the EPSS integration and the NVD throttle contract:
+/// FIRST's envelope parses with invariant-culture string numbers, a 429 opens a bounded cooldown
+/// (Retry-After honoured but capped), the NVD→cache projection carries the CVSS vector, EPSS
+/// application never erases an existing score, and the act/attend/track priority is exactly the
+/// three documented rules.
+/// </summary>
+public class EpssAndNvdThrottleTests
+{
+    // -----------------------------------------------------------------------
+    // EpssApiClient
+    // -----------------------------------------------------------------------
+
+    private const string SampleEnvelope = """
+        {"status":"OK","status-code":200,"version":"1.0","access":"public","total":2,"offset":0,"limit":100,
+         "data":[
+           {"cve":"CVE-2024-21447","epss":"0.00383","percentile":"0.73461","date":"2026-08-28"},
+           {"cve":"cve-2023-4863","epss":"0.94210","percentile":"0.99891","date":"2026-08-28"},
+           {"cve":"CVE-2020-0001","epss":"not-a-number","percentile":"0.5","date":"2026-08-28"},
+           {"cve":"","epss":"0.1","percentile":"0.5","date":"2026-08-28"}
+         ]}
+        """;
+
+    [Fact]
+    public void ParseResponse_ParsesInvariantStrings_AndDropsUnparseableRows()
+    {
+        var scores = EpssApiClient.ParseResponse(SampleEnvelope);
+
+        Assert.Equal(2, scores.Count);
+        var a = scores.Single(s => s.CveId == "CVE-2024-21447");
+        Assert.Equal(0.00383, a.Score, 6);
+        Assert.Equal(0.73461, a.Percentile, 6);
+        Assert.Equal("2026-08-28", a.Date);
+        // Ids are normalised to upper case so cache lookups are stable.
+        Assert.Contains(scores, s => s.CveId == "CVE-2023-4863");
+    }
+
+    [Fact]
+    public void ParseResponse_EmptyOrMissingData_ReturnsEmpty()
+    {
+        Assert.Empty(EpssApiClient.ParseResponse("""{"status":"OK","data":[]}"""));
+        Assert.Empty(EpssApiClient.ParseResponse("""{"status":"OK"}"""));
+    }
+
+    private sealed class StubHandler : HttpMessageHandler
+    {
+        public List<Uri> Requests { get; } = new();
+        private readonly Func<HttpRequestMessage, HttpResponseMessage> _respond;
+        public StubHandler(Func<HttpRequestMessage, HttpResponseMessage> respond) => _respond = respond;
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken ct)
+        {
+            Requests.Add(request.RequestUri!);
+            return Task.FromResult(_respond(request));
+        }
+    }
+
+    [Fact]
+    public async Task GetScoresAsync_BatchesByHundred_DedupesIds_AndSurvivesAFailedBatch()
+    {
+        int call = 0;
+        var handler = new StubHandler(req =>
+        {
+            call++;
+            if (call == 2)
+                return new HttpResponseMessage(HttpStatusCode.InternalServerError);
+            // Echo the first id of the batch back as scored.
+            var query = Uri.UnescapeDataString(req.RequestUri!.Query);
+            var firstId = query.Substring("?cve=".Length).Split(',')[0];
+            return new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new StringContent($$"""{"status":"OK","data":[{"cve":"{{firstId}}","epss":"0.5","percentile":"0.9","date":"2026-08-28"}]}""")
+            };
+        });
+        var client = new EpssApiClient(new HttpClient(handler), NullLogger<EpssApiClient>.Instance);
+
+        // 150 distinct ids + 10 duplicates (case-varied) ⇒ exactly two requests.
+        var ids = Enumerable.Range(1, 150).Select(i => $"CVE-2024-{10000 + i}").ToList();
+        ids.AddRange(ids.Take(10).Select(id => id.ToLowerInvariant()));
+
+        var result = await client.GetScoresAsync(ids);
+
+        Assert.Equal(2, handler.Requests.Count);
+        Assert.Single(result); // batch 1 scored one id, batch 2 failed soft
+        Assert.True(result.ContainsKey("cve-2024-10001")); // case-insensitive map
+        Assert.All(handler.Requests, u => Assert.StartsWith(EpssApiClient.EpssUrl, u.ToString()));
+    }
+
+    // -----------------------------------------------------------------------
+    // NVD throttle cooldown
+    // -----------------------------------------------------------------------
+
+    private static readonly DateTime Now = new(2026, 8, 29, 12, 0, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public void ComputeCooldown_NoHeader_UsesDefault()
+    {
+        Assert.Equal(NvdApiClient.ThrottleCooldown, NvdApiClient.ComputeCooldown(null, Now));
+    }
+
+    [Fact]
+    public void ComputeCooldown_RetryAfterDelta_IsHonoured()
+    {
+        var header = new RetryConditionHeaderValue(TimeSpan.FromSeconds(45));
+        Assert.Equal(TimeSpan.FromSeconds(45), NvdApiClient.ComputeCooldown(header, Now));
+    }
+
+    [Fact]
+    public void ComputeCooldown_RetryAfterDate_IsRelativeToNow()
+    {
+        var header = new RetryConditionHeaderValue(new DateTimeOffset(Now.AddSeconds(20)));
+        Assert.Equal(TimeSpan.FromSeconds(20), NvdApiClient.ComputeCooldown(header, Now));
+    }
+
+    [Fact]
+    public void ComputeCooldown_IsCapped_SoAServerCannotParkUsForAnHour()
+    {
+        var header = new RetryConditionHeaderValue(TimeSpan.FromHours(1));
+        Assert.Equal(NvdApiClient.MaxRetryAfter, NvdApiClient.ComputeCooldown(header, Now));
+    }
+
+    [Fact]
+    public void ComputeCooldown_PastDateOrZero_FallsBackToDefault()
+    {
+        Assert.Equal(NvdApiClient.ThrottleCooldown,
+            NvdApiClient.ComputeCooldown(new RetryConditionHeaderValue(new DateTimeOffset(Now.AddSeconds(-5))), Now));
+        Assert.Equal(NvdApiClient.ThrottleCooldown,
+            NvdApiClient.ComputeCooldown(new RetryConditionHeaderValue(TimeSpan.Zero), Now));
+    }
+
+    [Fact]
+    public void NvdFetchResult_FailureShapes_CarryEmptyDataButNeverSucceeded()
+    {
+        var throttled = NvdFetchResult<NvdCveResponse>.ThrottledResult();
+        Assert.False(throttled.Succeeded);
+        Assert.True(throttled.Throttled);
+        Assert.NotNull(throttled.Data);
+        Assert.Empty(throttled.Data.Vulnerabilities);
+
+        var failed = NvdFetchResult<NvdCveResponse>.Failed();
+        Assert.False(failed.Succeeded);
+        Assert.False(failed.Throttled);
+
+        var ok = NvdFetchResult<NvdCveResponse>.Ok(new NvdCveResponse { TotalResults = 1 });
+        Assert.True(ok.Succeeded);
+        Assert.Equal(1, ok.Data.TotalResults);
+    }
+
+    // -----------------------------------------------------------------------
+    // NVD → CachedCve projection
+    // -----------------------------------------------------------------------
+
+    [Fact]
+    public void ProjectNvdResponse_CarriesVector_PrefersV31_AndKeepsOnlyVulnerableRanges()
+    {
+        var response = new NvdCveResponse
+        {
+            Vulnerabilities =
+            {
+                new NvdVulnerabilityItem
+                {
+                    Cve = new NvdCve
+                    {
+                        Id = "CVE-2024-1",
+                        Published = "2026-01-01T00:00:00.000",
+                        Descriptions = { new NvdDescription { Lang = "en", Value = "desc" } },
+                        Metrics = new NvdMetrics
+                        {
+                            CvssMetricV30 = { new NvdCvssMetricV31 { CvssData = new NvdCvssData { BaseScore = 5, BaseSeverity = "MEDIUM", VectorString = "CVSS:3.0/AV:L" } } },
+                            CvssMetricV31 = { new NvdCvssMetricV31 { CvssData = new NvdCvssData { BaseScore = 9.8, BaseSeverity = "CRITICAL", VectorString = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } } },
+                        },
+                        Configurations =
+                        {
+                            new NvdConfiguration
+                            {
+                                Nodes =
+                                {
+                                    new NvdNode
+                                    {
+                                        CpeMatch =
+                                        {
+                                            new NvdCpeMatch { Vulnerable = true, Criteria = "cpe:2.3:a:v:p:*:*:*:*:*:*:*:*", VersionEndExcluding = "2.0" },
+                                            new NvdCpeMatch { Vulnerable = false, Criteria = "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*" },
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                },
+                new NvdVulnerabilityItem
+                {
+                    Cve = new NvdCve { Id = "CVE-2024-2", Descriptions = { new NvdDescription { Lang = "en", Value = "no metrics" } } }
+                },
+            }
+        };
+
+        var cves = VulnerabilityCorrelationService.ProjectNvdResponse(response);
+
+        Assert.Equal(2, cves.Count);
+        var first = cves[0];
+        Assert.Equal(9.8, first.CvssScore);
+        Assert.Equal("CRITICAL", first.CvssSeverity);
+        Assert.Equal("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", first.CvssVector);
+        Assert.Single(first.AffectedVersions);
+        Assert.Equal("2.0", first.AffectedVersions[0].VersionEndExcluding);
+        Assert.Null(first.EpssScore); // never defaulted before enrichment
+
+        var second = cves[1];
+        Assert.Equal(0, second.CvssScore);
+        Assert.Equal("UNKNOWN", second.CvssSeverity);
+        Assert.Null(second.CvssVector);
+    }
+
+    [Fact]
+    public void ProjectNvdResponse_Null_ReturnsEmpty()
+    {
+        Assert.Empty(VulnerabilityCorrelationService.ProjectNvdResponse(null));
+    }
+
+    // -----------------------------------------------------------------------
+    // EPSS application onto cached CVEs
+    // -----------------------------------------------------------------------
+
+    [Fact]
+    public void ApplyEpssScores_SetsNewScores_KeepsUnscoredUntouched_AndReportsOnlyChanges()
+    {
+        var cves = new List<CachedCve>
+        {
+            new() { CveId = "CVE-1", EpssScore = 0.2, EpssPercentile = 0.8, EpssDate = "2026-08-27" },
+            new() { CveId = "CVE-2" },
+            new() { CveId = "CVE-3", EpssScore = 0.5, EpssPercentile = 0.9, EpssDate = "2026-08-28" },
+        };
+        var scores = new Dictionary<string, EpssScore>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["cve-1"] = new EpssScore { CveId = "CVE-1", Score = 0.25, Percentile = 0.85, Date = "2026-08-28" }, // changed
+            ["CVE-3"] = new EpssScore { CveId = "CVE-3", Score = 0.5, Percentile = 0.9, Date = "2026-08-28" },   // unchanged
+            // CVE-2 absent: FIRST did not score it (or its batch failed) ⇒ stays null
+        };
+
+        var changed = VulnerabilityCorrelationService.ApplyEpssScores(cves, scores);
+
+        Assert.Equal(1, changed);
+        Assert.Equal(0.25, cves[0].EpssScore);
+        Assert.Equal("2026-08-28", cves[0].EpssDate);
+        Assert.Null(cves[1].EpssScore);
+        Assert.Equal(0.5, cves[2].EpssScore);
+    }
+
+    [Fact]
+    public void ApplyEpssScores_NeverErasesYesterdaysScore_WhenTodayHasNone()
+    {
+        var cves = new List<CachedCve> { new() { CveId = "CVE-1", EpssScore = 0.3, EpssPercentile = 0.7, EpssDate = "2026-08-27" } };
+        var changed = VulnerabilityCorrelationService.ApplyEpssScores(cves, new Dictionary<string, EpssScore>());
+        Assert.Equal(0, changed);
+        Assert.Equal(0.3, cves[0].EpssScore);
+    }
+
+    [Fact]
+    public void BuildCveCacheRow_PassesCachedAtThrough_SoEpssRewritesDoNotLookLikeNvdFetches()
+    {
+        var cachedAt = new DateTime(2026, 8, 20, 3, 0, 0, DateTimeKind.Utc);
+        var row = VulnerabilityCorrelationService.BuildCveCacheRow("cpe:2.3:a:v:p", new List<CachedCve> { new() { CveId = "CVE-1" } }, cachedAt);
+
+        Assert.Equal(cachedAt.ToString("o"), row["CachedAt"]);
+        Assert.Equal("cpe:2.3:a:v:p", row["CpeUri"]);
+        Assert.Equal(1, row["TotalCves"]);
+        Assert.True(row.ContainsKey("CveDataJson"));
+    }
+
+    [Fact]
+    public void CachedCve_RoundTrips_WithoutWritingNulls_SoLegacyRowsStayReadable()
+    {
+        var json = System.Text.Json.JsonSerializer.Serialize(new List<CachedCve> { new() { CveId = "CVE-1", CvssScore = 7 } }, JsonOptions);
+        Assert.DoesNotContain("EpssScore", json);
+        Assert.DoesNotContain("CvssVector", json);
+
+        // A row written before this change (no EPSS/vector properties at all) still deserialises.
+        var legacy = """[{"CveId":"CVE-9","CvssScore":4.3,"CvssSeverity":"MEDIUM","Description":"","PublishedDate":"","AffectedVersions":[]}]""";
+        var cves = System.Text.Json.JsonSerializer.Deserialize<List<CachedCve>>(legacy, JsonOptions)!;
+        Assert.Null(cves[0].EpssScore);
+        Assert.Null(cves[0].CvssVector);
+    }
+
+    // -----------------------------------------------------------------------
+    // Priority
+    // -----------------------------------------------------------------------
+
+    [Theory]
+    [InlineData(true, null, 0.0, CvePriority.Act)]
+    [InlineData(true, 0.001, 2.0, CvePriority.Act)]
+    [InlineData(false, 0.1, 2.0, CvePriority.Attend)]
+    [InlineData(false, 0.0999, 2.0, CvePriority.Track)]
+    [InlineData(false, null, 9.0, CvePriority.Attend)]
+    [InlineData(false, 0.0, 9.8, CvePriority.Attend)]
+    [InlineData(false, null, 8.9, CvePriority.Track)]
+    [InlineData(false, 0.05, 7.5, CvePriority.Track)]
+    public void Compute_FollowsTheThreeRules(bool kev, double? epss, double cvss, string expected)
+    {
+        Assert.Equal(expected, CvePriority.Compute(kev, epss, cvss));
+    }
+
+    [Fact]
+    public void Max_PicksHigherBand_AndTreatsUnknownAsLowest()
+    {
+        Assert.Equal(CvePriority.Act, CvePriority.Max(CvePriority.Track, CvePriority.Act));
+        Assert.Equal(CvePriority.Attend, CvePriority.Max(CvePriority.Attend, null));
+        Assert.Equal(CvePriority.Track, CvePriority.Max(null, ""));
+    }
+
+    [Fact]
+    public void StampFindingPriority_RollsUpHighestBand_AndMaxEpss()
+    {
+        var finding = new Dictionary<string, object> { ["maxEpssScore"] = 0.9 /* stale value, must be recomputed */ };
+        var vulns = new List<object>
+        {
+            new Dictionary<string, object> { ["priority"] = CvePriority.Track, ["epssScore"] = 0.02 },
+            new Dictionary<string, object> { ["priority"] = CvePriority.Attend, ["epssScore"] = 0.4 },
+            new Dictionary<string, object> { ["priority"] = CvePriority.Track },
+        };
+
+        VulnerabilityCorrelationService.StampFindingPriority(finding, vulns);
+
+        Assert.Equal(CvePriority.Attend, finding["priority"]);
+        Assert.Equal(0.4, finding["maxEpssScore"]);
+    }
+
+    [Fact]
+    public void StampFindingPriority_NoScoredCves_OmitsMaxEpss()
+    {
+        var finding = new Dictionary<string, object>();
+        VulnerabilityCorrelationService.StampFindingPriority(finding, new List<object> { new Dictionary<string, object> { ["priority"] = CvePriority.Track } });
+        Assert.Equal(CvePriority.Track, finding["priority"]);
+        Assert.False(finding.ContainsKey("maxEpssScore"));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GetImeVersionHistoryRedactionTests.cs

@@ -124,7 +124,7 @@ public class GetImeVersionHistoryRedactionTests
             new[]
             {
                 "firstSeenAt", "firstSeenSessionId", "firstSeenTenantId", "lastSeenAt",
-                "msiArchiveBlobPath", "msiArchiveStatus", "msiBytes", "msiSha256", "msiSourceUrl",
+                "msiArchiveBlobPath", "msiArchiveStatus", "msiArchiveUpdatedAt", "msiBytes", "msiSha256", "msiSourceUrl",
                 "sessionCount", "version",
             },
             keys);
@@ -211,6 +211,7 @@ public class GetImeVersionHistoryRedactionTests
             LastSeenAt = Last,
             SessionCount = 3109,
             MsiArchiveStatus = "Archived",
+            MsiArchiveUpdatedAt = Last,
             MsiArchiveBlobPath = $"{version}/IntuneWindowsAgent.msi",
             MsiSha256 = "4d6b85fd3c49cf227ab4711308bca1f3c701cad9bff1799da4c6b6616066bb5e",
             MsiBytes = 13_107_200,