feat(agent): signal-pipeline health block in agent_metrics_snapshot

The 2026-09-01 WG-seal soak on post-SignalIngress-fix builds (memory: project_wg_seal_postfix_soak_residual) found sessions whose DecisionEngine never sealed Part 1 while the agent kept running for hours - and telemetry could not distinguish a frozen ingress worker from a deliberate Weak sealing-classifier verdict, because the metrics snapshots carried no pipeline counters at all. Every agent_metrics_snapshot now carries the block. The fields are MONOTONIC totals plus a monotonic queue peak - deliberately no momentary queue length: a snapshot samples the integral, so any two snapshots prove whether the worker ran in between (a frozen worker keeps signal_pending_count growing while processed/applied stand still; a momentary gauge would alias between ticks). Same field pattern the snapshot already uses for the spool (spool_total_enqueued_count / spool_peak_pending_item_count). - signal_last_ordinal / signal_processed_total (new ProcessedSignalCount) / signal_pending_count / signal_reentrant_total: SignalIngress worker progress; signal_queue_peak is a new lock-free Interlocked-max recorded in Post (fast + slow path; worker-local follow-up items deliberately excluded) - decision_stage + decision_last_applied_ordinal: from the immutable DecisionState - answers the WG question directly ("minutes after the tracker's whiteglove_complete and still not WhiteGloveSealed") - wg_sealing_level / wg_sealing_score: only after the sealing classifier produced at least one verdict (key ABSENCE, not Unknown/0 noise, for every non-WG session) - separates "classifier said Weak" from "never ran" Wiring is a read-only probe chain following the imeTrackerHealthProbe pattern: EnrollmentOrchestrator passes () => _processor?.CurrentState into IComponentFactory.CreateCollectorHosts (new optional decisionStateProbe; test fakes updated), PeriodicCollectorLifecycleHost combines it with its existing concrete-SignalIngress reference in BuildSignalPipelineProbe, and AgentSelfMetricsCollector writes the fields fail-soft (a throwing probe degrades to a snapshot without the block - pinned by test). The snapshot event travels the collector/event path, which is independent of the signal pipeline it measures - field-proven by the freeze cases, whose perf/metrics events kept flowing while the engine stood still. No backend/web/MCP change needed: no new event type, DataJson is free-form. Tests: 5 new collector facts (full block, absence semantics x2, fail-soft, no-probe compatibility) + 2 new SignalIngress facts (processed total stable across drain; queue peak survives the queue draining - the property a momentary gauge would not have). Agent suite 2812 green, solution builds with 0 warnings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Ops alert channels, ops-events server-side filters, and generated MCP tool vocabularies (#140 )
2026-10-25 13:10:13 +00:00 · 2026-09-01 18:26:22 +02:00 · 2026-09-01 16:57:41 +02:00 · 2026-09-01 15:53:05 +02:00 · 2026-09-01 15:52:26 +02:00 · 2026-09-01 13:53:59 +02:00
555 changed files with 53756 additions and 5292 deletions
@@ -76,12 +76,23 @@ jobs:
      - name: Reserve build number (counter blob CAS)
        id: version
        shell: pwsh
+        # Input and secret reach the script only as environment variables, never as script
+        # text: ${{ }} is substituted before pwsh parses the block, so a crafted
+        # build_number could otherwise break out of the quotes and run arbitrary code.
+        env:
+          BUILD_NUMBER_OVERRIDE: ${{ inputs.build_number }}
+          AGENT_SAS_TOKEN: ${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}
        run: |
          $override = 0
-          if ('${{ inputs.build_number }}' -ne '') { $override = [int]'${{ inputs.build_number }}' }
+          if ($env:BUILD_NUMBER_OVERRIDE -ne '') {
+            if ($env:BUILD_NUMBER_OVERRIDE -notmatch '^\d+$') {
+              throw "build_number must be a positive integer, got '$($env:BUILD_NUMBER_OVERRIDE)'"
+            }
+            $override = [int]$env:BUILD_NUMBER_OVERRIDE
+          }

          $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v$($env:LINE_MAJOR).txt"
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' -Override $override
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken $env:AGENT_SAS_TOKEN -Override $override

          $csproj = Get-Content $env:CSPROJ_PATH -Raw
          if ($csproj -match '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -313,13 +324,19 @@ jobs:
          name: version-metadata
          path: ${{ env.MANIFEST_NAME }}

+      # First-party `gh` instead of a third-party action: this job holds contents:write,
+      # id-token:write and attestations:write, so no code we do not control runs here.
+      # --generate-notes appends the auto-generated notes below the body.
      - name: Create GitHub Release
        if: inputs.create_release
-        uses: softprops/action-gh-release@v3
-        with:
-          tag_name: ${{ steps.version.outputs.tag }}
-          name: Autopilot Monitor Agent ${{ steps.version.outputs.version }}
-          body: |
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.version.outputs.tag }}
+          RELEASE_NAME: Autopilot Monitor Agent ${{ steps.version.outputs.version }}
+          RELEASE_PRERELEASE: ${{ inputs.prerelease }}
+          RELEASE_ZIP: ${{ steps.artifact.outputs.versioned_zip_release }}
+          RELEASE_BODY: |
            ## Autopilot Monitor Agent ${{ steps.version.outputs.version }}

            ### Installation
@@ -344,9 +361,22 @@ jobs:
            ```
            gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/AutopilotMonitor
            ```
-          draft: false
-          prerelease: ${{ inputs.prerelease }}
-          files: |
-            ${{ steps.artifact.outputs.versioned_zip_release }}
-            ${{ env.MANIFEST_NAME }}
-          generate_release_notes: true
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $notesFile = Join-Path $env:RUNNER_TEMP 'release-notes.md'
+          Set-Content -Path $notesFile -Value $env:RELEASE_BODY -Encoding utf8 -NoNewline
+
+          $ghArgs = @(
+            'release', 'create', $env:RELEASE_TAG,
+            $env:RELEASE_ZIP, $env:MANIFEST_NAME,
+            '--repo', $env:GITHUB_REPOSITORY,
+            '--target', $env:GITHUB_SHA,
+            '--title', $env:RELEASE_NAME,
+            '--notes-file', $notesFile,
+            '--generate-notes'
+          )
+          if ($env:RELEASE_PRERELEASE -eq 'true') { $ghArgs += '--prerelease' }
+
+          & gh @ghArgs
+          if ($LASTEXITCODE -ne 0) { throw "gh release create failed with exit code $LASTEXITCODE" }
+          Write-Host "Release $env:RELEASE_TAG created"
@@ -143,3 +143,29 @@ jobs:
            git diff --stat
            exit 1
          fi
+
+  shared-manifests-in-sync:
+    name: Generated wire types match shared-manifests.json
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+
+      # JSON ↔ C# parity is the dotnet job's SharedManifestParityTests; this job pins
+      # JSON ↔ generated TS (shared-manifests.generated.ts, wire-types.generated.ts and the
+      # MCP's wire-types + wire-vocabularies copies - the vocabularies are what the MCP
+      # tool input schemas derive their z.enum() from).
+      - name: Regenerate
+        run: node scripts/generate-shared-manifest-types.js
+        working-directory: src/Web/autopilot-monitor-web
+
+      - name: Fail if the generated files drifted
+        run: |
+          if ! git diff --quiet -- src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts src/Web/autopilot-monitor-web/utils/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-vocabularies.generated.ts; then
+            echo "::error::Generated wire types are out of date. Run 'npm run generate:manifests' in src/Web/autopilot-monitor-web and commit the result."
+            git diff --stat
+            exit 1
+          fi
@@ -57,7 +57,7 @@ jobs:
          dotnet-version: '10.0.x'

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.3
+        uses: github/codeql-action/init@v4.37.9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -68,6 +68,6 @@ jobs:
        run: dotnet build AutopilotMonitor.sln --configuration Release

      - name: Analyze
-        uses: github/codeql-action/analyze@v4.37.3
+        uses: github/codeql-action/analyze@v4.37.9
        with:
          category: /language:${{ matrix.language }}
@@ -63,11 +63,23 @@ jobs:
      - name: Combine rules into dist/
        run: node rules/scripts/combine.js

+      # Plain git instead of a third-party action: this step runs with contents:write on
+      # main, so no code we do not control gets to push. Checkout leaves the job's
+      # GITHUB_TOKEN in the remote credential helper, which is all `git push` needs.
+      # NOTE: combine.js writes THREE outputs; committing only dist/ would silently discard
+      # the two generated TS modules and leave the guardrails-in-sync CI check red.
      - name: Commit generated outputs
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "chore: regenerate rules/dist + generated TS from individual files"
-          # combine.js writes THREE outputs; committing only dist/ would silently discard
-          # the two generated TS modules and leave the guardrails-in-sync CI check red.
-          file_pattern: "rules/dist/* src/Web/autopilot-monitor-web/utils/guardrails.generated.ts src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts"
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -- rules/dist/ \
+            src/Web/autopilot-monitor-web/utils/guardrails.generated.ts \
+            src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts
+          if git diff --cached --quiet; then
+            echo "Generated outputs unchanged - nothing to commit"
+            exit 0
+          fi
+          git commit -m "chore: regenerate rules/dist + generated TS from individual files"
+          git push origin HEAD:main
@@ -22,7 +22,7 @@ jobs:
      - uses: actions/checkout@v7

      - name: Login to Azure (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -65,7 +65,7 @@ jobs:
        run: dotnet publish ${{ env.CSPROJ_PATH }} --configuration Release --output ./publish --no-build -p:SourceRevisionId=${{ github.sha }} -p:BuildNumber=${{ steps.version.outputs.build_number }} -p:BuildTimestampUtc=${{ steps.version.outputs.build_utc }}

      - name: Deploy to Azure Functions
-        uses: Azure/functions-action@v1
+        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1
        with:
          app-name: ${{ env.FUNCTION_APP }}
          package: ./publish
@@ -46,7 +46,7 @@ jobs:
        run: echo "sha=$(git -C mcp-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Login to Azure (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -1,5 +1,13 @@
 name: Deploy Web (Static Web App)

+# Build here, upload with the pinned SWA CLI. No third-party action sees the deploy token
+# (the CLI is Microsoft-published npm code at an exact version), the build runs on the same
+# path ci.yml tests (setup-node 22 + npm ci + next build) instead of Oryx guessing inside the
+# action's container, and the exported site is attested like the agent ZIP and the MSI.
+#
+# PR preview environments were dropped with the action: their per-PR URLs are never
+# registered as redirect URIs, so nobody could log in on them anyway.
+
 on:
  push:
    branches:
@@ -8,39 +16,44 @@ on:
      - 'src/Web/autopilot-monitor-web/**'
      - '.github/workflows/deploy-web.yml'
  workflow_dispatch:
-  pull_request:
-    types: [opened, synchronize, reopened, closed]
-    branches:
-      - main
-    paths:
-      - 'src/Web/autopilot-monitor-web/**'
-      - '.github/workflows/deploy-web.yml'
+
+permissions:
+  contents: read
+  id-token: write      # keyless Sigstore signing (artifact attestation)
+  attestations: write  # store the provenance attestation

 env:
  PORTAL_VERSION_URL: https://portal.autopilotmonitor.com/version.json
  VERSIONS_CONTAINER: https://autopilotmonitoreu.blob.core.windows.net/versions
+  WEB_DIR: src/Web/autopilot-monitor-web
+  # Exact version: `npx --package` resolves from the registry at run time, so the pin is the
+  # only thing that keeps the deploy step's code fixed. Bump deliberately.
+  SWA_CLI_VERSION: 2.0.10

 jobs:
  build_and_deploy_job:
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
    name: Build and Deploy Job
-    # Dependabot PRs run without repo secrets, so the deploy token is absent.
-    # Surface it as an env var so the deploy step can gate on it — secrets
-    # cannot be referenced directly in an `if:` expression.
-    env:
-      DEPLOY_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
    steps:
      - uses: actions/checkout@v7
        with:
          lfs: false
          fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
-      - name: Build And Deploy
-        id: builddeploy
-        # Skip (green) instead of failing when the token is missing (Dependabot
-        # PRs); real deploys on main and internal PRs still have it.
-        if: env.DEPLOY_TOKEN != ''
-        uses: Azure/static-web-apps-deploy@v1
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: ${{ env.WEB_DIR }}/package-lock.json
+
+      - name: Install dependencies
+        working-directory: ${{ env.WEB_DIR }}
+        run: npm ci
+
+      # next.config output:'export' -- `next build` writes the static site to out/
+      # (prebuild: sync-error-codes, generate-lastmod, generate-version).
+      - name: Build
+        working-directory: ${{ env.WEB_DIR }}
        env:
          NEXT_PUBLIC_ENTRA_CLIENT_ID: ${{ vars.NEXT_PUBLIC_ENTRA_CLIENT_ID }}
          # Dual app-reg window: previous app registration (unset = single-app behaviour)
@@ -55,28 +68,50 @@ jobs:
          # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
          # the verify step below polls the deployed file for exactly this commit.
          GITHUB_SHA: ${{ github.sha }}
-        with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
-          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
-          action: "upload"
-          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
-          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
-          app_location: "src/Web/autopilot-monitor-web" # App source code path
-          api_location: "" # Api source code path - optional
-          # Static export (next.config output:'export'): Oryx runs `npm run build`
-          # and uploads the exported out/ directory as plain static files — no
-          # managed SSR runtime is provisioned anymore. (No is_static_export
-          # input on this action version; Oryx detects the export from
-          # next.config + output_location.)
-          output_location: "out" # Built app content directory - optional
-          ###### End of Repository/Build Configurations ######
+        run: |
+          npm run build
+          test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }

-      # The SWA action reporting success proves the upload, not that the production host
-      # serves the new build — verify against the live /version.json (Cache-Control:
-      # no-store via staticwebapp.config.json) before publishing the version manifest.
-      # PR builds deploy to per-PR preview environments, so only main deploys are verified.
+      # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
+      - name: Package export
+        id: package
+        run: |
+          archive="portal-${GITHUB_SHA::7}.tar.gz"
+          tar -C "$WEB_DIR/out" -czf "$archive" .
+          echo "archive=$archive" >> "$GITHUB_OUTPUT"
+          sha256sum "$archive"
+
+      # Sigstore keyless provenance: binds the export digest to this workflow run (repo, ref,
+      # commit, workflow file) in a public transparency log.
+      # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
+      - name: Attest build provenance (portal export)
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: ${{ steps.package.outputs.archive }}
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: portal-${{ github.sha }}
+          path: ${{ steps.package.outputs.archive }}
+
+      # Upload only -- out/ is already built. --swa-config-location points at the app root,
+      # where staticwebapp.config.json lives (next export does not copy it into out/).
+      - name: Deploy to Static Web App
+        env:
+          SWA_CLI_DEPLOYMENT_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
+        run: |
+          npx --yes --package "@azure/static-web-apps-cli@${SWA_CLI_VERSION}" swa deploy \
+            --app-location "$WEB_DIR" \
+            --output-location out \
+            --swa-config-location "$WEB_DIR" \
+            --env production \
+            --no-use-keychain
+
+      # The CLI reporting success proves the upload, not that the production host serves the
+      # new build -- verify against the live /version.json (Cache-Control: no-store via
+      # staticwebapp.config.json) before publishing the version manifest.
      - name: Verify deployed portal build is live
-        if: env.DEPLOY_TOKEN != '' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
        shell: pwsh
        run: |
          $expectedCommit = '${{ github.sha }}'.Substring(0, 7)
@@ -100,10 +135,9 @@ jobs:

          throw "Portal did not serve commit $expectedCommit within 5 minutes -- deployment not verified, version manifest NOT published"

-      # Cross-component deploy record, written last and only on a verified deploy —
+      # Cross-component deploy record, written last and only on a verified deploy --
      # same contract as versions/backend.json and versions/mcp.json.
      - name: Publish version manifest
-        if: env.DEPLOY_TOKEN != '' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
        shell: pwsh
        run: |
          $manifest = [ordered]@{
@@ -119,22 +153,3 @@ jobs:
          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
          Write-Host "Published versions/web.json"
          Write-Host $manifest
-
-  close_pull_request_job:
-    if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    runs-on: ubuntu-latest
-    name: Close Pull Request Job
-    env:
-      DEPLOY_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
-    steps:
-      - name: Close Pull Request
-        id: closepullrequest
-        if: env.DEPLOY_TOKEN != ''
-        uses: Azure/static-web-apps-deploy@v1
-        with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
-          action: "close"
-
-
-
-
@@ -15,7 +15,7 @@ jobs:
    name: Federated login + read check
    steps:
      - name: Login to Azure (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -4,7 +4,7 @@ title: CMTrace Time Resolution — Per-Line Self-Anchoring
 description: How the agent converts bias-less CMTrace local times to UTC without trusting any process's timezone belief — each provably fresh line anchors its own offset against the agent clock on the 15-minute grid; everything not provably fresh falls back uniformly and says so.
 resource: src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime
 tags: [agent, ime, cmtrace, timestamps, timezone, calibration, provenance]
-timestamp: 2026-08-30
+timestamp: 2026-09-01
 ---

 # Problem
@@ -139,6 +139,22 @@ regression); `measuredWriterOffsetMinutes` is never consulted (sticky after era
 flip-backs). Kill switch: app setting `CmTraceSkewTripwireDisabled`. Goal state: the event
 never fires — any hit is an anchoring case the per-line design misses, or a detector bug.

+Samples are windowed to the session's most recent INGEST ERA before any of that is
+computed: the batch stamps of both sides are walked backwards from the newest one and the
+era ends at the first `ReceivedAt` gap wider than 2 h. A session partition is not one agent
+run — a pre-provisioning session's Part 1 is written by whatever agent build was current
+weeks earlier, and its events stay in the partition forever. Field 2026-09-01 (sessions
+`e797117b` / `c06d639d` / `d7c8032b`, one tenant): 26 IME samples at exactly −60 min from a
+2026-08-20 technician leg under agent 2.0.1409 — before per-line anchoring — outnumbered the
+3…9 clean samples of the user leg that completed that morning and fired the tripwire against
+2.0.1445, a build the device had self-updated to minutes earlier. The skew was real, 12 days
+old, and already fixed; no scan-wide statistic can tell those apart, because event rows carry
+no agent version. The era boundary can. `eraStartUtc` and the excluded per-side sample counts
+travel in the ops event, so an inherited leg stays visible without being alarmed on. The
+2 h threshold sits above any in-leg upload gap (a live agent uploads self-metrics every few
+minutes, reports `session_stalled` at 60 min idle, and the maintenance sweep classifies
+silence at 2 h) and below every pre-provisioning handover.
+
 Device-clock problems (the customer-actionable cousin) are covered separately by the
 `clock_skew` analyze condition behind `ANALYZE-DEV-008`, which excludes IME-derived events
 precisely so an anchoring regression can never surface as a customer finding.
@@ -8,7 +8,7 @@ tags:
  - decision-engine
  - reducer
  - completion
-timestamp: 2026-07-11T00:00:00+02:00
+timestamp: 2026-08-30T00:00:00+02:00
 ---

 # V2 Agent — Decision Engine (DecisionCore)
@@ -175,6 +175,20 @@ advisory backstop. All routes converge on `CompleteThroughFinalizingOrDefer`:
   scheduler contract) dead-ends as `realmjoin_timeout_stale_superseded_by_rearm`.
   The idle case (detected, no deployment activity ever) times out at 60 min
   unchanged, and phase 200/210 activity never extends.
+   **Self-update observation** (gktatooine session 946ccbd6): the version on
+   `RealmJoinDetected` is read once from `RealmJoin.exe`, but the tray's `AppUpdater`
+   often replaces the MSI-shipped binary on its first start — minutes after detection,
+   before the deployment begins. `RealmJoinWatcher` therefore arms a
+   `RegNotifyChangeKeyValue` watcher on `HKLM\...\Uninstall\RealmJoin` (the only
+   registry write of the updater; appearance-watch on the `Uninstall` parent when the
+   entry does not exist yet) once Detected fired, re-reads the binary version after a
+   2 s debounce (registry `DisplayVersion` as fallback while the file is locked) and
+   posts the typed `RealmJoinAutoUpdateDetected` signal plus the
+   `realmjoin_autoupdate_detected` timeline event when the version differs from the
+   baseline. The reducer overrides `RealmJoinFacts.ProductVersion` / `ReleaseChannel`
+   (`WithVersionOverride` — the one legitimate later write past the set-once helpers);
+   it never touches the gate, the deadline, or `LastActivityUtc`. An unreadable
+   baseline at detection is seeded silently by the first successful re-read.
   A closed gate also outranks the 30-minute `AdvisoryCompletion` backstop: that
   handler re-arms (trigger suffix `:CompletionGateHolding`) instead of failing while
   the RealmJoin gate is closed *and* its own deadline is still armed, because the gate
@@ -208,6 +222,15 @@ IME false-positive AccountSetup entries.
 - **No silent parking**: a non-terminal post-AccountSetup session must always hold a
  resolution-capable deadline; a 10-min dwell tripwire emits
  `session_parked_without_deadline`.
+- **Every payload-derived string stored into state is bounded** (`FactStringBounds`,
+  256 chars): RealmJoin package id/version/scope (scope normalised to `machine`/`user`),
+  failed app ids, `HelloOutcome`, `ImeMatchedPatternId`, `EspAdvisoryFailureCategory`,
+  RealmJoin product version/channel. The bound is applied *before* any dedupe comparison
+  so a forged multi-hundred-KB key neither costs a full-length compare per stored row nor
+  lands in snapshots/audit trails. It never truncates real telemetry — the sources are
+  registry key names (Windows caps them at 255), GUIDs and enum-like strings. The same
+  engine replays device-uploaded signals server-side (`ReducerVerifier`), which is why
+  the bound lives in the reducer, not in the agent adapter alone.

 # Hosting & threading (inside the agent)

@@ -228,6 +251,21 @@ Wired by `EnrollmentOrchestrator.Start` (`src/Agent/AutopilotMonitor.Agent.V2.Co
  one-shot terminal-stage hook (raises the agent's `Terminated` event off-thread).
 - The `DeadlineScheduler`'s `Fired` event loops back in as synthetic `DeadlineFired`
  signals.
+- **Pipeline health in `agent_metrics_snapshot`** (2026-09-01, motivated by the WG-seal
+  soak in which a frozen engine and a deliberate Weak sealing verdict were telemetrically
+  indistinguishable): every snapshot carries monotonic totals from `SignalIngress`
+  (`signal_last_ordinal`, `signal_processed_total`, `signal_pending_count`,
+  `signal_reentrant_total`, `signal_queue_peak` — a monotonic peak, deliberately no
+  momentary queue length, so snapshot sampling cannot alias it) plus `decision_stage`,
+  `decision_last_applied_ordinal` and — once the sealing classifier has produced a
+  verdict — `wg_sealing_level`/`wg_sealing_score` from the immutable `DecisionState`.
+  Two snapshots therefore prove whether the worker ran in between: a frozen worker keeps
+  `signal_pending_count` growing while the processed/applied counters stand still. The
+  probe chain is read-only (`EnrollmentOrchestrator` → `IComponentFactory.
+  CreateCollectorHosts(decisionStateProbe)` → `PeriodicCollectorLifecycleHost` →
+  `AgentSelfMetricsCollector`); the snapshot event itself travels the collector/event
+  path, which is independent of the signal pipeline it measures — field-proven by the
+  freeze cases, whose perf/metrics events kept flowing while the engine stood still.
 - On restart, `RecoveryCoordinator` folds the persisted signal log through a transient
  `new DecisionEngine()` before the live pipeline starts — see
  [logs & persistence](logs-and-persistence.md).
@@ -0,0 +1,141 @@
+---
+type: concept
+title: IME Log Tracker — Anchored Patterns and the Bounded Read Loop
+description: Why every shipped IME log pattern starts with '^', why the on-device matcher reads lines through a byte-bounded reader with a per-line matching budget, and what an operator sees when a hostile log file is tailed — the IME Logs folder is writable by standard users and the SYSTEM tracker must stay linear on whatever lands there.
+resource: src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime
+tags: [agent, ime, regex, redos, log-tracker, reliability, security]
+timestamp: 2026-08-30
+---
+
+# Problem
+
+`ImeLogTracker` tails every file in `%ProgramData%\Microsoft\IntuneManagementExtension\Logs`
+whose name matches the IME log families and matches each entry against every active pattern of
+the shipped pack (`rules/ime-log-patterns/*.json` → `rules/dist/ime-log-patterns.json`, embedded
+in agent and backend, delivered live through the config channel). That folder is writable by a
+standard user, so the input is untrusted: anyone signed in during enrollment can append lines.
+
+Before 2026-08-30 three things multiplied:
+
+* **Unanchored patterns with unbounded lazy gaps.** `\[Win32App\]\[EspManager\] … registered.*?App name: (?<name>.*?)$`
+  re-scans its `.*?` tail at every offset where the literal prefix occurs; repeating the prefix
+  *m* times in one line of *n* chars costs O(m·n). `IME-APP-VERSION` chained two lazy scans
+  (`.*?"DetectedIdentityVersion":\{[^}]*?"NewValue"`) and was quadratic even when anchored.
+* **Per-pattern timeout, no per-line budget.** Each regex had a 1 s timeout, the timeout was
+  swallowed at Debug, and the loop tried all ~80 active patterns for every line — one crafted
+  line concatenating several trigger prefixes cost several seconds of SYSTEM CPU.
+* **Unbounded line length.** `StreamReader.ReadLineAsync` materializes the whole line before
+  anyone can look at its size; a multi-hundred-MB line is an OutOfMemory in the poll loop, which
+  retries from the same bookmark every second.
+
+Genuine IME decision signals (app failures, enforcement states, ESP phases, user-session
+completion) queue behind that work — a monitoring blackout during the enrollment window.
+
+# Design
+
+## Anchored, linear pattern pack
+
+* **Every shipped pattern starts with `^`.** The tracker compiles with
+  `IgnoreCase | Compiled | Singleline` and no `Multiline`, so `^` is the start of the matched
+  string — `CmTraceLogEntry.Message`, i.e. the text after `<![LOG[` (for multiline entries the
+  assembled entry, still offset 0). .NET treats a leading `^` as a beginning anchor: a
+  non-matching pattern costs O(prefix), never a scan. Evidence for the invariant: across eight
+  real diagnostics sets (~9,000 entries, all six log families) every match of the old pack began
+  at offset 0 — except one class of mid-line hits that were false positives (below).
+* **No chained unbounded scans.** `IME-APP-VERSION` now spells the report-delta JSON out
+  (`\{(?:"OldValue":[^,}]{0,64},)?"NewValue":"`) instead of scanning `[^}]*?` at every
+  occurrence. The test `ImeLogPatternPackLinearityTests` rejects `[^x]*` shapes outright.
+* **Raw lines.** A line that fails CMTrace parsing (orphaned continuation lines, lines after a
+  dropped entry) is still matched raw; with `^` it matches only if it *begins* with the pattern.
+  Field data: the unanchored `PS-SCRIPT-CONTEXT` fired 122 times on
+  `[Win32App] SideCarScriptDetectionManager Launch powershell executor in machine session`
+  (Win32 detection scripts in AppWorkload.log), each time overwriting the pending *platform*
+  script's `RunContext`. Anchoring removed that contamination; it is asserted by test.
+* **Custom patterns are not rewritten.** Tenant-authored patterns (and cached pre-anchor
+  configs) keep their semantics; `CompilePatterns` names the enabled patterns without `^` once
+  at Info so a pass summary's budget breaks can be attributed.
+
+## Bounded read loop (`CheckLogFilesAsync`)
+
+* **`BoundedLineReader`** replaces `StreamReader`: byte-oriented, splits on `\n`, strips one
+  `\r`, decodes UTF-8 per line, honours a BOM only at absolute file offset 0. A line beyond
+  `MaxEntryBytes` (32 MB) is never materialized — the reader keeps the capped prefix, discards
+  the rest while scanning for the terminator and flags `LastLineTruncated`. Its `Position` is
+  the exact offset of the next unread byte, so bookmarks are exact (the StreamReader's decoder
+  read-ahead used to lose up to a buffer of lines on a cancelled pass).
+* **Why 32 MB.** Real logs carry single lines of ~110 KB routinely
+  (`IntuneManagementExtension.log` policy dumps) and one large tenant's `AppWorkload.log`
+  writes a 5.6 MB `Get policies = […]` line that `IME-POLICIES` legitimately captures (app
+  names for the dashboard). A "few KB" cap would drop genuine entries; with anchored patterns
+  the CPU cost of a large line is O(n) for the handful of patterns whose prefix matches, so the
+  cap only has to bound memory. The same constant caps an assembled multiline entry.
+* **Oversized lines are dropped, not matched.** Captures on a cut line would be wrong. If the
+  capped prefix opens a CMTrace entry without closing it, the existing `skippingDroppedEntry`
+  mechanism skips the entry's continuation lines instead of raw-matching them; a line that
+  opens a *new* entry always ends the skip and is processed itself.
+* **Per-line matching budget.** `MatchLine` runs all active patterns under a 2 s budget that
+  sums only the time spent inside `Regex.Match` on that line; a pattern that times out is
+  skipped and counted, and once the budget is spent the remaining patterns are skipped for that
+  line (matches already handled stand). No genuine line comes near it — the budget exists for
+  unanchored custom patterns and hostile input. It is deliberately not the wall-clock across
+  the pattern loop: that window also holds the match handlers (signal ingress, match-log
+  append) and scheduler stalls, and session 946ccbd6 (2026-08-30, Hyper-V guest with 5–10 s
+  process-wide stalls, 1 MB log, no line over 5 KB) broke the wall-clock budget twice on
+  genuine lines and skipped their remaining patterns.
+* **Held-back tails.** An unterminated tail at EOF (a physical line without `\n`, or a
+  multiline entry without `]LOG]!>`) is normally the writer mid-write. Instead of dropping it
+  (and raw-matching its remainder next pass) the bookmark stays at the entry start. The hold
+  lasts until the entry completes or the file has stood still for `HeldTailSettle` (1 s), and
+  only for tails up to 1 MB — a never-closing hostile tail costs a handful of re-reads, then is
+  processed as-is and the bookmark advances.
+* **One Warning per pass and file.** `oversizedLines`, `regexTimeouts`, `lineBudgetBreaks` and
+  the first skipped pattern ID are logged in a single line after the pass when any is non-zero
+  (fail-soft with a trace); the first timeout per pattern per process additionally names the
+  pattern at Debug. No per-line logging, so a hostile file cannot flood the agent log.
+* **Deliberately not done: per-file preemption.** The first pass over a legitimate
+  `AppWorkload.log` can be hundreds of MB and runs in one pass by design; after the changes
+  above the work per byte is linear and small, so a writer can only delay processing in
+  proportion to the bytes it writes.
+
+## Pack hygiene against the decompiles (2026-08-30)
+
+Every shipped pattern's distinctive phrase was checked in the IME decompiles 1.97.107.0,
+1.104.102.0 and 1.105.103.0 (`ime-decompiles` repo): no wording changed in any of them. The 11
+disabled legacy patterns whose literals last existed in IME 1.50 (fleet minimum 1.97) were
+deleted rather than left as re-enable traps; `IME-DO-TIMEOUT-1/2` now match the exact source
+literal (`[Win32App DO] DO downloading is not finished within timeout, jobId = …, fileId = …`)
+instead of two lookaheads; `IME-DO-TEL` has no emitter from 1.104 on and stays only while
+1.101/1.103 devices are in the fleet (`get_ime_version_history`).
+
+## Observability (2026-08-30)
+
+Everything the loop skips is counted (`ImeTrackerHealth`: lines read, entries matched, oversized
+lines, regex timeouts, budget breaks, held tails, unanchored patterns, files tailed, backlog
+bytes) and, together with a per-pattern match histogram, persisted in `ImeTrackerState`. The
+periodic `agent_metrics_snapshot` carries the counters as `ime_*` keys, the first pass that
+skipped work raises the one-shot `ime_tracker_degraded` Warning (immediate upload), and the
+termination handler emits `ime_pattern_hits` — the input of the backend's pattern-drift loop
+([IME Pattern Health](../backend/ime-pattern-health.md)).
+
+# Verification
+
+* `ImeLogPatternPackLinearityTests` loads the shipped pack, asserts the `^` invariant, runs four
+  hostile constructions (repeated prefix, the reported `"DetectedIdentityVersion":{x`
+  repetition, long word runs, prefix+keywords with newlines; 512 KB each) against every pattern
+  with the agent's exact regex options and fails on a timeout or > 150 ms (best of three),
+  and re-matches representative real lines with their captures.
+* `BoundedLineReaderTests`, `ImeLogTrackerReadLoopHardeningTests` (oversized single line,
+  oversized multiline opener, held-back tail, settle, cancelled pass bookmark, single Warning).
+* Parity: the old and new packs were run over eight real diagnostics sets with the tracker's
+  assembly semantics; the match sets are identical apart from the removed `PS-SCRIPT-CONTEXT`
+  false positives. `--run-ime-matching` (the agent's offline matcher) now assembles multiline
+  entries like the tracker so it reproduces the same result.
+
+# Citations
+
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs` — `CheckLogFilesAsync`, `MatchLine`, `HoldBackTail`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/BoundedLineReader.cs`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs` — `MaxEntryBytes`, `HeldTailSettle`, `CompilePatterns`
+* `rules/ime-log-patterns/*.json`, `rules/scripts/combine.js`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs`
+* [CMTrace Time Resolution](cmtrace-time-resolution.md) — the linear CMTrace line parser this loop feeds
@@ -0,0 +1,69 @@
+---
+type: concept
+title: IME Process Watcher — Identity Before Attach, Re-Arm After Exit
+description: Why ImeProcessWatcher attaches only to a process that runs in session 0 with its image under the IME install root — a process name is not an identity — and why a reported exit re-arms discovery instead of ending it.
+resource: src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeProcessWatcher.cs
+tags: [agent, ime, process, security, cwe-807, reliability]
+timestamp: 2026-08-30
+---
+
+# Problem
+
+`ImeProcessWatcher` reports `ime_process_exited` (Warning — read as an IME crash indicator in the
+timeline) by subscribing to `Process.Exited` of `IntuneManagementExtension.exe`. Until 2026-08-30 it
+attached to `Process.GetProcessesByName(...)[0]` and stopped discovery for good once attached.
+
+A process name is not a protected namespace. During AccountSetup (and on Device Preparation flows)
+a standard-user session is live and can start any binary renamed to `IntuneManagementExtension.exe`.
+Two consequences (CWE-807 — the same class as the agent instance guard and the local-admin dynamic
+allowance):
+
+* **Forged signal** — the fake exits, the SYSTEM agent emits a Warning with the fake's PID/exit
+  code, and failure diagnosis is misdirected.
+* **Muted signal** — attached to the fake, discovery is stopped; the real service is never watched,
+  and a genuine IME crash later in the enrollment is never reported. Even without an attacker the
+  one-shot design missed every IME exit after the first (an IME service restart is not rare).
+
+# Schema
+
+`ImeProcessIdentity` establishes identity by facts a standard user cannot forge:
+
+| Check | Source | Why it holds |
+|---|---|---|
+| `SessionId == 0` | `Process.SessionId` | Only services and their children run in session 0; a user session cannot start a process there. |
+| image under `%ProgramFiles(x86)%\Microsoft Intune Management Extension\` (also `%ProgramW6432%`/`%ProgramFiles%` variants) | `QueryFullProcessImageName` (cross-bitness — IME is 32-bit, the agent may be 64-bit; `MainModule` throws there), `MainModule.FileName` fallback | Program Files is admin-writable only. Segment-aware prefix (`...Extension\`), `GetFullPath`-normalised, so a sibling folder or `..` does not pass. |
+| file name exactly `IntuneManagementExtension.exe` | image path | `GetProcessesByName` matches the name without extension. |
+
+Unknown facts (session `-1`, unresolved path) are **untrusted** — a false negative only delays
+attach by one 5 s discovery tick, a false positive mutes the signal for the session.
+
+Among trusted candidates the **oldest** by `StartTime` wins (the SCM-started service predates
+anything transient). Untrusted name matches are logged once per PID as a Warning in the agent log
+(`ignoring untrusted IntuneManagementExtension.exe candidate (PID, session, image)`) and never
+attached; no timeline event is raised for them.
+
+**Re-arm:** `OnImeExited` detaches, emits the event, and restarts the discovery timer. Only the
+currently attached `Process` object is honoured (`ReferenceEquals`), so a late `Exited` from a
+replaced or disposed handle cannot produce a duplicate event. A process that exits between probe
+and subscription is handled by an explicit `HasExited` check after subscribing.
+
+The watcher owns the `Process` handles its source returns (like `GetProcessesByName`) and disposes
+them — tests must hand it fresh handles (`Process.GetProcessById`), not the ones they hold.
+
+# Examples
+
+* Fake started in session 1 from `Downloads\IntuneManagementExtension.exe` before the service is up →
+  never attached; its exit emits nothing; the service arriving later is attached normally.
+* Service exits (crash or restart) → `ime_process_exited` (PID, exit code, uptime), discovery
+  re-armed, the restarted service is attached on the next tick and its later exit is reported too.
+* Fake and service both running, fake listed first → the service is attached.
+
+Covered by `ImeProcessWatcherIdentityTests` (pure identity table + stand-in `cmd.exe` processes
+with injected identity facts).
+
+# Citations
+
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeProcessIdentity.cs`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeProcessWatcher.cs`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeProcessWatcherIdentityTests.cs`
+* Related: [Local Admin Analyzer](local-admin-analyzer.md) (CWE-807 dynamic allowance).
@@ -1,7 +1,7 @@
 ---
 type: Concept
 title: Admin Identity Binding — tid + oid behind every cross-tenant-role UPN
-description: Why a GlobalAdmins or DelegatedAdmins row keyed on a UPN string must never confer access by itself in an API that accepts tokens from every Entra tenant, the AdminIdentityBindings table that pins each such UPN to its immutable home tenant id and object id, the fail-closed resolution order in both role services, the first-sign-in object-id pin, and the explicit rebind surface.
+description: Why a GlobalAdmins, DelegatedAdmins or McpUsers row keyed on a UPN string must never confer access by itself in an API that accepts tokens from every Entra tenant, the AdminIdentityBindings table that pins each such UPN to its immutable home tenant id and object id, the fail-closed resolution order in the role services and the MCP whitelist, the first-sign-in object-id pin, and the explicit rebind surface.
 resource: src/Backend/AutopilotMonitor.Functions/Services/AdminIdentityBindingService.cs
 tags:
  - backend
@@ -10,7 +10,8 @@ tags:
  - multi-tenant
  - global-admin
  - delegated-admin
-timestamp: 2026-08-29T00:00:00+02:00
+  - mcp
+timestamp: 2026-08-30T00:00:00+02:00
 ---

 # Problem
@@ -83,10 +84,28 @@ winner). Two accounts racing the first sign-in inside the home tenant therefore
 Row lookups stay cached by UPN; the binding has its own 30 s cache keyed by UPN and is invalidated on
 pin, rebind and removal. A rebind on one scaled-out instance converges on the others within seconds.

+## The MCP whitelist is a third UPN-keyed grant
+
+`McpUsers` (PK `McpUsers`, RK = lowercase UPN) is the WhitelistOnly allow-list consulted by
+`GET auth/mcp`, which runs under the AuthenticatedUser policy — a token from any Entra tenant reaches it.
+Before 2026-08-30 the row was honoured by UPN alone, so a same-UPN identity from another tenant
+received `allowed=true` / `accessGrant=McpUser`, inherited the row's `UsagePlan` (a paid quota tier
+provisioned for another organization's user), and was also hit by the row's Disabled kill-switch. The
+data reach stayed tenant-bound (the MCP server routes a non-global caller on its own JWT `tid`), but the
+GA-curated whitelist and the per-user entitlement were bypassable.
+
+`McpUserService` now resolves the whitelist exactly like the role services: row by UPN (cached 30 s) →
+no row ⇒ `NotPresent` without touching the binding → `IsBoundAsync(identity)` false ⇒ `NotPresent`. Grant,
+usage-plan override (`GetBoundMcpUserAsync`, used by `McpQuotaService.ResolvePlanAsync` and the
+self-service usage view) and the Disabled kill-switch all belong to the bound identity only; an unbound
+legacy row is inert. `POST global/mcp-users` binds first via the same resolver / 422 / 409 contract as the
+other grant endpoints, and the MCP users settings section shows the same home-tenant picker on 422. The
+AllMembers path is unaffected — it is tenant-bound by the auth middleware itself.
+
 ## Grants bind first — and resolve the identity themselves

-Granting is "type the UPN". The three grant endpoints (`POST auth/global-admins`,
-`POST global/delegated-admins`, `POST global/tenant-groups/{id}/assignees`) accept `homeTenantId` /
+Granting is "type the UPN". The four grant endpoints (`POST auth/global-admins`,
+`POST global/delegated-admins`, `POST global/tenant-groups/{id}/assignees`, `POST global/mcp-users`) accept `homeTenantId` /
 `objectId` only as optional overrides; normally `AdminIdentityResolver` supplies them:

 1. **Sign-in history** (`UserActivity`, filtered on the UPN): the person has signed in before ⇒ tid + oid
@@ -98,7 +117,7 @@ Granting is "type the UPN". The three grant endpoints (`POST auth/global-admins`
   tenants) and retries with `homeTenantId`. This is the only manual step, and only for a UPN whose
   domain the platform has never seen.

-`AddGlobalAdminAsync`, `DelegatedAdminService.UpsertAsync` and `AssignGroupAsync` then take the resolved
+`AddGlobalAdminAsync`, `DelegatedAdminService.UpsertAsync`, `AssignGroupAsync` and `AddMcpUserAsync` then take the resolved
 `homeTenantId` / `objectId` and call `EnsureBoundAsync` **before** writing the role row. `EnsureBoundAsync` creates the binding, keeps a compatible one (same tenant; the
 supplied object id equals the pin or upgrades an unpinned one), and throws
 `IdentityBindingConflictException` for a different tenant or a different pinned object id — the
@@ -158,7 +177,7 @@ Same row, binding without an object id: the first `tid=1111…` sign-in pins its
 * `src/Backend/AutopilotMonitor.Functions/Services/AdminIdentityBindingService.cs` — verdict, pin, grant-time binding, rebind; the table entity.
 * `src/Backend/AutopilotMonitor.Functions/Services/AdminIdentityResolver.cs` — sign-in-history / UPN-domain resolution at grant time (`AdminIdentityResolverTests`).
 * `src/Web/autopilot-monitor-web/app/admin/components/IdentityBindingsSection.tsx` — the per-tenant inspect/correct panel.
-* `src/Backend/AutopilotMonitor.Functions/Services/GlobalAdminService.cs`, `DelegatedAdminService.cs` — resolution order.
+* `src/Backend/AutopilotMonitor.Functions/Services/GlobalAdminService.cs`, `DelegatedAdminService.cs`, `McpUserService.cs` — resolution order (`McpUserServiceIdentityBindingTests` for the whitelist matrix).
 * `src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableAdminRepository.cs` — `TryPinIdentityObjectIdAsync` and the binding CRUD.
 * `src/Backend/AutopilotMonitor.Functions/Functions/Admin/IdentityBindingManagementFunction.cs` — the rebind surface and the shared `IdentityBindingRequest.Validate`.
 * `src/Backend/AutopilotMonitor.Functions.Tests/AdminIdentityBindingServiceTests.cs`, `AdminIdentityBindingAuthorizationTests.cs` — verdict matrix, race semantics, and the middleware-level denials for foreign-tenant and recycled-UPN tokens.
@@ -9,7 +9,7 @@ tags:
  - archive
  - blob
  - queue
-timestamp: 2026-08-29T17:30:00+02:00
+timestamp: 2026-08-30T12:00:00+02:00
 ---

 # IME Installer Archive
@@ -22,7 +22,7 @@ on. Two stores:
 | Store | Content | Written by |
 | --- | --- | --- |
 | Blob container `ime-archive` (private, kept by design, not tenant-scoped) | `{version}/IntuneWindowsAgent.msi` (write-once) + `{version}/provenance.json` (derived, overwritable) | `ImeMsiArchiver` via the `ime-msi-archive` queue; `/ime-decompile` skill as manual backfill |
-| Table `ImeVersionHistory` (partition `Global`, RowKey = version) | first/last seen, session count, `MsiArchiveStatus`, `MsiArchiveUpdatedAt`, `MsiArchiveBlobPath`, `MsiSha256`, `MsiBytes`, `MsiSourceUrl` | `RecordImeVersionAsync` (sighting), `UpdateImeVersionArchiveInfoAsync` (archive outcome / queued stamp) |
+| Table `ImeVersionHistory` (partition `Global`, RowKey = version) | first/last seen, session count, `CorroboratedAt`, `MsiArchiveStatus`, `MsiArchiveUpdatedAt`, `MsiArchiveBlobPath`, `MsiSha256`, `MsiBytes`, `MsiSourceUrl` | `RecordImeVersionAsync` (sighting), `UpdateImeVersionArchiveInfoAsync` (archive outcome / queued stamp) |

 # Schema

@@ -45,6 +45,25 @@ older than 24 h (`RequeueBackoff`) or never happened. The ingest path then merge
 sessions of that version see "in flight" and do not pile on. Worst case for a version no
 host serves any more: one walk over the hosts per day, not one per enrollment.

+## Trust boundary of a sighting
+
+The version string is **device-supplied** (any device holding a tenant agent credential can
+send an `ime_agent_version` event) and becomes the RowKey of a caller-independent GLOBAL
+partition that every tenant reads. Four layers keep one tenant's device from turning a
+claim into a platform fact:
+
+| Layer | Where | Effect |
+| --- | --- | --- |
+| Plausibility guard | `ImeMsiArchiver.IsPlausibleVersion`, called first in `RecordImeVersionAsync` (and again by the archiver) | plain dotted digits, 2–4 components, inside Windows Installer `ProductVersion` bounds (major/minor ≤ 255, build ≤ 65535). Anything else → `ImeVersionSighting.Rejected`: no row, no ops event, no archive job, no re-queue. |
+| One sighting per session | `UpdateSessionImeAgentVersionAsync` returns whether the session's stored version changed; only then does the ingest path call `RecordImeVersionAsync` | `SessionCount` moves once per session and version; a re-sent or replayed event, a tombstoned or unregistered session, count nothing. |
+| Corroboration | merge path of `RecordImeVersionAsync` stamps `CorroboratedAt` on the first sighting from a tenant other than `FirstSeenTenantId` | the first-seen tenant's own devices can never corroborate their own claim. |
+| Fleet confirmation on read | `GetImeVersionHistoryFunction.IsFleetConfirmed` (MemberRead projection only) | tenant members see a version once it is `Archived` (ProductVersion matched a real package), or corroborated, or first seen before `LegacyTrustCutoffUtc` (2026-08-31 — the 16 rows reviewed on 2026-08-30 are all genuine builds). Global scope sees every row, unconfirmed ones included. |
+
+What remains possible for a hostile device: a plausible, never-shipped version creates a
+row visible to Global Admins plus one `NewImeVersionDetected` ops event and one archive walk
+that ends `Failed:VersionMismatch` (no blob). It is never listed to other tenants and can
+never occupy the archive folder of a real build.
+
 ## Candidate hosts and the version check

 Microsoft distributes IME from several versionless URLs that carry **different rollout
@@ -0,0 +1,100 @@
+---
+type: concept
+title: IME Pattern Health — the pattern-drift loop
+description: How a Microsoft change to IME log wording becomes visible before it breaks timelines — the agent's session-end pattern histogram, the global per-IME-version statistics, the data-driven drift alarm, and the operator page/MCP tool that turn the alarm into a repair workflow.
+resource: src/Backend/AutopilotMonitor.Functions/Services/Ime
+tags: [backend, agent, ime, log-patterns, drift, ops-events, metrics, mcp]
+timestamp: 2026-08-30
+---
+
+# Problem
+
+The IME log-pattern pack is the product's core signal source, and Microsoft changes IME log
+wording without notice. Until now a changed line was invisible until sessions looked wrong:
+the agent kept matching nothing, the client log said nothing, and the only alarm was the
+registry/log reconciliation for app states. Tracker problems (skipped lines, regex timeouts)
+were a client-log Warning nobody sees without pulling diagnostics.
+
+# Design
+
+Three layers, one loop:
+
+## 1. Tracker health in `agent_metrics_snapshot`
+
+`ImeLogTracker` keeps cumulative counters (`ImeTrackerHealth`: lines read, entries matched,
+oversized lines, regex timeouts, per-line budget breaks, held tails, unanchored patterns,
+files tailed, backlog bytes = Σ file length − bookmark). `AgentSelfMetricsCollector` reads them
+through a read-only probe (`ImeLogHost.GetTrackerHealth`) and adds `ime_*` keys to the periodic
+snapshot next to the spool queue. Fleet expectation for every skip counter: **0**. The session
+page's "IME Tracker" section shows queue depth and skips.
+
+## 2. `ime_tracker_degraded` (Warning, one-shot, immediate upload)
+
+The first pass that skipped work raises `ImeLogTracker.OnTrackerDegraded`; the adapter emits
+the event with the counters, file and first skipped pattern. Persisted flag (`ImeTrackerState`)
+so a restart cannot re-emit. Listed in the MCP `health_events` catalog; informational for the
+idle/stall clocks (`SignalActivityClassifier`).
+
+## 3. `ime_pattern_hits` → `ImePatternStats` → `ImePatternDriftSuspected`
+
+* **Agent.** At termination (same slot as `app_tracking_summary`, so WhiteGlove Part 2 reports
+  the whole session via the persisted histogram) the handler emits `ime_pattern_hits`:
+  `hits` = every ENABLED pattern ID → match count, zeros included, plus the health counters and
+  `imeVersion` (IME's own "Agent version is:" line). Only sessions with a terminal run report —
+  crashes/kills are outside the denominator by construction. Severity is Debug: the event is an
+  operator/backend signal, hidden from the default session timeline; the session page's
+  "IME Tracker" card and the ingest fold read it regardless of severity.
+* **Ingest.** `EventIngestProcessor` hands the event to `ImePatternHealthService` fire-and-forget:
+  IDs are filtered against `BuiltInImeLogPatterns.BuiltInPatternIds` (a device may only claim an
+  ID; tenant custom IDs never reach the global table), the version must pass
+  `ImeMsiArchiver.IsPlausibleVersion` (event value first, session row as fallback), then one
+  partition read + one transactional batch upsert into `ImePatternStats`
+  (PK = version, RK = patternId: `Sessions`, `SessionsWithHit`, `Hits`, `LastHitAt`,
+  `DriftFlaggedAt`). Permanent table (`TableLifecycleBucketTests` KeptByDesign) — the baseline
+  needs the established versions.
+* **Drift statistic (`ImePatternDriftEvaluator`, pure).** No hard-coded must-hit list.
+  Baseline = the version with the most reporting sessions (≥ 100, never the candidate).
+  A pattern is *expected* when its baseline hit rate (`SessionsWithHit / Sessions`) is ≥ 0.8.
+  Drift is suspected when the candidate has ≥ 25 reporting sessions and an expected pattern
+  matched in none of them. Conditional patterns (platform/remediation scripts, WinGet, errors)
+  sit below 0.8 on the baseline and cannot alarm. One alarm per version × pattern:
+  `TryMarkImePatternDriftFlaggedAsync` (ETag-conditional) then
+  `OpsEventService.RecordImePatternDriftSuspectedAsync` (Warning, Agent, `System.Ingest`;
+  dual-registered in the web `OPS_EVENT_TYPES`). The stats snapshot used for evaluation is
+  cached 10 minutes and patched with each batch, so a version crossing the threshold is judged
+  promptly.
+* **Read side.** `GET metrics/ime-pattern-health` (`GlobalReadOrAdmin`) returns baseline,
+  thresholds, versions (with `ImeVersionHistory` first/last seen and fleet session count),
+  patterns (catalog + retired IDs still in the statistics), cells and open alerts. Web:
+  Global Admin → Metrics → IME Pattern Health (matrix, legend: drift / silent / low / few).
+  MCP: `get_ime_pattern_health` (GA + Global Reader).
+
+# Workflow on an alert
+
+1. `ImePatternDriftSuspected` names version + pattern; the matrix shows the cell.
+2. `search_sessions imeAgentVersion=<version>` → `get_session_diagnostics` on a session with a
+   package (upload mode must not be Off).
+3. `/ime-pattern-validate` against the real log; `/ime-decompile` for the version's sources.
+4. Fix the pattern under `rules/ime-log-patterns/` (anchored, linear —
+   [IME Log Tracker](../agent/ime-log-tracker-matching-budget.md)); Backend-Deploy delivers it
+   through the config channel without an agent release.
+
+# Limits
+
+* Denominator = sessions that reached a terminal run; a version that only crashes never gets
+  a histogram and therefore never alarms here (it alarms elsewhere).
+* The baseline is fleet-wide: a pattern that only some tenants can produce stays "conditional"
+  even if it is 100 % within those tenants.
+* Thresholds are constants (`ImePatternDriftEvaluator`), tuned for the current fleet size
+  (~25k sessions/month); revisit when versions roll out faster than 25 sessions per day.
+
+# Citations
+
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerHealth.cs`, `ImeLogTracker.cs` (`GetHealthSnapshot`, `OnTrackerDegraded`), `ImeTrackerStatePersistence.cs`
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Termination/EnrollmentTerminationHandler.cs` (`EmitImePatternHits`)
+* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/AgentSelfMetricsCollector.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/Ime/{ImePatternHealthService,ImePatternDriftEvaluator}.cs`
+* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.ImePatternStats.cs`
+* `src/Backend/AutopilotMonitor.Functions/Functions/Metrics/GetImePatternHealthFunction.cs`
+* `src/Web/autopilot-monitor-web/app/admin/metrics/sections/SectionImePatternHealth.tsx`, `imePatternHealthLogic.ts`
+* `src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts` (`get_ime_pattern_health`)
@@ -39,7 +39,9 @@ Every table in `Constants.TableNames` must belong to at least one deletion lifec
 - Unknown session → `TargetTenantId`, leaving each endpoint's own not-found semantics (404 / empty 200 / 400) in charge.
 - Delegated (MSP) callers deliberately get NO fallback — extending it to `AllowedTenantIds` is a pending user decision.

-The lookup row is written at session registration (fail-soft), deleted by the cascade one step before the tombstone, and rebuildable from Sessions (not in the critical-backup set). The former lazy triggers (`events.Count == 0` → scan) are gone: empty-but-owned results no longer pay a table scan, and endpoints resolve upfront.
+The lookup row is **claimed at registration, first-writer-wins** (`ClaimSessionTenantLookupAsync`, create-only `AddEntity` BEFORE any Sessions/SessionsIndex write): on 409 the existing owner is read back — same tenant ⇒ normal re-registration, different tenant ⇒ `SessionTenantConflictException` ⇒ `409 Conflict` with `ErrorCode=session_owner_mismatch` (owning tenant not disclosed) plus a `SessionTenantConflict` ops event, and nothing is written. The claim is deliberately NOT fail-soft. Before this, the row was an unconditional last-writer-wins upsert after the session write, so any tenant's device (self-service onboarding) that knew a victim session GUID (portal deep links, Teams/Slack notifications, progress-portal URLs) could re-point the mapping at its own tenant and have every no-`tenantId` Global Admin/Reader read — and GA writes such as the `globaladmin` annotation lane — silently served from a forged session. Session ids are 122-bit random, so a genuine cross-tenant collision does not occur; a conflict is an attack or an agent bug and fails loudly. The legacy self-heal write is Add-only too (an existing claim is the authority), and `scripts/Migration/Backfill-SessionTenantLookup.ps1` closes the pre-table window once (idempotent, Add-only) so no legacy session id is claimable. The row is deleted by the cascade one step before the tombstone (no tombstone is kept — a freed id gives a foreign tenant nothing a fresh GUID would not) and is rebuildable from Sessions (not in the critical-backup set). The former lazy triggers (`events.Count == 0` → scan) are gone: empty-but-owned results no longer pay a table scan, and endpoints resolve upfront.
+
+`requireGlobalAdmin: true` additionally corroborates the resolved tenant against its Sessions row (one point-read): a mapping whose session does not exist in the resolved tenant keeps `TargetTenantId`, so a stale or poisoned row can never steer a GA write — silently, without any operator confirmation step (a "confirm tenant GUID" dialog was rejected as unusable). Read paths keep the single point-read; their own session read is the corroboration (404).

 Related enforcement added with the migration: `RecomputeTriggerGate` — `?reanalyze=true` and `?rescan=true` on the MemberRead session routes are actions (delete + rewrite stored results) and now 403 for Viewer / Global Reader / cross-tenant tenant roles (Global Admin or own-tenant Admin/Operator only).

@@ -0,0 +1,134 @@
+---
+type: Concept
+title: Ops-Events Query Surface
+description: The server-side filter surface of GET /api/global/ops-events (category, eventType, severity/minSeverity, tenant drill, date window), why every filter is folded into the continuation fingerprint, why minSeverity expands to an OR-set, and why the paged cross-category read has to fan out over the complete category vocabulary.
+resource: /src/Backend/AutopilotMonitor.Functions/Functions/Admin/GetOpsEventsFunction.cs
+tags:
+  - backend
+  - table-storage
+  - ops-events
+  - pagination
+  - mcp
+timestamp: 2026-09-01T00:00:00+02:00
+---
+
+# Problem
+
+`OpsEvents` is the platform operator's log: consent flows, maintenance runs, security blocks,
+tenant offboards, agent emergency breaks, SLA and Azure Monitor alerts. It is partitioned by
+**category** (`PartitionKey`), with a reverse-tick `RowKey` for newest-first ordering.
+
+Until 2026-09-01 the read endpoint could only narrow by category and date window. Every other
+question — *"did any `AgentEmergencyBreak` fire yesterday?"*, *"show me everything at Error or
+worse"* — had to be answered by pulling the whole category and filtering it on the client. For the
+MCP tool that client is a language model, so an event-type question cost a category-sized response
+in model context.
+
+# Schema
+
+`GET /api/global/ops-events` (GA + Global Reader; `TenantScoping.None`, so a delegated admin cannot
+reach it at all):
+
+| Param | Where it is applied | Notes |
+| --- | --- | --- |
+| `category` | `PartitionKey eq` — indexed | One partition; omit to fan out over all of them |
+| `eventType` | `EventType eq` — server-side scan | **Exact and case-sensitive**; Table Storage cannot fold case |
+| `severity` | `Severity eq` — server-side scan | Normalised onto the canonical vocabulary before use |
+| `minSeverity` | OR-set over `Severity` — server-side scan | Threshold: that level and everything above |
+| `dateFrom` / `dateTo` | RowKey range — indexed | Both absent ⇒ backend resolves the last 30 days |
+| `tenantId` | **in-memory**, post-fetch | Drill, not an isolation boundary — see below |
+| `pageSize` / `continuation` | — | `pageSize` opts into pagination; absent ⇒ full window, no cap |
+
+The filter surface lives in two shared pieces so no path can honour a different one:
+`OpsEventFilterRequest` (query → `OpsEventQueryFilters` + pagination extras) and
+`TableOpsEventRepository.AppendFieldFilters` (filters → OData clauses), which **both** filter
+builders call — the single-category/unpaged builder and the per-partition fan-out builder that adds
+the `RowKey gt` bound. This mirrors `AuditLogFilterRequest` / `AuditLogQueryFilters` on the audit
+endpoints one-for-one.
+
+## Why `minSeverity` is an OR-set, not a range
+
+Table Storage compares strings lexicographically, and the severity names sort
+`Critical < Error < Info < Warning` — nothing to do with severity order. A `Severity ge 'Warning'`
+clause would return `Warning` only, silently dropping `Error` and `Critical`, which is precisely the
+alert-worthy half. `minSeverity` therefore expands to
+`(Severity eq 'Warning' or Severity eq 'Error' or Severity eq 'Critical')`. The ladder itself lives
+in `OpsEventSeverity.Rank` and is shared with `OpsAlertDispatchService`, so *"Warning and above"* in
+a read means exactly what *"Warning and above"* meant when the alert rules decided to fire.
+
+`minSeverity=Info` emits no clause at all — it is the floor, so the clause would only cost query
+length.
+
+## Why severity is normalised but eventType is not
+
+Both columns are matched with `eq`, which is case-sensitive. Severity has a closed vocabulary of
+four values, so `?severity=warning` is normalised to `Warning`, and anything outside the vocabulary
+is a **400** — an unnormalised value would return an empty page that reads exactly like *"no such
+events happened"*.
+
+Event types have a declared vocabulary too (`OpsEventTypes`, reflected into the shared manifest and
+served to the model as `get_resource(name="ops_event_types")`), but the filter deliberately does
+**not** validate against it: stored rows outlive the vocabulary, so a type that was retired after a
+refactor must stay searchable in the historical window. The value is passed verbatim and a typo
+legitimately returns zero rows — the catalog is there so nobody has to guess.
+
+## Continuation fingerprint
+
+Every filter value is appended to the pagination *extras*, which are both folded into the
+continuation-token fingerprint and echoed on `nextLink`. Consequences:
+
+* a token minted for one filter cannot page a different one (it is rejected with a 400),
+* the follow-up request is self-contained — the resolved date window and the filters travel on the
+  link, so no page re-resolves "now",
+* extras are appended **after** the pre-existing `category` / `tenantId` discriminators and skipped
+  when empty, so tokens minted before the field filters existed still fingerprint identically.
+
+Because severity values are normalised *before* fingerprinting, `?severity=error` and
+`?severity=Error` share one token instead of minting two that each reject the other.
+
+## The tenant drill stays in memory
+
+`?tenantId=` is filtered post-fetch (`GetOpsEventsFunction.FilterByTenant`) because OpsEvents is
+partitioned by category, and — deliberately — because the in-memory comparison is
+`OrdinalIgnoreCase` while an OData `eq` would be case-sensitive: stored tenant casing is not
+guaranteed, so pushing this one down would lose rows. It is drill *correctness*, not isolation:
+every caller that reaches this route already has full cross-tenant scope. Pages therefore can report
+fewer items than `pageSize` when the drill is narrow.
+
+## The category vocabulary must be complete
+
+The paged cross-category read does not issue one cross-partition query (Azure would page it by
+`PartitionKey asc`, so the first page would come entirely from the alphabetically first category).
+It fans out per partition over a fixed list and merge-sorts. That list is therefore load-bearing: a
+category that is written but not listed is **invisible to every paged reader** while the unpaged
+full-table path still returns it. `Platform` (Azure Monitor alerts relayed through the ops alert
+webhook) was missing that way from its introduction until 2026-09-01.
+
+The list is now owned by `OpsEventCategory.All`, and `OpsEventCategoryCoverageTests` reflects over
+the constants to fail the build when a new category is not added to it.
+
+# Examples
+
+```
+# One event type, last 24h, cross-category
+GET /api/global/ops-events?eventType=AgentEmergencyBreak&dateFrom=2026-08-31T12:00:00Z&pageSize=200
+
+# Everything alert-worthy in the maintenance partition this month
+GET /api/global/ops-events?category=Maintenance&minSeverity=Error&dateFrom=2026-08-01T00:00:00Z
+```
+
+MCP `get_ops_events` exposes the same surface plus a `days` shorthand, which it resolves to a
+concrete `dateFrom` **client-side** — a backend-side "last N days" would re-resolve "now" on every
+page and blow the token fingerprint. An explicit `dateFrom`/`dateTo` always wins over the shorthand.
+
+# Citations
+
+* `/src/Backend/AutopilotMonitor.Functions/Functions/Admin/GetOpsEventsFunction.cs`
+* `/src/Backend/AutopilotMonitor.Functions/Functions/Admin/OpsEventFilterRequest.cs`
+* `/src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableOpsEventRepository.cs`
+* `/src/Shared/AutopilotMonitor.Shared/DataAccess/IOpsEventRepository.cs`
+* `/src/Shared/AutopilotMonitor.Shared/DataAccess/OpsEventTypes.cs` — the declared event-type vocabulary
+* `/src/Backend/AutopilotMonitor.Functions.Tests/OpsEventFieldFilterTests.cs`
+* `/src/Backend/AutopilotMonitor.Functions.Tests/OpsEventCategoryCoverageTests.cs`
+* `/src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts`
+* [Business Timestamps](business-timestamps.md) — why the date window filters on the RowKey
@@ -0,0 +1,151 @@
+---
+type: Concept
+title: Ops Notification Channels
+description: How platform alerts are routed to named channels instead of three fixed provider slots — the shared NotificationChannel model on both the tenant and platform side, one NotificationChannelDispatcher that routes each channel to its transport, the legacy-slot synthesis that keeps pre-migration dispatch behaviour identical, the empty-means-all rule binding, why Telegram is Global-Admin-only by construction, and why an ops event's structured payload only reaches a destination when a rule opts in.
+resource: /src/Backend/AutopilotMonitor.Functions/Services/OpsAlertDispatchService.cs
+tags:
+  - backend
+  - notifications
+  - ops-events
+  - configuration
+  - security
+timestamp: 2026-09-01T00:00:00+02:00
+---
+
+# Problem
+
+Platform (ops) alerting had no routing. An `OpsAlertRule` was
+`{ EventType, MinSeverity, Enabled }` with no destination, and `OpsAlertDispatchService`
+broadcast every matching rule to all three hard-wired slots in `AdminConfiguration`
+(`OpsAlertTelegramChatId`, `OpsAlertTeamsWebhookUrl`, `OpsAlertSlackWebhookUrl`). Three
+consequences followed:
+
+1. **No per-event destinations.** Binding a conversion signal to a sales channel meant every
+   other rule reached that channel too.
+2. **Only the first matching rule was evaluated** (`FirstOrDefault`), so two rules on the same
+   event type could not coexist.
+3. **The payload never left the backend.** `OpsEventService.WriteAsync` serialized a `details`
+   object into the `OpsEvents` table but passed only `(category, eventType, severity, message,
+   tenantId)` to the dispatch — a receiving system saw a tenant GUID and a sentence.
+
+The tenant side already had the right model: `NotificationChannel` (a named list in
+`TenantConfiguration.NotificationChannelsJson`) with analyze rules binding channels by id
+(`RuleState.NotifyChannelIdsJson`). The platform side needed that model, not a second one.
+
+# Schema
+
+## One model, two scopes
+
+`NotificationChannel` is unchanged and now backs both lists:
+
+| Scope | Storage | Bound by |
+| --- | --- | --- |
+| Tenant | `TenantConfiguration.NotificationChannelsJson` | per-channel `NotifyOn*` toggles + analyze rules (`NotifyChannelIdsJson`) |
+| Platform | `AdminConfiguration.OpsNotificationChannelsJson` | `OpsAlertRule.NotifyChannelIds` |
+
+The scopes stay separate on purpose — platform events resolve against platform channels, and a
+tenant's channel list can never receive an ops alert. What is shared is the *model* and the
+*dispatch path*, so a new provider is added once.
+
+## One dispatch path
+
+`NotificationChannelDispatcher` is the channel-level send API. It routes by provider:
+`WebhookProviderType.Telegram` goes to `TelegramNotificationService`; everything else is a
+rendered webhook POST through `WebhookNotificationService`. Every caller that sends to
+configured channels — enrollment (`EventIngestProcessor`), session start
+(`RegisterSessionFunction`), hardware rejection (`ReportDistressFunction`), SLA
+(`SlaBreachEvaluationService`), analyze rules (`AnalyzeOnEnrollmentEndHandler`), ops alerts
+(`OpsAlertDispatchService`) and both test endpoints — goes through it.
+
+## Telegram is Global-Admin-only by construction
+
+Telegram (`WebhookProviderType.Telegram = 40`) is the odd provider: it is not a webhook. The
+channel's `Url` carries the destination **chat ID**, and the bot token is platform-owned
+(PreviewConfig `WebhookUrl`). A tenant admin configuring one would be sending through *our*
+bot, which is why the gate is a server-side rule, not a hidden dropdown option:
+
+* `TenantConfigValidation.ValidateTelegramChannelGate` refuses a non-GA caller who **adds** a
+  Telegram channel or changes an existing one's destination or enabled state. It lives in
+  `ValidateModel`, so it covers both write paths — the full-model PUT *and* the MCP field-patch
+  flow (`TenantConfigPatchService`). A check placed in `UpdateTenantConfigurationFunction` alone
+  would not.
+* An **unchanged** GA-created channel passes, so a tenant admin can still save unrelated config.
+* Telegram destinations skip `SsrfGuard.ValidateWebhookUrlFormat` (a chat ID is not a URL and
+  would always fail it) and are format-checked as a numeric id or `@username` instead.
+
+## Migration without a data job
+
+`AdminConfiguration.GetOpsNotificationChannels()` returns the stored list, or — when it is empty —
+synthesizes one channel per *configured* legacy slot with stable ids (`legacy-telegram`,
+`legacy-teams`, `legacy-slack`) and the legacy enabled flags. `GetAdminConfigurationFunction`
+projects the same synthesis into the read model, so the editor shows exactly what receives
+alerts today and the first save materializes it. The legacy fields stay as the migration source
+and are no longer written by the Alerts section.
+
+## Rule binding: empty means all
+
+`OpsAlertRule.NotifyChannelIds` null or empty = every enabled channel. That is what every rule
+written before routing existed carries, so behaviour on the deploy day is identical. Dispatch
+resolves **all** matching rules (`Where`, not `FirstOrDefault`) and unions their channels;
+ids that no longer resolve are dropped rather than falling back to broadcast — a rule whose only
+channel was deleted must reach nothing, not everything. The web editor mirrors the same rule in
+`app/admin/components/opsChannelRouting.ts`.
+
+## Payload delivery is opt-in per rule
+
+`WriteAsync` hands the serialized `details` to `DispatchAsync`, but a channel only receives it when
+a rule sets `OpsAlertRule.IncludePayload`. **Default false**: an ops alert is a "something happened,
+go look" signal, most payloads are operational noise in a chat, and some carry data the baseline
+never does (tenant domain, administrator contact address). Widening what leaves the platform stays
+a deliberate per-rule decision.
+
+`ResolveTargets` therefore returns two groups. Channels reached only by plain rules get an alert
+built with `detailsJson: null`; channels reached by an opted-in rule get the enriched one. A channel
+in both groups appears in the payload group only — one message per channel, and an unrelated
+sibling rule cannot cancel an explicit opt-in.
+
+For the enriched alert, `BuildAlert`:
+
+* flattens top-level **scalars** into `NotificationFact`s — capped at 12 facts and 256 characters,
+  nulls and nested values skipped — so card formats and the plain-text Telegram message carry the
+  same information,
+* passes the raw JSON through `NotificationAlert.DataJson`, which only `GenericJsonRenderer`
+  emits, as a real JSON object under `data`. Additive within `schemaVersion` 1.0.
+
+`NotificationAlert.EventType` is set either way: it is the same value the `Event` fact already
+carries, so it adds no information — only a stable key for a generic consumer to branch on.
+
+# Examples
+
+A trial-conversion signal reaching only a sales webhook:
+
+1. Admin → Alerts → add a channel `Sales` (Generic JSON, the internal endpoint).
+2. Enable the `TenantTrialStarted` rule at `Info`, select **only** `Sales`, and switch its
+   **Payload** toggle on (off by default, so every other rule keeps the baseline alert).
+3. `PlanManagementFunction` fires `TenantTrialStarted` from both plan write paths — the
+   self-service `POST config/{tenantId}/trial` and a GA grant via `PATCH config/{tenantId}/plan`
+   (distinguished by `selfService`). Ending a trial is a downgrade and stays with
+   `TenantPlanDowngraded`.
+4. The webhook receives `eventType`, the rendered facts, and `data` with `domainName`,
+   `contactEmail`, `trialStartedUtc`, `trialExpiresUtc`, `grantedBy`, `selfService`. The operator
+   push channel receives nothing, because it is not bound to that rule.
+
+# Gotchas
+
+* **A new ops event type must be dual-registered** in `OPS_EVENT_TYPES`
+  (`app/admin/components/OpsAlertRulesSection.tsx`) or it cannot be selected. `OpsEventTypeDualRegisterTests`
+  enforces it.
+* **`OpsNotificationChannelsJson` is secret-bearing** and is on the deny-list in
+  `AdminConfiguration.RedactedCopyForReader()`. `NotificationChannel.RedactList` /
+  `RestoreRedactedList` are shared with the tenant list — do not add a second copy.
+* **Details are capped at 4096 characters** in the `OpsEvents` table (`TableOpsEventRepository`)
+  before they ever reach a channel.
+
+# Citations
+
+* `/src/Backend/AutopilotMonitor.Functions/Services/OpsAlertDispatchService.cs`
+* `/src/Backend/AutopilotMonitor.Functions/Services/Notifications/NotificationChannelDispatcher.cs`
+* `/src/Shared/AutopilotMonitor.Shared/Models/Notifications/NotificationChannel.cs`
+* `/src/Shared/AutopilotMonitor.Shared/Models/Config/AdminConfiguration.cs`
+* `/src/Backend/AutopilotMonitor.Functions/Helpers/TenantConfigValidation.cs`
+* `/src/Backend/AutopilotMonitor.Functions/Functions/Config/PlanManagementFunction.cs`
@@ -1,14 +1,14 @@
 ---
 type: Concept
-title: Drift Guards — SignalR Names, RowKeys, Config Sections, Scoped Routing
-description: The 2026-08 fragility-audit follow-up contracts that turn formerly hand-synchronized mirrors into enforced ones — SignalR message-name catalog, the inverted-tick RowKey codec, tombstone table tagging, the OkAsync ratchet, per-section config PATCH, and the web's scoped-endpoint builders.
-resource: /src/Backend/AutopilotMonitor.Functions.Tests/OkAsyncBaselineGuardTests.cs
+title: Drift Guards — SignalR Names, RowKeys, Wire DTOs, Tool Vocabularies, Config Sections, Scoped Routing
+description: The 2026-08 fragility-audit follow-up contracts that turn formerly hand-synchronized mirrors into enforced ones — SignalR message-name catalog, the inverted-tick RowKey codec, tombstone table tagging, typed wire DTOs with generated TypeScript interfaces, the MCP's generated tool vocabularies with their inline-enum ratchet, per-section config PATCH, and the web's scoped-endpoint builders.
+resource: /src/Backend/AutopilotMonitor.Functions.Tests/TypedResponseGuardTests.cs
 tags:
  - contracts
  - guard-tests
  - signalr
  - web
-timestamp: 2026-08-13T00:00:00+02:00
+timestamp: 2026-08-31T00:00:00+02:00
 ---

 # Drift Guards
@@ -49,13 +49,94 @@ restore + dry-run); the historical `Contains('_')` RowKey-shape heuristic surviv
 solely as the fallback for manifests written before the field existed and must outlive
 one full manifest-retention cycle.

-## Anonymous OkAsync responses — frozen, shrink-only
+## Wire DTOs — generated interfaces, zero anonymous success bodies

-`OkAsyncBaselineGuardTests` freezes the 44 existing `req.OkAsync(new { … })` call
-sites as a per-file baseline. A new anonymous response (new file or count above
-baseline) fails; converting a site to a typed DTO (Shared response models, picked up
-by the manifest parity tests) fails too until its baseline entry is lowered — the debt
-list stays truthful and only ever shrinks.
+Every HTTP success body is a flat class in `AutopilotMonitor.Shared.Models`
+implementing the `IApiResponse` marker (2026-08-31, `feat/typed-api-contract` —
+migrated from the 44 `OkAsync(new { … })` + 134 raw `WriteAsJsonAsync(new { … })`
+sites the 2026-08-13 audit froze). Three layers enforce it:
+
+- **Compile time**: the only `OkAsync/CreatedAsync/JsonAsync` overloads constrain on
+  `IApiResponse` — an anonymous object cannot satisfy the constraint. Error bodies
+  (first key `error`/`message`, or literal `success = false`) stay anonymous by design.
+- **`TypedResponseGuardTests`** (successor of `OkAsyncBaselineGuardTests`): both
+  per-file baselines are EMPTY — any anonymous success body, through the helpers or
+  raw `WriteAsJsonAsync`, is a straight failure. A reflection fact keeps every
+  `IApiResponse` implementer flat (System.Text.Json serializes derived properties
+  before base ones — key order is wire contract; MCP hands raw JSON to an LLM) and
+  inside the Shared assembly.
+- **`*WireParityTests`**: each migrated site carries an ordinal old-anonymous-literal
+  vs. new-DTO serialization proof (production `ApiJsonOptions`), including a null case
+  per key that WhenWritingNull omits.
+- **Object-slot ratchet** (2026-08-31 typisierung follow-up): a reflection walk over
+  the reachable wire-type graph fails on any `object` / collection-of-`object`
+  property outside `ObjectSlotBaseline` (sole entry: `RuleDryRunCondition.Evidence`,
+  heterogeneous by design). `[ProjectedItems]` slots and dictionary VALUES are exempt.
+  The former deliberately-untyped slots (RuleDryRun trace, HealthCheck,
+  GlobalNotificationDto, TenantConfigFieldSchema, maintenance run reports,
+  MetricsSummary items, auth/me, auth/mcp) are concrete Shared types now. The raw
+  table entities left the wire entirely in the same pass: global-admins,
+  tenant-admins and preview-whitelist serve flat rows (`GlobalAdminRow` /
+  `TenantAdminRow` / `PreviewWhitelistTenantEntry`) WITHOUT
+  partitionKey/rowKey/eTag/timestamp — a deliberate wire change pinned by exact-JSON
+  shape tests instead of parity facts.
+
+The DTO rules: declaration order == wire order; a property is nullable exactly when a
+site can emit null (the key then vanishes — never add non-null defaults that would
+invent a key); preformatted strings (`.ToString("o")`, enum `.ToString()`) stay
+`string`; `fields=` projections stay `IReadOnlyList<object>` tagged
+`[ProjectedItems(typeof(Item))]`; raw table rows stay verbatim-keyed dictionaries
+(no `DictionaryKeyPolicy` — dictionary KEYS never run through the camelCase policy,
+and dictionary VALUES keep explicit nulls, both pinned by tests).
+
+`SharedManifestParityTests` (schemaVersion 2) reflects the full graph — every
+`IApiResponse` implementer plus `[WireContract]`-marked payload types, transitively
+closed by `WireTypeManifestBuilder` — into the `types` section of
+`shared-manifests.json`, carrying C# `<summary>` texts. The web codegen
+(`npm run generate:manifests`) emits `utils/wire-types.generated.ts` (one interface
+per object, one string union per enum, JSDoc from the summaries); the hand-written
+`types/session.ts` / `types/enrollment.ts` / `types/adminConfig.ts` re-export from
+it. Freshness is pinned by the vitest suite and the `shared-manifests-in-sync` CI
+job. Unmappable shapes (non-string dictionary keys, foreign BCL classes) fail the
+manifest build instead of degrading to `unknown`.
+
+## Tool vocabularies — the MCP derives them, it no longer retypes them
+
+Wire TYPES reached the MCP from day one (`src/generated/wire-types.generated.ts`, the
+same codegen output the web gets). Vocabularies did not: types are erased at runtime and
+a `z.enum([...])` needs values, so every MCP tool schema hand-typed its own copy of
+statuses, severities and categories — with nothing to compare against. The copies drifted
+exactly as you would expect: `search_sessions` offered 5 of 8 session statuses (no
+`AwaitingUser`, no `Incomplete`), both event readers offered 4 of 6 severities (no `Debug`,
+no `Trace`), and `get_ops_events` named 6 ops categories while the backend wrote 7. None of
+that surfaces as an error — the tool just quietly cannot ask for the missing value.
+
+The vocabularies now ship as VALUES. `MCP_VOCABULARIES` in the codegen maps manifest
+sections onto `src/generated/wire-vocabularies.generated.ts` (`export const
+SESSION_STATUSES = [...] as const` plus its union type); the tool schemas do
+`z.enum(SESSION_STATUSES)` and descriptions interpolate the list instead of spelling it.
+Freshness is pinned twice: `wire-types-freshness.test.ts` compares the committed file
+byte-for-byte against a fresh codegen run, and the `shared-manifests-in-sync` CI job
+diffs it after regenerating.
+
+`vocabulary-drift.guard.test.ts` is the ratchet that keeps it that way: every inline
+`z.enum([...])` left in `src/tools/*.ts` must be on a baseline that names why it has no
+backend owner (MCP-local knobs like `depth: fast|deep`, plus three free-string columns —
+rule type, connection type, CVE risk — that have no C# constants class yet). A new
+hand-typed list fails until it is derived or reviewed onto the baseline, and a stale
+baseline entry fails too.
+
+Ops event types got the missing owner: they were bare literals at the `OpsEventService`
+call sites, so nothing could enumerate them and both the portal alert-rule catalog and the
+MCP had to retype the list. `OpsEventTypes` (Shared) now declares all 77; the write sites
+use the constants (a raw literal fails `OpsEventTypeDualRegisterTests`), the manifest
+exports them, and `get_resource(name="ops_event_types")` serves categories + severities +
+types to the model from the generated copy.
+
+Backend-internal lists follow the same rule: a list that enumerates a constants class IS
+the class. `TableOpsEventRepository.AllCategories` is `OpsEventCategory.All` rather than a
+retyped copy — the copy had gone stale and silently hid every `Platform` (Azure Monitor)
+event from the paged cross-category read while the unpaged path still showed it.

 ## Tenant settings — per-section PATCH

@@ -98,9 +179,14 @@ list in `sectionFieldMap.test.ts`.
 # Citations

 - `src/Shared/AutopilotMonitor.Shared/Constants.cs` — SignalRMessages catalog
+- `src/Web/autopilot-monitor-web/scripts/generate-shared-manifest-types.js` — `MCP_VOCABULARIES`, the vocabulary codegen
+- `src/McpServer/autopilot-monitor-mcp/src/__tests__/vocabulary-drift.guard.test.ts` — the inline-enum ratchet
+- `src/Shared/AutopilotMonitor.Shared/DataAccess/OpsEventTypes.cs` + `OpsEventTypeDualRegisterTests.cs`
 - `src/Backend/AutopilotMonitor.Functions/Helpers/RowKeyCodec.cs` + `RowKeyCodecTests.cs`
 - `src/Shared/AutopilotMonitor.Shared/Models/Deletion/DeletionManifest.cs` — `DeletionRowDump.Table`, `DeletionTombstoneTables`
- `src/Backend/AutopilotMonitor.Functions.Tests/OkAsyncBaselineGuardTests.cs`
+- `src/Backend/AutopilotMonitor.Functions.Tests/TypedResponseGuardTests.cs` + `WireTypeManifestBuilder.cs` + the `*WireParityTests` files
+- `src/Shared/AutopilotMonitor.Shared/Models/CommonApiModels.cs` — `IApiResponse`, `[WireContract]`, `[ProjectedItems]`
+- `src/Web/autopilot-monitor-web/utils/wire-types.generated.ts` (via `scripts/generate-shared-manifest-types.js`)
 - `src/Web/autopilot-monitor-web/app/settings/sectionFieldMap.ts` + `__tests__/sectionFieldMap.test.ts`
 - `src/Web/autopilot-monitor-web/lib/scopedApi.ts`, `lib/navVisibility.ts`, `hooks/concreteAdminScopeView.ts`
 - [Version Contract](versioning.md) — the web `/version.json` stamp + deploy verify added in the same round
@@ -15,7 +15,7 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Version Contract](versioning.md) - One version shape for agent, backend and MCP: the ETag-CAS counter blob that mints build numbers, and the manifests published only after a deploy is verified live.
 * [Customer Script Publishing](script-publishing.md) - How the customer-facing PowerShell scripts reach download.autopilotmonitor.com/agent/, why publishing is decoupled from agent releases, and the guards keeping the published copy, the version badge and the portal's version oracle in agreement.
 * [URL Registry](url-registry.md) - Every well-known host lives in one registry file per component (Constants.cs / utils/config.ts / src/config.ts), enforced by guard tests; includes the agent-download migration to the download alias and its deploy-order constraint.
-* [Drift Guards](drift-guards.md) - The 2026-08 fragility-audit follow-up contracts: SignalR message-name catalog (typed on both ends), the inverted-tick RowKey codec, tombstone table tagging, the shrink-only OkAsync baseline, per-section config PATCH with the section field map, and the web's scoped-endpoint builders + sidebar visibility matrix.
+* [Drift Guards](drift-guards.md) - The 2026-08 fragility-audit follow-up contracts: SignalR message-name catalog (typed on both ends), the inverted-tick RowKey codec, tombstone table tagging, typed wire DTOs (IApiResponse + generated wire-types.generated.ts, empty anonymous-body baselines), the MCP's generated tool vocabularies (wire-vocabularies.generated.ts + the inline-z.enum ratchet), per-section config PATCH with the section field map, and the web's scoped-endpoint builders + sidebar visibility matrix.

 # Agent

@@ -29,8 +29,11 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Secure Boot CA-2023 Detection](agent/secureboot-ca2023-detection.md) - Why ANALYZE-SEC-001 v3 reads the UEFI db/KEK variables directly instead of trusting the SecureBoot\Servicing registry, and how the one-sided uefiCa2023FirmwareConfirmed marker plus a not_exists precondition give absence-tolerant suppression across old and new agents.
 * [Continue-Anyway Observation Mode](agent/continue-anyway-observation.md) - EnableEspContinueAnywayObservation (ConfigVersion 37, operator-set): Device-phase ESP terminal failures on Continue-Anyway profiles get a bounded 60-min observation instead of an immediate hard fail; the DAD-validated real-user desktop + Hello gate detect the true end, the session completes Succeeded + EspSoftFailure (amber "with issues" badge), expiry un-defangs to the original esp_terminal_failure.
 * [CMTrace Time Resolution](agent/cmtrace-time-resolution.md) - Converting bias-less CMTrace local times to UTC without trusting any process's timezone belief: per-line self-anchoring on the 15-minute offset grid for provably fresh lines, uniform marked reader-zone fallback for backlog, and the provenance vocabulary (bias / line-anchored / reader-zone-fallback) that keeps every event re-derivable; plus the linear-cost CMTrace line parser (first open / last parseable trailer, timeout-backed) and the agent multiline caps.
+* [IME Pattern Health — the pattern-drift loop](backend/ime-pattern-health.md) - How a Microsoft change to IME log wording becomes visible before it breaks timelines: tracker health counters in `agent_metrics_snapshot`, the one-shot `ime_tracker_degraded` Warning, the session-end `ime_pattern_hits` histogram folded into the global per-IME-version `ImePatternStats` table, the data-driven drift alarm (`ImePatternDriftSuspected`: an expected pattern — ≥80 % on the fleet baseline — matched in none of ≥25 sessions on a newer version), the Global Admin → Metrics → IME Pattern Health matrix and the `get_ime_pattern_health` MCP tool.
+* [IME Log Tracker — Anchored Patterns and the Bounded Read Loop](agent/ime-log-tracker-matching-budget.md) - The IME Logs folder is user-writable, so the SYSTEM tracker must stay linear on hostile input: every shipped pattern starts with `^` (a non-match is O(prefix)), no chained unbounded scans, a byte-bounded line reader (32 MB — real `Get policies` lines reach 5.6 MB) with exact bookmarks, a 2 s per-line matching budget, held-back unterminated tails, and one Warning per pass instead of silent Debug timeouts.
 * [Registry App-State Second Pillar](agent/registry-app-state-pillar.md) - IME's authoritative per-app state read straight from the registry (Win32Apps EnforcementStateMessage, EspTrackingWin32Apps, StatusServiceReports) via a snapshot-and-diff watcher; registry/log reconciliation doubles as the built-in IME log-pattern drift alarm.
 * [WDP Scenario Gates & Completion Backstop](agent/wdp-scenario-gates.md) - How the agent gates Autopilot/ESP-only machinery off on Windows Device Preparation sessions (deterministic ExecutionContext marker, fail-toward-Classic), which noise it suppresses (ZTD probe, esp_config unknown, ModernDeployment 100/417/418/1005, starved sweep), and the WDP completion model: High-confidence seed, desktop-based arm D, and the 30-min device_prep_completion backstop.
+* [IME Process Watcher — Identity Before Attach, Re-Arm After Exit](agent/ime-process-watcher.md) - `ime_process_exited` comes only from a process that runs in session 0 with its image under the IME install root (QueryFullProcessImageName, cross-bitness) — a process name is not an identity (CWE-807: a standard user can start a renamed binary during AccountSetup); the oldest trusted candidate wins, untrusted matches are logged once per PID and never attached, and a reported exit re-arms discovery so an IME restart and a later crash are both seen.
 * [Local Admin Analyzer](agent/local-admin-analyzer.md) - What local_admin_analysis asserts at enrollment start/end: every local account inventoried, disabled ones included (a /active:no backdoor is dormant at both scans), Administrators membership read from the SAM by well-known SID (NetLocalGroupGetMembers, WMI-independent), unexpected admin members scored +40, built-ins matched by well-known RID (localized Guest/Administrator never flagged), shutdown-time dynamic allowance never covers a local SAM account (CWE-807), junctions and $GUID folders are not profiles, non-local members (Entra role SIDs) listed but never flagged, built-in Administrator enabled-state reported but not scored.
 * [Power-State Watcher](agent/power-state-watcher.md) - Live AC↔battery transitions and 50/30/15% downward battery-threshold crossings during enrollment via a WMI Win32_PowerManagementEvent push subscription (zero polling, never armed on battery-less devices): the power_state_change event (transition field, per-level lifetime latch, 5s debounce, emission cap) and the analyze rules ANALYZE-DEV-009 (battery <15%, high) / ANALYZE-DEV-010 (AC→battery, warning) with on_event interim triggers.
 * [System Timeline Watcher](agent/system-timeline-watcher.md) - Ground truth for two timeline blind spots from one System-channel EventLogWatcher with pre-agent backfill: system_clock_changed (Kernel-General 1 — oldTime/newTime/signed timeDeltaMs/reason/setting process; 2 s micro-slew floor, ≥5 min Warning+immediate) and system_sleep_episode (Power-Troubleshooter 1 sleep/hibernate + Kernel-Power 507 Modern Standby; authoritative enteredAt/exitedAt payload instants, 60 s Modern-Standby floor). Consumed by the TimeJumpBadge clock-set cause, the SessionInfoCard standby note, time-attribution SleepSpans (AttributionVersion 3) and ANALYZE-DEV-012.
@@ -51,6 +54,8 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Telemetry Ingest Shaping](backend/telemetry-ingest-shaping.md) - One canonical App Insights request record (worker copy with tenant context, per-item sampling bypass; host HTTP duplicate dropped by a workspace transformation DCR), expected storage outcomes 404/412/409 and successful SignalR REST calls filtered in the worker, and the count()/sum(itemCount) query rules that follow.
 * [Table Schema Sentinel](backend/table-schema-sentinel.md) - Startup no longer issues one CreateTableIfNotExists per table: a SHA-256 over TableNames.All in AdminConfiguration gates the full pass (derived, never hand-maintained), the SessionsIndex backfill runs only after a full pass behind a conditional-insert claim, and daily maintenance repairs out-of-band deletions.
 * [Business Timestamps](backend/business-timestamps.md) - Why the Azure Tables system Timestamp is never authoritative (migrations reset it), and the OccurredUtc + RowKey-decode compensation for AuditLogs/OpsEvents/Events after the 2026-07-18 migration.
+* [Ops-Events Query Surface](backend/ops-events-query-surface.md) - The server-side filter surface of the ops-events read (category, eventType, severity/minSeverity, in-memory tenant drill, RowKey date window), why every filter is folded into the continuation fingerprint, why minSeverity expands to an OR-set instead of a lexicographic range, and why the paged cross-category fan-out must cover the complete category vocabulary (Platform was missing).
+* [Ops Notification Channels](backend/ops-notification-channels.md) - Platform alerts route to NAMED channels instead of three fixed provider slots: the tenant-side NotificationChannel model now backs both scopes, one NotificationChannelDispatcher routes each channel to its transport (Telegram is not a webhook - chat id, platform-owned bot, Global-Admin-only enforced in ValidateModel so the MCP patch path is covered too), legacy slots are synthesized with stable ids so pre-migration dispatch is unchanged, a rule's empty channel binding means all, and an ops event's structured details reach the destination as facts plus a `data` object only when a rule opts in (IncludePayload, off by default, so the baseline alert is unchanged).
 * [Send-Time Frame Separation](backend/send-time-frame-separation.md) - One device-clock send timestamp per upload batch (X-Send-Time-Utc → SentAt on Events) splits ReceivedAt − OccurredUtc into pure spool delay and pure device-vs-server clock offset; the clock_skew condition measures SentAt batches directly (spool-immune), the CMTrace tripwire deliberately stays on its differential math.
 * [OOBE Bootstrap go-Code Flow](backend/oobe-bootstrap-go-flow.md) - The bootstrap short-code lifecycle (portal-created session → `irm go.autopilotmonitor.com/CODE | iex` at Shift+F10 → GetBootstrapScriptFunction), the always-HTTP-200 text/plain contract, the two-line injection defense (GUID/URL/expiry validator + single-quoted PS literals, golden-pinned against the legacy TS template), and the per-IP rate-limit story behind Front Door.
 * [Silent-Session Classification](backend/silent-session-classification.md) - How a session whose agent went silent gets its honest status: the two-stage maintenance sweep (2h Stalled marker with the WhiteGlove Part-2 AwaitingUser gate and the self-deploying Succeeded gate, 5h timeout classification), the EnrollmentTimeoutClassifier rule order (explicit failure → WG Part 2 → self-deploying → completion evidence → emergency break → desktop+Hello → Device Setup/grace), the ingest paths sharing it (max-lifetime, late-telemetry heal, stall probe) and the admin retro-reconcile modes incl. self_deploying_silent.
@@ -84,7 +89,7 @@ https://docs.autopilotmonitor.com (separate repository).
 * [Vulnerability Correlation Sources](backend/vulnerability-correlation-sources.md) - How the software inventory becomes CVE findings from four cached primaries (NVD per-CPE cache with budget and TTLs, CISA KEV, MSRC, FIRST EPSS stored on the cached CVE and re-scored nightly), the NVD throttle contract (a refused answer is never cached as "0 CVEs"; bounded process-wide cooldown honouring Retry-After), the persisted CVSS vector, and the act/attend/track priority that keeps severity and likelihood as two visible signals instead of one composite score.
 * [Client-Certificate Tenant Binding](backend/client-cert-tenant-binding.md) - Why a chain-valid Intune MDM certificate only proves "issued to some tenant", which extension actually carries the Entra tenant id (`…5.14`) versus the two that look like it (`…5.6` Intune Account id, `…5.4` device id, different encodings), why the Entra join certificate is not part of the auth path, the shadow-then-enforce rollout with its volume-controlled telemetry, and why `X-ARR-ClientCert` is the only certificate transport (TLS handshake = proof of possession; bootstrap routes token-only, fail-closed).
 * [Admin Identity Binding](backend/admin-identity-binding.md) - Why a GlobalAdmins / DelegatedAdmins row keyed on a UPN string must never confer access by itself in an API that accepts tokens from every Entra tenant (domain re-registration, UPN recycling), the AdminIdentityBindings table pinning each cross-tenant-role UPN to its immutable home tid + oid, the fail-closed resolution order in both role services (row → binding → entitlement), the first-sign-in object-id pin with its race semantics, the 409 on grant-time conflicts, and the explicit GET/PUT/DELETE rebind surface.
-* [IME Installer Archive](backend/ime-msi-archive.md) - How every fleet-observed IME build is archived as its MSI: the ime_agent_version sighting that queues the job (first sighting, or a later sighting with a version-authoritative CSP URL after a 24 h backoff), the primary/secondary/hotfix candidate walk, the managed MSI ProductVersion check that keeps another ring's build out of the version folder (Failed:VersionMismatch), provenance with the full candidate walk, and the skill-side overwrite path for corrections.
+* [IME Installer Archive](backend/ime-msi-archive.md) - How every fleet-observed IME build is archived as its MSI: the ime_agent_version sighting that queues the job (first sighting, or a later sighting with a version-authoritative CSP URL after a 24 h backoff), the primary/secondary/hotfix candidate walk, the managed MSI ProductVersion check that keeps another ring's build out of the version folder (Failed:VersionMismatch), provenance with the full candidate walk, the skill-side overwrite path for corrections, and the trust boundary of a device-reported version (plausibility guard, one sighting per session, second-tenant corroboration, fleet-confirmed tenant view).

 # Conventions for this bundle

@@ -1,5 +1,81 @@
 # Log

+## 2026-09-01 (3)
+
+* **Update**: `agent/decision-engine.md` - agent_metrics_snapshot gains a signal-pipeline health block: monotonic SignalIngress totals (last ordinal, processed, pending, reentrant, queue peak) + decision_stage / decision_last_applied_ordinal / wg_sealing_level+score from the immutable DecisionState, wired via a read-only decisionStateProbe through IComponentFactory. Motivated by the WG-seal soak (project_wg_seal_postfix_soak_residual): a frozen engine and a deliberate Weak sealing verdict were previously indistinguishable in telemetry.
+
+## 2026-09-01 (4)
+
+* **Update**: `drift-guards.md` — MCP tool vocabularies are generated, not retyped. The codegen now emits `wire-vocabularies.generated.ts` (VALUES: session statuses, event severities, ops categories/severities/types, annotation lanes/verdicts) alongside the MCP's wire types, byte-pinned by the MCP freshness suite and the `shared-manifests-in-sync` CI job; the tool schemas derive their `z.enum()` from it. Found by the switch: `search_sessions` had offered 5 of 8 session statuses (no `AwaitingUser`/`Incomplete`) and both event readers 4 of 6 severities (no `Debug`/`Trace`). `vocabulary-drift.guard.test.ts` ratchets the remaining inline enums against a reasoned baseline. New `OpsEventTypes` (Shared) gives the 77 ops event types a canonical home — `OpsEventService` write sites use the constants (a raw literal now fails the dual-register test), and `get_resource(name="ops_event_types")` serves the vocabulary to the model.
+
+## 2026-09-01 (3)
+
+* **New**: `backend/ops-notification-channels.md` - platform alerting gains named channels. `AdminConfiguration.OpsNotificationChannelsJson` reuses the tenant `NotificationChannel` model (redaction/restore helpers hoisted onto the model so both scopes share one implementation); `OpsAlertRule.NotifyChannelIds` binds rules to channels with empty = all, and dispatch now evaluates ALL matching rules (`Where`, not `FirstOrDefault`) and unions their targets, dropping ids that no longer resolve instead of falling back to broadcast. New `NotificationChannelDispatcher` is the single channel-level send API for every caller (enrollment, session start, hardware rejection, SLA, analyze rules, ops alerts, both test endpoints). New provider `WebhookProviderType.Telegram = 40` carries a chat id rather than a URL and sends through the platform-owned bot - Global-Admin-only, enforced in `TenantConfigValidation.ValidateModel` so the MCP field-patch path is gated too, not just the PUT. Legacy provider slots are synthesized into channels with stable ids (`legacy-telegram` named "Autopilot Monitor IT Engineer") and projected into the GET read model, so day-one behaviour is unchanged and the first save materializes the list. New ops event `TenantTrialStarted` fires from both plan write paths, and `OpsEventService.WriteAsync` hands the serialized details to the dispatch - but delivery is opt-in per rule (`OpsAlertRule.IncludePayload`, default false), so every existing alert keeps its category/event/severity/tenant baseline and the trust-page description of operator alerting stays accurate. `ResolveTargets` splits targets into a payload group and a plain group (a channel in both gets the payload once); for the enriched alert `BuildAlert` flattens top-level scalars into facts (12 / 256 chars) and passes the raw object to `GenericJsonRenderer` as `data` (additive, schemaVersion stays 1.0). `eventType` is set either way - same value the `Event` fact already carried.
+
+## 2026-09-01 (2)
+
+* **New**: `backend/ops-events-query-surface.md` - the ops-events read gains server-side `eventType` / `severity` / `minSeverity` filters (audit-log filter pattern: one parse helper, one clause appender used by both filter builders, values folded into the continuation fingerprint and echoed on nextLink). `minSeverity` expands to an OR-set because the severity names sort `Critical < Error < Info < Warning` lexicographically; the ladder is now shared with `OpsAlertDispatchService`. Fixed alongside: the paged cross-category fan-out skipped `Platform` (Azure Monitor alerts) because its category list had drifted from `OpsEventCategory` - the list is now `OpsEventCategory.All` with a reflection coverage test. MCP `get_ops_events` exposes the filters plus a client-resolved `days` shorthand.
+
+## 2026-09-01 (1)
+
+* **Update**: `agent/cmtrace-time-resolution.md` — the backend skew tripwire now judges only the session's most recent ingest era (batch stamps walked back from the newest, split at the first `ReceivedAt` gap > 2 h). Pre-provisioning partitions hold a Part 1 leg written weeks earlier by an older agent build: on 2026-09-01 three sessions of one tenant fired on 26 IME samples at −60 min left by agent 2.0.1409 on 2026-08-20 (pre per-line anchoring), against a device already self-updated to 2.0.1445. `SessionSkewScan` carries `ReceivedAt` per sample (distinct-batch counts derive from the era-filtered set; the cap keeps the newest samples), and the ops event reports `eraStartUtc` plus the excluded per-side counts.
+
+## 2026-08-31 (2)
+
+* **Update**: `drift-guards.md` — typisierung follow-up: the deliberately-untyped remainder (RuleDryRun trace, HealthCheck, GlobalNotificationDto, TenantConfigFieldSchema, maintenance run reports, MetricsSummary items, auth/me, auth/mcp) is typed end-to-end; a new object-slot reflection ratchet in `TypedResponseGuardTests` closes the class (baseline: `RuleDryRunCondition.Evidence` only). Deliberate wire change: global-admins / tenant-admins / preview-whitelist rows are flat read models (`GlobalAdminRow` / `TenantAdminRow` / `PreviewWhitelistTenantEntry`) without partitionKey/rowKey/eTag/timestamp, pinned by exact-JSON shape tests.
+
+## 2026-08-31 (1)
+
+* **Update**: `drift-guards.md` — the shrink-only OkAsync baseline became the typed API contract (`feat/typed-api-contract`): all 175 anonymous success bodies (44 helper + 134 raw minus overlaps already typed) are flat `IApiResponse` DTOs in Shared, both `TypedResponseGuardTests` baselines are empty regression guards, the untyped `OkAsync/CreatedAsync(object)` overloads are gone, and every migrated site carries an ordinal wire-parity proof. `SharedManifestParityTests` schemaVersion 2 exports the full type graph (208 types incl. `[WireContract]` extras) with C# `<summary>` JSDoc into `utils/wire-types.generated.ts`; web hand-types re-export from it; freshness pinned by vitest + the new `shared-manifests-in-sync` CI job.
+
+## 2026-08-30 (15)
+
+* **Update**: `backend/lifecycle-manifests-and-session-scope.md` — SessionTenantLookup is now claimed first-writer-wins at registration (create-only Add BEFORE any session write; foreign owner ⇒ 409 `session_owner_mismatch` + `SessionTenantConflict` ops event, nothing written; not fail-soft). Closes the poisoning path where any tenant's device could re-point a victim sessionId's mapping at its own tenant and hijack every no-tenantId Global Admin/Reader read and GA write (annotation lane). `ResolveSessionScopeAsync(requireGlobalAdmin: true)` corroborates the resolved tenant against its Sessions row (silent — no operator confirmation). Self-heal write is Add-only; `scripts/Migration/Backfill-SessionTenantLookup.ps1` closes the legacy window once. No tombstone on deletion (deliberate: unbounded growth for no gain).
+
+## 2026-08-30 (14)
+
+* **Update**: `agent/decision-engine.md` — new invariant: every payload-derived string stored into `DecisionState` is bounded to 256 chars by `FactStringBounds` before any dedupe comparison (RealmJoin package id/version/scope, failed app ids, `HelloOutcome`, `ImeMatchedPatternId`, `EspAdvisoryFailureCategory`, RJ product version/channel). Backend `ReducerVerifier` now replays decode-fold-discard instead of materialising all decoded signals, and `ISignalRepository.QueryBySessionAsync` carries a cumulative `PayloadJson` budget (`SignalQueryLimits`, 32 M chars) reflected in the `truncated` flag of `sessions/{id}/signals` and `sessions/{id}/reducer-verification`.
+
+## 2026-08-30 (13)
+
+* **Update**: `agent/decision-engine.md` — RealmJoin self-update observation. `realmjoin_detected` reported the MSI-shipped build (4.21.4) although the tray auto-updated to 4.21.18 nine minutes later and ran the whole deployment on it (gktatooine session 946ccbd6). `RealmJoinWatcher` now watches `HKLM\...\Uninstall\RealmJoin` (the updater's only registry write) after detection, re-reads the binary version on change and emits `realmjoin_autoupdate_detected` (`previousVersion`, `newVersion`, `releaseChannel`); the typed `RealmJoinAutoUpdateDetected` signal overrides `RealmJoinFacts.ProductVersion`/`ReleaseChannel` and nothing else. Portal device card shows the updated version with an "auto-updated from" note.
+
+## 2026-08-30 (12)
+
+* **Update**: `web/portal-navigation-prefetch.md` — hosting citation now points at `deploy-web.yml`: the portal is built in CI (setup-node 22, `npm ci`, `next build`) and uploaded with the pinned SWA CLI; the Azure/static-web-apps-deploy action, its Oryx in-container build and the per-PR preview environments are gone. All non-GitHub-owned actions are SHA-pinned; the release and rules auto-commit steps use first-party `gh`/`git`.
+
+## 2026-08-30 (11)
+
+* **New**: `agent/ime-process-watcher.md` — `ImeProcessWatcher` no longer attaches to the first `IntuneManagementExtension` name match: `ImeProcessIdentity` requires session 0 + image under the IME install root (`QueryFullProcessImageName`, cross-bitness), prefers the oldest trusted candidate, logs untrusted matches once per PID, and re-arms discovery after every reported exit (previously one-shot — a fake in a user session could forge `ime_process_exited` and mute the real signal for the session; even an IME service restart was never watched again). Registered in `index.md`.
+
+## 2026-08-30 (10)
+
+* **Update**: `agent/ime-log-tracker-matching-budget.md` — the per-line budget sums only `Regex.Match` time; the previous wall-clock window also counted match handlers and scheduler stalls and broke twice on genuine lines of a stalled Hyper-V guest (session 946ccbd6). `backend/ime-pattern-health.md` — `ime_pattern_hits` is Debug severity (operator signal, hidden from the default timeline; the IME Tracker card and the ingest fold read it regardless). The session page's "IME Tracker" card moved to the right column.
+
+## 2026-08-30 (9)
+
+* **New**: `backend/ime-pattern-health.md` — the pattern-drift loop: `ImeTrackerHealth` counters + per-pattern histogram in the agent (restart-safe via `ImeTrackerState`), `ime_*` keys in `agent_metrics_snapshot`, one-shot `ime_tracker_degraded` Warning, session-end `ime_pattern_hits` (every enabled pattern, zeros included, `imeVersion`), backend `ImePatternStats` (PK = IME version, batch upsert, permanent), `ImePatternDriftEvaluator` (baseline = biggest version ≥100 sessions, expected = ≥0.8 hit rate, drift = 0 hits in ≥25 sessions, once per cell) → `ImePatternDriftSuspected` ops event, `GET metrics/ime-pattern-health` (GlobalReadOrAdmin), web section `admin/metrics/ime-pattern-health` + session-page "IME Tracker" rows, MCP `get_ime_pattern_health`. Registered in `index.md`.
+
+## 2026-08-30 (8)
+
+* **Update**: `agent/ime-log-tracker-matching-budget.md` — pattern-pack hygiene against the IME decompiles (1.97.107.0 / 1.104.102.0 / 1.105.103.0, spot checks 1.50 / 1.83): no wording drift in any shipped pattern; the 11 disabled legacy patterns (IME-DETECTED-OLD, IME-SET-CURRENT-1/2/3, IME-SKIP-APPLICABILITY-NOTMET, IME-SKIP-DEPENDENCY-DETECT, IME-SKIP-DETECTED, IME-SKIP-UNINSTALL-NOTDETECTED-2, IME-UPDATE-NAME-1/2/3) are deleted — their literals last existed in IME 1.50, the fleet starts at 1.97; IME-DO-TIMEOUT-1/2 match the exact source literal (`DO downloading is not finished within timeout, jobId = …, fileId = …`) instead of two lookaheads; IME-DO-TEL is documented as dead from 1.104 on and kept only for the 1.101/1.103 fleet share.
+
+## 2026-08-30 (7)
+
+* **New**: `agent/ime-log-tracker-matching-budget.md` — the shipped IME pattern pack is anchored (`^` on all 90 patterns, `IME-APP-VERSION` without the chained `[^}]*?` scan) and the tracker's read loop is bounded: `BoundedLineReader` (32 MB per line, exact byte bookmarks), 2 s per-line matching budget, held-back unterminated EOF tails with a 1 s settle, one Warning per pass (`oversizedLines` / `regexTimeouts` / `lineBudgetBreaks`); the unanchored `PS-SCRIPT-CONTEXT` false positives on `[Win32App] SideCarScript…` lines are gone. `--run-ime-matching` assembles multiline entries like the tracker. Registered in `index.md`.
+
+## 2026-08-30 (6)
+
+* **Update**: `rules/rule-id-namespace.md` — guard 1 rewritten: gather RuleStats (tenant + `global_*` rows) are now resolved against the tenant's active gather catalog (`EventIngestProcessor.ResolveFiredGatherRules`), metadata catalog-sourced, unknown IDs dropped — same design as the analyze path; the `IsReservedBuiltInId` pattern gate on device-supplied IDs is gone.
+
+## 2026-08-30 (5)
+
+* **Update**: `backend/admin-identity-binding.md` — new "The MCP whitelist is a third UPN-keyed grant" section: `McpUsers` rows (grant, `UsagePlan` override and Disabled kill-switch) are honoured only for the identity the UPN is bound to (`McpUserService` row → `IsBoundAsync`, `GetBoundMcpUserAsync` for the quota plan); `POST global/mcp-users` binds first with the shared resolver / 422 / 409 contract; unbound legacy rows are inert.
+
+## 2026-08-30 (4)
+
+* **Update**: `backend/ime-msi-archive.md` — new "Trust boundary of a sighting" section: the device-supplied `ime_agent_version` string is gated by `ImeMsiArchiver.IsPlausibleVersion` (dotted digits within MSI ProductVersion bounds) before it can become a GLOBAL `ImeVersionHistory` RowKey (`ImeVersionSighting.Rejected` → no row/ops event/archive job); a session counts once (`UpdateSessionImeAgentVersionAsync` returns whether the version changed); a second tenant's sighting stamps `CorroboratedAt`; the MemberRead projection lists only fleet-confirmed versions (Archived, corroborated, or first seen before 2026-08-31), Global scope sees every row.
+
 ## 2026-08-30 (3)

 * **Update**: `agent/local-admin-analyzer.md` — built-ins matched by well-known RID (500/501/503/504) so localized Guest/Administrator are not flagged now that disabled accounts are inventoried; `kioskUser0` built-in; shutdown-time dynamic allowance restricted to non-SAM identities (a logged-in local account is never exempted — CWE-807) with new `logged_in_local_accounts` field; junctions and `$<32 hex>` folders skipped by the profile check.
@@ -31,7 +31,7 @@ Namespace split (`RuleIdPolicy.cs`, shared model):

 # Guards (all enforced, 2026-08-21)

-1. **Global RuleStats aggregate is catalog-only.** The `global_{ruleId}` row would otherwise sum same-ID custom rules of unrelated tenants (title/severity last-writer-wins). Analyze gates on `rule.IsBuiltIn || rule.IsCommunity` (`AnalyzeOnEnrollmentEndHandler`), gather gates on `RuleIdPolicy.IsReservedBuiltInId` (`EventIngestProcessor.RuleStats`) because agent events carry no flag — valid because custom rules can never occupy the reserved pattern.
+1. **Global RuleStats aggregate is catalog-only.** The `global_{ruleId}` row would otherwise sum same-ID custom rules of unrelated tenants (title/severity last-writer-wins). Both paths gate on the server-side catalog rule object: analyze on `rule.IsBuiltIn || rule.IsCommunity` of the evaluated rule (`AnalyzeOnEnrollmentEndHandler`), gather on the same flags of the rule resolved from the tenant's active gather catalog (`EventIngestProcessor.ResolveFiredGatherRules`). The agent event contributes only the `ruleId`; title/category/severity are taken from the catalog, never from event `Data`, and a claimed ID that is not an active rule for the tenant is dropped — so a device cannot mint `global_*` rows for retired/unshipped IDs, inflate a built-in rule's counters under a foreign ID, or respell its title. (Earlier the gather path selected the global row by `RuleIdPolicy.IsReservedBuiltInId` on the device-supplied ID and wrote the device-supplied title — pattern membership is not catalog membership.)
 2. **Catalog build fails on namespace violations.** `rules/scripts/combine.js` rejects duplicate IDs (case-insensitive) and any gather/analyze built-in outside the reserved pattern; `BuiltInRuleCatalogPolicyTests` pins the same invariants on the embedded resource actually deployed.
 3. **GitHub reseed rejects non-reserved IDs** before writing to the `global` partition (`ReseedFromGitHubFunction`) — a seeded `*-CUSTOM-*` rule would silently shadow every tenant's same-ID custom rule at merge time.
 4. **Cross-tenant RuleState GC is namespace-gated.** `DeleteRuleStatesForRuleIdAcrossTenantsAsync` deletes by bare RowKey across all partitions; it now refuses non-reserved IDs with `failed=-1` (callers then skip the global catalog delete, same contract as enumeration failure).
@@ -123,4 +123,4 @@ Application Insights resource — the prefetch is cheap only while the runtime i

 * `src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx` — nav link rendering, rationale comment
 * `src/Web/autopilot-monitor-web/components/Navbar.tsx` — top-bar and notification links
-* [SWA and Oryx node pinning](../architecture.md) — hosting model for the web app
+* `.github/workflows/deploy-web.yml` — hosting model: static export built in CI (Node 22 via setup-node, `engines` in package.json), uploaded with the pinned SWA CLI
@@ -4,7 +4,7 @@
    {
      "patternId": "HS-COMPLIANCE",
      "category": "always",
-      "pattern": "\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+      "pattern": "^\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
      "action": "healthScriptDetectionResult",
      "parameters": {
        "scriptType": "remediation"
@@ -15,7 +15,7 @@
    {
      "patternId": "HS-COMPLIANCE-POST",
      "category": "always",
-      "pattern": "\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+      "pattern": "^\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
      "action": "healthScriptDetectionResult",
      "parameters": {
        "scriptType": "remediation"
@@ -26,7 +26,7 @@
    {
      "patternId": "HS-EXITCODE",
      "category": "always",
-      "pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
+      "pattern": "^\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
      "action": "scriptExitCode",
      "parameters": {
        "scriptType": "remediation"
@@ -37,7 +37,7 @@
    {
      "patternId": "HS-NEW-RESULT",
      "category": "always",
-      "pattern": "\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
+      "pattern": "^\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
      "action": "healthScriptResult",
      "parameters": {
        "scriptType": "remediation"
@@ -48,7 +48,7 @@
    {
      "patternId": "HS-RUN-CONTEXT",
      "category": "always",
-      "pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
+      "pattern": "^\\[HS\\] The policy needs be run as (?<context>System|User)",
      "action": "scriptContext",
      "parameters": {
        "scriptType": "remediation"
@@ -59,7 +59,7 @@
    {
      "patternId": "HS-SCRIPT-START",
      "category": "always",
-      "pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
+      "pattern": "^\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
      "action": "scriptStarted",
      "parameters": {
        "scriptType": "remediation"
@@ -70,7 +70,7 @@
    {
      "patternId": "HS-STDERR",
      "category": "always",
-      "pattern": "\\[HS\\] err output = (?<output>.*)",
+      "pattern": "^\\[HS\\] err output = (?<output>.*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "remediation",
@@ -82,7 +82,7 @@
    {
      "patternId": "HS-STDOUT",
      "category": "always",
-      "pattern": "\\[HS\\] std output = (?<output>.*)",
+      "pattern": "^\\[HS\\] std output = (?<output>.*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "remediation",
@@ -94,7 +94,7 @@
    {
      "patternId": "IME-AGENT-VERSION",
      "category": "always",
-      "pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
+      "pattern": "^Agent version is: (?<agentVersion>[\\d.]+)",
      "action": "imeAgentVersion",
      "description": "Captures the Intune Management Extension agent version number.",
      "enabled": true
@@ -102,7 +102,7 @@
    {
      "patternId": "IME-ALREADY-DETECTED-1",
      "category": "otherPhases",
-      "pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
+      "pattern": "^\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
      "action": "ignoreCompletedApp",
      "description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
      "enabled": true
@@ -110,7 +110,7 @@
    {
      "patternId": "IME-ALREADY-DETECTED-2",
      "category": "otherPhases",
-      "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
+      "pattern": "^\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
      "action": "ignoreCompletedApp",
      "description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
      "enabled": true
@@ -118,7 +118,7 @@
    {
      "patternId": "IME-APP-TYPE-MSI",
      "category": "always",
-      "pattern": "\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
+      "pattern": "^\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
      "action": "captureAppTypeMsi",
      "description": "Detects an MSI-based Win32 app via the 'MSI App <guid>' phrase in the ESP retry configuration line. Marks AppType as 'MSI' for that app id.",
      "enabled": true
@@ -126,7 +126,7 @@
    {
      "patternId": "IME-APP-TYPE-WINGET",
      "category": "always",
-      "pattern": "\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
+      "pattern": "^\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
      "action": "captureAppTypeWinGet",
      "description": "Detects a WinGet-backed Store app by any [Win32App][WinGetApp] handler log line (Detection/Applicability/Operation). Marks AppType as 'WinGet' for that app id.",
      "enabled": true
@@ -134,7 +134,7 @@
    {
      "patternId": "IME-APP-VERSION",
      "category": "always",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{[^}]*?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{(?:\"OldValue\":[^,}]{0,64},)?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
      "action": "captureAppVersion",
      "description": "Captures the product version IME detected after an app install (e.g. \"11.2.1787.0\"). Source: [ReportingManager] Detection state update with DetectedIdentityVersion.NewValue. Used by App Dashboard to show version-level failure breakdowns.",
      "enabled": true
@@ -142,7 +142,7 @@
    {
      "patternId": "IME-ATTEMPT-NUMBER",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
+      "pattern": "^\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
      "action": "captureAttemptNumber",
      "parameters": {
        "useCurrentApp": "true"
@@ -153,7 +153,7 @@
    {
      "patternId": "IME-CACHE-MISS",
      "category": "always",
-      "pattern": "\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
+      "pattern": "^\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
      "action": "updateName",
      "description": "Captures 'Content cache miss for app (id = <guid>, name = <name>), start downloading...' (ContentManager.cs) as a secondary app-name source. Fires right before a real download begins, so it resolves names for exactly the apps that will produce download/install activity — a redundancy for IME-POLICIES-based naming after IME retired the old name-bearing processing lines.",
      "enabled": true
@@ -161,7 +161,7 @@
    {
      "patternId": "IME-DECRYPT-FAILED",
      "category": "currentPhase",
-      "pattern": "Decryption is failed for appId {GUID}",
+      "pattern": "^Decryption is failed for appId {GUID}",
      "action": "updateStateError",
      "description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
      "enabled": true
@@ -169,7 +169,7 @@
    {
      "patternId": "IME-DETECTED-INSTALLED-1",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DetectionState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}Installed\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DetectionState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}Installed\"{1,2}",
      "action": "updateStateInstalled",
      "description": "Detects when an app's detection state transitions to Installed (new ReportingManager format). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
      "enabled": true
@@ -177,23 +177,15 @@
    {
      "patternId": "IME-DETECTED-INSTALLED-2",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
+      "pattern": "^\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
      "action": "updateStateInstalled",
      "description": "Detects when an app's detection action handler reports successful detection (app is installed).",
      "enabled": true
    },
-    {
-      "patternId": "IME-DETECTED-OLD",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Detected app {GUID} ",
-      "action": "updateStateInstalled",
-      "description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app <guid> ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).",
-      "enabled": false
-    },
    {
      "patternId": "IME-DETECTION-RESULT",
      "category": "always",
-      "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
+      "pattern": "^\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
      "action": "captureDetectionResult",
      "description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not, 'DetectedDifferentVersion' means a different version was found (supersedence / WinGet version mismatch). DetectedDifferentVersion must come first in the alternation so the unanchored regex does not mis-capture its 'Detected' prefix. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
      "enabled": true
@@ -201,23 +193,23 @@
    {
      "patternId": "IME-DO-TEL",
      "category": "currentPhase",
-      "pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
+      "pattern": "^\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
      "action": "updateDoTelemetry",
-      "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
+      "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent in 1.104.102.0 and 1.105.103.0 decompiles, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.",
      "enabled": true
    },
    {
      "patternId": "IME-DO-TIMEOUT-1",
      "category": "currentPhase",
-      "pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
+      "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout, jobId = [^,]{0,64}, fileId =.*?intunewin-bin_{GUID}",
      "action": "updateStatePostponed",
-      "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
+      "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in the DO fileId). Source literal (ContentDownloaderDeliveryOptimization, identical IME 1.97-1.105): \"[Win32App DO] DO downloading is not finished within timeout, jobId = {0}, fileId = {1}\".",
      "enabled": true
    },
    {
      "patternId": "IME-DO-TIMEOUT-2",
      "category": "currentPhase",
-      "pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
+      "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout",
      "action": "updateStatePostponed",
      "parameters": {
        "useCurrentApp": "true"
@@ -228,7 +220,7 @@
    {
      "patternId": "IME-DOWNLOADING",
      "category": "currentPhase",
-      "pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
+      "pattern": "^\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
      "action": "updateStateDownloading",
      "description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
      "enabled": true
@@ -236,7 +228,7 @@
    {
      "patternId": "IME-ENFORCEMENT-SUCCESS",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}\\w+\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}Success\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}\\w+\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}Success\"{1,2}",
      "action": "updateStateInstalled",
      "description": "Detects when an app's enforcement state transitions to Success in an Execution state report delta. OldValue is deliberately unpinned: besides InProgressDownloadCompleted it can be Error (retry succeeding in a later check-in), InProgressPendingReboot (post-reboot completion) or null (first write) — the previously pinned InProgressDownloadCompleted missed those legitimate success paths (IME 1.97 audit 2026-08-17). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
      "enabled": true
@@ -244,7 +236,7 @@
    {
      "patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
+      "pattern": "^\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
      "action": "updateStateInstalled",
      "parameters": {
        "useCurrentApp": "true"
@@ -255,7 +247,7 @@
    {
      "patternId": "IME-ERROR-DOWNLOAD",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:\"{1,2}InProgress\"{1,2},\"{1,2}NewValue\"{1,2}:\"{1,2}ErrorDownloadingContent\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:\"{1,2}InProgress\"{1,2},\"{1,2}NewValue\"{1,2}:\"{1,2}ErrorDownloadingContent\"{1,2}",
      "action": "updateStateError",
      "description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent. Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
      "enabled": true
@@ -263,7 +255,7 @@
    {
      "patternId": "IME-ERROR-ENFORCEMENT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
+      "pattern": "^\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
@@ -274,7 +266,7 @@
    {
      "patternId": "IME-ERROR-NO-CONTENT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Didn't get content info from service",
+      "pattern": "^\\[Win32App\\] Didn't get content info from service",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
@@ -285,7 +277,7 @@
    {
      "patternId": "IME-ERROR-REPORT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}(?<from>\\w+)\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}(?<to>\\w+)\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}(?<from>\\w+)\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}(?<to>\\w+)\"{1,2}",
      "action": "updateStateError",
      "parameters": {
        "checkTo": "true"
@@ -296,7 +288,7 @@
    {
      "patternId": "IME-ERROR-TIMEOUT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Installation is timeout",
+      "pattern": "^\\[Win32App\\] Installation is timeout",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
@@ -307,7 +299,7 @@
    {
      "patternId": "IME-ERROR-UNMAPPED-EXIT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
+      "pattern": "^\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
      "action": "updateStateError",
      "description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
      "enabled": true
@@ -315,7 +307,7 @@
    {
      "patternId": "IME-ESP-APP-REGISTERED",
      "category": "always",
-      "pattern": "\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
+      "pattern": "^\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
      "action": "updateName",
      "description": "Captures the ESP tracked-app registration line ('App <guid> has been registered[ for user <id>]. App name: <name>', EspManager.cs) as an app-name source. Primary replacement for the retired IME-UPDATE-NAME-1/2/3 whose emitters were removed with IME's old V1/V2 processing pipeline; also documents exactly which apps IME registered for ESP tracking. Category 'always' so names resolve even before the first ApplicationPoller EspPhase line is seen.",
      "enabled": true
@@ -323,7 +315,7 @@
    {
      "patternId": "IME-ESP-PHASE",
      "category": "always",
-      "pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
+      "pattern": "^\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
      "action": "espPhaseDetected",
      "description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
      "enabled": true
@@ -331,7 +323,7 @@
    {
      "patternId": "IME-ESP-TRACK-STATUS",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
+      "pattern": "^\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
      "action": "espTrackStatus",
      "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app. No trailing anchor: IME 1.97 (Dec 2025) appends ' with name: <appName>.' after the GUID (EspManager.cs), which broke the previous '\\.' suffix. 'from' can be the literal string 'null' on first tracking.",
      "enabled": true
@@ -339,7 +331,7 @@
    {
      "patternId": "IME-EXITCODE",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
+      "pattern": "^\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
      "action": "captureExitCode",
      "parameters": {
        "useCurrentApp": "true"
@@ -350,7 +342,7 @@
    {
      "patternId": "IME-EXITCODE-MAPPED-FAILED",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] lpExitCode is defined as Failed$",
+      "pattern": "^\\[Win32App\\] lpExitCode is defined as Failed$",
      "action": "updateStateError",
      "parameters": {
        "useCurrentApp": "true"
@@ -361,7 +353,7 @@
    {
      "patternId": "IME-GRS-CLEARED",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Encountered early subgraph termination\\. Clearing GRS for app with id: {GUID} so it can be retried during the next check-in\\.",
+      "pattern": "^\\[Win32App\\]\\[ExecutionActionHandler\\] Encountered early subgraph termination\\. Clearing GRS for app with id: {GUID} so it can be retried during the next check-in\\.",
      "action": "updateStatePostponed",
      "description": "IME aborted the app's subgraph before enforcement finished and cleared its GRS entry so the app retries on the next check-in (ExecutionActionHandler, AppWorkload.log). Maps to Postponed: the install did not complete this pass but is scheduled to run again - previously this looked like an unexplained gap. Wording verified in IME 1.97 and 1.104.",
      "enabled": true
@@ -369,7 +361,7 @@
    {
      "patternId": "IME-GRS-SKIP",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID} to (?:install|uninstall) is in GRS\\. The app will not be enforced\\.",
+      "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID} to (?:install|uninstall) is in GRS\\. The app will not be enforced\\.",
      "action": "updateStatePostponed",
      "description": "GRS (Global Retry Schedule) skip: the app failed recently and IME will not re-enforce it this check-in ('App with id: <guid> to install is in GRS. The app will not be enforced.', EnforcementActionProcessor / MixedEnforcementActionProcessor). THE canonical reason an app silently does nothing for up to 24h - previously invisible. Lives in AppActionProcessor.log, which the agent tails since the 2026-08-18 release; wording verified in IME 1.97 and 1.104.",
      "enabled": true
@@ -377,7 +369,7 @@
    {
      "patternId": "IME-HRESULT",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
+      "pattern": "^\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
      "action": "captureHResult",
      "parameters": {
        "useCurrentApp": "true"
@@ -388,7 +380,7 @@
    {
      "patternId": "IME-IMPERSONATION",
      "category": "always",
-      "pattern": "After impersonation: (?<user>.*?)$",
+      "pattern": "^After impersonation: (?<user>.*?)$",
      "action": "imeImpersonation",
      "description": "Detects when IME impersonates a user context for app installation.",
      "enabled": true
@@ -396,7 +388,7 @@
    {
      "patternId": "IME-INSTALL-HANDLER",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
+      "pattern": "^\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
      "action": "updateStateInstalling",
      "description": "Detects when the IME execution handler starts installing an app.",
      "enabled": true
@@ -404,7 +396,7 @@
    {
      "patternId": "IME-LAUNCH-INSTALLER",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
+      "pattern": "^\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
      "action": "updateStateInstalling",
      "parameters": {
        "useCurrentApp": "true"
@@ -415,7 +407,7 @@
    {
      "patternId": "IME-NO-ACTION",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
+      "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
      "action": "updateStateSkipped",
      "description": "Detects when IME determines no action is required for an app (already in desired state).",
      "enabled": true
@@ -423,7 +415,7 @@
    {
      "patternId": "IME-NOT-APPLICABLE-1",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
+      "pattern": "^\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
      "action": "updateStateSkipped",
      "description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
      "enabled": true
@@ -431,7 +423,7 @@
    {
      "patternId": "IME-NOT-APPLICABLE-2",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}ApplicabilityState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}ScriptRequirementRuleNotMet\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}ApplicabilityState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}ScriptRequirementRuleNotMet\"{1,2}",
      "action": "updateStateSkipped",
      "description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
      "enabled": true
@@ -439,7 +431,7 @@
    {
      "patternId": "IME-NOT-APPLICABLE-3",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}None\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}None\"{1,2}",
      "action": "updateStateSkipped",
      "description": "Detects when an app's desired state is set to None (not targeted or not applicable). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
      "enabled": true
@@ -447,7 +439,7 @@
    {
      "patternId": "IME-NOT-APPLICABLE-4",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}NotPresent\"{1,2}",
+      "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}NotPresent\"{1,2}",
      "action": "updateStateSkipped",
      "description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
      "enabled": true
@@ -455,7 +447,7 @@
    {
      "patternId": "IME-NOT-TARGETED-1",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
+      "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
      "action": "updateStateSkipped",
      "description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
      "enabled": true
@@ -463,7 +455,7 @@
    {
      "patternId": "IME-NOT-TARGETED-2",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
+      "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
      "action": "updateStateSkipped",
      "description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
      "enabled": true
@@ -471,7 +463,7 @@
    {
      "patternId": "IME-POLICIES",
      "category": "currentPhase",
-      "pattern": "Get policies =\\s*(?<policies>.*)",
+      "pattern": "^Get policies =\\s*(?<policies>.*)",
      "action": "policiesDiscovered",
      "description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
      "enabled": true
@@ -479,7 +471,7 @@
    {
      "patternId": "IME-RESTART-STOP-PROCESSING",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
+      "pattern": "^\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
      "action": "updateStatePostponed",
      "parameters": {
        "useCurrentApp": "true"
@@ -490,39 +482,15 @@
    {
      "patternId": "IME-SESSION-CHANGE",
      "category": "always",
-      "pattern": "OnSessionChange:? (?<change>.*?)$",
+      "pattern": "^OnSessionChange:? (?<change>.*?)$",
      "action": "imeSessionChange",
      "description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
      "enabled": true
    },
-    {
-      "patternId": "IME-SET-CURRENT-1",
-      "category": "always",
-      "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
-      "action": "setCurrentApp",
-      "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
-    {
-      "patternId": "IME-SET-CURRENT-2",
-      "category": "always",
-      "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
-      "action": "setCurrentApp",
-      "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
-    {
-      "patternId": "IME-SET-CURRENT-3",
-      "category": "always",
-      "pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
-      "action": "setCurrentApp",
-      "description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
    {
      "patternId": "IME-SET-CURRENT-4",
      "category": "always",
-      "pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
+      "pattern": "^\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
      "action": "setCurrentApp",
      "description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
      "enabled": true
@@ -530,7 +498,7 @@
    {
      "patternId": "IME-SHUTDOWN",
      "category": "currentPhase",
-      "pattern": "EMS Agent received shutdown signal",
+      "pattern": "^EMS Agent received shutdown signal",
      "action": "updateStatePostponed",
      "parameters": {
        "useCurrentApp": "true"
@@ -538,34 +506,10 @@
      "description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
      "enabled": true
    },
-    {
-      "patternId": "IME-SKIP-APPLICABILITY-NOTMET",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
-      "action": "updateStateSkipped",
-      "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
-    {
-      "patternId": "IME-SKIP-DEPENDENCY-DETECT",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
-      "action": "updateStateSkipped",
-      "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
-    {
-      "patternId": "IME-SKIP-DETECTED",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
-      "action": "updateStateSkipped",
-      "description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
    {
      "patternId": "IME-SKIP-FILTERS",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
+      "pattern": "^\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
      "action": "updateStateSkipped",
      "parameters": {
        "useCurrentApp": "true"
@@ -576,7 +520,7 @@
    {
      "patternId": "IME-SKIP-INSTALL-DETECTED",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
+      "pattern": "^\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
      "action": "updateStateSkipped",
      "description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
      "enabled": true
@@ -584,23 +528,15 @@
    {
      "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
+      "pattern": "^\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
      "action": "updateStateSkipped",
      "description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
      "enabled": true
    },
-    {
-      "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
-      "action": "updateStateSkipped",
-      "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
    {
      "patternId": "IME-STARTED",
      "category": "always",
-      "pattern": "EMS Agent Started",
+      "pattern": "^EMS Agent Started",
      "action": "imeStarted",
      "description": "Detects when the Intune Management Extension (IME) agent starts up.",
      "enabled": true
@@ -608,7 +544,7 @@
    {
      "patternId": "IME-STOP-SIGNAL",
      "category": "currentPhase",
-      "pattern": "EMS Agent received stop signal",
+      "pattern": "^EMS Agent received stop signal",
      "action": "updateStatePostponed",
      "parameters": {
        "useCurrentApp": "true"
@@ -619,7 +555,7 @@
    {
      "patternId": "IME-SUBGRAPH",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
+      "pattern": "^\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
      "action": "cancelStuckAndSetCurrent",
      "description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
      "enabled": true
@@ -627,7 +563,7 @@
    {
      "patternId": "IME-TOKEN-FAILURE",
      "category": "always",
-      "pattern": "Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
+      "pattern": "^Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
      "action": "imeTokenFailure",
      "description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104 decompiled sources.",
      "enabled": true
@@ -635,7 +571,7 @@
    {
      "patternId": "IME-TOKEN-SUCCESS",
      "category": "always",
-      "pattern": "Successfully get the token",
+      "pattern": "^Successfully get the token",
      "action": "espPhaseDetected",
      "parameters": {
        "phase": "AccountSetup"
@@ -643,34 +579,10 @@
      "description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
      "enabled": true
    },
-    {
-      "patternId": "IME-UPDATE-NAME-1",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
-      "action": "updateName",
-      "description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
-    {
-      "patternId": "IME-UPDATE-NAME-2",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
-      "action": "updateName",
-      "description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
-    {
-      "patternId": "IME-UPDATE-NAME-3",
-      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
-      "action": "updateName",
-      "description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-      "enabled": false
-    },
    {
      "patternId": "IME-USER-SESSION-COMPLETED",
      "category": "always",
-      "pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
+      "pattern": "^\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
      "action": "enrollmentCompleted",
      "description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
      "enabled": true
@@ -678,7 +590,7 @@
    {
      "patternId": "IME-USER-SESSION-ZERO-APPS",
      "category": "always",
-      "pattern": "\\[Win32App\\] Get 0 apps for user session (?<sessionId>\\d+), user id = (?<userId>[a-f0-9\\-]+)",
+      "pattern": "^\\[Win32App\\] Get 0 apps for user session (?<sessionId>\\d+), user id = (?<userId>[a-f0-9\\-]+)",
      "action": "userSessionZeroApps",
      "description": "Detects when IME enumerated a user session and found zero targeted Win32 apps. IME then skips its 'Completed user session' line entirely (the zero-app branch in ApplicationPoller continues before that log statement), so this line is the only evidence that user-phase enforcement finished on a device with no user-targeted apps. Treated as equivalent to a completed user session.",
      "enabled": true
@@ -686,7 +598,7 @@
    {
      "patternId": "IME-WIN32-STATE-1",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
+      "pattern": "^\\[Win32App\\] Got InstanceID: Win32App_{GUID}_\\d+, installationStateString: (?<state>\\d)",
      "action": "updateWin32AppState",
      "description": "Captures the Win32 app installation state string from instance ID tracking (old log format).",
      "enabled": true
@@ -694,7 +606,7 @@
    {
      "patternId": "IME-WIN32-STATE-2",
      "category": "currentPhase",
-      "pattern": "\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
+      "pattern": "^\\[Win32App\\] (?:Got|Set) (?:ESP )?win32App state (?<state>\\w+) for {GUID}",
      "action": "updateWin32AppState",
      "description": "Captures the Win32 app ESP state (e.g., Installed, InProgress) for a specific app.",
      "enabled": true
@@ -702,7 +614,7 @@
    {
      "patternId": "IME-WINGET-ERROR",
      "category": "currentPhase",
-      "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Error",
+      "pattern": "^\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Error",
      "action": "updateStateError",
      "description": "Marks a WinGet (new Store) app as failed when its operation progress reports phase Error (WinGetOperationInstallPhase: Downloading/Installing/Queued/Finished/Error). Before this pattern only the Installing phase was matched, so WinGet failures never surfaced as app errors (IME 1.97 audit 2026-08-17).",
      "enabled": true
@@ -710,7 +622,7 @@
    {
      "patternId": "IME-WINGET-INSTALLING-1",
      "category": "currentPhase",
-      "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
+      "pattern": "^\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID} and user = .*?- Operation Phase = Installing",
      "action": "updateStateInstalling",
      "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 1).",
      "enabled": true
@@ -718,7 +630,7 @@
    {
      "patternId": "IME-WINGET-INSTALLING-2",
      "category": "currentPhase",
-      "pattern": "\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
+      "pattern": "^\\[WinGetMessageProcessor\\] Processing Progress for app = {GUID}.*?- Operation Phase = Installing",
      "action": "updateStateInstalling",
      "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
      "enabled": true
@@ -726,7 +638,7 @@
    {
      "patternId": "PS-AGENT-ERROR",
      "category": "always",
-      "pattern": "error from script =(?<output>[\\s\\S]*)",
+      "pattern": "^error from script =(?<output>[\\s\\S]*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "platform",
@@ -738,7 +650,7 @@
    {
      "patternId": "PS-AGENT-EXITCODE",
      "category": "always",
-      "pattern": "Powershell exit code is (?<exitCode>-?\\d+)",
+      "pattern": "^Powershell exit code is (?<exitCode>-?\\d+)",
      "action": "scriptExitCode",
      "parameters": {
        "scriptType": "platform"
@@ -749,7 +661,7 @@
    {
      "patternId": "PS-AGENT-INVOCATION",
      "category": "always",
-      "pattern": "ExecutorLog AgentExecutor gets invoked",
+      "pattern": "^ExecutorLog AgentExecutor gets invoked",
      "action": "resetPlatformScriptContext",
      "description": "Marks the start of a new AgentExecutor.exe invocation. AgentExecutor hosts BOTH platform scripts (Policies\\Scripts\\<id>.ps1) and proactive-remediation scripts (IMECache\\HealthScripts\\<id>\\detect.ps1) and writes their lines interleaved into the shared AgentExecutor.log. The policyId-less 'Powershell exit code is N' / 'write output done' lines are otherwise routed to the last-started platform script via a sticky pointer, so a remediation invocation (whose start line does not match PS-AGENT-SCRIPT-START) leaks its exit/output into that platform script's result. This pattern resets the platform-script line-capture context at each invocation boundary so only the matching platform invocation captures its own exit/output.",
      "enabled": true
@@ -757,7 +669,7 @@
    {
      "patternId": "PS-AGENT-OUTPUT",
      "category": "always",
-      "pattern": "write output done\\. output = (?<output>[\\s\\S]*?), error = (?<error>[\\s\\S]*)",
+      "pattern": "^write output done\\. output = (?<output>[\\s\\S]*?), error = (?<error>[\\s\\S]*)",
      "action": "scriptOutput",
      "parameters": {
        "scriptType": "platform"
@@ -768,7 +680,7 @@
    {
      "patternId": "PS-AGENT-SCRIPT-START",
      "category": "always",
-      "pattern": "Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
+      "pattern": "^Adding argument powershell with value C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1",
      "action": "scriptStarted",
      "parameters": {
        "scriptType": "platform",
@@ -780,7 +692,7 @@
    {
      "patternId": "PS-SCRIPT-CONTEXT",
      "category": "always",
-      "pattern": "Launch powershell executor in (?<context>machine|user) session",
+      "pattern": "^Launch powershell executor in (?<context>machine|user) session",
      "action": "scriptContext",
      "description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
      "enabled": true
@@ -788,7 +700,7 @@
    {
      "patternId": "PS-SCRIPT-EXITCODE",
      "category": "always",
-      "pattern": "Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
+      "pattern": "^Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
      "action": "scriptExitCode",
      "description": "Captures the PowerShell exit code when script execution completes in the IME log.",
      "enabled": true
@@ -796,7 +708,7 @@
    {
      "patternId": "PS-SCRIPT-GENERATED",
      "category": "always",
-      "pattern": "Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
+      "pattern": "^Script file C:\\\\.*\\\\Policies\\\\Scripts\\\\[a-z0-9\\-]+_(?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\\.ps1 is generated",
      "action": "scriptStarted",
      "parameters": {
        "scriptType": "platform"
@@ -807,7 +719,7 @@
    {
      "patternId": "PS-SCRIPT-RESULT",
      "category": "always",
-      "pattern": "\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
+      "pattern": "^\\[PowerShell\\] User Id = [a-z0-9\\-]+, Policy id = (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}), policy result = (?<result>\\w+)",
      "action": "scriptCompleted",
      "parameters": {
        "scriptType": "platform"
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-COMPLIANCE-POST",
  "category": "always",
-  "pattern": "\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+  "pattern": "^\\[HS\\] the (?<part>post) detection script result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
  "action": "healthScriptDetectionResult",
  "parameters": { "scriptType": "remediation" },
  "description": "Post-remediation detection result, current wording. IME 1.97 (Dec 2025) replaced the old '[HS] the post-remdiation detection script compliance result for ...' line (still covered by HS-COMPLIANCE for older logs) with '[HS] the post detection script result for <guid> is <True|False>' (ScriptProcessorV2.cs:721). The literal word 'post' in the line is captured as the part group so the handler classifies it as the post-detection phase.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-COMPLIANCE",
  "category": "always",
-  "pattern": "\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
+  "pattern": "^\\[HS\\] the (?<part>pre|post)-rem(?:e)?diation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
  "action": "healthScriptDetectionResult",
  "parameters": { "scriptType": "remediation" },
  "description": "Early-signal fallback for health-script detection / post-detection results. Microsoft IME emits this line immediately after each detection script runs, ~30-90 seconds before the consolidated [HS] new result = JSON line is logged (which only fires after IME's batch-send to the Microsoft service). Short Autopilot enrollments often end inside that gap, so this pattern guarantees at least the compliance verdict is captured. The full data version arrives later via HS-NEW-RESULT and replaces this sparse entry through the UI dedupe (dataCompleteness scoring). Tolerates both Microsoft's historical typo 'remdiation' and a future corrected 'remediation'. NOTE: IME 1.97 (Dec 2025) no longer emits the post- variant of this line; the post case is covered by HS-COMPLIANCE-POST.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-EXITCODE",
  "category": "always",
-  "pattern": "\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
+  "pattern": "^\\[HS\\] exit code of the script is (?<exitCode>-?\\d+)",
  "action": "scriptExitCode",
  "parameters": { "scriptType": "remediation" },
  "description": "Captures the exit code of a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees the real exit code (not just the inferred 0/1) before HS-NEW-RESULT arrives.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-NEW-RESULT",
  "category": "always",
-  "pattern": "\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
+  "pattern": "^\\[HS\\] new result = (?<json>\\{[\\s\\S]*\\})\\s*$",
  "action": "healthScriptResult",
  "parameters": { "scriptType": "remediation" },
  "description": "Atomic final JSON of a health script run, covering all three phases (pre-detection / remediation / post-detection) emitted by IME after the policy completes. Single source of truth for health-script outcomes — replaces the line-by-line HS-COMPLIANCE/HS-EXITCODE/HS-STDOUT/HS-STDERR patterns. The end-anchor and [\\s\\S] character class are defensive against future format changes and multi-line CMTrace buffering.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-RUN-CONTEXT",
  "category": "always",
-  "pattern": "\\[HS\\] The policy needs be run as (?<context>System|User)",
+  "pattern": "^\\[HS\\] The policy needs be run as (?<context>System|User)",
  "action": "scriptContext",
  "parameters": { "scriptType": "remediation" },
  "description": "Captures the execution context (System or User) for a health-script. Feeds the early-signal slot consumed by HS-COMPLIANCE so context is visible immediately rather than waiting for HS-NEW-RESULT (which exposes RunAsAccount).",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-SCRIPT-START",
  "category": "always",
-  "pattern": "\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
+  "pattern": "^\\[HS\\] ProcessScript PolicyId: (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) PolicyType: (?<policyType>\\d+)",
  "action": "scriptStarted",
  "parameters": { "scriptType": "remediation" },
  "description": "Detects when a Proactive Remediation (Health Script) starts processing. Captures PolicyId and PolicyType (6 = remediation). Drives the live script_started event for UI progress indication; the consolidated final result for the same PolicyId arrives later via HS-NEW-RESULT.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-STDERR",
  "category": "always",
-  "pattern": "\\[HS\\] err output = (?<output>.*)",
+  "pattern": "^\\[HS\\] err output = (?<output>.*)",
  "action": "scriptOutput",
  "parameters": { "scriptType": "remediation", "outputType": "stderr" },
  "description": "Captures standard error from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so stderr is visible immediately rather than waiting for HS-NEW-RESULT.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "HS-STDOUT",
  "category": "always",
-  "pattern": "\\[HS\\] std output = (?<output>.*)",
+  "pattern": "^\\[HS\\] std output = (?<output>.*)",
  "action": "scriptOutput",
  "parameters": { "scriptType": "remediation", "outputType": "stdout" },
  "description": "Captures standard output from a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees stdout immediately rather than waiting for HS-NEW-RESULT.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-AGENT-VERSION",
  "category": "always",
-  "pattern": "Agent version is: (?<agentVersion>[\\d.]+)",
+  "pattern": "^Agent version is: (?<agentVersion>[\\d.]+)",
  "action": "imeAgentVersion",
  "description": "Captures the Intune Management Extension agent version number.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ALREADY-DETECTED-1",
  "category": "otherPhases",
-  "pattern": "\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
+  "pattern": "^\\[Win32App\\] Completed detectionManager SideCar\\w+?DetectionManager, applicationDetectedByCurrentRule: True",
  "action": "ignoreCompletedApp",
  "description": "Detects when an app from a previous ESP phase is detected as already installed, so it should be ignored in the current phase.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ALREADY-DETECTED-2",
  "category": "otherPhases",
-  "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
+  "pattern": "^\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
  "action": "ignoreCompletedApp",
  "description": "Detects enforcement success in a non-current phase, indicating an app completed in a previous phase should be ignored.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-APP-TYPE-MSI",
  "category": "always",
-  "pattern": "\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
+  "pattern": "^\\[Win32App\\].*?\\bMSI App (?<id>{GUID})",
  "action": "captureAppTypeMsi",
  "description": "Detects an MSI-based Win32 app via the 'MSI App <guid>' phrase in the ESP retry configuration line. Marks AppType as 'MSI' for that app id.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-APP-TYPE-WINGET",
  "category": "always",
-  "pattern": "\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
+  "pattern": "^\\[Win32App\\]\\[WinGetApp\\].*?app with id: (?<id>{GUID})",
  "action": "captureAppTypeWinGet",
  "description": "Detects a WinGet-backed Store app by any [Win32App][WinGetApp] handler log line (Detection/Applicability/Operation). Marks AppType as 'WinGet' for that app id.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-APP-VERSION",
  "category": "always",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{[^}]*?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: (?<id>{GUID}).*?\"DetectedIdentityVersion\":\\{(?:\"OldValue\":[^,}]{0,64},)?\"NewValue\":\"(?<appVersion>[^\"]+)\"",
  "action": "captureAppVersion",
  "description": "Captures the product version IME detected after an app install (e.g. \"11.2.1787.0\"). Source: [ReportingManager] Detection state update with DetectedIdentityVersion.NewValue. Used by App Dashboard to show version-level failure breakdowns.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ATTEMPT-NUMBER",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
+  "pattern": "^\\[Win32App\\] ===Step=== Execute retry (?<attempt>\\d+)$",
  "action": "captureAttemptNumber",
  "parameters": {
    "useCurrentApp": "true"
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-CACHE-MISS",
  "category": "always",
-  "pattern": "\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
+  "pattern": "^\\[Win32App\\] Content cache miss for app \\(id = {GUID}, name = (?<name>.*?)\\), start downloading",
  "action": "updateName",
  "description": "Captures 'Content cache miss for app (id = <guid>, name = <name>), start downloading...' (ContentManager.cs) as a secondary app-name source. Fires right before a real download begins, so it resolves names for exactly the apps that will produce download/install activity — a redundancy for IME-POLICIES-based naming after IME retired the old name-bearing processing lines.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DECRYPT-FAILED",
  "category": "currentPhase",
-  "pattern": "Decryption is failed for appId {GUID}",
+  "pattern": "^Decryption is failed for appId {GUID}",
  "action": "updateStateError",
  "description": "Detects when app content decryption fails, indicating a corrupted or tampered download.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DETECTED-INSTALLED-1",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DetectionState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}Installed\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Detection state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DetectionState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}Installed\"{1,2}",
  "action": "updateStateInstalled",
  "description": "Detects when an app's detection state transitions to Installed (new ReportingManager format). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DETECTED-INSTALLED-2",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
+  "pattern": "^\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: {GUID} resulted in action status: Success and detection state: Detected",
  "action": "updateStateInstalled",
  "description": "Detects when an app's detection action handler reports successful detection (app is installed).",
  "enabled": true
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-DETECTED-OLD",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Detected app {GUID} ",
-  "action": "updateStateInstalled",
-  "description": "Detects when an app is detected as installed (old log format). DISABLED 2026-08-17: the standalone 'Detected app <guid> ' line no longer exists in IME 1.97.107; this regex instead matched the 'Detected app ... and intent is to install, skip applicability check' line, colliding with IME-SKIP-INSTALL-DETECTED and firing updateStateInstalled and updateStateSkipped on the same physical line (see tasks/ime-v1-code-audit-2026-08-17.md).",
-  "enabled": false
-}
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DETECTION-RESULT",
  "category": "always",
-  "pattern": "\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
+  "pattern": "^\\[Win32App\\]\\[DetectionActionHandler\\] Detection for policy with id: (?<id>{GUID}) resulted in action status: Success and detection state: (?<detection>DetectedDifferentVersion|NotDetected|Detected)",
  "action": "captureDetectionResult",
  "description": "Captures the detection rule result after IME runs detection for an app. 'Detected' means the detection rule matched (app is installed), 'NotDetected' means it did not, 'DetectedDifferentVersion' means a different version was found (supersedence / WinGet version mismatch). DetectedDifferentVersion must come first in the alternation so the unanchored regex does not mis-capture its 'Detected' prefix. Excludes [SimulatedDetectionActionHandler] which fires during applicability pre-checks.",
  "enabled": true
@@ -2,8 +2,8 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DO-TEL",
  "category": "currentPhase",
-  "pattern": "\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
+  "pattern": "^\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
  "action": "updateDoTelemetry",
-  "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration.",
+  "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent in 1.104.102.0 and 1.105.103.0 decompiles, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.",
  "enabled": true
 }
@@ -2,8 +2,8 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DO-TIMEOUT-1",
  "category": "currentPhase",
-  "pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b).*?intunewin-bin_{GUID}",
+  "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout, jobId = [^,]{0,64}, fileId =.*?intunewin-bin_{GUID}",
  "action": "updateStatePostponed",
-  "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in filename).",
+  "description": "Detects when a Delivery Optimization download times out for a specific app (identified by GUID in the DO fileId). Source literal (ContentDownloaderDeliveryOptimization, identical IME 1.97-1.105): \"[Win32App DO] DO downloading is not finished within timeout, jobId = {0}, fileId = {1}\".",
  "enabled": true
 }
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DO-TIMEOUT-2",
  "category": "currentPhase",
-  "pattern": "\\[Win32App DO\\] DO download(?=.*?\\bnot finished\\b)(?=.*?\\btimeout\\b)",
+  "pattern": "^\\[Win32App DO\\] DO downloading is not finished within timeout",
  "action": "updateStatePostponed",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when a Delivery Optimization download times out (generic, uses current app context).",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-DOWNLOADING",
  "category": "currentPhase",
-  "pattern": "\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
+  "pattern": "^\\[StatusService\\] Downloading app \\(id = {GUID}.*?\\) via (?<tech>\\w+), bytes (?<bytes>\\w+)/(?<ofbytes>\\w+) for user",
  "action": "updateStateDownloading",
  "description": "Captures app download progress including technology (DO/CDN), bytes downloaded, and total bytes.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ENFORCEMENT-SUCCESS-OLD",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
+  "pattern": "^\\[Win32App\\] Setting enforcementState as\\W+Success\\b",
  "action": "updateStateInstalled",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when enforcement state is set to Success for the current app (old log format).",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ENFORCEMENT-SUCCESS",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}\\w+\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}Success\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}\\w+\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}Success\"{1,2}",
  "action": "updateStateInstalled",
  "description": "Detects when an app's enforcement state transitions to Success in an Execution state report delta. OldValue is deliberately unpinned: besides InProgressDownloadCompleted it can be Error (retry succeeding in a later check-in), InProgressPendingReboot (post-reboot completion) or null (first write) — the previously pinned InProgressDownloadCompleted missed those legitimate success paths (IME 1.97 audit 2026-08-17). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-DOWNLOAD",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:\"{1,2}InProgress\"{1,2},\"{1,2}NewValue\"{1,2}:\"{1,2}ErrorDownloadingContent\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Download state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:\"{1,2}InProgress\"{1,2},\"{1,2}NewValue\"{1,2}:\"{1,2}ErrorDownloadingContent\"{1,2}",
  "action": "updateStateError",
  "description": "Detects when an app's enforcement state transitions to ErrorDownloadingContent. Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-ENFORCEMENT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
+  "pattern": "^\\[Win32App\\] Setting enforcementState as\\W+Error\\b",
  "action": "updateStateError",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when enforcement state is set to Error for the current app (old log format).",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-NO-CONTENT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Didn't get content info from service",
+  "pattern": "^\\[Win32App\\] Didn't get content info from service",
  "action": "updateStateError",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when IME cannot retrieve content info from the Intune service for the current app.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-REPORT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}(?<from>\\w+)\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}(?<to>\\w+)\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Execution state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}EnforcementState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:(?:\"{1,2}(?<from>\\w+)\"{1,2}|null),\"{1,2}NewValue\"{1,2}:\"{1,2}(?<to>\\w+)\"{1,2}",
  "action": "updateStateError",
  "parameters": {
    "checkTo": "true"
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-TIMEOUT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Installation is timeout",
+  "pattern": "^\\[Win32App\\] Installation is timeout",
  "action": "updateStateError",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when an app installation times out.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ERROR-UNMAPPED-EXIT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
+  "pattern": "^\\[Win32App\\] Admin did NOT set mapping for lpExitCode\\W+(?<exitCode>\\d+) of app\\W+{GUID}",
  "action": "updateStateError",
  "description": "Detects when an app installer returned an exit code that has no mapping configured in Intune.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ESP-APP-REGISTERED",
  "category": "always",
-  "pattern": "\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
+  "pattern": "^\\[Win32App\\]\\[EspManager\\] In EspPhase: \\w+\\. App {GUID} has been registered.*?App name: (?<name>.*?)$",
  "action": "updateName",
  "description": "Captures the ESP tracked-app registration line ('App <guid> has been registered[ for user <id>]. App name: <name>', EspManager.cs) as an app-name source. Primary replacement for the retired IME-UPDATE-NAME-1/2/3 whose emitters were removed with IME's old V1/V2 processing pipeline; also documents exactly which apps IME registered for ESP tracking. Category 'always' so names resolve even before the first ApplicationPoller EspPhase line is seen.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ESP-PHASE",
  "category": "always",
-  "pattern": "\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
+  "pattern": "^\\[Win32App\\] (?:In|The) EspPhase: (?<espPhase>\\w+)",
  "action": "espPhaseDetected",
  "description": "Detects ESP phase transitions reported by IME Win32App processing (e.g., DeviceSetup, AccountSetup).",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-ESP-TRACK-STATUS",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
+  "pattern": "^\\[Win32App\\]\\[EspManager\\] Updating ESP tracked install status from (?<from>\\w+) to (?<to>\\w+) for application {GUID}",
  "action": "espTrackStatus",
  "description": "Captures ESP tracked install status transitions (e.g., InProgress to Installed) for a specific app. No trailing anchor: IME 1.97 (Dec 2025) appends ' with name: <appName>.' after the GUID (EspManager.cs), which broke the previous '\\.' suffix. 'from' can be the literal string 'null' on first tracking.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-EXITCODE-MAPPED-FAILED",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] lpExitCode is defined as Failed$",
+  "pattern": "^\\[Win32App\\] lpExitCode is defined as Failed$",
  "action": "updateStateError",
  "parameters": { "useCurrentApp": "true" },
  "description": "Marks the current app as failed when its exit code maps to Failed via the admin-defined return-code table ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs). This is the NORMAL mapped-exit-code outcome; the previously matched 'Setting enforcementState as ... Error' line only fires on the rare no-mapping fallback path. The numeric exit code is captured separately by IME-EXITCODE, which precedes this line.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-EXITCODE",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
+  "pattern": "^\\[Win32App\\] lpExitCode (?<exitCode>-?\\d+)$",
  "action": "captureExitCode",
  "parameters": {
    "useCurrentApp": "true"
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-GRS-CLEARED",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Encountered early subgraph termination\\. Clearing GRS for app with id: {GUID} so it can be retried during the next check-in\\.",
+  "pattern": "^\\[Win32App\\]\\[ExecutionActionHandler\\] Encountered early subgraph termination\\. Clearing GRS for app with id: {GUID} so it can be retried during the next check-in\\.",
  "action": "updateStatePostponed",
  "description": "IME aborted the app's subgraph before enforcement finished and cleared its GRS entry so the app retries on the next check-in (ExecutionActionHandler, AppWorkload.log). Maps to Postponed: the install did not complete this pass but is scheduled to run again - previously this looked like an unexplained gap. Wording verified in IME 1.97 and 1.104.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-GRS-SKIP",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID} to (?:install|uninstall) is in GRS\\. The app will not be enforced\\.",
+  "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID} to (?:install|uninstall) is in GRS\\. The app will not be enforced\\.",
  "action": "updateStatePostponed",
  "description": "GRS (Global Retry Schedule) skip: the app failed recently and IME will not re-enforce it this check-in ('App with id: <guid> to install is in GRS. The app will not be enforced.', EnforcementActionProcessor / MixedEnforcementActionProcessor). THE canonical reason an app silently does nothing for up to 24h - previously invisible. Lives in AppActionProcessor.log, which the agent tails since the 2026-08-18 release; wording verified in IME 1.97 and 1.104.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-HRESULT",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
+  "pattern": "^\\[Win32App\\] hResultFromWin32 (?<hresult>-?\\d+)$",
  "action": "captureHResult",
  "parameters": {
    "useCurrentApp": "true"
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-IMPERSONATION",
  "category": "always",
-  "pattern": "After impersonation: (?<user>.*?)$",
+  "pattern": "^After impersonation: (?<user>.*?)$",
  "action": "imeImpersonation",
  "description": "Detects when IME impersonates a user context for app installation.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-INSTALL-HANDLER",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
+  "pattern": "^\\[Win32App\\]\\[ExecutionActionHandler\\] Handler invoked with execution type: Install for policy with id: {GUID}",
  "action": "updateStateInstalling",
  "description": "Detects when the IME execution handler starts installing an app.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-LAUNCH-INSTALLER",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
+  "pattern": "^\\[Win32App\\] Launch Win32AppInstaller in \\w+? session",
  "action": "updateStateInstalling",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when the Win32 app installer process is launched in a user or system session.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NO-ACTION",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
+  "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] No action required for app with id: {GUID}",
  "action": "updateStateSkipped",
  "description": "Detects when IME determines no action is required for an app (already in desired state).",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NOT-APPLICABLE-1",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
+  "pattern": "^\\[Win32App\\]\\[ApplicabilityActionHandler\\] Applicability check for policy with id: {GUID} resulted in action status: Success and applicability state: NotApplicable",
  "action": "updateStateSkipped",
  "description": "Detects when an app's applicability check returns NotApplicable (requirements not met).",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NOT-APPLICABLE-2",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}ApplicabilityState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}ScriptRequirementRuleNotMet\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Applicability state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}ApplicabilityState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}ScriptRequirementRuleNotMet\"{1,2}",
  "action": "updateStateSkipped",
  "description": "Detects when an app's applicability state is set to ScriptRequirementRuleNotMet (PowerShell requirement script returned false). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NOT-APPLICABLE-3",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}None\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}None\"{1,2}",
  "action": "updateStateSkipped",
  "description": "Detects when an app's desired state is set to None (not targeted or not applicable). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NOT-APPLICABLE-4",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}NotPresent\"{1,2}",
+  "pattern": "^\\[Win32App\\]\\[ReportingManager\\] Desired state for app with id: {GUID} has been updated\\. Report delta: \\{\"{1,2}DesiredState\"{1,2}:\\{\"{1,2}OldValue\"{1,2}:null,\"{1,2}NewValue\"{1,2}:\"{1,2}NotPresent\"{1,2}",
  "action": "updateStateSkipped",
  "description": "Detects when an app's desired state is set to NotPresent (targeted for uninstall or not required). Quote-flexible since 2026-08-17: IME 1.104 serializes the report-delta JSON with single quotes ({\"Key\":...) where older versions logged doubled quotes ({\"\"Key\"\":...) - every literal quote in the delta is matched as \"{1,2} to cover both.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NOT-TARGETED-1",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
+  "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, targeted intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
  "action": "updateStateSkipped",
  "description": "Detects when an app with RequiredInstall intent is classified as NotApplicableOrNotTargeted (new log format).",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-NOT-TARGETED-2",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
+  "pattern": "^\\[Win32App\\]\\[ActionProcessor\\] App with id: {GUID}, effective intent: RequiredInstall, and enforceability: Enforceable has projected enforcement classification: NotApplicableOrNotTargeted with desired state: None\\.",
  "action": "updateStateSkipped",
  "description": "Detects when an app with effective RequiredInstall intent is classified as NotApplicableOrNotTargeted.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-POLICIES",
  "category": "currentPhase",
-  "pattern": "Get policies =\\s*(?<policies>.*)",
+  "pattern": "^Get policies =\\s*(?<policies>.*)",
  "action": "policiesDiscovered",
  "description": "Captures the JSON policies list discovered by IME, used to build the app inventory.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-RESTART-STOP-PROCESSING",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
+  "pattern": "^\\[Win32App\\]\\[V3Processor\\] A restart is required to continue processing apps\\. Stop processing\\.",
  "action": "updateStatePostponed",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects IME aborting app processing because an app requires a restart ('A restart is required to continue processing apps. Stop processing.', SideCarV3AppProcessor.cs). Postpones the current app: remaining apps do nothing until after the reboot, which previously looked like an unexplained stall mid-ESP.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SESSION-CHANGE",
  "category": "always",
-  "pattern": "OnSessionChange:? (?<change>.*?)$",
+  "pattern": "^OnSessionChange:? (?<change>.*?)$",
  "action": "imeSessionChange",
  "description": "Detects Windows session change events (logon, logoff, lock, unlock) reported by IME.",
  "enabled": true
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SET-CURRENT-1",
-  "category": "always",
-  "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name",
-  "action": "setCurrentApp",
-  "description": "Detects when IME begins processing an app with its dependency chain, setting it as the current app. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SET-CURRENT-2",
-  "category": "always",
-  "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?\\bid\\W+{GUID}",
-  "action": "setCurrentApp",
-  "description": "Detects when the IME ExecManager starts processing a targeted app, setting it as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SET-CURRENT-3",
-  "category": "always",
-  "pattern": "\\[Win32App\\] ===Step=== Start to Present app {GUID}",
-  "action": "setCurrentApp",
-  "description": "Detects the start of app presentation step in IME, setting the app as current. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SET-CURRENT-4",
  "category": "always",
-  "pattern": "\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
+  "pattern": "^\\[Win32App\\] SetCurrentDirectory:.*?\\\\{GUID}_\\d+",
  "action": "setCurrentApp",
  "description": "Detects when IME sets the working directory for an app's staging folder, setting it as current.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SHUTDOWN",
  "category": "currentPhase",
-  "pattern": "EMS Agent received shutdown signal",
+  "pattern": "^EMS Agent received shutdown signal",
  "action": "updateStatePostponed",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when the IME agent receives a shutdown signal, postponing the current app installation.",
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SKIP-APPLICABILITY-NOTMET",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] (?=.*?\\bapplicability\\b)(?=.*?NotMet\\b).*?\\bapp\\W+{GUID}\\b",
-  "action": "updateStateSkipped",
-  "description": "Detects when an app's applicability check returns NotMet (old log format with lookaheads). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SKIP-DEPENDENCY-DETECT",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] app\\W+{GUID}\\b.*?\\bis a dependency\\b.*?\\bDetect Only mode\\b.*?\\bfinished processing",
-  "action": "updateStateSkipped",
-  "description": "Detects when a dependency app in Detect Only mode finishes processing (no install needed). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SKIP-DETECTED",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Detected app {GUID}.*?skip next step",
-  "action": "updateStateSkipped",
-  "description": "Detects when an already-detected app is skipped for further processing steps (old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SKIP-FILTERS",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
+  "pattern": "^\\[Win32App\\]\\[V3Processor\\] All apps in the subgraph are not applicable due to assignment filters\\. Skipping processing\\.",
  "action": "updateStateSkipped",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects when all apps in a subgraph are skipped due to assignment filter exclusions.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SKIP-INSTALL-DETECTED",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
+  "pattern": "^\\[Win32App\\] Detected app {GUID} and intent is to install, skip applicability check",
  "action": "updateStateSkipped",
  "description": "Detects when an app targeted for install is already detected/installed, so the install is skipped (old log format).",
  "enabled": true
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED-2",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] NOT detected app {GUID}.*?skip un-installation",
-  "action": "updateStateSkipped",
-  "description": "Detects when an app is not detected and uninstall is skipped (alternate old log format). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SKIP-UNINSTALL-NOTDETECTED",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
+  "pattern": "^\\[Win32App\\] Not detected app {GUID} and intent is to un-install, skip applicability check",
  "action": "updateStateSkipped",
  "description": "Detects when an app targeted for uninstall is not detected, so the uninstall is skipped (old log format).",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-STARTED",
  "category": "always",
-  "pattern": "EMS Agent Started",
+  "pattern": "^EMS Agent Started",
  "action": "imeStarted",
  "description": "Detects when the Intune Management Extension (IME) agent starts up.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-STOP-SIGNAL",
  "category": "currentPhase",
-  "pattern": "EMS Agent received stop signal",
+  "pattern": "^EMS Agent received stop signal",
  "action": "updateStatePostponed",
  "parameters": { "useCurrentApp": "true" },
  "description": "Detects an IME service stop ('EMS Agent received stop signal', EmsAgentService.OnStop) — fired on manual restarts and agent-updater restarts, unlike the OS-shutdown-only 'shutdown signal' line matched by IME-SHUTDOWN. Postpones the current app installation, mirroring IME-SHUTDOWN semantics.",
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-SUBGRAPH",
  "category": "currentPhase",
-  "pattern": "\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
+  "pattern": "^\\[Win32App\\]\\[V3Processor\\] Processing subgraph with app ids: {GUID}",
  "action": "cancelStuckAndSetCurrent",
  "description": "Detects when V3Processor starts a new subgraph, cancelling any stuck app and setting the new app as current.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-TOKEN-FAILURE",
  "category": "always",
-  "pattern": "Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
+  "pattern": "^Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
  "action": "imeTokenFailure",
  "description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104 decompiled sources.",
  "enabled": true
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-TOKEN-SUCCESS",
  "category": "always",
-  "pattern": "Successfully get the token",
+  "pattern": "^Successfully get the token",
  "action": "espPhaseDetected",
  "parameters": { "phase": "AccountSetup" },
  "description": "Detects successful token acquisition, indicating the AccountSetup ESP phase has started.",
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-UPDATE-NAME-1",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] ExecManager: processing targeted app.*?name\\W+(?<name>.*?)\\W+id\\W+{GUID}",
-  "action": "updateName",
-  "description": "Captures the app name from ExecManager processing log (old format: name before id). DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-UPDATE-NAME-2",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] ProcessAppWithDependencies starts for {GUID} with name (?<name>.*?)$",
-  "action": "updateName",
-  "description": "Captures the app name from ProcessAppWithDependencies log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "IME-UPDATE-NAME-3",
-  "category": "currentPhase",
-  "pattern": "\\[Win32App\\] Processing app \\(id={GUID}, name = (?<name>.*?)\\)",
-  "action": "updateName",
-  "description": "Captures the app name from the Processing app log entry. DISABLED 2026-08-17: emitter no longer exists in current IME (1.97.107, Dec 2025) - the old V1/V2 app processing pipeline was removed and this line is not logged anymore (verified against decompiled source, see tasks/ime-v1-code-audit-2026-08-17.md). Kept for history.",
-  "enabled": false
-}
@@ -2,7 +2,7 @@
  "$schema": "../schema/ime-log-pattern.schema.json",
  "patternId": "IME-USER-SESSION-COMPLETED",
  "category": "always",
-  "pattern": "\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
+  "pattern": "^\\[Win32App\\] \\.+ Completed user session \\d+, userId: (?<userId>[a-f0-9\\-]+), userSID: (?<userSid>S-[\\d\\-]+) \\.+",
  "action": "enrollmentCompleted",
  "description": "Detects when IME completes a user session, indicating enrollment has finished for that user.",
  "enabled": true
--- a/Show More
+++ b/Show More