Merge branch 'main' of https://github.com/okieselbach/AutopilotMonitor

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -1,6 +1,6 @@
 # Agent Directives
 
-- **Plan first.** Enter plan mode for any non-trivial task (3+ steps or an architectural decision) and write the spec before building. If something goes sideways, stop and re-plan instead of pushing on.
+- **Plan first.** Enter plan mode for any non-trivial task (3+ steps or an architectural decision) and write the spec before building. The plan file is `internal/work/plans/<slug>.md` from the first draft; the harness plan folder outside the repo is never the storage place, at most a copy for the approval dialog. If something goes sideways, stop and re-plan instead of pushing on.
 - **Use subagents liberally** for research, exploration, and parallel analysis — one focus each — to keep the main context clean.
 - **Verify before claiming done.** Run the tests, check the logs, show the evidence. Diff against `main` where behaviour could regress.
 - **Fix bugs autonomously.** Given a report, a failing test, or an error, resolve it — no hand-holding.

.github/dependabot.yml

@@ -55,6 +55,10 @@ updates:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
 
+  # Every action is referenced by commit SHA with the version in a trailing comment;
+  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
+  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
+  # pins are reviewed in a PR instead of drifting silently or being bumped by hand.
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/scripts/Get-StorageAuthHeaders.ps1

@@ -0,0 +1,51 @@
+<#
+.SYNOPSIS
+    Returns the request headers that authorize an Azure Storage REST call with Microsoft Entra.
+
+.DESCRIPTION
+    One place for the storage OAuth contract shared by every publisher in this repo -- the
+    agent ZIP and MSI, the customer bootstrap scripts, the version manifests and the build
+    counters. Resource id, the az invocation, the service version and the failure message
+    live here so they cannot drift between call sites.
+
+    Identity comes from whatever `az login` established: the federated GitHub OIDC principal
+    in CI (azure/login, subject repo:okieselbach/AutopilotMonitor:ref:refs/heads/main), the
+    operator's own account for the local build. No secret is read, stored or passed around.
+
+    x-ms-version is MANDATORY here, not decoration: Entra-authorized requests are rejected
+    below 2017-11-09, and Table requests without a SAS must carry the header at all. 2021-08-06
+    is old enough to be deployed in every region and new enough for everything we send.
+
+    Callers merge the result into their own headers -- `$auth + @{ ... }` yields a new
+    hashtable per request, so nothing is shared across uploads:
+
+        $auth = & "$PSScriptRoot/Get-StorageAuthHeaders.ps1"
+        Invoke-RestMethod -Uri $url -Method Put -Headers ($auth + @{ 'x-ms-blob-type' = 'BlockBlob' }) -Body $bytes
+
+    Acquire once per step and reuse: every call shells out to az (~1s) and the token is valid
+    for the lifetime of a job.
+
+.OUTPUTS
+    [hashtable] Authorization + x-ms-version.
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+# The data-plane resource, not management.azure.com -- a management token is accepted by
+# neither the blob nor the table endpoint.
+$token = az account get-access-token --resource https://storage.azure.com --query accessToken -o tsv 2>$null
+
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+    throw ('Could not acquire an Azure Storage token. In CI this means the azure/login step ' +
+           'is missing or its federated credential does not cover this ref; locally, run ' +
+           '`az login`. A token alone is not enough: the principal also needs Storage Blob ' +
+           'Data Contributor on the container it writes, and Storage Table Data Contributor ' +
+           'on the table -- a missing role shows up later as HTTP 403 AuthorizationPermissionMismatch.')
+}
+
+return @{
+    'Authorization' = "Bearer $token"
+    'x-ms-version'  = '2021-08-06'
+}

.github/scripts/Publish-BootstrapScripts.ps1

@@ -12,52 +12,78 @@
                                 lands a consistent set (ZIP + manifest + scripts).
 
     Both callers run the same code. The scripts on the download alias are the live
-    copy the WDP bootstrap MSI (Invoke-BootstrapDownload.ps1) downloads on every
-    enrolling device, so "current" is a correctness property, not cosmetics.
+    copy the stage-1 loader downloads on every enrolling device, whether it came from
+    Intune or from the bootstrap MSI, so "current" is a correctness property, not
+    cosmetics.
 
     Steps, in order:
-      1. Parse $ScriptVersion from the bootstrap source.
-      2. Render the -Dev variant by literal substitution of the two URL/manifest
+      1. Parse $ScriptVersion from the loader and the bootstrap source.
+      2. Render the -Dev variants by literal substitution of the URL/manifest
          defaults. A missing anchor is a hard failure -- a silently un-substituted
          dev script would point the dev fleet at the stable agent.
-      3. Version-bump guard: if the published bootstrap differs from the source
-         but carries the same $ScriptVersion, abort. Otherwise the docs badge,
+      3. Version-bump guard: if a published script differs from its source but
+         carries the same $ScriptVersion, abort. Otherwise the docs badge,
          version.json.bootstrapVersion and the portal's "your script is outdated"
          hint would all keep asserting a version that is no longer what ships.
-      4. Upload every script blob with Cache-Control: no-cache (they rotate in
+      4. Build the publish set (loader, bootstrap, both dev renders, the extras).
+      5. Authenticode-sign every script (see -SigningToken). Signing is the LAST
+         transformation: it covers the exact CRLF/UTF-8 bytes that get uploaded,
+         and nothing may touch them afterwards or the signature breaks.
+      6. Upload every script blob with Cache-Control: no-cache (they rotate in
          place), mirrored fail-soft to the legacy account.
-      5. Reconcile the two version oracles: version.json.bootstrapVersion
-         (read-modify-write under If-Match, so a concurrent agent release cannot
-         lose its agent fields) and AdminConfiguration.LatestBootstrapV2ScriptVersion.
-      6. Verify through the alias -- re-download each blob and compare SHA-256.
+      7. Reconcile the version oracles: version.json.bootstrapVersion and
+         .loaderVersion (read-modify-write under If-Match, so a concurrent agent
+         release cannot lose its agent fields) and
+         AdminConfiguration.LatestBootstrapV2ScriptVersion.
+      8. Verify through the alias -- re-download each blob and compare SHA-256.
 
-.PARAMETER SasToken
-    Container SAS for the eu storage account with write permission. Leading '?' tolerated.
+    Comparisons against a published script always strip its signature block first
+    (Get-ComparableText). A signature carries a timestamp, so signed bytes differ on
+    every run; without stripping, the bump guard and the drift check would report a
+    change for every unchanged script.
 
 .PARAMETER LegacySasToken
     Container SAS for the legacy account. Optional -- a mirror failure warns, never fails.
-
-.PARAMETER TableSasToken
-    Table SAS for AdminConfiguration. Optional -- omitted or 'XXX' skips the oracle update.
+    The legacy account lives in a different tenant, so the ambient Entra identity cannot
+    reach it; this is the only credential the publisher still takes.
 
 .PARAMETER RepoRoot
     Repository root. Defaults to the parent of .github/scripts.
 
 .PARAMETER DryRun
-    Run every check and render, upload nothing.
+    Run every check and render, upload nothing. A dry run signs when a token is supplied
+    and skips signing when it is not: the PR gate runs this without any Azure login.
+
+.PARAMETER SigningToken
+    Azure Key Vault access token for AzureSignTool. MANDATORY for a real publish -- an
+    unsigned customer script is not something this repo publishes. Together with
+    -KeyVaultUrl and -CertificateName.
+
+.PARAMETER ExpectedPublisher
+    Optional -like pattern the signer subject must match after signing. Pins the publisher
+    instead of accepting any trusted signature; the loader on the device pins the same way.
+
+.PARAMETER SignedOutputDir
+    Optional directory that receives a copy of every published file exactly as uploaded.
+    Used by CI to offer the signed scripts as a build artifact for local inspection.
 
 .EXAMPLE
     ./Publish-BootstrapScripts.ps1 -DryRun
 
 .EXAMPLE
-    ./Publish-BootstrapScripts.ps1 -SasToken $env:SAS -TableSasToken $env:TABLE_SAS
+    ./Publish-BootstrapScripts.ps1 -LegacySasToken $env:LEGACY_SAS -SigningToken $env:AKV_TOKEN `
+        -KeyVaultUrl $env:KV_URL -CertificateName $env:CERT
 #>
 [CmdletBinding()]
 param(
-    [string]$SasToken,
     [string]$LegacySasToken,
-    [string]$TableSasToken,
     [string]$RepoRoot,
+    [string]$SigningToken,
+    [string]$KeyVaultUrl,
+    [string]$CertificateName,
+    [string]$TimestampUrl = 'http://timestamp.acs.microsoft.com',
+    [string]$ExpectedPublisher,
+    [string]$SignedOutputDir,
     [switch]$DryRun
 )
 
@@ -66,9 +92,6 @@ $ErrorActionPreference = 'Stop'
 if (-not $RepoRoot) {
     $RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).Path
 }
-if (-not $DryRun -and [string]::IsNullOrWhiteSpace($SasToken)) {
-    throw 'SasToken is required unless -DryRun is used.'
-}
 
 $ContainerUrl       = 'https://autopilotmonitoreu.blob.core.windows.net/agent'
 $LegacyContainerUrl = 'https://autopilotmonitor.blob.core.windows.net/agent'
@@ -78,8 +101,23 @@ $TableUrl           = "https://autopilotmonitoreu.table.core.windows.net/AdminCo
 $BootstrapSource   = Join-Path $RepoRoot 'scripts/Bootstrap/Install-AutopilotMonitor.ps1'
 $BootstrapBlob     = 'Install-AutopilotMonitor.ps1'
 $DevBlob           = 'Install-AutopilotMonitor-Dev.ps1'
+# Stage 1. Assigned in Intune once, and embedded in the bootstrap MSI; it downloads the
+# bootstrap above on every device and verifies its publisher before running it.
+$LoaderSource      = Join-Path $RepoRoot 'scripts/Bootstrap/Start-AutopilotMonitor.ps1'
+$LoaderBlob        = 'Start-AutopilotMonitor.ps1'
+$LoaderDevBlob     = 'Start-AutopilotMonitor-Dev.ps1'
 $ScriptContentType = 'text/plain; charset=utf-8'
 
+$SigningEnabled = -not [string]::IsNullOrWhiteSpace($SigningToken)
+if (-not $DryRun -and -not $SigningEnabled) {
+    throw ('Publishing requires -SigningToken (plus -KeyVaultUrl and -CertificateName): the ' +
+           'loader on every device verifies the publisher of what it downloads, so an unsigned ' +
+           'script would be rejected in the field. Only -DryRun may run without signing.')
+}
+if ($SigningEnabled -and ([string]::IsNullOrWhiteSpace($KeyVaultUrl) -or [string]::IsNullOrWhiteSpace($CertificateName))) {
+    throw '-SigningToken needs -KeyVaultUrl and -CertificateName.'
+}
+
 function Get-HttpStatus {
     param($ErrorRecord)
     if ($ErrorRecord.Exception.PSObject.Properties['Response'] -and $ErrorRecord.Exception.Response) {
@@ -125,6 +163,132 @@ function Get-PublishBytes {
     return ,(New-Object System.Text.UTF8Encoding $false).GetBytes($normalised)
 }
 
+# A PowerShell signature is appended as a comment block at the end of the file, so the
+# published bytes are "source + signature". Everything that compares a published script to
+# its source has to cut that block off first -- the signature carries a timestamp and is
+# therefore different on every publish, while the script above it is unchanged.
+function Remove-SignatureBlock {
+    param([string]$Text)
+    $marker = '# SIG # Begin signature block'
+    $index = $Text.IndexOf($marker)
+    if ($index -lt 0) { return $Text }
+    return $Text.Substring(0, $index)
+}
+
+# Comparison form: no signature, LF, no trailing blank lines. Used for "is the published
+# copy still this source" -- never for what gets uploaded.
+function Get-ComparableText {
+    param([string]$Text)
+    return (Remove-SignatureBlock $Text).Replace("`r`n", "`n").TrimEnd("`n")
+}
+
+# Signs the publish set in place: each item's bytes are written to a work directory, signed
+# there, verified, and read back as the bytes that will be uploaded. Signing has to be the
+# last transformation -- the signature covers exactly these bytes, so nothing may normalise
+# or re-encode them afterwards.
+function Set-PublishSetSignature {
+    param([object[]]$Items, [string]$WorkDir)
+
+    if (-not (Get-Command azuresigntool -ErrorAction SilentlyContinue)) {
+        throw "azuresigntool is not on PATH. Install it with: dotnet tool install --global AzureSignTool --version 7.0.1"
+    }
+
+    New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
+
+    $paths = @()
+    foreach ($item in $Items) {
+        $path = Join-Path $WorkDir $item.BlobName
+        [System.IO.File]::WriteAllBytes($path, [byte[]]$item.Bytes)
+        $paths += $path
+    }
+
+    Write-Host "Signing $($paths.Count) script(s) with certificate '$CertificateName'..."
+    & azuresigntool.exe sign --verbose `
+        --azure-key-vault-url $KeyVaultUrl `
+        --azure-key-vault-accesstoken $SigningToken `
+        --azure-key-vault-certificate $CertificateName `
+        --timestamp-rfc3161 $TimestampUrl `
+        --file-digest sha256 `
+        --description 'Autopilot Monitor bootstrap' `
+        --description-url 'https://www.autopilotmonitor.com' `
+        $paths
+
+    # Native tool: PowerShell does not throw on a non-zero exit, and an unnoticed signing
+    # failure would publish unsigned scripts that every loader in the field then rejects.
+    if ($LASTEXITCODE -ne 0) {
+        throw "azuresigntool failed with exit code $LASTEXITCODE -- nothing was uploaded."
+    }
+
+    foreach ($item in $Items) {
+        $path = Join-Path $WorkDir $item.BlobName
+        $sig = Get-AuthenticodeSignature -FilePath $path
+        if ($sig.Status -ne 'Valid') {
+            throw "Signature on $($item.BlobName) is '$($sig.Status)', expected 'Valid'."
+        }
+        # Without a timestamp the signature dies with the certificate, and these scripts sit
+        # on customer devices far longer than a certificate lifetime.
+        if (-not $sig.TimeStamperCertificate) {
+            throw "Signature on $($item.BlobName) carries no timestamp."
+        }
+        if ($ExpectedPublisher -and $sig.SignerCertificate.Subject -notlike $ExpectedPublisher) {
+            throw "$($item.BlobName) was signed by '$($sig.SignerCertificate.Subject)', expected '$ExpectedPublisher'."
+        }
+        # Plain assignment, NO comma operator: the ',' elsewhere in this file exists because
+        # PowerShell unrolls an array RETURNED from a function, which is not what a property
+        # assignment does -- here it would wrap the byte[] in an Object[] of length 1 and the
+        # upload would fail converting it back.
+        $signedBytes = [System.IO.File]::ReadAllBytes($path)
+        if ($signedBytes.Length -le $item.Bytes.Length) {
+            throw ("Signed $($item.BlobName) is $($signedBytes.Length) bytes but the unsigned form " +
+                   "was $($item.Bytes.Length) -- a signature only ever adds bytes, so this is a " +
+                   'read-back bug, not a signing result.')
+        }
+        $item.Bytes = $signedBytes
+        Write-Host "  signed $($item.BlobName) ($($signedBytes.Length) bytes, signer $($sig.SignerCertificate.Subject.Split(',')[0]))"
+    }
+}
+
+# Aborts when a published script changed behaviour without a version bump. Consumers act on
+# the version (docs badge, version.json, the portal's outdated-script hint), so an unchanged
+# version has to mean unchanged behaviour.
+function Assert-VersionBump {
+    param(
+        [string]$BlobName,
+        [string]$SourceContent,
+        [string]$SourceOrigin,
+        [string]$SourceVersion
+    )
+
+    $publishedBytes = Get-PublishedBytes "$AliasUrl/$BlobName"
+    if ($null -eq $publishedBytes) {
+        Write-Host "No published $BlobName yet -- version-bump guard skipped (first publish)"
+        return
+    }
+
+    $publishedText = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
+    if ((Get-ComparableText $publishedText) -eq (Get-ComparableText $SourceContent)) {
+        Write-Host "Published $BlobName is already this source (signature block aside)"
+        return
+    }
+
+    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BlobName" -Optional
+
+    if ($null -eq $publishedVersion) {
+        Write-Host "::warning::The published $BlobName is not a readable script (no ScriptVersion found). Republishing over it."
+    } elseif ($publishedVersion -ne $SourceVersion) {
+        Write-Host "Version bump: $publishedVersion -> $SourceVersion ($BlobName)"
+    } elseif ((Get-CodeFingerprint -Text (Remove-SignatureBlock $publishedText) -Origin "$AliasUrl/$BlobName") -eq
+              (Get-CodeFingerprint -Text $SourceContent -Origin $SourceOrigin)) {
+        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
+        Write-Host "::warning::$BlobName changed in comments or formatting only; publishing under the unchanged version $SourceVersion."
+    } else {
+        throw ("Version-bump guard: $BlobName changed behaviour but ScriptVersion is still $SourceVersion. " +
+               "Bump it in $SourceOrigin -- the docs badge, version.json and the " +
+               'portal outdated-script hint all read that value, and customers decide from it whether ' +
+               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
+    }
+}
+
 function Get-BootstrapScriptVersion {
     param([string]$Content, [string]$Origin, [switch]$Optional)
     if ($Content -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"') { return $Matches[1] }
@@ -152,12 +316,16 @@ function Get-CodeFingerprint {
     return (($tokens | Where-Object { $ignored -notcontains $_.Kind.ToString() } | ForEach-Object { $_.Text }) -join "`n")
 }
 
-# ------------------------------------------------------------------ 1. source
+# ------------------------------------------------------------------ 1. sources
 $sourceContent = Get-Content $BootstrapSource -Raw
 $sourceBytes   = Get-PublishBytes $sourceContent
 $scriptVersion = Get-BootstrapScriptVersion -Content $sourceContent -Origin $BootstrapSource
 Write-Host "Bootstrap script version: $scriptVersion"
 
+$loaderContent = Get-Content $LoaderSource -Raw
+$loaderVersion = Get-BootstrapScriptVersion -Content $loaderContent -Origin $LoaderSource
+Write-Host "Loader script version: $loaderVersion"
+
 # ------------------------------------------------------------------ 2. dev render
 $stableUrlLiteral = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip"'
 $devUrlLiteral    = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent-dev.zip"'
@@ -170,33 +338,21 @@ if ($sourceContent.IndexOf($stableUrlLiteral) -lt 0 -or $sourceContent.IndexOf($
 $devContent = $sourceContent.Replace($stableUrlLiteral, $devUrlLiteral).Replace($stableManLiteral, $devManLiteral)
 Write-Host "Rendered $DevBlob (dev agent URL + version-dev.json)"
 
-# ------------------------------------------------------------------ 3. bump guard
-$publishedBytes = Get-PublishedBytes "$AliasUrl/$BootstrapBlob"
-if ($null -eq $publishedBytes) {
-    Write-Host 'No published bootstrap yet -- version-bump guard skipped (first publish)'
-} elseif ((Get-Sha256 $publishedBytes) -eq (Get-Sha256 $sourceBytes)) {
-    Write-Host 'Published bootstrap is already byte-identical to the source'
-} else {
-    $publishedText    = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
-    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BootstrapBlob" -Optional
+# The dev loader must fetch the dev bootstrap, or a dev device would run the stable chain.
+$stableLoaderLiteral = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1"'
+$devLoaderLiteral    = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor-Dev.ps1"'
 
-    if ($null -eq $publishedVersion) {
-        Write-Host "::warning::The published $BootstrapBlob is not a readable bootstrap script (no ScriptVersion found). Republishing over it."
-    } elseif ($publishedVersion -ne $scriptVersion) {
-        Write-Host "Version bump: $publishedVersion -> $scriptVersion"
-    } elseif ((Get-CodeFingerprint -Text $publishedText -Origin "$AliasUrl/$BootstrapBlob") -eq
-              (Get-CodeFingerprint -Text $sourceContent -Origin $BootstrapSource)) {
-        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
-        Write-Host "::warning::$BootstrapBlob changed in comments or formatting only; publishing under the unchanged version $scriptVersion."
-    } else {
-        throw ("Version-bump guard: $BootstrapBlob changed behaviour but ScriptVersion is still $scriptVersion. " +
-               "Bump it in $BootstrapSource -- the docs badge, version.json.bootstrapVersion and the " +
-               'portal outdated-script hint all read that value, and customers decide from it whether ' +
-               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
-    }
+if ($loaderContent.IndexOf($stableLoaderLiteral) -lt 0) {
+    throw "Loader dev-render: anchor literal missing in $LoaderSource"
 }
+$devLoaderContent = $loaderContent.Replace($stableLoaderLiteral, $devLoaderLiteral)
+Write-Host "Rendered $LoaderDevBlob (points at $DevBlob)"
 
-# ------------------------------------------------------------------ 4. upload
+# ------------------------------------------------------------------ 3. bump guards
+Assert-VersionBump -BlobName $BootstrapBlob -SourceContent $sourceContent -SourceOrigin $BootstrapSource -SourceVersion $scriptVersion
+Assert-VersionBump -BlobName $LoaderBlob    -SourceContent $loaderContent -SourceOrigin $LoaderSource    -SourceVersion $loaderVersion
+
+# ------------------------------------------------------------------ 4. publish set
 # Sources beyond the bootstrap pair, read straight from the repo.
 $extraSources = @(
     @{ Path = 'scripts/Bootstrap/Test-ShouldBootstrapAgent.ps1';       BlobName = 'Test-ShouldBootstrapAgent.ps1' }
@@ -206,20 +362,38 @@ $extraSources = @(
 # Uninstall-AutopilotMonitor.ps1 is deliberately NOT published: nothing links it, and
 # an unauthenticated uninstall script on the public download host is not a feature.
 
+# Text is the unsigned publish form and stays the reference for every comparison against a
+# published copy; Bytes is what goes on the wire and carries the signature after step 4.
 $publishSet = [System.Collections.Generic.List[object]]::new()
-$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Bytes = $sourceBytes })
-$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Bytes = (Get-PublishBytes $devContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $LoaderBlob;    Text = $loaderContent;    Bytes = (Get-PublishBytes $loaderContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $LoaderDevBlob; Text = $devLoaderContent; Bytes = (Get-PublishBytes $devLoaderContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Text = $sourceContent;    Bytes = $sourceBytes })
+$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Text = $devContent;       Bytes = (Get-PublishBytes $devContent) })
 foreach ($extra in $extraSources) {
     $extraPath = Join-Path $RepoRoot $extra.Path
     if (-not (Test-Path $extraPath)) {
         throw "Publish source missing: $extraPath"
     }
-    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Bytes = (Get-PublishBytes (Get-Content $extraPath -Raw)) })
+    $extraText = Get-Content $extraPath -Raw
+    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Text = $extraText; Bytes = (Get-PublishBytes $extraText) })
+}
+
+# ------------------------------------------------------------------ 5. sign
+# After this point the bytes are final. Normalising, re-encoding or rewriting a line ending
+# would invalidate the signature, and the device-side loader would refuse the script.
+if ($SigningEnabled) {
+    Set-PublishSetSignature -Items $publishSet -WorkDir (Join-Path ([System.IO.Path]::GetTempPath()) "apm-publish-$PID")
+} else {
+    Write-Host '::warning::No signing token supplied -- dry run continues with unsigned scripts.'
 }
 
 $legacySas = if ($LegacySasToken) { $LegacySasToken.TrimStart('?') } else { '' }
-$writeSas  = if ($SasToken) { $SasToken.TrimStart('?') } else { '' }
 
+# Acquired lazily: a dry run must stay runnable without any Azure login -- the PR gate
+# (bootstrap-script-gates.yml) executes this script with -DryRun and never logs in.
+$authHeaders = if ($DryRun) { $null } else { & (Join-Path $PSScriptRoot 'Get-StorageAuthHeaders.ps1') }
+
+# ------------------------------------------------------------------ 6. upload
 foreach ($item in $publishSet) {
     # Explicit type, not a convenience: an Object[] body is uploaded as space-separated
     # decimals rather than raw bytes, and every hash check still passes because [byte[]]
@@ -227,11 +401,21 @@ foreach ($item in $publishSet) {
     [byte[]]$bytes = $item.Bytes
     $item | Add-Member -NotePropertyName Sha256 -NotePropertyValue (Get-Sha256 $bytes) -Force
 
+    # Exactly the bytes that go on the wire, for the CI artifact. Written in a dry run too:
+    # that is the run an operator uses to inspect a signed script before it is published.
+    if ($SignedOutputDir) {
+        New-Item -ItemType Directory -Force -Path $SignedOutputDir | Out-Null
+        [System.IO.File]::WriteAllBytes((Join-Path $SignedOutputDir $item.BlobName), $bytes)
+    }
+
     if ($DryRun) {
-        # Doubles as a drift check: says per blob whether the alias already serves this source.
+        # Doubles as a drift check: says per blob whether the alias already serves this
+        # source. Compared as text without the signature block -- signed bytes differ on
+        # every run, so a byte comparison would report drift for every unchanged script.
         $served = Get-PublishedBytes "$AliasUrl/$($item.BlobName)"
         $state = if ($null -eq $served) { 'MISSING on the alias' }
-                 elseif ((Get-Sha256 $served) -eq $item.Sha256) { 'already current' }
+                 elseif ((Get-ComparableText ([System.Text.Encoding]::UTF8.GetString($served))) -eq
+                         (Get-ComparableText $item.Text)) { 'already current' }
                  else { 'STALE on the alias' }
         Write-Host "  [dry-run] $($item.BlobName) ($($bytes.Length) bytes, sha256 $($item.Sha256)) -- $state"
         continue
@@ -241,8 +425,18 @@ foreach ($item in $publishSet) {
     # with Front Door. Route caching is disabled there, but a stale script paired with a
     # fresh manifest would fail the bootstrap SHA check -- this keeps that class of bug
     # impossible even if caching is ever re-enabled.
-    $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = $ScriptContentType; 'x-ms-blob-cache-control' = 'no-cache' }
-    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)?$writeSas" -Method Put -Headers $headers -Body $bytes | Out-Null
+    #
+    # Content-Disposition: without it a text/plain blob opens as a web page in every
+    # browser, and the documented "download the script" step silently becomes "copy this
+    # text". The header makes the link a download everywhere, and command-line clients
+    # (the loader, the MSI, curl) ignore it.
+    $headers = @{
+        'x-ms-blob-type'                = 'BlockBlob'
+        'Content-Type'                  = $ScriptContentType
+        'x-ms-blob-cache-control'       = 'no-cache'
+        'x-ms-blob-content-disposition' = ('attachment; filename="{0}"' -f $item.BlobName)
+    }
+    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)" -Method Put -Headers ($authHeaders + $headers) -Body $bytes | Out-Null
 
     # Read straight back from the blob (authoritative, no CDN in the way) before touching the
     # mirror or the next file. The alias verification at the end would catch a bad body too,
@@ -266,7 +460,7 @@ foreach ($item in $publishSet) {
     }
 }
 
-# ------------------------------------------------------------------ 5. version oracles
+# ------------------------------------------------------------------ 7. version oracles
 # version.json is the agent manifest; only bootstrapVersion belongs to us. Read from the
 # blob (not the alias) for an authoritative ETag, write back under If-Match so a concurrent
 # agent release cannot lose its version/sha256 fields.
@@ -278,11 +472,15 @@ if (-not $DryRun) {
         } else { [string]$manifestResp.Content }
         $manifest = $manifestRaw | ConvertFrom-Json
 
-        if ($manifest.bootstrapVersion -eq $scriptVersion) {
-            Write-Host "version.json already reports bootstrapVersion $scriptVersion"
+        if ($manifest.bootstrapVersion -eq $scriptVersion -and $manifest.loaderVersion -eq $loaderVersion) {
+            Write-Host "version.json already reports bootstrapVersion $scriptVersion and loaderVersion $loaderVersion"
         } else {
             $etag = '"' + ([string]($manifestResp.Headers['ETag'] | Select-Object -First 1)).Trim('"') + '"'
             $manifest | Add-Member -NotePropertyName 'bootstrapVersion' -NotePropertyValue $scriptVersion -Force
+            # Additive: no consumer reads loaderVersion yet. It exists so support can tell
+            # which stage-1 file a device was assigned -- stage 2 is always current by
+            # construction, so its version says nothing about the customer's Intune copy.
+            $manifest | Add-Member -NotePropertyName 'loaderVersion' -NotePropertyValue $loaderVersion -Force
             $body = [System.Text.Encoding]::UTF8.GetBytes(($manifest | ConvertTo-Json -Compress))
             $manifestHeaders = @{
                 'x-ms-blob-type'          = 'BlockBlob'
@@ -290,8 +488,8 @@ if (-not $DryRun) {
                 'x-ms-blob-cache-control' = 'no-cache'
                 'If-Match'                = $etag
             }
-            Invoke-RestMethod -Uri "$ContainerUrl/version.json?$writeSas" -Method Put -Headers $manifestHeaders -Body $body | Out-Null
-            Write-Host "version.json bootstrapVersion -> $scriptVersion (agent fields untouched)"
+            Invoke-RestMethod -Uri "$ContainerUrl/version.json" -Method Put -Headers ($authHeaders + $manifestHeaders) -Body $body | Out-Null
+            Write-Host "version.json bootstrapVersion -> $scriptVersion, loaderVersion -> $loaderVersion (agent fields untouched)"
 
             if ($legacySas) {
                 try {
@@ -310,11 +508,8 @@ if (-not $DryRun) {
     }
 }
 
-$tableSas = if ($TableSasToken) { $TableSasToken.TrimStart('?') } else { '' }
 if ($DryRun) {
     Write-Host "  [dry-run] would set AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
-} elseif ([string]::IsNullOrEmpty($tableSas) -or $tableSas -eq 'XXX') {
-    Write-Host 'SKIPPED: AdminConfiguration update -- set AZURE_TABLE_ADMIN_SAS_TOKEN to enable the portal version oracle'
 } else {
     $tableHeaders = @{
         'Content-Type' = 'application/json'
@@ -322,11 +517,11 @@ if ($DryRun) {
         'If-Match'     = '*'
     }
     $tableBody = @{ LatestBootstrapV2ScriptVersion = $scriptVersion } | ConvertTo-Json
-    Invoke-RestMethod -Uri "$TableUrl`?$tableSas" -Method Merge -Headers $tableHeaders -Body $tableBody | Out-Null
+    Invoke-RestMethod -Uri $TableUrl -Method Merge -Headers ($authHeaders + $tableHeaders) -Body $tableBody | Out-Null
     Write-Host "AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
 }
 
-# ------------------------------------------------------------------ 6. verify via alias
+# ------------------------------------------------------------------ 8. verify via alias
 if (-not $DryRun) {
     $pending = [System.Collections.ArrayList]::new()
     $publishSet | ForEach-Object { [void]$pending.Add($_) }
@@ -358,7 +553,8 @@ if ($env:GITHUB_STEP_SUMMARY) {
     $summary = @(
         "### Bootstrap scripts: $mode",
         '',
-        "Bootstrap script version: **$scriptVersion**",
+        "Loader script version: **$loaderVersion** | Bootstrap script version: **$scriptVersion**",
+        "Signed: **$(if ($SigningEnabled) { "yes, certificate '$CertificateName'" } else { 'NO (unsigned dry run)' })**",
         ''
     ) + ($publishSet | ForEach-Object { "- $($_.BlobName) -- sha256 $($_.Sha256)" })
     ($summary -join [Environment]::NewLine) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8

.github/scripts/Request-BuildNumber.ps1

@@ -12,7 +12,8 @@
     A failed build burns a number, which is harmless -- uniqueness matters,
     density does not.
 
-    The blob is public-read; only the write needs the container SAS.
+    The blob is public-read; only the write needs authorization, and that comes from the
+    ambient Entra identity (see Get-StorageAuthHeaders.ps1) -- no secret is passed in.
 
     Why a counter and not the published version manifest: manifests are written
     on publish, not on build (the agent writes version.json only for stable
@@ -20,10 +21,7 @@
     overwrite each other's versioned artifact.
 
 .PARAMETER CounterUrl
-    Full URL of the counter blob, without SAS.
-
-.PARAMETER SasToken
-    Container SAS with create+write permission. A leading '?' is tolerated.
+    Full URL of the counter blob.
 
 .PARAMETER Override
     Explicit build number instead of counter+1. If it is not greater than the
@@ -37,20 +35,19 @@
     [int] the reserved build number. Progress goes to the host, not the pipeline.
 
 .EXAMPLE
-    $n = ./Request-BuildNumber.ps1 -CounterUrl $url -SasToken $sas
+    $n = ./Request-BuildNumber.ps1 -CounterUrl $url
 #>
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)][string]$CounterUrl,
-    [Parameter(Mandatory = $true)][string]$SasToken,
     [int]$Override = 0,
     [int]$MaxAttempts = 5
 )
 
 $ErrorActionPreference = 'Stop'
 
-# Tolerate both secret formats ("sp=cw&..." and "?sp=cw&...").
-$writeUrl = $CounterUrl + '?' + $SasToken.TrimStart('?')
+# The write is Entra-authorized; the read below stays anonymous (public container).
+$authHeaders = & (Join-Path $PSScriptRoot 'Get-StorageAuthHeaders.ps1')
 
 function Get-HttpStatus {
     param($ErrorRecord)
@@ -85,8 +82,8 @@ for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
     $target = if ($Override -gt 0) { $Override } else { $counter.Value + 1 }
 
     try {
-        $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'If-Match' = $counter.ETag }
-        Invoke-RestMethod -Uri $writeUrl -Method Put -Headers $headers -Body "$target" -ContentType 'text/plain' | Out-Null
+        $headers = $authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'If-Match' = $counter.ETag }
+        Invoke-RestMethod -Uri $CounterUrl -Method Put -Headers $headers -Body "$target" -ContentType 'text/plain' | Out-Null
         Write-Host "  Reserved build number $target (CAS write ok, attempt $attempt)"
         return $target
     } catch {

.github/workflows/action-pins.yml

@@ -0,0 +1,70 @@
+name: Action Pin Gate
+
+# Every third-party action must be referenced by a full commit SHA, never by a tag.
+# Tags are mutable: whoever controls an action repository can repoint v4 at new code,
+# and that code runs inside jobs that hold the code-signing identity, the storage
+# credentials and a token that can push to main. A SHA is the only reference an
+# upstream owner cannot change under us.
+#
+# Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
+# the other workflow files, so a guard placed there would stay silent for exactly the
+# commits it needs to inspect.
+#
+# Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
+# run is a signal to act on, not a merge barrier. Making it binding means adding
+# 'Verify action pins' as a required status check -- a branch-protection decision, not
+# something this file can assert.
+#
+# The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
+# PR that rewrites both the SHA and the trailing version comment. The comment is
+# therefore required too: it is what makes a pinned line reviewable.
+
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pins:
+    name: Verify action pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Every third-party action is pinned to a SHA
+        run: |
+          set -uo pipefail
+          failed=0
+          while IFS=: read -r file line ref; do
+            # Reusable workflows from this repository move with the commit that calls
+            # them, so there is nothing to pin.
+            case "$ref" in ./*) continue ;; esac
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
+              continue
+            fi
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+            else
+              echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
+            fi
+            failed=1
+          # -H is load-bearing: with a single matching file grep omits the name, the
+          # fields shift by one and every diagnostic points at nothing.
+          done < <(grep -nHE '^[[:space:]]*(-[[:space:]]+)?uses:' .github/workflows/*.yml \
+                   | sed -E 's/^([^:]+):([0-9]+):[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*/\1:\2:/')
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::Unpinned action references found -- fix them before this reaches main."
+            exit 1
+          fi
+          echo "All action references are pinned to commit SHAs."

.github/workflows/bootstrap-script-gates.yml

@@ -18,7 +18,7 @@ jobs:
     name: Bootstrap guard tests (PS 5.1)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install Pester 5+
         shell: powershell

.github/workflows/build-agent.yml

@@ -27,6 +27,10 @@ on:
         required: false
         type: boolean
         default: false
+      release_notes:
+        description: 'Customer-facing notes for the GitHub Release (Markdown bullets). Empty = generic fallback linking to the docs changelog'
+        required: false
+        type: string
 
 permissions:
   contents: write
@@ -53,6 +57,13 @@ env:
   VERSIONED_ZIP: AutopilotMonitor-Agent-v2.zip
   STABLE_ZIP: AutopilotMonitor-Agent.zip
   STABLE_MANIFEST: version.json
+  # Authenticode via Azure Key Vault; identity and vault come from repository variables.
+  # CODE_SIGN_EXPECTED_SUBJECT is optional and pins the publisher in the verify step.
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
   build:
@@ -61,14 +72,66 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      # Every released build is signed; a missing variable stops the run before a build
+      # number is burnt.
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Every released build must be Authenticode-signed."
+            }
+          }
+          Write-Host "Code-signing configuration present (certificate '$env:CODE_SIGN_CERTIFICATE_NAME')"
+
+      # Logs in FIRST and only to fetch the Key Vault token: azure/login sets the default az
+      # account, so the storage login below has to be the last one. Both federated credentials
+      # are bound to the ref, so this job must never be given an `environment:` -- that would
+      # change the OIDC subject claim and break both logins.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # Every storage write below (counter blob, agent ZIP, manifests, AdminConfiguration)
+      # is authorized by this federated identity -- no SAS secret. One login covers the whole
+      # job: the federated credential is bound to the ref, and a release run takes ~2 minutes,
+      # well inside the token lifetime. Only the legacy mirror still needs a SAS: that account
+      # lives in the pre-migration tenant, where this principal has no identity.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
       - name: Setup .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
+      # Version pinned; roll-forward because the tool targets an older runtime than the SDK above.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
       # Build numbers come from the shared counter blob -- one counter and one
       # implementation for CI and the local build (.github/scripts/Request-BuildNumber.ps1).
       # Reserve-before-build with ETag-CAS: concurrent builds can never mint the same
@@ -81,7 +144,6 @@ jobs:
         # build_number could otherwise break out of the quotes and run arbitrary code.
         env:
           BUILD_NUMBER_OVERRIDE: ${{ inputs.build_number }}
-          AGENT_SAS_TOKEN: ${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}
         run: |
           $override = 0
           if ($env:BUILD_NUMBER_OVERRIDE -ne '') {
@@ -92,7 +154,7 @@ jobs:
           }
 
           $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v$($env:LINE_MAJOR).txt"
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken $env:AGENT_SAS_TOKEN -Override $override
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -Override $override
 
           $csproj = Get-Content $env:CSPROJ_PATH -Raw
           if ($csproj -match '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -125,6 +187,47 @@ jobs:
       - name: Run Agent unit tests
         run: dotnet test ${{ env.TEST_PROJECT }} --configuration Release --no-restore --verbosity quiet
 
+      # Authenticode over everything we author; third-party assemblies keep their own signature.
+      #
+      # THE POSITION IS LOAD-BEARING: signing rewrites the PE file, so it must run before the
+      # ZIP and every SHA-256 in the next step -- those hashes are the bootstrap's integrity
+      # oracle, and hashes taken before signing match no downloaded file.
+      #
+      # $LASTEXITCODE is checked explicitly: PowerShell does not throw on a native non-zero exit.
+      - name: Sign agent binaries (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $targets = @()
+          $targets += Get-ChildItem -Path "$env:AGENT_OUTPUT/*" -Include 'AutopilotMonitor.*.exe', 'AutopilotMonitor.*.dll' -File
+          $targets += Get-ChildItem -Path "$env:DIALOG_OUTPUT/AutopilotMonitor.SummaryDialog.exe" -File
+
+          if (-not ($targets | Where-Object Name -eq 'AutopilotMonitor.Agent.exe')) {
+            throw "AutopilotMonitor.Agent.exe not found in $env:AGENT_OUTPUT -- nothing to sign."
+          }
+          if (-not ($targets | Where-Object Name -eq 'AutopilotMonitor.SummaryDialog.exe')) {
+            throw "AutopilotMonitor.SummaryDialog.exe not found in $env:DIALOG_OUTPUT -- nothing to sign."
+          }
+
+          $targets | ForEach-Object { Write-Host "Signing $($_.Name)" }
+
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description "Autopilot Monitor Agent" `
+            --description-url "https://www.autopilotmonitor.com" `
+            ($targets | ForEach-Object { $_.FullName })
+
+          if ($LASTEXITCODE -ne 0) {
+            throw "azuresigntool failed with exit code $LASTEXITCODE -- aborting before anything is published."
+          }
+
       - name: Create release artifact
         id: artifact
         shell: pwsh
@@ -215,12 +318,57 @@ jobs:
           "sha256=$sha256Hash" >> $env:GITHUB_OUTPUT
           "exe_sha256=$exeSha256Hash" >> $env:GITHUB_OUTPUT
 
+      # Verified against the STAGING copy -- the exact bytes that ship. The invariant is "every
+      # AutopilotMonitor PE in the ZIP is signed", so a project added later cannot ride along
+      # unsigned. A missing timestamp fails too: without it the signature dies with the cert.
+      - name: Verify Authenticode signatures
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $files = Get-ChildItem -Path "staging/agent/*" -Include 'AutopilotMonitor.*.exe', 'AutopilotMonitor.*.dll' -File
+          if ($files.Count -lt 2) {
+            throw "Expected signed binaries in staging/agent, found $($files.Count)."
+          }
+
+          $failed = $false
+          $thumbprints = @{}
+          foreach ($file in $files) {
+            $sig = Get-AuthenticodeSignature -FilePath $file.FullName
+            if ($sig.Status -ne 'Valid') {
+              Write-Host "::error file=$($file.Name)::Signature status is '$($sig.Status)' -- expected 'Valid'."
+              $failed = $true
+              continue
+            }
+            if (-not $sig.TimeStamperCertificate) {
+              Write-Host "::error file=$($file.Name)::Signature carries no RFC-3161 timestamp -- it would expire with the certificate."
+              $failed = $true
+              continue
+            }
+            if (-not [string]::IsNullOrWhiteSpace($env:CODE_SIGN_EXPECTED_SUBJECT) -and
+                $sig.SignerCertificate.Subject -notlike $env:CODE_SIGN_EXPECTED_SUBJECT) {
+              Write-Host "::error file=$($file.Name)::Signed by '$($sig.SignerCertificate.Subject)', expected '$env:CODE_SIGN_EXPECTED_SUBJECT'."
+              $failed = $true
+              continue
+            }
+            $thumbprints[$sig.SignerCertificate.Thumbprint] = $true
+            Write-Host "$($file.Name): Valid, timestamped $($sig.TimeStamperCertificate.Subject.Split(',')[0]), signer $($sig.SignerCertificate.Subject)"
+          }
+
+          if ($thumbprints.Count -gt 1) {
+            Write-Host "::error::Staged binaries carry $($thumbprints.Count) different signing certificates -- expected exactly one."
+            $failed = $true
+          }
+          if ($failed) {
+            throw "Signature verification failed. Nothing was published."
+          }
+          Write-Host "All $($files.Count) binaries signed with certificate $($thumbprints.Keys -join ', ')"
+
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
           # Legacy mirror (transition until customers moved to the download.-alias):
           # blobs are ALSO pushed to the old account so the bootstrap URL baked into
           # customers' Intune scripts keeps serving current bits. Fail-soft -- a
@@ -230,7 +378,6 @@ jobs:
 
           function Send-Blob {
             param([string]$Local, [string]$BlobName, [string]$ContentType)
-            $url = "$containerUrl/$BlobName`?$sasToken"
             $bytes = [System.IO.File]::ReadAllBytes($Local)
             # no-cache on EVERY blob: they all rotate in place (even the per-line ZIP is
             # overwritten each build), and the download alias fronts them with Front Door.
@@ -244,7 +391,7 @@ jobs:
               $md5.Dispose()
             }
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1MB, 2)) MB)..."
-            Invoke-RestMethod -Uri $url -Method Put -Headers $headers -Body $bytes
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName" -Method Put -Headers ($authHeaders + $headers) -Body $bytes
             Write-Host "  uploaded $BlobName"
             if (-not [string]::IsNullOrEmpty($legacySasToken)) {
               try {
@@ -270,63 +417,79 @@ jobs:
             # to main, so a release lands a set that is consistent with what is already live
             # (dev render, version-bump guard, bootstrapVersion oracles, alias verification).
             # Runs AFTER version.json so its bootstrapVersion read sees this build's manifest.
+            # Signed with the same identity: the device-side loader verifies the publisher
+            # of what it downloads, and the publisher refuses to upload unsigned scripts.
             ./.github/scripts/Publish-BootstrapScripts.ps1 `
-              -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
               -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
-              -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}'
+              -SigningToken $env:CODE_SIGN_AKV_ACCESS_TOKEN `
+              -KeyVaultUrl $env:CODE_SIGN_KEY_VAULT_URL `
+              -CertificateName $env:CODE_SIGN_CERTIFICATE_NAME `
+              -TimestampUrl $env:CODE_SIGN_TIMESTAMP_URL `
+              -ExpectedPublisher $env:CODE_SIGN_EXPECTED_SUBJECT
           }
 
           # Update AdminConfiguration LatestAgentV2* -- ONLY on stable cutover. The hash-oracle
           # must never point at a build that is not actually in the stable namespace.
           # LatestBootstrapV2ScriptVersion is NOT set here: it belongs to the script publisher
           # above, which also owns it on script-only pushes. One writer per field.
-          $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}".TrimStart('?')
           if ('${{ inputs.publish_as_stable }}' -ne 'true') {
             Write-Host "SKIPPED: AdminConfiguration update (versioned-only run -- stable namespace unchanged)"
-          } elseif ([string]::IsNullOrEmpty($tableSasToken) -or $tableSasToken -eq "XXX") {
-            Write-Host "SKIPPED: Table SAS token not configured -- set AZURE_TABLE_ADMIN_SAS_TOKEN secret to enable backend hash-oracle"
           } else {
             $sha256 = "${{ steps.artifact.outputs.sha256 }}"
             $exeSha256 = "${{ steps.artifact.outputs.exe_sha256 }}"
             $agentVersion = "${{ steps.version.outputs.version }}"
-            $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')?$tableSasToken"
+            $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')"
             $tableBody = @{
               LatestAgentV2Version    = $agentVersion
               LatestAgentV2Sha256     = $sha256
               LatestAgentV2ExeSha256  = $exeSha256
             }
-            Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers @{
+            Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers ($authHeaders + @{
               "Content-Type" = "application/json"
               "Accept"       = "application/json;odata=nometadata"
               "If-Match"     = "*"
-            } -Body ($tableBody | ConvertTo-Json)
+            }) -Body ($tableBody | ConvertTo-Json)
             Write-Host "AdminConfiguration updated: V2 version=$agentVersion, sha256=$sha256, exeSha256=$exeSha256"
           }
 
-      # Sigstore keyless provenance: binds the ZIP digest to this workflow run (repo, ref,
-      # commit, workflow file) in a public transparency log. The digest covers the identical
+      # Sigstore keyless provenance: binds the artifact digests to this workflow run (repo, ref,
+      # commit, workflow file) in a public transparency log. The digests cover the identical
       # bytes uploaded to blob (versioned AND stable), so one attestation covers all copies.
-      # Verify: gh attestation verify <zip> --repo okieselbach/AutopilotMonitor
-      - name: Attest build provenance (ZIP)
-        uses: actions/attest-build-provenance@v4
+      # Complements Authenticode rather than replacing it: the signature says who published a
+      # binary, the attestation which build produced these exact bytes. Both EXEs are subjects
+      # of their own so an extracted binary can be verified without the ZIP.
+      # Verify: gh attestation verify <file> --repo okieselbach/AutopilotMonitor
+      # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
+      - name: Attest build provenance
+        if: inputs.upload_blob || inputs.create_release
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
-          subject-path: ${{ steps.artifact.outputs.versioned_zip_release }}
+          subject-path: |
+            ${{ steps.artifact.outputs.versioned_zip_release }}
+            staging/agent/AutopilotMonitor.Agent.exe
+            staging/agent/AutopilotMonitor.SummaryDialog.exe
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
           path: ${{ steps.artifact.outputs.versioned_zip_release }}
 
       - name: Upload version metadata
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: version-metadata
           path: ${{ env.MANIFEST_NAME }}
 
       # First-party `gh` instead of a third-party action: this job holds contents:write,
       # id-token:write and attestations:write, so no code we do not control runs here.
-      # --generate-notes appends the auto-generated notes below the body.
+      # The "What's new" section comes ONLY from the release_notes input -- CI never
+      # composes customer-facing text from commits. An empty input writes a generic
+      # fallback that links to the docs changelog and carries the HTML-comment marker
+      # below; the operator tooling scans release bodies for that marker to find the
+      # last release with real notes, so the next noted release covers the gap.
+      # Never rename the marker. --generate-notes is not used: it lists pull requests
+      # only (Dependabot noise); the compare link to the previous tag replaces it.
       - name: Create GitHub Release
         if: inputs.create_release
         shell: pwsh
@@ -336,19 +499,8 @@ jobs:
           RELEASE_NAME: Autopilot Monitor Agent ${{ steps.version.outputs.version }}
           RELEASE_PRERELEASE: ${{ inputs.prerelease }}
           RELEASE_ZIP: ${{ steps.artifact.outputs.versioned_zip_release }}
-          RELEASE_BODY: |
-            ## Autopilot Monitor Agent ${{ steps.version.outputs.version }}
-
-            ### Installation
-            1. Download `AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip`
-            2. Extract to `C:\ProgramData\AutopilotMonitor\Agent\`
-            3. Run `AutopilotMonitor.Agent.exe --install` to register the Scheduled Task
-
-            ### Included Components
-            - **AutopilotMonitor.Agent.exe** - Monitoring agent (V2 release line)
-            - **AutopilotMonitor.SummaryDialog.exe** - Enrollment summary dialog (WPF)
-            - **version-v2.json** - Per-line version manifest
-
+          RELEASE_NOTES: ${{ inputs.release_notes }}
+          RELEASE_BODY_TAIL: |
             ### Version Info
             - **Version:** ${{ steps.version.outputs.version }}
             - **Build Number:** ${{ steps.version.outputs.build_number }}
@@ -357,14 +509,35 @@ jobs:
             - **Published as stable:** ${{ inputs.publish_as_stable }}
 
             ### Provenance
-            This ZIP carries a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
+            The executables are Authenticode-signed and timestamped. The ZIP and both executables carry a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
             ```
             gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/AutopilotMonitor
             ```
         run: |
           $ErrorActionPreference = 'Stop'
+
+          $notes = "$env:RELEASE_NOTES".Trim()
+          if ($notes -eq '') {
+            $notes = "Minor enhancements and bug fixes. See the [Agent Changelog](https://docs.autopilotmonitor.com/changelog/agent-changelog) for details.`n<!-- release-notes: none -->"
+          }
+
+          # Previous release for the compare link. Fail-soft: the first release has none,
+          # and a listing hiccup must never fail a release.
+          $prevTag = ''
+          $eap = $ErrorActionPreference
+          $ErrorActionPreference = 'Continue'
+          try {
+            $prevTag = "$(gh release list --repo $env:GITHUB_REPOSITORY --limit 1 --exclude-drafts --json tagName -q '.[0].tagName' 2>$null)".Trim()
+          } catch { $prevTag = '' }
+          $ErrorActionPreference = $eap
+          $compare = ''
+          if ($prevTag -ne '' -and $prevTag -ne $env:RELEASE_TAG) {
+            $compare = "`n`n**Full changelog:** https://github.com/$env:GITHUB_REPOSITORY/compare/$prevTag...$env:RELEASE_TAG`n"
+          }
+
+          $body = "### What's new`n$notes`n`n" + "$env:RELEASE_BODY_TAIL".TrimEnd() + $compare
           $notesFile = Join-Path $env:RUNNER_TEMP 'release-notes.md'
-          Set-Content -Path $notesFile -Value $env:RELEASE_BODY -Encoding utf8 -NoNewline
+          Set-Content -Path $notesFile -Value $body -Encoding utf8 -NoNewline
 
           $ghArgs = @(
             'release', 'create', $env:RELEASE_TAG,
@@ -372,8 +545,7 @@ jobs:
             '--repo', $env:GITHUB_REPOSITORY,
             '--target', $env:GITHUB_SHA,
             '--title', $env:RELEASE_NAME,
-            '--notes-file', $notesFile,
-            '--generate-notes'
+            '--notes-file', $notesFile
           )
           if ($env:RELEASE_PRERELEASE -eq 'true') { $ghArgs += '--prerelease' }
 

.github/workflows/build-msi.yml

@@ -1,11 +1,11 @@
 name: Build & Publish Bootstrap MSI
 
 # Thin MDM LOB delivery vehicle for WDP (Autopilot v2) — see
-# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI carries no bootstrap
-# logic (only the runner script that downloads the CURRENT server-hosted
-# Install-AutopilotMonitor.ps1), so it is rebuilt rarely: only when the runner script
-# or the WiX package changes. Version lives in Package.wxs — bump it there before
-# dispatching so Intune LOB update detection sees a new ProductVersion.
+# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI is packaging only: it
+# carries the SAME stage-1 loader that is assigned directly in Intune, so it is rebuilt
+# rarely — only when that loader or the WiX package changes. Version lives in Package.wxs
+# — bump it there before dispatching so Intune LOB update detection sees a new
+# ProductVersion.
 
 on:
   workflow_dispatch:
@@ -23,8 +23,15 @@ permissions:
 
 env:
   MSI_PROJECT_DIR: src/Agent/AutopilotMonitor.BootstrapMsi
-  RUNNER_SCRIPT: src/Agent/AutopilotMonitor.BootstrapMsi/Invoke-BootstrapDownload.ps1
+  RUNNER_SCRIPT: scripts/Bootstrap/Start-AutopilotMonitor.ps1
   STABLE_MSI: AutopilotMonitor-Bootstrap.msi
+  # Authenticode via Azure Key Vault; identity and vault come from repository variables.
+  # CODE_SIGN_EXPECTED_SUBJECT is optional and pins the publisher in the verify steps.
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
   build:
@@ -33,10 +40,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      # The runner executes as SYSTEM on every enrolling device — a parse error or
+      # The loader executes as SYSTEM on every enrolling device — a parse error or
       # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
+      # bootstrap-script-gates.yml runs the same checks plus Pester on pushes; this job
+      # stands on its own because it can be dispatched at any time.
       - name: Validate runner script (parse + ASCII-only)
         shell: pwsh
         run: |
@@ -62,8 +71,77 @@ jobs:
           Write-Host "MSI version (from Package.wxs): $version"
           "version=$version" >> $env:GITHUB_OUTPUT
 
+      # Every published MSI is signed; a missing variable stops the run before the build.
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Every published MSI must be Authenticode-signed."
+            }
+          }
+
+      # Logs in FIRST and only to fetch the Key Vault token: azure/login sets the default az
+      # account, so the storage login below has to be the last one. Both federated credentials
+      # are bound to the ref, so this job must never be given an `environment:` -- that would
+      # change the OIDC subject claim and break both logins.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # The blob upload below is authorized by this federated identity, not by a SAS.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # Exact version, not a "5.*" range: wix writes the bytes of the MSI that customers
+      # install, so a compromised or simply broken point release must not flow into a build
+      # unnoticed. Bumping is a reviewed commit.
       - name: Install WiX toolset
-        run: dotnet tool install --global wix --version "5.*"
+        run: dotnet tool install --global wix --version 5.0.2
+
+      # Version pinned; roll-forward because the tool targets an older runtime than the SDK.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
+      # BEFORE the build: wix embeds the file as it finds it, so a loader signed afterwards
+      # would leave the copy inside the MSI unsigned. Devices under an AllSigned policy need
+      # the embedded loader to carry a signature of its own.
+      - name: Sign bootstrap loader (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description 'Autopilot Monitor bootstrap runner' `
+            --description-url 'https://www.autopilotmonitor.com' `
+            $env:RUNNER_SCRIPT
+          if ($LASTEXITCODE -ne 0) { throw "azuresigntool failed with exit code $LASTEXITCODE" }
 
       - name: Build MSI
         shell: pwsh
@@ -75,16 +153,46 @@ jobs:
           wix build Package.wxs -arch x64 -o $out
           Pop-Location
           if (-not (Test-Path $env:STABLE_MSI)) { Write-Error "wix build produced no MSI"; exit 1 }
-          $sha256 = (Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant()
           Write-Host "Built $env:STABLE_MSI ($([math]::Round((Get-Item $env:STABLE_MSI).Length / 1KB)) KB)"
-          Write-Host "SHA-256: $sha256"
+
+      # Signing rewrites the MSI, so it runs before the hash and the upload. A missing
+      # timestamp fails the run: without it the signature dies with the certificate.
+      - name: Sign MSI (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description 'Autopilot Monitor Bootstrap' `
+            --description-url 'https://www.autopilotmonitor.com' `
+            $env:STABLE_MSI
+          if ($LASTEXITCODE -ne 0) { throw "azuresigntool failed with exit code $LASTEXITCODE" }
+
+          # The MSI and the loader it carries -- verified here, before anything is published.
+          foreach ($file in @($env:STABLE_MSI, $env:RUNNER_SCRIPT)) {
+            $sig = Get-AuthenticodeSignature -FilePath $file
+            if ($sig.Status -ne 'Valid') { throw "Signature on $file is '$($sig.Status)', expected 'Valid'." }
+            if (-not $sig.TimeStamperCertificate) { throw "Signature on $file carries no timestamp." }
+            if ($env:CODE_SIGN_EXPECTED_SUBJECT -and $sig.SignerCertificate.Subject -notlike $env:CODE_SIGN_EXPECTED_SUBJECT) {
+              throw "$file was signed by '$($sig.SignerCertificate.Subject)', expected '$env:CODE_SIGN_EXPECTED_SUBJECT'."
+            }
+            Write-Host "$file : Valid, timestamped, signer $($sig.SignerCertificate.Subject.Split(',')[0])"
+          }
+
+          Write-Host "SHA-256: $((Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant())"
 
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
           $version = "${{ steps.version.outputs.version }}"
 
           # Same Send-Blob contract as build-agent.yml: no-cache on every blob because the
@@ -102,7 +210,7 @@ jobs:
             $headers["Content-MD5"] = [Convert]::ToBase64String($md5.ComputeHash($bytes))
             $md5.Dispose()
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1KB)) KB)..."
-            Invoke-RestMethod -Uri "$containerUrl/$BlobName`?$sasToken" -Method Put -Headers $headers -Body $bytes
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName" -Method Put -Headers ($authHeaders + $headers) -Body $bytes
             Write-Host "  uploaded $BlobName"
           }
 
@@ -125,15 +233,17 @@ jobs:
           }
           Write-Host "Alias verified: https://download.autopilotmonitor.com/agent/$env:STABLE_MSI ($remoteSize bytes)"
 
-      # Sigstore keyless provenance, same as the agent ZIP. Verify:
+      # Sigstore keyless provenance, same as the agent ZIP; covers the signed bytes. Skipped
+      # on runs that publish nothing -- no log entry for bytes nobody receives. Verify:
       # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (MSI)
-        uses: actions/attest-build-provenance@v4
+        if: inputs.upload_blob
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: ${{ env.STABLE_MSI }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
           path: ${{ env.STABLE_MSI }}

.github/workflows/ci.yml

@@ -9,8 +9,8 @@ name: CI
 # red run reports rather than blocks. Read the result and follow up.
 #
 # Path filters: commits that only bump a private submodule gitlink (internal/, infra/,
-# .claude/commands) or touch prose cannot change anything the suites cover, so they are
-# skipped instead of burning ~15 runner-minutes each. A gitlink bump reports the bare
+# .claude/commands), touch prose or edit another workflow cannot change anything the
+# suites cover, so they are skipped instead of burning ~15 runner-minutes each. A gitlink bump reports the bare
 # path ('internal', no trailing slash), which 'internal/**' does NOT match — both forms
 # are listed. GitHub skips only when EVERY changed path matches; a commit that touches
 # docs AND code still runs.
@@ -30,6 +30,24 @@ on:
       - '.github/FUNDING.yml'
       - '.github/dependabot.yml'
       - '.github/assets/**'
+      - '.github/codeql/**'
+      - '.github/scripts/**'
+      # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
+      # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
+      # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
+      - '.github/workflows/bootstrap-script-gates.yml'
+      - '.github/workflows/build-agent.yml'
+      - '.github/workflows/build-msi.yml'
+      - '.github/workflows/codeql.yml'
+      - '.github/workflows/combine-rules.yml'
+      - '.github/workflows/deploy-backend.yml'
+      - '.github/workflows/deploy-mcp.yml'
+      - '.github/workflows/deploy-web.yml'
+      - '.github/workflows/indexnow-notify.yml'
+      - '.github/workflows/oidc-login-test.yml'
+      - '.github/workflows/pester.yml'
+      - '.github/workflows/publish-scripts.yml'
   pull_request:
     branches: [main]
     paths-ignore:
@@ -45,6 +63,24 @@ on:
       - '.github/FUNDING.yml'
       - '.github/dependabot.yml'
       - '.github/assets/**'
+      - '.github/codeql/**'
+      - '.github/scripts/**'
+      # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
+      # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
+      # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
+      - '.github/workflows/bootstrap-script-gates.yml'
+      - '.github/workflows/build-agent.yml'
+      - '.github/workflows/build-msi.yml'
+      - '.github/workflows/codeql.yml'
+      - '.github/workflows/combine-rules.yml'
+      - '.github/workflows/deploy-backend.yml'
+      - '.github/workflows/deploy-mcp.yml'
+      - '.github/workflows/deploy-web.yml'
+      - '.github/workflows/indexnow-notify.yml'
+      - '.github/workflows/oidc-login-test.yml'
+      - '.github/workflows/pester.yml'
+      - '.github/workflows/publish-scripts.yml'
   workflow_dispatch:
 
 permissions:
@@ -60,9 +96,9 @@ jobs:
     # windows-latest is required: the agent test projects target net48.
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
@@ -91,9 +127,9 @@ jobs:
       run:
         working-directory: src/Web/autopilot-monitor-web
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -125,9 +161,9 @@ jobs:
       run:
         working-directory: src/McpServer/autopilot-monitor-mcp
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -145,7 +181,7 @@ jobs:
       # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
       # is honored by vector-search-provider.ts.
       - name: Cache embedding model
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ${{ github.workspace }}/.hf-cache
           key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -159,9 +195,9 @@ jobs:
     name: Generated guardrails match rules/guardrails.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 
@@ -180,9 +216,9 @@ jobs:
     name: Generated wire types match shared-manifests.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 

.github/workflows/codeql.yml

@@ -6,7 +6,7 @@ name: CodeQL
 # A gitlink bump reports the bare path ('internal', no trailing slash), which
 # 'internal/**' does NOT match — both forms are listed. A commit that touches docs
 # AND code still runs: GitHub skips only when EVERY changed path matches the filter.
-# Same list as ci.yml; keep them in step.
+# Same list as ci.yml except that each file leaves itself out; keep them in step.
 on:
   push:
     branches: [main]
@@ -23,6 +23,22 @@ on:
       - '.github/FUNDING.yml'
       - '.github/dependabot.yml'
       - '.github/assets/**'
+      - '.github/scripts/**'
+      # Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
+      # paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
+      # .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/bootstrap-script-gates.yml'
+      - '.github/workflows/build-agent.yml'
+      - '.github/workflows/build-msi.yml'
+      - '.github/workflows/ci.yml'
+      - '.github/workflows/combine-rules.yml'
+      - '.github/workflows/deploy-backend.yml'
+      - '.github/workflows/deploy-mcp.yml'
+      - '.github/workflows/deploy-web.yml'
+      - '.github/workflows/indexnow-notify.yml'
+      - '.github/workflows/oidc-login-test.yml'
+      - '.github/workflows/pester.yml'
+      - '.github/workflows/publish-scripts.yml'
   pull_request:
     branches: [main]
     paths-ignore:
@@ -38,6 +54,22 @@ on:
       - '.github/FUNDING.yml'
       - '.github/dependabot.yml'
       - '.github/assets/**'
+      - '.github/scripts/**'
+      # Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
+      # paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
+      # .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/bootstrap-script-gates.yml'
+      - '.github/workflows/build-agent.yml'
+      - '.github/workflows/build-msi.yml'
+      - '.github/workflows/ci.yml'
+      - '.github/workflows/combine-rules.yml'
+      - '.github/workflows/deploy-backend.yml'
+      - '.github/workflows/deploy-mcp.yml'
+      - '.github/workflows/deploy-web.yml'
+      - '.github/workflows/indexnow-notify.yml'
+      - '.github/workflows/oidc-login-test.yml'
+      - '.github/workflows/pester.yml'
+      - '.github/workflows/publish-scripts.yml'
   schedule:
     # Weekly, so advisories published after a merge still surface. Deliberately
     # unfiltered — it re-analyzes the whole tree regardless of what changed, which
@@ -70,15 +102,15 @@ jobs:
             build-mode: none
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         if: matrix.language == 'csharp'
         with:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -89,6 +121,6 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}

.github/workflows/combine-rules.yml

@@ -24,14 +24,17 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 
+      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # main, so an install-time script from a hijacked package would run with a token that
+      # can rewrite the repository. ajv is pure JS and needs no install hooks.
       - name: Install ajv-cli
-        run: npm install -g ajv-cli ajv-formats
+        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1
 
       - name: Validate Gather Rules
         run: |

.github/workflows/deploy-backend.yml

@@ -19,7 +19,7 @@ jobs:
     name: Build and Deploy Backend
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Login to Azure (OIDC)
         uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
@@ -29,7 +29,7 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
@@ -41,7 +41,7 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/backend.txt" -SasToken '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/backend.txt"
 
           $csproj = Get-Content ${{ env.CSPROJ_PATH }} -Raw
           if ($csproj -notmatch '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -115,9 +115,9 @@ jobs:
             runId       = '${{ github.run_id }}'
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/backend.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/backend.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/backend.json"
           Write-Host $manifest

.github/workflows/deploy-mcp.yml

@@ -26,7 +26,7 @@ jobs:
     name: Build and Deploy MCP Server
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # The published customer documentation lives in its own PUBLIC repo and is
       # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -36,7 +36,7 @@ jobs:
       # re-run actually rolls a new revision). /health reports the SHA captured
       # below so that staleness is checkable.
       - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: autopilotmonitor/autopilotmonitor-docs
           path: mcp-docs
@@ -59,7 +59,7 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/mcp.txt" -SasToken '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/mcp.txt"
 
           $pkgVersion = (Get-Content ${{ env.PACKAGE_JSON }} -Raw | ConvertFrom-Json).version
           $prefix = ($pkgVersion -split '\.')[0..1] -join '.'
@@ -144,9 +144,9 @@ jobs:
             docsCommit  = '${{ steps.docs.outputs.sha }}'.Substring(0, 7)
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/mcp.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/mcp.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/mcp.json"
           Write-Host $manifest

.github/workflows/deploy-web.yml

@@ -35,12 +35,38 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and Deploy Job
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           lfs: false
           fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
 
-      - uses: actions/setup-node@v7
+      # Only the version manifest at the very end needs Azure; logging in here rather than
+      # next to that step keeps a credential problem from surfacing after a live deploy.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # The customer docs repo is the single source of the "What's new" panel: the prebuild
+      # step (scripts/whats-new/build-whats-new.js) turns changelog/*.md into
+      # public/whats-new.json and dates every bullet via git blame — hence the full history.
+      # Public repo, no token. Editing the docs does NOT update the live panel until this
+      # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
+      # records which docs commit is live.
+      - name: Check out documentation bundle
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: autopilotmonitor/autopilotmonitor-docs
+          path: whats-new-docs
+          fetch-depth: 0
+
+      - name: Resolve docs commit
+        id: docs
+        run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -51,7 +77,7 @@ jobs:
         run: npm ci
 
       # next.config output:'export' -- `next build` writes the static site to out/
-      # (prebuild: sync-error-codes, generate-lastmod, generate-version).
+      # (prebuild: sync-error-codes, generate-lastmod, generate-version, whats-new).
       - name: Build
         working-directory: ${{ env.WEB_DIR }}
         env:
@@ -68,9 +94,12 @@ jobs:
           # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
           # the verify step below polls the deployed file for exactly this commit.
           GITHUB_SHA: ${{ github.sha }}
+          # Docs checkout for public/whats-new.json; the prebuild fails in CI without it.
+          WHATS_NEW_DOCS_DIR: ${{ github.workspace }}/whats-new-docs
         run: |
           npm run build
           test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }
+          test -f out/whats-new.json || { echo "out/whats-new.json missing - whats-new prebuild did not run"; exit 1; }
 
       # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
       - name: Package export
@@ -85,12 +114,12 @@ jobs:
       # commit, workflow file) in a public transparency log.
       # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: ${{ steps.package.outputs.archive }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: portal-${{ github.sha }}
           path: ${{ steps.package.outputs.archive }}
@@ -136,7 +165,8 @@ jobs:
           throw "Portal did not serve commit $expectedCommit within 5 minutes -- deployment not verified, version manifest NOT published"
 
       # Cross-component deploy record, written last and only on a verified deploy --
-      # same contract as versions/backend.json and versions/mcp.json.
+      # same contract as versions/backend.json and versions/mcp.json. docsCommit says which
+      # docs revision the live What's new panel was generated from (as for the MCP corpus).
       - name: Publish version manifest
         shell: pwsh
         run: |
@@ -145,11 +175,12 @@ jobs:
             commit      = '${{ github.sha }}'.Substring(0, 7)
             deployedUtc = [DateTime]::UtcNow.ToString('o')
             runId       = '${{ github.run_id }}'
+            docsCommit  = '${{ steps.docs.outputs.sha }}'.Substring(0, 7)
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/web.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/web.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/web.json"
           Write-Host $manifest

.github/workflows/publish-scripts.yml

@@ -26,6 +26,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write   # OIDC federated login for the storage writes (secret-less)
 
 # Shared with build-agent.yml: a script publish and an agent release both touch
 # version.json, and the bootstrapVersion read-modify-write must not interleave with the
@@ -34,6 +35,16 @@ concurrency:
   group: agent-blob-publish
   cancel-in-progress: false
 
+# Authenticode for the customer scripts. Same identity and same repository variables as
+# build-agent.yml -- the loader on every device pins this publisher, so the two must not
+# drift apart.
+env:
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
+
 jobs:
   gates:
     uses: ./.github/workflows/bootstrap-script-gates.yml
@@ -43,14 +54,81 @@ jobs:
     needs: gates
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Published customer scripts must be signed."
+            }
+          }
+
+      # First, and only to fetch the Key Vault token: azure/login sets the default az
+      # account and the storage login below has to be the one that stays. See D-223 --
+      # both federated credentials are bound to the ref, so this job must never carry a
+      # GitHub `environment:`.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # Authorizes the eu blob writes and the AdminConfiguration merge. The gates job above
+      # runs the same publisher with -DryRun and deliberately without a login -- a dry run
+      # must never need Azure credentials.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # Version pinned so a new or compromised NuGet release cannot flow into signing
+      # unreviewed; roll-forward because the tool targets an older runtime than the SDK
+      # preinstalled on the runner.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
 
       - name: Publish bootstrap + customer scripts
         shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
         run: |
           $dryRun = '${{ inputs.dry_run }}' -eq 'true'
           ./.github/scripts/Publish-BootstrapScripts.ps1 `
-            -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
             -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
-            -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}' `
+            -SigningToken $env:CODE_SIGN_AKV_ACCESS_TOKEN `
+            -KeyVaultUrl $env:CODE_SIGN_KEY_VAULT_URL `
+            -CertificateName $env:CODE_SIGN_CERTIFICATE_NAME `
+            -TimestampUrl $env:CODE_SIGN_TIMESTAMP_URL `
+            -ExpectedPublisher $env:CODE_SIGN_EXPECTED_SUBJECT `
+            -SignedOutputDir "$env:RUNNER_TEMP/signed-scripts" `
             -DryRun:$dryRun
+
+      # The exact bytes that were (or, on a dry run, would have been) uploaded. A dry-run
+      # dispatch is therefore the way to inspect a signed script locally before it reaches
+      # a single customer. Kept on failure too: a failed alias verification is precisely
+      # when someone wants to look at the file.
+      - name: Upload signed scripts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: signed-scripts
+          path: ${{ runner.temp }}/signed-scripts
+          if-no-files-found: ignore

.gitignore

@@ -145,6 +145,10 @@ internal/docs/~$Introduction-AutopilotMonitor.pptx
 # changes each run) and served at /version.json from the static export.
 src/Web/autopilot-monitor-web/public/version.json
 
+# What's new payload: generated by scripts/whats-new/build-whats-new.js from the docs
+# checkout on every build and served at /whats-new.json from the static export.
+src/Web/autopilot-monitor-web/public/whats-new.json
+
 
 # Local IME installer scratch (MSI + extracted payload per version, for grepping
 # in binaries). Operator-only, never committed.

README.md

@@ -1,33 +1,63 @@
-# <img src=".github/assets/logo.svg" height="28" alt="" /> Autopilot Monitor
+# <img src=".github/assets/logo.svg" height="28" alt="Autopilot Monitor logo" /> Autopilot Monitor
 
 [![Status](https://img.shields.io/badge/status-live-brightgreen)](https://www.autopilotmonitor.com)
 [![License](https://img.shields.io/badge/license-MIT%20%2B%20AGPL--3.0-blue)](LICENSE)
 [![Website](https://img.shields.io/badge/website-autopilotmonitor.com-2ea44f)](https://www.autopilotmonitor.com)
 
-Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
+Autopilot Monitor is an open-source, real-time monitoring and troubleshooting platform for **Windows Autopilot** and **Microsoft Intune** enrollment. It records enrollment events, application installations, policies, device state, and diagnostics while provisioning is still running, instead of collecting logs by hand after a failure. Administrators get live enrollment tracking, Enrollment Status Page (ESP) visibility, detailed session timelines, automated issue detection, on-demand diagnostics, fleet health analytics, and AI-assisted troubleshooting through a hosted Model Context Protocol (MCP) server.
+
+The platform supports classic Windows Autopilot and modern Intune provisioning scenarios, including **Windows Autopilot Device Preparation**.
 
 ## Availability
 
 Autopilot Monitor is **publicly available** — the Community plan is free. Sign in with your work account at **[autopilotmonitor.com](https://www.autopilotmonitor.com)**; new organizations complete a short activation step after first sign-in.
 
 <p align="center">
-  <img src=".github/assets/SessionList.png" width="45%" />
-  <img src=".github/assets/FleetHealth.png" width="45%" />
+  <img src=".github/assets/SessionList.png" width="45%" alt="Autopilot Monitor dashboard showing live Windows Autopilot and Intune enrollment sessions" />
+  <img src=".github/assets/FleetHealth.png" width="45%" alt="Autopilot Monitor fleet health dashboard with Windows Autopilot enrollment analytics and success metrics" />
 </p>
 <p align="center">
-  <img src=".github/assets/SessionDetails.png" width="45%" />
-  <img src=".github/assets/SessionTimeline.png" width="45%" />
+  <img src=".github/assets/SessionDetails.png" width="45%" alt="Autopilot Monitor session details showing device information, diagnostics, apps, policies, and enrollment status" />
+  <img src=".github/assets/SessionTimeline.png" width="45%" alt="Windows Autopilot enrollment timeline showing ESP phases, application installs, policies, events, and errors" />
 </p>
 
-## Overview
+## Key Features
 
-Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
+- **Real-time Windows Autopilot monitoring** — follow device provisioning while enrollment is still running
+- **Detailed enrollment timelines** — correlate Autopilot, ESP, Intune Management Extension, apps, policies, device state, and system events
+- **Enrollment Status Page visibility** — see which phase, application, or policy is delaying provisioning
+- **Automated issue detection** — define custom analysis rules that identify known failure patterns
+- **Targeted evidence collection** — gather registry values, event log entries, files, log-parser matches, and allow-listed commands when specific conditions are detected
+- **On-demand diagnostics** — request diagnostics packages from enrolled devices remotely
+- **Fleet health analytics** — success rates, deployment duration, device models, applications, errors, and recurring issues
+- **Session reporting** — inspect and share detailed enrollment information for individual devices
+- **Windows Autopilot Device Preparation support** — monitor Device Preparation deployments alongside classic Autopilot scenarios
+- **Centralized agent configuration** — control diagnostic behavior, automatic reboots, timezone adjustment, and other monitoring settings from the web dashboard
+- **AI-assisted troubleshooting** — query enrollment data through the built-in Model Context Protocol server
 
-- **Bootstrap Script** — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
-- **Monitoring Agent** — Lightweight .NET application that collects telemetry and evidence during enrollment
+## How it works
+
+Autopilot Monitor consists of several components working together throughout Windows enrollment:
+
+- **Bootstrap Script** — PowerShell script deployed through Microsoft Intune that starts monitoring early in the provisioning process
+- **Monitoring Agent** — lightweight .NET application that collects telemetry and evidence during enrollment
 - **Backend API** — Azure Functions-based ingestion and processing pipeline
-- **Web Dashboard** — Next.js application for real-time monitoring and fleet analytics
-- **MCP Server** — Model Context Protocol server that lets AI assistants query and troubleshoot enrollments in natural language
+- **Web Dashboard** — Next.js application for real-time monitoring, troubleshooting, and fleet analytics
+- **MCP Server** — Model Context Protocol server that lets AI assistants query Autopilot Monitor data in natural language
+
+## Windows Autopilot and Intune Troubleshooting
+
+Autopilot Monitor helps investigate common Windows provisioning and enrollment problems such as:
+
+- Windows Autopilot deployments that fail or appear stuck
+- Enrollment Status Page (ESP) delays and unusually long deployment phases
+- Win32 application installation failures and slow application downloads
+- Intune Management Extension problems
+- Microsoft Entra join, Hybrid Join, and device registration issues
+- policies that block or delay provisioning
+- inconsistent behavior across hardware models and recurring failures affecting multiple devices
+
+Because telemetry is collected during enrollment, many problems can be investigated without reproducing the issue or manually collecting logs from the affected device.
 
 ## AI Integration (MCP)
 
@@ -35,13 +65,19 @@ Autopilot Monitor ships a hosted **[Model Context Protocol](https://modelcontext
 
 - *"Show me all failed enrollments from the last 24 hours and group them by failure reason."*
 - *"Why did session X fail, and which app install caused the delay?"*
+- *"Which devices had unusually long ESP application phases this week?"*
+- *"Which device models have the highest Autopilot failure rate?"*
 - *"Which devices in my fleet are affected by CVE-2024-30078?"*
 
-Server URL: `https://mcp.autopilotmonitor.com/mcp` — sign-in runs through your existing work account, access is scoped to your tenant exactly like in the portal, and no credentials are stored. Setup guide: **[AI Integration (MCP)](https://docs.autopilotmonitor.com/integrations/ai-integration-mcp)**.
+Server URL: `https://mcp.autopilotmonitor.com/mcp` — sign-in runs through your existing work account, access is scoped to your tenant exactly like in the portal, and the MCP server stores no credentials. Setup guide: **[AI Integration (MCP)](https://docs.autopilotmonitor.com/integrations/ai-integration-mcp)**.
 
 ## Documentation
 
-Full admin documentation is available at **[docs.autopilotmonitor.com](https://docs.autopilotmonitor.com)**
+Full admin documentation is available at **[docs.autopilotmonitor.com](https://docs.autopilotmonitor.com)** — deployment, configuration, monitoring, diagnostics, troubleshooting, analysis and gather rules, integrations, and AI-assisted troubleshooting.
+
+## Open Source
+
+Autopilot Monitor is developed openly on GitHub. The source is published so that customers and security reviewers can see what runs on their devices and with their data: the repository contains the device agent, shared library, backend, web dashboard, and MCP server.
 
 ## Feedback
 

rules/analyze/ANALYZE-APP-014.json

@@ -5,7 +5,7 @@
   "description": "Detects when the Enrollment Status Page failed on the Apps subcategory and the agent's AppX deployment log scan identified a suspected MSIX/Store package. Store/MSIX apps install outside the Win32 pipeline, so the regular per-app tracking sees nothing — this correlation names the likely culprit.",
   "severity": "warning",
   "category": "apps",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "enabled": true,
   "evaluateOn": [
     "enrollment_end",
@@ -93,7 +93,7 @@
       "steps": [
         "Open Event Viewer → Applications and Services Logs → Microsoft → Windows → AppXDeploymentServer → Operational on the device (or in the diagnostics archive if uploaded)",
         "Filter for Error-level events around the ESP failure time and confirm the package name and HRESULT match this finding",
-        "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = invalid/corrupt package, 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
+        "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = package could not be opened (unsigned, publisher mismatch, or not found), 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
       ]
     },
     {

rules/analyze/ANALYZE-APP-018.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-APP-018",
+  "title": "App Return Code Requested a Reboot During Enrollment",
+  "description": "Detects Win32 apps whose installer exit code maps to Soft reboot or Hard reboot in the app's Intune return-code table (the '[Win32App] lpExitCode is defined as ...' line). Hard reboot stops app processing and restarts the device in Device Setup - the mid-enrollment restart and second sign-in; Soft reboot leaves the app pending until the next restart while the ESP moves on. Confidence rises for Hard reboot and when a reboot was actually observed in the session.",
+  "severity": "warning",
+  "category": "apps",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
+  "trigger": "single",
+  "baseConfidence": 60,
+  "conditions": [
+    {
+      "signal": "reboot_return_code",
+      "source": "event_data",
+      "eventType": "app_install_completed",
+      "dataField": "exitCodeClass",
+      "operator": "in",
+      "value": "SoftReboot,HardReboot",
+      "required": true
+    },
+    {
+      "signal": "hard_reboot_return_code",
+      "source": "event_data",
+      "eventType": "app_install_completed",
+      "dataField": "exitCodeClass",
+      "operator": "equals",
+      "value": "HardReboot",
+      "required": false
+    },
+    {
+      "signal": "reboot_observed",
+      "source": "event_count",
+      "eventType": "system_reboot_detected",
+      "operator": "count_gte",
+      "value": "1",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "hard_reboot_return_code",
+      "condition": "exists",
+      "weight": 25
+    },
+    {
+      "signal": "reboot_observed",
+      "condition": "exists",
+      "weight": 15
+    }
+  ],
+  "confidenceThreshold": 60,
+  "explanation": "App **{{appName}}** returned exit code **{{exitCode}}**, which its Intune return-code table maps to **{{exitCodeClass}}** - the installer asked for a restart before its work is complete.\n\n- **SoftReboot**: the Intune Management Extension reports the app as *pending reboot*. The Enrollment Status Page treats it as completed and moves on, and Intune only marks the app installed after the next restart re-evaluates the detection rule. Until then the app may be unusable or half-configured, and the user sees a restart notification.\n- **HardReboot**: the Intune Management Extension stops processing further apps and, in Device Setup, restarts the device right away (the restart grace period does not apply during the ESP) - the same mid-enrollment restart and second sign-in that ANALYZE-ESP-005 attributes to reboot-required policies. In Account Setup the extension does not restart the device itself and the app stays pending.\n\nA restart requested by an installer is normal for many MSI packages (exit codes 3010 and 1641), but during Autopilot it lengthens the ESP, can surprise the user with a restart, and hides the app's real state until after the reboot. The return-code class is the app's own configuration in Intune, not a device fault.",
+  "remediation": [
+    {
+      "title": "Check the app's return-code mapping",
+      "steps": [
+        "Open the app in the Intune admin center > Properties > Program and review the return codes table: exit code {{exitCode}} is currently mapped to {{exitCodeClass}}",
+        "If the installer only recommends a restart (MSI 3010 ERROR_SUCCESS_REBOOT_REQUIRED, 1641 ERROR_SUCCESS_REBOOT_INITIATED), map the code to Soft reboot instead of Hard reboot so the next app can install before the restart",
+        "If the app works without an immediate restart, suppress the installer's own reboot (for MSI: REBOOT=ReallySuppress on the install command) so it returns 0 and the restart happens on your schedule",
+        "Keep Hard reboot only when the following apps genuinely cannot install before the restart - and then expect the mid-ESP restart in every enrollment"
+      ]
+    },
+    {
+      "title": "Take the app out of the ESP critical path",
+      "steps": [
+        "If the app is not needed for first use, remove it from the ESP blocking-app list so the restart happens after the user reaches the desktop",
+        "If it must stay blocking, order it last in Device Setup (dependencies or install order) so a hard reboot does not interrupt the remaining apps",
+        "For Soft reboot apps, plan a restart at the end of enrollment or accept that the app finishes on the user's first restart"
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Add a Win32 app - Program step (device restart behavior and return codes)",
+      "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32#step-2-program"
+    },
+    {
+      "title": "Microsoft Learn: Enrollment Status Page tracking",
+      "url": "https://learn.microsoft.com/en-us/autopilot/enrollment-status"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "apps",
+    "reboot",
+    "return-code",
+    "soft-reboot",
+    "hard-reboot",
+    "esp",
+    "second-sign-in"
+  ]
+}

rules/analyze/ANALYZE-DEV-012.json

@@ -2,10 +2,10 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-DEV-012",
   "title": "Device Entered Standby During Enrollment",
-  "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log — pre-agent episodes are backfilled). Uses a single required condition on the episode's durationSeconds so the match is pinned to one event instance and the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
+  "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log). The watcher also backfills pre-agent episodes from the last 24 h for timeline context (backfilled=true); those ended before the enrollment started and are excluded via the same-event filter backfilled equals false — a separate condition could not do that, because each condition scans all events on its own and a pre-session hibernate would still satisfy the duration test. A single required condition keeps the match pinned to one event instance so the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
   "severity": "info",
   "category": "device",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "enabled": true,
   "evaluateOn": [
     "enrollment_end",
@@ -23,6 +23,9 @@
       "dataField": "durationSeconds",
       "operator": "gte",
       "value": "300",
+      "filterField": "backfilled",
+      "filterOperator": "equals",
+      "filterValue": "false",
       "required": true
     }
   ],

rules/analyze/ANALYZE-ESP-004.json

@@ -1,11 +1,11 @@
 {
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-ESP-004",
-  "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-  "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+  "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+  "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
   "severity": "warning",
   "category": "esp",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "enabled": true,
   "baseConfidence": 80,
   "conditions": [
@@ -26,6 +26,27 @@
       "value": "true",
       "required": true
     },
+    {
+      "signal": "esp_gave_up_on_app",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "failureType",
+      "operator": "equals",
+      "value": "esp_apps_timeout",
+      "required": true
+    },
+    {
+      "signal": "appName",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "appName",
+      "operator": "exists",
+      "value": "",
+      "filterField": "failureType",
+      "filterOperator": "equals",
+      "filterValue": "esp_apps_timeout",
+      "required": false
+    },
     {
       "signal": "espSyncFailureTimeoutMinutes",
       "source": "event_type",
@@ -38,34 +59,25 @@
     {
       "signal": "failedSubcategory",
       "source": "event_type",
-      "eventType": "enrollment_failed",
+      "eventType": "esp_failure_settle_started",
       "dataField": "failedSubcategory",
       "operator": "exists",
       "value": "",
       "required": false
-    },
-    {
-      "signal": "appName",
-      "source": "event_type",
-      "eventType": "app_install_failed",
-      "dataField": "appName",
-      "operator": "exists",
-      "value": "",
-      "required": false
     }
   ],
   "confidenceFactors": [
-    { "signal": "appName", "condition": "exists", "weight": 10 }
+    { "signal": "failedSubcategory", "condition": "exists", "weight": 10 }
   ],
-  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
   "remediation": [
     {
       "title": "Relieve ESP pressure so enrollments finish inside the window",
       "steps": [
-        "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-        "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-        "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-        "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+        "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+        "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+        "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+        "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
       ]
     }
   ],

rules/analyze/ANALYZE-ID-001.json

@@ -5,6 +5,7 @@
   "description": "Detects when a certificate with the configured subject is missing from the local machine personal store (LocalMachine\\My). Requires the gather rule GATHER-ID-002 (machine cert store inventory) to be enabled — the check runs against its gather_machine_cert_store output. A missing certificate may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
   "severity": "warning",
   "category": "identity",
+  "author": "Community",
   "isCommunity": true,
   "enabled": false,
   "evaluateOn": [

rules/analyze/ANALYZE-ID-004.json

@@ -2,14 +2,14 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-ID-004",
   "title": "Hybrid Sign-In Never Establishes Entra User Affinity",
-  "description": "On a hybrid-joined device the real user reached the desktop, but the Autopilot provisioning placeholder stayed active in JoinInfo and the agent repeatedly reported the hybrid sign-in as overdue. The user session never establishes Entra user affinity (no PRT), so the Account Setup ESP re-runs on every logon and the enrollment never completes.",
+  "description": "On a hybrid-joined device the real user reached the desktop, but the Intune Management Extension never acquired a Microsoft Entra user token for that user within the wait window — repeatedly across reboots when the warning recurs. Without a user token the signed-in user has no Entra user affinity: user-targeted apps and policies cannot apply, Windows Hello for Business cannot provision, and with a user ESP the Account Setup page re-runs on every logon.",
   "severity": "high",
   "category": "identity",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "author": "Autopilot Monitor",
   "enabled": true,
   "trigger": "correlation",
-  "evaluateOn": ["enrollment_end", "on_event:hybrid_login_pending"],
+  "evaluateOn": ["enrollment_end", "on_event:entra_user_affinity_pending"],
   "baseConfidence": 60,
   "confidenceThreshold": 75,
   "preconditions": [
@@ -17,14 +17,14 @@
       "source": "event_data",
       "eventType": "enrollment_complete",
       "operator": "not_exists",
-      "description": "Suppress when the session eventually completed — a single overdue-login warning followed by a successful sign-in is normal hybrid latency, not a broken affinity."
+      "description": "Suppress when the session eventually completed — a single pending-affinity warning followed by a successful token acquisition is hybrid latency, not a broken affinity."
     }
   ],
   "conditions": [
     {
-      "signal": "hybrid_login_overdue",
+      "signal": "user_affinity_pending",
       "source": "event_type",
-      "eventType": "hybrid_login_pending",
+      "eventType": "entra_user_affinity_pending",
       "operator": "exists",
       "value": "",
       "required": true
@@ -38,28 +38,27 @@
       "required": true
     },
     {
-      "signal": "placeholder_still_active",
+      "signal": "no_user_token",
       "source": "event_type",
-      "eventType": "aad_placeholder_user_detected",
-      "operator": "exists",
+      "eventType": "ime_user_token_acquired",
+      "operator": "not_exists",
       "value": "",
-      "required": false
+      "required": true
     }
   ],
   "confidenceFactors": [
-    { "signal": "hybrid_login_pending", "condition": "count >= 2", "weight": 20 },
-    { "signal": "hybrid_login_pending", "condition": "count >= 3", "weight": 10 },
-    { "signal": "aad_placeholder_user_detected", "condition": "count >= 3", "weight": 10 }
+    { "signal": "entra_user_affinity_pending", "condition": "count >= 2", "weight": 20 },
+    { "signal": "entra_user_affinity_pending", "condition": "count >= 3", "weight": 10 }
   ],
-  "explanation": "A real user signed in and reached the desktop, but the device kept reporting the **Autopilot provisioning placeholder** as the active identity in JoinInfo and the hybrid sign-in as **overdue** — across multiple reboots. This means the signed-in user never established **Microsoft Entra user affinity** (no Primary Refresh Token), so:\n\n- the Account Setup ESP page re-appears on every logon,\n- user-targeted required apps and policies cannot settle,\n- the enrollment never reaches completion.\n\nAfter this many hours this is not normal Entra Connect sync latency — something is structurally preventing the user (or the computer object) from registering:\n\n- the computer object's `userCertificate` attribute is not syncing to Entra ID (sync scope / OU filtering),\n- the signing-in user is not synced, or their UPN does not match a verified Entra domain,\n- the device has no line of sight to a domain controller **at logon time**, so the hybrid PRT flow cannot finish,\n- time skew or a proxy blocking `login.microsoftonline.com` / `enterpriseregistration.windows.net` from the user context.\n\nA frequent variant: the user's **first sign-in happens without domain-controller reachability** — for example when a pre-logon VPN tunnel (GlobalProtect, Always On VPN, Zscaler ZPA) is not established yet at the logon screen. Windows falls back to cached credentials, the hybrid PRT flow silently never runs, and later reboots do not fix it — sessions in this state typically show repeated reboots and network flapping while the placeholder identity stays active.\n\nA visible side effect: **the Windows Hello for Business wizard never appears**, because Hello provisioning requires an Entra user token (PRT). Hello is a downstream symptom here, not the cause.",
+  "explanation": "**What was measured.** A real user signed in and reached the desktop (`desktop_arrived`), and by the end of the agent's wait window the Intune Management Extension (IME) had still not acquired a **Microsoft Entra user token** for that user (`entra_user_affinity_pending`). That event lists the IME token error codes observed after the desktop (`tokenFailureCodes`) and how often the acquisition failed (`tokenFailureCount`). Each agent run reports this at most once, so a second or third occurrence means the same outcome across reboots — that repetition is what raises the confidence of this finding. No `ime_user_token_acquired` event followed in this session.\n\n**Why this means no user affinity.** IME's user check-in acquires the user token through the Windows web account manager (WAM), which needs the signed-in user's Entra identity — the Primary Refresh Token (PRT) that a hybrid sign-in establishes at logon. When that PRT was never issued, every token request fails and the user has **no Entra user affinity** on this device. Consequences:\n\n- user-targeted required apps and policies cannot apply,\n- Windows Hello for Business cannot provision (it requires a user token),\n- with a user ESP the Account Setup page re-appears on every logon instead of completing.\n\n**What this diagnosis does not use.** The Autopilot provisioning placeholder in JoinInfo (`aad_placeholder_user_detected`) is not part of this finding — on hybrid devices it can stay present through a perfectly healthy sign-in. Likewise, `dsregcmd /status` collected by the agent runs as SYSTEM and shows only the **device** join state; the per-user PRT state is visible only when the command runs as the signed-in user.\n\n**Typical causes** — something structurally prevents the user (or the computer object) from registering:\n\n- the computer object's `userCertificate` attribute is not syncing to Entra ID (sync scope / OU filtering),\n- the signing-in user is not synced, or their UPN does not match a verified Entra domain,\n- the device has no line of sight to a domain controller **at logon time**, so the hybrid PRT flow cannot finish,\n- time skew or a proxy blocking `login.microsoftonline.com` / `enterpriseregistration.windows.net` from the user context.\n\nA frequent variant: the user's **first sign-in happens without domain-controller reachability** — for example when a pre-logon VPN tunnel (GlobalProtect, Always On VPN, Zscaler ZPA) is not established yet at the logon screen. Windows falls back to cached credentials, the hybrid PRT flow silently never runs, and later reboots do not fix it.\n\nThe `device_registration_event` entries in the timeline (User Device Registration events 304/305) carry the OS-side record of the failed registration; the error codes in `entra_user_affinity_pending` carry the token side. A missing Windows Hello for Business wizard is a downstream symptom here, not the cause.",
   "remediation": [
     {
       "title": "Verify user affinity on the device",
       "steps": [
         "Sign in as the affected user and run: dsregcmd /status — under 'SSO State' the value AzureAdPrt must be YES. NO means the user has no Entra token and this diagnosis is confirmed.",
-        "Also check 'Device State': AzureAdJoined = YES and DomainJoined = YES are expected for hybrid join.",
-        "Check Event Viewer: Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin for PRT / registration errors (e.g. event 304/305/362).",
-        "Enable the gather rules 'Collect dsregcmd join status' so future sessions capture this state automatically."
+        "Also check 'Device State': AzureAdJoined = YES and DomainJoined = YES are expected for hybrid join — they prove the device join only, not the user's registration.",
+        "Check Event Viewer: Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin for PRT / registration errors (e.g. event 304/305/362). The device_registration_event entries (304/305) in the session timeline carry the same OS-side failure record.",
+        "Enable the gather rule GATHER-DEVICE-006 (dsregcmd /status at the moment of the finding — device state only, the agent runs as SYSTEM). GATHER-DEVICE-007 and GATHER-DEVICE-008 (Microsoft-Windows-AAD/Operational events 1098 and 1097 at the same moment) are on by default."
       ]
     },
     {

rules/analyze/ANALYZE-OFFICE-001.json

@@ -2,10 +2,10 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-OFFICE-001",
   "title": "Microsoft 365 Apps Install Failed",
-  "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) background install did not reach completion. The V2 OfficeInstallDetector watches the C2R client directly (registry + process) and emits office_install_failed when the install scenario was abandoned (worker gone and streaming never finished) or a C2R failure code was observed. This catches Office failures that the Intune integrated app type hides, because IME reports the app done within 1-2 minutes while C2R keeps installing in the background.",
+  "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) install failed. The V2 OfficeInstallDetector watches the C2R client directly (registry, Delivery Optimization, process) and emits office_install_failed when the C2R INSTALL scenario records an error code. Completion is proven by the core Office binaries on disk; an install window that closes without that proof ends silently, never as a failure. This catches Office failures the deployment status hides: the Intune built-in app type is marked done once the configuration is delivered, and a Win32 or RealmJoin package once its installer exits, while C2R keeps installing in the background.",
   "severity": "warning",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "enabled": true,
   "evaluateOn": [
     "enrollment_end",
@@ -39,12 +39,12 @@
     }
   ],
   "confidenceThreshold": 40,
-  "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install did not finish.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real background install lifecycle. The Intune \"integrated\" Microsoft 365 Apps app type only pushes the configuration XML and starts the C2R bootstrapper, so IME marks the app done within 1-2 minutes while C2R keeps streaming and laying down the product for several more minutes. This event means C2R activity ended (the OfficeC2RClient worker exited and the install scenario cleared) without the StreamingFinished flag being set, or a C2R failure code was observed.\n\nReview the office_install_failed event payload: `products`, `channel`, `phase`, `streamingFinished`, `errorCode` (best-effort — may be empty) and `durationSeconds`.",
+  "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install failed.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real install lifecycle, however it was started. The Intune built-in Microsoft 365 Apps app type delivers the configuration through the Office CSP and lets the device start C2R; a Win32 or RealmJoin package runs the Office Deployment Tool. Either way the deployment is marked done before C2R has finished laying down the product. This event means C2R recorded an error code in its INSTALL scenario before the core Office apps were on disk.\n\nReview the office_install_failed event payload: `products`, `channel`, `errorCode`, `errorSource` (the C2R registry value that carried the code) and `durationSeconds`.",
   "remediation": [
     {
       "title": "Investigate the Office C2R install failure",
       "steps": [
-        "Open the office_install_failed event and review products, channel, phase, streamingFinished and errorCode",
+        "Open the office_install_failed event and review products, channel, errorCode and errorSource",
         "Check the Click-to-Run logs on the device (%windir%\\Temp and %temp%, files named <MachineName>-yyyymmdd-nnnn.log) for the failing operation",
         "Verify the device had network reachability to the Office CDN / Microsoft Connected Cache during the enrollment window",
         "Confirm the Intune Microsoft 365 Apps app configuration (products, channel, architecture) matches what the device can install",

rules/dist/analyze-rules.json

@@ -615,7 +615,7 @@
       "description": "Detects when the Enrollment Status Page failed on the Apps subcategory and the agent's AppX deployment log scan identified a suspected MSIX/Store package. Store/MSIX apps install outside the Win32 pipeline, so the regular per-app tracking sees nothing — this correlation names the likely culprit.",
       "severity": "warning",
       "category": "apps",
-      "version": "1.2.0",
+      "version": "1.2.1",
       "enabled": true,
       "evaluateOn": [
         "enrollment_end",
@@ -703,7 +703,7 @@
           "steps": [
             "Open Event Viewer → Applications and Services Logs → Microsoft → Windows → AppXDeploymentServer → Operational on the device (or in the diagnostics archive if uploaded)",
             "Filter for Error-level events around the ESP failure time and confirm the package name and HRESULT match this finding",
-            "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = invalid/corrupt package, 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
+            "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = package could not be opened (unsigned, publisher mismatch, or not found), 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
           ]
         },
         {
@@ -1034,6 +1034,103 @@
         "esp"
       ]
     },
+    {
+      "ruleId": "ANALYZE-APP-018",
+      "title": "App Return Code Requested a Reboot During Enrollment",
+      "description": "Detects Win32 apps whose installer exit code maps to Soft reboot or Hard reboot in the app's Intune return-code table (the '[Win32App] lpExitCode is defined as ...' line). Hard reboot stops app processing and restarts the device in Device Setup - the mid-enrollment restart and second sign-in; Soft reboot leaves the app pending until the next restart while the ESP moves on. Confidence rises for Hard reboot and when a reboot was actually observed in the session.",
+      "severity": "warning",
+      "category": "apps",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end",
+        "whiteglove_sealed"
+      ],
+      "trigger": "single",
+      "baseConfidence": 60,
+      "conditions": [
+        {
+          "signal": "reboot_return_code",
+          "source": "event_data",
+          "eventType": "app_install_completed",
+          "dataField": "exitCodeClass",
+          "operator": "in",
+          "value": "SoftReboot,HardReboot",
+          "required": true
+        },
+        {
+          "signal": "hard_reboot_return_code",
+          "source": "event_data",
+          "eventType": "app_install_completed",
+          "dataField": "exitCodeClass",
+          "operator": "equals",
+          "value": "HardReboot",
+          "required": false
+        },
+        {
+          "signal": "reboot_observed",
+          "source": "event_count",
+          "eventType": "system_reboot_detected",
+          "operator": "count_gte",
+          "value": "1",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "hard_reboot_return_code",
+          "condition": "exists",
+          "weight": 25
+        },
+        {
+          "signal": "reboot_observed",
+          "condition": "exists",
+          "weight": 15
+        }
+      ],
+      "confidenceThreshold": 60,
+      "explanation": "App **{{appName}}** returned exit code **{{exitCode}}**, which its Intune return-code table maps to **{{exitCodeClass}}** - the installer asked for a restart before its work is complete.\n\n- **SoftReboot**: the Intune Management Extension reports the app as *pending reboot*. The Enrollment Status Page treats it as completed and moves on, and Intune only marks the app installed after the next restart re-evaluates the detection rule. Until then the app may be unusable or half-configured, and the user sees a restart notification.\n- **HardReboot**: the Intune Management Extension stops processing further apps and, in Device Setup, restarts the device right away (the restart grace period does not apply during the ESP) - the same mid-enrollment restart and second sign-in that ANALYZE-ESP-005 attributes to reboot-required policies. In Account Setup the extension does not restart the device itself and the app stays pending.\n\nA restart requested by an installer is normal for many MSI packages (exit codes 3010 and 1641), but during Autopilot it lengthens the ESP, can surprise the user with a restart, and hides the app's real state until after the reboot. The return-code class is the app's own configuration in Intune, not a device fault.",
+      "remediation": [
+        {
+          "title": "Check the app's return-code mapping",
+          "steps": [
+            "Open the app in the Intune admin center > Properties > Program and review the return codes table: exit code {{exitCode}} is currently mapped to {{exitCodeClass}}",
+            "If the installer only recommends a restart (MSI 3010 ERROR_SUCCESS_REBOOT_REQUIRED, 1641 ERROR_SUCCESS_REBOOT_INITIATED), map the code to Soft reboot instead of Hard reboot so the next app can install before the restart",
+            "If the app works without an immediate restart, suppress the installer's own reboot (for MSI: REBOOT=ReallySuppress on the install command) so it returns 0 and the restart happens on your schedule",
+            "Keep Hard reboot only when the following apps genuinely cannot install before the restart - and then expect the mid-ESP restart in every enrollment"
+          ]
+        },
+        {
+          "title": "Take the app out of the ESP critical path",
+          "steps": [
+            "If the app is not needed for first use, remove it from the ESP blocking-app list so the restart happens after the user reaches the desktop",
+            "If it must stay blocking, order it last in Device Setup (dependencies or install order) so a hard reboot does not interrupt the remaining apps",
+            "For Soft reboot apps, plan a restart at the end of enrollment or accept that the app finishes on the user's first restart"
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Add a Win32 app - Program step (device restart behavior and return codes)",
+          "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32#step-2-program"
+        },
+        {
+          "title": "Microsoft Learn: Enrollment Status Page tracking",
+          "url": "https://learn.microsoft.com/en-us/autopilot/enrollment-status"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "apps",
+        "reboot",
+        "return-code",
+        "soft-reboot",
+        "hard-reboot",
+        "esp",
+        "second-sign-in"
+      ]
+    },
     {
       "ruleId": "ANALYZE-CORR-003",
       "title": "Proxy Configuration Causing Download Failure",
@@ -1772,10 +1869,10 @@
     {
       "ruleId": "ANALYZE-DEV-012",
       "title": "Device Entered Standby During Enrollment",
-      "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log — pre-agent episodes are backfilled). Uses a single required condition on the episode's durationSeconds so the match is pinned to one event instance and the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
+      "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log). The watcher also backfills pre-agent episodes from the last 24 h for timeline context (backfilled=true); those ended before the enrollment started and are excluded via the same-event filter backfilled equals false — a separate condition could not do that, because each condition scans all events on its own and a pre-session hibernate would still satisfy the duration test. A single required condition keeps the match pinned to one event instance so the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
       "severity": "info",
       "category": "device",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "enabled": true,
       "evaluateOn": [
         "enrollment_end",
@@ -1793,6 +1890,9 @@
           "dataField": "durationSeconds",
           "operator": "gte",
           "value": "300",
+          "filterField": "backfilled",
+          "filterOperator": "equals",
+          "filterValue": "false",
           "required": true
         }
       ],
@@ -2396,11 +2496,11 @@
     },
     {
       "ruleId": "ANALYZE-ESP-004",
-      "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-      "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+      "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+      "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
       "severity": "warning",
       "category": "esp",
-      "version": "1.0.1",
+      "version": "1.1.0",
       "enabled": true,
       "baseConfidence": 80,
       "conditions": [
@@ -2421,6 +2521,27 @@
           "value": "true",
           "required": true
         },
+        {
+          "signal": "esp_gave_up_on_app",
+          "source": "event_type",
+          "eventType": "app_install_failed",
+          "dataField": "failureType",
+          "operator": "equals",
+          "value": "esp_apps_timeout",
+          "required": true
+        },
+        {
+          "signal": "appName",
+          "source": "event_data",
+          "eventType": "app_install_failed",
+          "dataField": "appName",
+          "operator": "exists",
+          "value": "",
+          "filterField": "failureType",
+          "filterOperator": "equals",
+          "filterValue": "esp_apps_timeout",
+          "required": false
+        },
         {
           "signal": "espSyncFailureTimeoutMinutes",
           "source": "event_type",
@@ -2433,38 +2554,29 @@
         {
           "signal": "failedSubcategory",
           "source": "event_type",
-          "eventType": "enrollment_failed",
+          "eventType": "esp_failure_settle_started",
           "dataField": "failedSubcategory",
           "operator": "exists",
           "value": "",
           "required": false
-        },
-        {
-          "signal": "appName",
-          "source": "event_type",
-          "eventType": "app_install_failed",
-          "dataField": "appName",
-          "operator": "exists",
-          "value": "",
-          "required": false
         }
       ],
       "confidenceFactors": [
         {
-          "signal": "appName",
+          "signal": "failedSubcategory",
           "condition": "exists",
           "weight": 10
         }
       ],
-      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
       "remediation": [
         {
           "title": "Relieve ESP pressure so enrollments finish inside the window",
           "steps": [
-            "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-            "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-            "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-            "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+            "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+            "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+            "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+            "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
           ]
         }
       ],
@@ -2694,6 +2806,7 @@
       "description": "Detects when a certificate with the configured subject is missing from the local machine personal store (LocalMachine\\My). Requires the gather rule GATHER-ID-002 (machine cert store inventory) to be enabled — the check runs against its gather_machine_cert_store output. A missing certificate may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
       "severity": "warning",
       "category": "identity",
+      "author": "Community",
       "isCommunity": true,
       "enabled": false,
       "evaluateOn": [
@@ -2937,16 +3050,16 @@
     {
       "ruleId": "ANALYZE-ID-004",
       "title": "Hybrid Sign-In Never Establishes Entra User Affinity",
-      "description": "On a hybrid-joined device the real user reached the desktop, but the Autopilot provisioning placeholder stayed active in JoinInfo and the agent repeatedly reported the hybrid sign-in as overdue. The user session never establishes Entra user affinity (no PRT), so the Account Setup ESP re-runs on every logon and the enrollment never completes.",
+      "description": "On a hybrid-joined device the real user reached the desktop, but the Intune Management Extension never acquired a Microsoft Entra user token for that user within the wait window — repeatedly across reboots when the warning recurs. Without a user token the signed-in user has no Entra user affinity: user-targeted apps and policies cannot apply, Windows Hello for Business cannot provision, and with a user ESP the Account Setup page re-runs on every logon.",
       "severity": "high",
       "category": "identity",
-      "version": "1.2.0",
+      "version": "2.0.0",
       "author": "Autopilot Monitor",
       "enabled": true,
       "trigger": "correlation",
       "evaluateOn": [
         "enrollment_end",
-        "on_event:hybrid_login_pending"
+        "on_event:entra_user_affinity_pending"
       ],
       "baseConfidence": 60,
       "confidenceThreshold": 75,
@@ -2955,14 +3068,14 @@
           "source": "event_data",
           "eventType": "enrollment_complete",
           "operator": "not_exists",
-          "description": "Suppress when the session eventually completed — a single overdue-login warning followed by a successful sign-in is normal hybrid latency, not a broken affinity."
+          "description": "Suppress when the session eventually completed — a single pending-affinity warning followed by a successful token acquisition is hybrid latency, not a broken affinity."
         }
       ],
       "conditions": [
         {
-          "signal": "hybrid_login_overdue",
+          "signal": "user_affinity_pending",
           "source": "event_type",
-          "eventType": "hybrid_login_pending",
+          "eventType": "entra_user_affinity_pending",
           "operator": "exists",
           "value": "",
           "required": true
@@ -2976,40 +3089,35 @@
           "required": true
         },
         {
-          "signal": "placeholder_still_active",
+          "signal": "no_user_token",
           "source": "event_type",
-          "eventType": "aad_placeholder_user_detected",
-          "operator": "exists",
+          "eventType": "ime_user_token_acquired",
+          "operator": "not_exists",
           "value": "",
-          "required": false
+          "required": true
         }
       ],
       "confidenceFactors": [
         {
-          "signal": "hybrid_login_pending",
+          "signal": "entra_user_affinity_pending",
           "condition": "count >= 2",
           "weight": 20
         },
         {
-          "signal": "hybrid_login_pending",
-          "condition": "count >= 3",
-          "weight": 10
-        },
-        {
-          "signal": "aad_placeholder_user_detected",
+          "signal": "entra_user_affinity_pending",
           "condition": "count >= 3",
           "weight": 10
         }
       ],
-      "explanation": "A real user signed in and reached the desktop, but the device kept reporting the **Autopilot provisioning placeholder** as the active identity in JoinInfo and the hybrid sign-in as **overdue** — across multiple reboots. This means the signed-in user never established **Microsoft Entra user affinity** (no Primary Refresh Token), so:\n\n- the Account Setup ESP page re-appears on every logon,\n- user-targeted required apps and policies cannot settle,\n- the enrollment never reaches completion.\n\nAfter this many hours this is not normal Entra Connect sync latency — something is structurally preventing the user (or the computer object) from registering:\n\n- the computer object's `userCertificate` attribute is not syncing to Entra ID (sync scope / OU filtering),\n- the signing-in user is not synced, or their UPN does not match a verified Entra domain,\n- the device has no line of sight to a domain controller **at logon time**, so the hybrid PRT flow cannot finish,\n- time skew or a proxy blocking `login.microsoftonline.com` / `enterpriseregistration.windows.net` from the user context.\n\nA frequent variant: the user's **first sign-in happens without domain-controller reachability** — for example when a pre-logon VPN tunnel (GlobalProtect, Always On VPN, Zscaler ZPA) is not established yet at the logon screen. Windows falls back to cached credentials, the hybrid PRT flow silently never runs, and later reboots do not fix it — sessions in this state typically show repeated reboots and network flapping while the placeholder identity stays active.\n\nA visible side effect: **the Windows Hello for Business wizard never appears**, because Hello provisioning requires an Entra user token (PRT). Hello is a downstream symptom here, not the cause.",
+      "explanation": "**What was measured.** A real user signed in and reached the desktop (`desktop_arrived`), and by the end of the agent's wait window the Intune Management Extension (IME) had still not acquired a **Microsoft Entra user token** for that user (`entra_user_affinity_pending`). That event lists the IME token error codes observed after the desktop (`tokenFailureCodes`) and how often the acquisition failed (`tokenFailureCount`). Each agent run reports this at most once, so a second or third occurrence means the same outcome across reboots — that repetition is what raises the confidence of this finding. No `ime_user_token_acquired` event followed in this session.\n\n**Why this means no user affinity.** IME's user check-in acquires the user token through the Windows web account manager (WAM), which needs the signed-in user's Entra identity — the Primary Refresh Token (PRT) that a hybrid sign-in establishes at logon. When that PRT was never issued, every token request fails and the user has **no Entra user affinity** on this device. Consequences:\n\n- user-targeted required apps and policies cannot apply,\n- Windows Hello for Business cannot provision (it requires a user token),\n- with a user ESP the Account Setup page re-appears on every logon instead of completing.\n\n**What this diagnosis does not use.** The Autopilot provisioning placeholder in JoinInfo (`aad_placeholder_user_detected`) is not part of this finding — on hybrid devices it can stay present through a perfectly healthy sign-in. Likewise, `dsregcmd /status` collected by the agent runs as SYSTEM and shows only the **device** join state; the per-user PRT state is visible only when the command runs as the signed-in user.\n\n**Typical causes** — something structurally prevents the user (or the computer object) from registering:\n\n- the computer object's `userCertificate` attribute is not syncing to Entra ID (sync scope / OU filtering),\n- the signing-in user is not synced, or their UPN does not match a verified Entra domain,\n- the device has no line of sight to a domain controller **at logon time**, so the hybrid PRT flow cannot finish,\n- time skew or a proxy blocking `login.microsoftonline.com` / `enterpriseregistration.windows.net` from the user context.\n\nA frequent variant: the user's **first sign-in happens without domain-controller reachability** — for example when a pre-logon VPN tunnel (GlobalProtect, Always On VPN, Zscaler ZPA) is not established yet at the logon screen. Windows falls back to cached credentials, the hybrid PRT flow silently never runs, and later reboots do not fix it.\n\nThe `device_registration_event` entries in the timeline (User Device Registration events 304/305) carry the OS-side record of the failed registration; the error codes in `entra_user_affinity_pending` carry the token side. A missing Windows Hello for Business wizard is a downstream symptom here, not the cause.",
       "remediation": [
         {
           "title": "Verify user affinity on the device",
           "steps": [
             "Sign in as the affected user and run: dsregcmd /status — under 'SSO State' the value AzureAdPrt must be YES. NO means the user has no Entra token and this diagnosis is confirmed.",
-            "Also check 'Device State': AzureAdJoined = YES and DomainJoined = YES are expected for hybrid join.",
-            "Check Event Viewer: Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin for PRT / registration errors (e.g. event 304/305/362).",
-            "Enable the gather rules 'Collect dsregcmd join status' so future sessions capture this state automatically."
+            "Also check 'Device State': AzureAdJoined = YES and DomainJoined = YES are expected for hybrid join — they prove the device join only, not the user's registration.",
+            "Check Event Viewer: Applications and Services Logs > Microsoft > Windows > User Device Registration > Admin for PRT / registration errors (e.g. event 304/305/362). The device_registration_event entries (304/305) in the session timeline carry the same OS-side failure record.",
+            "Enable the gather rule GATHER-DEVICE-006 (dsregcmd /status at the moment of the finding — device state only, the agent runs as SYSTEM). GATHER-DEVICE-007 and GATHER-DEVICE-008 (Microsoft-Windows-AAD/Operational events 1098 and 1097 at the same moment) are on by default."
           ]
         },
         {
@@ -3138,10 +3246,10 @@
     {
       "ruleId": "ANALYZE-OFFICE-001",
       "title": "Microsoft 365 Apps Install Failed",
-      "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) background install did not reach completion. The V2 OfficeInstallDetector watches the C2R client directly (registry + process) and emits office_install_failed when the install scenario was abandoned (worker gone and streaming never finished) or a C2R failure code was observed. This catches Office failures that the Intune integrated app type hides, because IME reports the app done within 1-2 minutes while C2R keeps installing in the background.",
+      "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) install failed. The V2 OfficeInstallDetector watches the C2R client directly (registry, Delivery Optimization, process) and emits office_install_failed when the C2R INSTALL scenario records an error code. Completion is proven by the core Office binaries on disk; an install window that closes without that proof ends silently, never as a failure. This catches Office failures the deployment status hides: the Intune built-in app type is marked done once the configuration is delivered, and a Win32 or RealmJoin package once its installer exits, while C2R keeps installing in the background.",
       "severity": "warning",
       "category": "apps",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "enabled": true,
       "evaluateOn": [
         "enrollment_end",
@@ -3175,12 +3283,12 @@
         }
       ],
       "confidenceThreshold": 40,
-      "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install did not finish.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real background install lifecycle. The Intune \"integrated\" Microsoft 365 Apps app type only pushes the configuration XML and starts the C2R bootstrapper, so IME marks the app done within 1-2 minutes while C2R keeps streaming and laying down the product for several more minutes. This event means C2R activity ended (the OfficeC2RClient worker exited and the install scenario cleared) without the StreamingFinished flag being set, or a C2R failure code was observed.\n\nReview the office_install_failed event payload: `products`, `channel`, `phase`, `streamingFinished`, `errorCode` (best-effort — may be empty) and `durationSeconds`.",
+      "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install failed.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real install lifecycle, however it was started. The Intune built-in Microsoft 365 Apps app type delivers the configuration through the Office CSP and lets the device start C2R; a Win32 or RealmJoin package runs the Office Deployment Tool. Either way the deployment is marked done before C2R has finished laying down the product. This event means C2R recorded an error code in its INSTALL scenario before the core Office apps were on disk.\n\nReview the office_install_failed event payload: `products`, `channel`, `errorCode`, `errorSource` (the C2R registry value that carried the code) and `durationSeconds`.",
       "remediation": [
         {
           "title": "Investigate the Office C2R install failure",
           "steps": [
-            "Open the office_install_failed event and review products, channel, phase, streamingFinished and errorCode",
+            "Open the office_install_failed event and review products, channel, errorCode and errorSource",
             "Check the Click-to-Run logs on the device (%windir%\\Temp and %temp%, files named <MachineName>-yyyymmdd-nnnn.log) for the failing operation",
             "Verify the device had network reachability to the Office CDN / Microsoft Connected Cache during the enrollment window",
             "Confirm the Intune Microsoft 365 Apps app configuration (products, channel, architecture) matches what the device can install",

rules/dist/gather-rules.json

@@ -130,16 +130,16 @@
     },
     {
       "ruleId": "GATHER-DEVICE-006",
-      "title": "Collect dsregcmd join status on overdue hybrid sign-in",
-      "description": "Runs dsregcmd /status the moment the agent reports a hybrid sign-in as overdue (hybrid_login_pending), capturing the Entra join and registration state at exactly the point where the problem is detected. Complements GATHER-DEVICE-001 (snapshot on entering Account Setup). Note: the agent runs as SYSTEM, so the output shows device join state — the per-user SSO/PRT state still requires running dsregcmd as the signed-in user.",
+      "title": "Collect dsregcmd join status on pending user affinity",
+      "description": "Runs dsregcmd /status the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending), capturing the device join and registration state at exactly the point where ANALYZE-ID-004 draws its evidence. Complements GATHER-DEVICE-001 (snapshot on entering Account Setup). Note: the agent runs as SYSTEM, so the output shows device join state — the per-user SSO/PRT state still requires running dsregcmd as the signed-in user.",
       "category": "device",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "author": "Autopilot Monitor",
       "enabled": false,
       "collectorType": "command_allowlisted",
       "target": "dsregcmd /status",
       "trigger": "on_event",
-      "triggerEventType": "hybrid_login_pending",
+      "triggerEventType": "entra_user_affinity_pending",
       "outputEventType": "gather_dsregcmd_status",
       "outputSeverity": "Info",
       "tags": [
@@ -149,6 +149,54 @@
         "hybrid"
       ]
     },
+    {
+      "ruleId": "GATHER-DEVICE-007",
+      "title": "Collect Entra operational log on pending user affinity (event 1098)",
+      "description": "Collects the most recent Entra token-broker operational events with ID 1098 from Microsoft-Windows-AAD/Operational the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending). Captures the OS-side token-broker record at exactly the point where ANALYZE-ID-004 draws its evidence. The event log collector filters on one event ID per rule; GATHER-DEVICE-008 collects event 1097 from the same channel.",
+      "category": "device",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "collectorType": "eventlog",
+      "target": "Microsoft-Windows-AAD/Operational",
+      "parameters": {
+        "eventId": "1098",
+        "maxEntries": "20"
+      },
+      "trigger": "on_event",
+      "triggerEventType": "entra_user_affinity_pending",
+      "outputEventType": "gather_aad_operational_events",
+      "outputSeverity": "Warning",
+      "tags": [
+        "device",
+        "entra",
+        "hybrid"
+      ]
+    },
+    {
+      "ruleId": "GATHER-DEVICE-008",
+      "title": "Collect Entra operational log on pending user affinity (event 1097)",
+      "description": "Collects the most recent Entra token-broker operational events with ID 1097 from Microsoft-Windows-AAD/Operational the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending). Captures the OS-side token-broker record at exactly the point where ANALYZE-ID-004 draws its evidence. The event log collector filters on one event ID per rule; GATHER-DEVICE-007 collects event 1098 from the same channel.",
+      "category": "device",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "collectorType": "eventlog",
+      "target": "Microsoft-Windows-AAD/Operational",
+      "parameters": {
+        "eventId": "1097",
+        "maxEntries": "20"
+      },
+      "trigger": "on_event",
+      "triggerEventType": "entra_user_affinity_pending",
+      "outputEventType": "gather_aad_operational_events",
+      "outputSeverity": "Warning",
+      "tags": [
+        "device",
+        "entra",
+        "hybrid"
+      ]
+    },
     {
       "ruleId": "GATHER-ENROLL-001",
       "title": "MDM enrollment diagnostic events",

rules/dist/ime-log-patterns.json

@@ -34,6 +34,14 @@
       "description": "Captures the exit code of a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees the real exit code (not just the inferred 0/1) before HS-NEW-RESULT arrives.",
       "enabled": true
     },
+    {
+      "patternId": "HS-INVOCATION",
+      "category": "always",
+      "pattern": "^\"[^\"]{0,260}\\\\agentexecutor\\.exe\"\\s+-(?<kind>remediationScript)\\s",
+      "action": "agentInvocationArgument",
+      "description": "The IME service's command line for a health-script executor, written by the health-script worker to IntuneManagementExtension.log and HealthScripts.log right before 'Launch powershell executor in ... session'. Opens an invocation that owns nothing, so the launch line the same worker writes next never sets the context of the platform script whose run is in flight in the IME log. The platform-script command line ('-powershell') does not match.",
+      "enabled": true
+    },
     {
       "patternId": "HS-NEW-RESULT",
       "category": "always",
@@ -339,6 +347,17 @@
       "description": "Captures the installer exit code (lpExitCode) for the current app.",
       "enabled": true
     },
+    {
+      "patternId": "IME-EXITCODE-CLASS",
+      "category": "currentPhase",
+      "pattern": "^\\[Win32App\\] lpExitCode is defined as (?<exitCodeClass>Success|SoftReboot|HardReboot|Retry|Failed)$",
+      "action": "captureExitCodeClass",
+      "parameters": {
+        "useCurrentApp": "true"
+      },
+      "description": "Captures the admin-defined return-code class of the installer exit code for the current app ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs, enum AppReturnCodeType - literal identical from IME 1.50 through 1.105). Stored as exitCodeClass on the app and emitted on its terminal events; the last value wins, so a Retry loop that ends in Success reports Success. Anchored on both ends on purpose: the no-mapping warning ('... defined as <n>, fall into default now.') and an unparsable numeric type print a raw number and must not match. Companion of IME-EXITCODE (the number, logged just before) and IME-EXITCODE-MAPPED-FAILED (the Failed state transition), which still owns the error path.",
+      "enabled": true
+    },
     {
       "patternId": "IME-EXITCODE-MAPPED-FAILED",
       "category": "currentPhase",
@@ -635,6 +654,22 @@
       "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
       "enabled": true
     },
+    {
+      "patternId": "PS-AGENT-ARG",
+      "category": "always",
+      "pattern": "^Adding argument (?<kind>[A-Za-z0-9]+) with value ",
+      "action": "agentInvocationArgument",
+      "description": "The first argument line of every AgentExecutor.exe invocation (powershell, remediationScript, detectionScript, requirementScript, ...). Opens the invocation that owns the policyId-less exit/output lines following it in AgentExecutor.log; PS-AGENT-SCRIPT-START upgrades a powershell invocation to its platform script. Also keeps the tracker's overwrite check active while the invocation runs.",
+      "enabled": true
+    },
+    {
+      "patternId": "PS-AGENT-COMPLETED",
+      "category": "always",
+      "pattern": "^Agent executor completed\\.",
+      "action": "agentExecutorCompleted",
+      "description": "Last line of an AgentExecutor.exe invocation. Closes the invocation's ownership of the exit/output lines in AgentExecutor.log and triggers the tracker's overwrite check: the executor wrote its end block at its own stream position, which may lie behind the tracker's bookmark when another process appended meanwhile.",
+      "enabled": true
+    },
     {
       "patternId": "PS-AGENT-ERROR",
       "category": "always",
@@ -697,14 +732,6 @@
       "description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
       "enabled": true
     },
-    {
-      "patternId": "PS-SCRIPT-EXITCODE",
-      "category": "always",
-      "pattern": "^Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
-      "action": "scriptExitCode",
-      "description": "Captures the PowerShell exit code when script execution completes in the IME log.",
-      "enabled": true
-    },
     {
       "patternId": "PS-SCRIPT-GENERATED",
       "category": "always",

rules/gather/GATHER-DEVICE-006.json

@@ -1,16 +1,16 @@
 {
   "$schema": "../schema/gather-rule.schema.json",
   "ruleId": "GATHER-DEVICE-006",
-  "title": "Collect dsregcmd join status on overdue hybrid sign-in",
-  "description": "Runs dsregcmd /status the moment the agent reports a hybrid sign-in as overdue (hybrid_login_pending), capturing the Entra join and registration state at exactly the point where the problem is detected. Complements GATHER-DEVICE-001 (snapshot on entering Account Setup). Note: the agent runs as SYSTEM, so the output shows device join state — the per-user SSO/PRT state still requires running dsregcmd as the signed-in user.",
+  "title": "Collect dsregcmd join status on pending user affinity",
+  "description": "Runs dsregcmd /status the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending), capturing the device join and registration state at exactly the point where ANALYZE-ID-004 draws its evidence. Complements GATHER-DEVICE-001 (snapshot on entering Account Setup). Note: the agent runs as SYSTEM, so the output shows device join state — the per-user SSO/PRT state still requires running dsregcmd as the signed-in user.",
   "category": "device",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "author": "Autopilot Monitor",
   "enabled": false,
   "collectorType": "command_allowlisted",
   "target": "dsregcmd /status",
   "trigger": "on_event",
-  "triggerEventType": "hybrid_login_pending",
+  "triggerEventType": "entra_user_affinity_pending",
   "outputEventType": "gather_dsregcmd_status",
   "outputSeverity": "Info",
   "tags": ["device", "entra", "join", "hybrid"]

rules/gather/GATHER-DEVICE-007.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "../schema/gather-rule.schema.json",
+  "ruleId": "GATHER-DEVICE-007",
+  "title": "Collect Entra operational log on pending user affinity (event 1098)",
+  "description": "Collects the most recent Entra token-broker operational events with ID 1098 from Microsoft-Windows-AAD/Operational the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending). Captures the OS-side token-broker record at exactly the point where ANALYZE-ID-004 draws its evidence. The event log collector filters on one event ID per rule; GATHER-DEVICE-008 collects event 1097 from the same channel.",
+  "category": "device",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "collectorType": "eventlog",
+  "target": "Microsoft-Windows-AAD/Operational",
+  "parameters": {
+    "eventId": "1098",
+    "maxEntries": "20"
+  },
+  "trigger": "on_event",
+  "triggerEventType": "entra_user_affinity_pending",
+  "outputEventType": "gather_aad_operational_events",
+  "outputSeverity": "Warning",
+  "tags": ["device", "entra", "hybrid"]
+}

rules/gather/GATHER-DEVICE-008.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "../schema/gather-rule.schema.json",
+  "ruleId": "GATHER-DEVICE-008",
+  "title": "Collect Entra operational log on pending user affinity (event 1097)",
+  "description": "Collects the most recent Entra token-broker operational events with ID 1097 from Microsoft-Windows-AAD/Operational the moment the agent reports that the signed-in user still has no Entra user token (entra_user_affinity_pending). Captures the OS-side token-broker record at exactly the point where ANALYZE-ID-004 draws its evidence. The event log collector filters on one event ID per rule; GATHER-DEVICE-007 collects event 1098 from the same channel.",
+  "category": "device",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "collectorType": "eventlog",
+  "target": "Microsoft-Windows-AAD/Operational",
+  "parameters": {
+    "eventId": "1097",
+    "maxEntries": "20"
+  },
+  "trigger": "on_event",
+  "triggerEventType": "entra_user_affinity_pending",
+  "outputEventType": "gather_aad_operational_events",
+  "outputSeverity": "Warning",
+  "tags": ["device", "entra", "hybrid"]
+}

rules/guardrails.json

@@ -94,7 +94,11 @@
     "C:\\Windows\\Panther",
     "C:\\Windows\\SetupDiag",
     "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
   ],
   "wmiQueryPrefixes": [
     "SELECT * FROM Win32_OperatingSystem",
@@ -282,5 +286,25 @@
     "log_entry",
     "agent_trace",
     "stall_probe_check"
+  ],
+  "imeLogDerivedEventTypes": [
+    "app_install_started",
+    "app_install_completed",
+    "app_install_failed",
+    "app_install_skipped",
+    "app_download_started",
+    "app_tracking_summary",
+    "download_progress",
+    "do_telemetry",
+    "script_started",
+    "script_completed",
+    "script_failed",
+    "script_timeout_suspected",
+    "esp_phase_changed",
+    "ime_agent_version",
+    "ime_token_failure",
+    "ime_user_session_completed",
+    "ime_process_exited",
+    "ime_user_token_acquired"
   ]
 }

rules/ime-log-patterns/HS-INVOCATION.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "HS-INVOCATION",
+  "category": "always",
+  "pattern": "^\"[^\"]{0,260}\\\\agentexecutor\\.exe\"\\s+-(?<kind>remediationScript)\\s",
+  "action": "agentInvocationArgument",
+  "description": "The IME service's command line for a health-script executor, written by the health-script worker to IntuneManagementExtension.log and HealthScripts.log right before 'Launch powershell executor in ... session'. Opens an invocation that owns nothing, so the launch line the same worker writes next never sets the context of the platform script whose run is in flight in the IME log. The platform-script command line ('-powershell') does not match.",
+  "enabled": true
+}

rules/ime-log-patterns/IME-EXITCODE-CLASS.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-EXITCODE-CLASS",
+  "category": "currentPhase",
+  "pattern": "^\\[Win32App\\] lpExitCode is defined as (?<exitCodeClass>Success|SoftReboot|HardReboot|Retry|Failed)$",
+  "action": "captureExitCodeClass",
+  "parameters": { "useCurrentApp": "true" },
+  "description": "Captures the admin-defined return-code class of the installer exit code for the current app ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs, enum AppReturnCodeType - literal identical from IME 1.50 through 1.105). Stored as exitCodeClass on the app and emitted on its terminal events; the last value wins, so a Retry loop that ends in Success reports Success. Anchored on both ends on purpose: the no-mapping warning ('... defined as <n>, fall into default now.') and an unparsable numeric type print a raw number and must not match. Companion of IME-EXITCODE (the number, logged just before) and IME-EXITCODE-MAPPED-FAILED (the Failed state transition), which still owns the error path.",
+  "enabled": true
+}

rules/ime-log-patterns/PS-AGENT-ARG.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "PS-AGENT-ARG",
+  "category": "always",
+  "pattern": "^Adding argument (?<kind>[A-Za-z0-9]+) with value ",
+  "action": "agentInvocationArgument",
+  "description": "The first argument line of every AgentExecutor.exe invocation (powershell, remediationScript, detectionScript, requirementScript, ...). Opens the invocation that owns the policyId-less exit/output lines following it in AgentExecutor.log; PS-AGENT-SCRIPT-START upgrades a powershell invocation to its platform script. Also keeps the tracker's overwrite check active while the invocation runs.",
+  "enabled": true
+}

rules/ime-log-patterns/PS-AGENT-COMPLETED.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "PS-AGENT-COMPLETED",
+  "category": "always",
+  "pattern": "^Agent executor completed\\.",
+  "action": "agentExecutorCompleted",
+  "description": "Last line of an AgentExecutor.exe invocation. Closes the invocation's ownership of the exit/output lines in AgentExecutor.log and triggers the tracker's overwrite check: the executor wrote its end block at its own stream position, which may lie behind the tracker's bookmark when another process appended meanwhile.",
+  "enabled": true
+}

rules/ime-log-patterns/PS-SCRIPT-EXITCODE.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "PS-SCRIPT-EXITCODE",
-  "category": "always",
-  "pattern": "^Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
-  "action": "scriptExitCode",
-  "description": "Captures the PowerShell exit code when script execution completes in the IME log.",
-  "enabled": true
-}

rules/schema/analyze-rule.schema.json

@@ -168,7 +168,7 @@
         },
         "source": {
           "type": "string",
-          "description": "Source of the signal.",
+          "description": "Source of the signal. phase_duration and app_install_duration never derive a duration from a span with mixed timestamp provenance (exactly one IME-log endpoint with sourceOffsetOrigin=reader-zone-fallback, i.e. the writer timezone was unknown to the agent for one endpoint only): such a condition evaluates false with evidence timestampProvenance=reader-zone-fallback. Two fallback endpoints share the same error and stay measurable.",
           "enum": ["event_type", "event_data", "event_data_array", "phase_duration", "event_count", "app_install_duration", "event_correlation", "clock_skew"]
         },
         "skewMetric": {
@@ -190,7 +190,7 @@
         },
         "operator": {
           "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
           "enum": ["equals", "not_equals", "contains", "not_contains", "regex", "not_regex", "gt", "lt", "gte", "lte", "exists", "not_exists", "count_gte", "count_per_group_gte", "in", "not_in"]
         },
         "value": {
@@ -204,16 +204,16 @@
         },
         "filterField": {
           "type": "string",
-          "description": "For event_count only: optional value filter — only events whose filterField satisfies filterOperator/filterValue are counted (e.g. count only performance_snapshot events with memory_used_percent > 90). Applies before counting for both count_gte and count_per_group_gte."
+          "description": "Optional same-event value filter for event_count, event_data and event_data_array: only events whose filterField satisfies filterOperator/filterValue are considered. For event_count it applies before counting (both count_gte and count_per_group_gte, e.g. count only performance_snapshot events with memory_used_percent > 90). For event_data/event_data_array the filter and the main dataField/operator test are evaluated on the SAME event instance — the only way to pin two fields of one event together, since separate conditions each scan all events independently (e.g. system_sleep_episode with durationSeconds gte 300 AND backfilled equals false)."
         },
         "filterOperator": {
           "type": "string",
-          "description": "Operator for the event_count value filter.",
+          "description": "Operator for the same-event value filter. Same vocabulary as operator.",
           "enum": ["equals", "not_equals", "contains", "not_contains", "regex", "not_regex", "gt", "lt", "gte", "lte", "exists", "not_exists", "in", "not_in"]
         },
         "filterValue": {
           "type": "string",
-          "description": "Value for the event_count value filter."
+          "description": "Value for the same-event value filter. Boolean values are stringified (\"true\"/\"false\")."
         },
         "correlateEventType": {
           "type": "string",

rules/schema/gather-rule.schema.json

@@ -114,6 +114,11 @@
           "description": "Emit behavior: \"always\" (default — emit on every collection) or \"on_change\" (poll on the trigger cadence but emit only when the collected result changes; the first in-scope result always emits).",
           "enum": ["always", "on_change"]
         },
+        "enrichErrorCodes": {
+          "type": "boolean",
+          "description": "Opt-in: let the backend explain error-code fields in this rule's output (exitCode, errorCode, hresult, ...) with the Windows/MSI/Intune error-code catalog, attaching the same *Info siblings built-in events get. Default false because gather-rule codes usually come from third-party logs or commands (HP Image Assistant, Dell Command Update, custom scripts) with their own exit-code numbering, where the catalog meaning would be wrong. Enable only when the parsed source really uses Windows codes (e.g. an msiexec or IME log).",
+          "default": false
+        },
         "outputEventType": {
           "type": "string",
           "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."

rules/schema/guardrails.schema.json

@@ -8,6 +8,16 @@
     "$schema": { "type": "string" },
     "registryPrefixes": { "$ref": "#/$defs/categorizedList" },
     "filePrefixes": { "$ref": "#/$defs/stringList" },
+    "userProfileFilePrefixes": {
+      "description": "Folders under the signed-in user's profile that file collectors and diagnostics paths may read, RELATIVE to the profile root (e.g. \"AppData\\\\Local\\\\Vendor\"). Resolved against %LOGGED_ON_USER_PROFILE% at match time. Entries outside AppData\\Local / AppData\\Roaming are dropped at load: the C:\\Users hard block never admits them, so this list can only ever narrow what the block's exception already permits.",
+      "type": "array",
+      "items": {
+        "allOf": [
+          { "$ref": "#/$defs/safeString" },
+          { "pattern": "^AppData\\\\(Local|Roaming)(\\\\|$)" }
+        ]
+      }
+    },
     "wmiQueryPrefixes": { "$ref": "#/$defs/stringList" },
     "eventLogChannels": { "$ref": "#/$defs/categorizedList" },
     "blockedEventLogChannels": { "$ref": "#/$defs/stringList" },
@@ -16,6 +26,7 @@
     "blockedFilePrefixes": { "$ref": "#/$defs/stringList" },
     "blockedCommandPatterns": { "$ref": "#/$defs/stringList" },
     "blockedInterimTriggerEventTypes": { "$ref": "#/$defs/stringList" },
+    "imeLogDerivedEventTypes": { "$ref": "#/$defs/stringList" },
     "maxCommandLength": { "type": "integer", "minimum": 1, "maximum": 100000 }
   },
   "required": [

rules/schema/ime-log-pattern.schema.json

@@ -71,6 +71,8 @@
             "scriptOutput",
             "scriptCompleted",
             "resetPlatformScriptContext",
+            "agentInvocationArgument",
+            "agentExecutorCompleted",
             "healthScriptResult",
             "healthScriptDetectionResult",
             "captureExitCode",
@@ -79,7 +81,8 @@
             "captureAppTypeWinGet",
             "captureAppTypeMsi",
             "captureAttemptNumber",
-            "captureDetectionResult"
+            "captureDetectionResult",
+            "captureExitCodeClass"
           ]
         },
         "parameters": {

rules/scripts/combine.js

@@ -142,6 +142,7 @@ if (fs.existsSync(guardrailsPath)) {
     assertStringList(guardrails[key], key);
   }
   assertStringList(guardrails.blockedInterimTriggerEventTypes ?? [], 'blockedInterimTriggerEventTypes');
+  assertStringList(guardrails.imeLogDerivedEventTypes ?? [], 'imeLogDerivedEventTypes');
   if (!Number.isInteger(guardrails.maxCommandLength) || guardrails.maxCommandLength < 1) {
     fail(`maxCommandLength: expected a positive integer, got ${JSON.stringify(guardrails.maxCommandLength)}`);
   }
@@ -207,6 +208,14 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.filePrefixes)}
 ];
 
+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+${flatArray(guardrails.userProfileFilePrefixes ?? [])}
+];
+
 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.wmiQueryPrefixes)}
 ];

scripts/Bootstrap/Install-AutopilotMonitor.Tests.ps1

@@ -14,6 +14,22 @@
 BeforeAll {
     . (Join-Path $PSScriptRoot 'Install-AutopilotMonitor.ps1')
 
+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+
+    function New-FakePayload {
+        param([string[]]$Files)
+        $dir = Join-Path $TestDrive ([guid]::NewGuid().ToString())
+        New-Item -ItemType Directory -Path $dir -Force | Out-Null
+        foreach ($f in $Files) { Set-Content -Path (Join-Path $dir $f) -Value 'x' }
+        return $dir
+    }
+
     function New-FakeProfile {
         param([string]$Name, [double]$AgeMinutes)
         $p = Join-Path $TestDrive $Name
@@ -305,3 +321,93 @@ Describe 'logging purity' {
         Get-Content $LogFile -Raw | Should -Match 'SKIP: Agent was previously deployed'
     }
 }
+
+Describe 'Get-UnverifiedAgentBinaries' {
+    # The publisher gate on the extracted payload. What matters is the DECISION: which
+    # payload is accepted, which is refused, and which files are looked at at all.
+    BeforeEach {
+        Mock Write-Log { }
+        $script:ours = 'CN=glueckkanja AG, O=glueckkanja AG, C=DE'
+    }
+
+    It 'accepts a payload where every binary of ours is validly signed by us' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+    }
+
+    It 'checks the binaries we author and leaves third-party assemblies alone' {
+        $dir = New-FakePayload -Files @(
+            'AutopilotMonitor.Agent.exe',
+            'AutopilotMonitor.Agent.exe.config',
+            'AutopilotMonitor.Shared.dll',
+            'Newtonsoft.Json.dll',
+            'System.Management.Automation.dll'
+        )
+        $script:checked = @()
+        Mock Get-AuthenticodeSignature {
+            $script:checked += (Split-Path $FilePath -Leaf)
+            New-FakeSignature -Status 'Valid' -Subject $script:ours
+        }
+
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+        $script:checked | Should -Be @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+    }
+
+    It 'refuses an unsigned agent executable' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a tampered binary (hash mismatch)' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a validly signed binary from a different publisher' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses the whole payload when a single DLL of ours is swapped' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature {
+            if ((Split-Path $FilePath -Leaf) -eq 'AutopilotMonitor.Shared.dll') {
+                New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US'
+            } else {
+                New-FakeSignature -Status 'Valid' -Subject $script:ours
+            }
+        }
+        $rejected = Get-UnverifiedAgentBinaries -Path $dir
+        $rejected.Count | Should -Be 1
+        $rejected[0] | Should -BeLike 'AutopilotMonitor.Shared.dll*'
+    }
+
+    It 'refuses when the signature check itself throws' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { throw 'access denied' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses an empty payload instead of passing it' {
+        $dir = New-FakePayload -Files @('Newtonsoft.Json.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+}
+
+Describe 'publisher pin' {
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $ExpectedPublisher | Should -Be '*O=glueckkanja AG*'
+        $ExpectedPublisher | Should -Not -Match '^[0-9A-Fa-f]{40}$'
+    }
+}

scripts/Bootstrap/Install-AutopilotMonitor.ps1

@@ -12,8 +12,9 @@
       2. Downloads the monitoring agent ZIP from Azure Blob Storage
       3. Verifies integrity via SHA-256 hash from the version manifest (mandatory)
       4. Extracts the agent into %ProgramData%\AutopilotMonitor\Agent
-      5. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
-      6. Verifies the runtime process actually launched
+      5. Verifies the Authenticode signature and publisher of every binary we author
+      6. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
+      7. Verifies the runtime process actually launched
     Agent self-destructs when enrollment completes.
 
     Relax flow (guards 2+3): a real user profile (or a real LastLoggedOnUser)
@@ -76,6 +77,11 @@
       PowerShell 5.1 (IME) reads scripts without BOM as ANSI, corrupting multi-byte chars.
 
 .CHANGELOG
+    2026-09-08  v2.5  Publisher gate: every AutopilotMonitor binary in the extracted
+                      payload must carry a valid Authenticode signature from the
+                      expected publisher before --install runs. The SHA-256 manifest
+                      check stays and is unchanged; it proves the bytes, the signature
+                      proves the author.
     2026-08-08  v2.3  Windows 365 Cloud PC support: a positively identified Cloud PC
                       (Windows365 registry key AND CloudManagedDesktopExtension
                       service) now triggers the guard 2+3 relax alongside OOBE
@@ -128,7 +134,12 @@ param(
 )
 
 # Script version (bump on meaningful changes; see .CHANGELOG above)
-$ScriptVersion = "2.4"
+$ScriptVersion = "2.5"
+
+# The publisher every binary we author must carry. A -like pattern on the subject, NOT a
+# thumbprint: certificates are renewed, deployed copies of this script are not. Same value
+# the loader pins for this script.
+$ExpectedPublisher = "*O=glueckkanja AG*"
 
 # Configuration - Everything in ProgramData for easy cleanup
 $AgentBasePath = "$env:ProgramData\AutopilotMonitor"
@@ -329,6 +340,56 @@ function Get-BootstrapDecision {
     return [pscustomobject]@{ Install = $true; ReasonCode = $null; RelaxActive = $relax.Active }
 }
 
+# Returns the list of reasons why the extracted payload is not ours; an empty result means
+# every binary we author carries a valid Authenticode signature from the expected publisher.
+# Third-party assemblies keep their own publisher's signature and are not checked here.
+# Any error is a rejection: an unreadable signature is an unverified binary.
+function Get-UnverifiedAgentBinaries {
+    param([string]$Path)
+
+    $rejected = @()
+    $ourBinaries = @(
+        Get-ChildItem -Path $Path -Filter 'AutopilotMonitor.*' -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Extension -in @('.exe', '.dll') }
+    )
+
+    # An empty set is a rejection, not a pass: it means the extraction produced nothing we
+    # recognise, and the alternative would be a gate that silently approves an empty folder.
+    # The comma keeps a single rejection an ARRAY: PowerShell unrolls a one-element result to
+    # a bare string, and the caller reads .Count and indexes into it.
+    if ($ourBinaries.Count -eq 0) {
+        return , @("no AutopilotMonitor binaries found in $Path")
+    }
+
+    foreach ($binary in $ourBinaries) {
+        try {
+            $sig = Get-AuthenticodeSignature -FilePath $binary.FullName -ErrorAction Stop
+        }
+        catch {
+            $rejected += "$($binary.Name): signature check failed to run ($($_.Exception.Message))"
+            continue
+        }
+
+        if ($null -eq $sig) {
+            $rejected += "$($binary.Name): signature check returned nothing"
+            continue
+        }
+
+        $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<unsigned>' }
+
+        if ($sig.Status -ne 'Valid') {
+            $rejected += "$($binary.Name): signature status $($sig.Status)"
+            continue
+        }
+        if ($subject -notlike $ExpectedPublisher) {
+            $rejected += "$($binary.Name): unexpected publisher $subject"
+            continue
+        }
+    }
+
+    return , $rejected
+}
+
 # Main bootstrap flow. Only invoked when the script is run directly (see entry guard
 # at the bottom); never on dot-source.
 function Invoke-Bootstrap {
@@ -445,6 +506,20 @@ function Invoke-Bootstrap {
             }
         }
 
+        # Publisher gate. The SHA-256 above proves the ZIP is the one the manifest names, but
+        # that manifest lives in the same container as the ZIP and cannot outlive a compromise
+        # of the download host. The expected publisher travels inside THIS script, which the
+        # loader verified before running it, so the chain from the file an administrator
+        # assigns to the process that starts here stays publisher-anchored end to end.
+        # Fail-closed, exactly like the hash check: running unverified code as SYSTEM is the
+        # risk being removed.
+        Write-Log "Verifying Authenticode signatures of the agent binaries..."
+        $unverified = Get-UnverifiedAgentBinaries -Path $AgentBinPath
+        if ($unverified.Count -gt 0) {
+            throw "Authenticode verification FAILED ($($unverified -join '; ')). Refusing to run an agent that is not signed by the expected publisher."
+        }
+        Write-Log "Authenticode verification passed (publisher pin: $ExpectedPublisher)"
+
         Write-Log "Calling agent install mode (--install)..."
         & $agentExePath --install
         $installExitCode = $LASTEXITCODE

scripts/Bootstrap/Start-AutopilotMonitor.Tests.ps1

@@ -0,0 +1,147 @@
+# Pester tests (Pester 5+) for the stage-1 loader Start-AutopilotMonitor.ps1.
+#
+# The script under test is dot-sourced; its entry guard prevents the loader from
+# executing, so loading it here is side-effect free. Network and signature checks
+# are mocked -- what is verified is the DECISION: what does the loader accept, what
+# does it refuse, and how often does it retry.
+#
+# Run under Windows PowerShell 5.1 to match the IME runtime:
+#   powershell.exe -NoProfile -Command "& { $c = New-PesterConfiguration; $c.Run.Path = 'scripts\Bootstrap'; $c.Output.Verbosity = 'Detailed'; Invoke-Pester -Configuration $c }"
+#
+# This file MUST remain pure ASCII (PS 5.1 reads BOM-less files as ANSI).
+
+BeforeAll {
+    . (Join-Path $PSScriptRoot 'Start-AutopilotMonitor.ps1')
+
+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+}
+
+Describe 'Test-BootstrapSignature' {
+    BeforeEach {
+        Mock Write-Log { }
+    }
+
+    It 'accepts a valid signature from the expected publisher' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeTrue
+    }
+
+    # An EV subject is a line of street address and registration numbers; the log gets the CN.
+    It 'logs the signer CN, not the whole subject' {
+        Mock Get-AuthenticodeSignature {
+            New-FakeSignature -Status 'Valid' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, L=Offenbach am Main, C=DE, SERIALNUMBER=HRB 12381'
+        }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeTrue
+        Should -Invoke Write-Log -ParameterFilter { $Message -eq 'Signature status: Valid. Signer: glueckkanja AG' }
+    }
+
+    It 'refuses an unsigned script' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses a tampered script (hash mismatch)' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    # The whole point of the pinned publisher: a validly signed script from someone else
+    # is exactly what an attacker with any code-signing certificate can produce.
+    It 'refuses a valid signature from a different publisher' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses when the signature check itself fails' {
+        Mock Get-AuthenticodeSignature { throw 'file not found' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+}
+
+Describe 'Get-VerifiedBootstrapScript' {
+    BeforeEach {
+        Mock Write-Log { }
+        Mock Start-Sleep { }
+        Mock Invoke-WebRequest { }
+    }
+
+    It 'returns after the first attempt when the download verifies' {
+        Mock Test-BootstrapSignature { $true }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 1 -Exactly
+    }
+
+    It 'gives up after three attempts when verification keeps failing' {
+        Mock Test-BootstrapSignature { $false }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeFalse
+        Should -Invoke Invoke-WebRequest -Times 3 -Exactly
+    }
+
+    # A truncated or proxy-mangled body fails verification, so the retry has to cover the
+    # download AND the check, not just the transport.
+    It 'retries a failed verification and accepts a later attempt' {
+        $script:calls = 0
+        Mock Test-BootstrapSignature { $script:calls++; return ($script:calls -ge 2) }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 2 -Exactly
+    }
+
+    It 'retries a transport failure' {
+        $script:downloads = 0
+        Mock Invoke-WebRequest { $script:downloads++; if ($script:downloads -eq 1) { throw 'connection reset' } }
+        Mock Test-BootstrapSignature { $true }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 2 -Exactly
+    }
+
+    It 'never executes anything when no attempt verifies' {
+        Mock Test-BootstrapSignature { $false }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeFalse
+    }
+}
+
+Describe 'publish contract' {
+    BeforeAll {
+        $script:loaderText = Get-Content (Join-Path $PSScriptRoot 'Start-AutopilotMonitor.ps1') -Raw
+    }
+
+    # Publish-BootstrapScripts.ps1 renders the -Dev loader by substituting this exact
+    # literal and fails the publish when it is gone. Catching that here means the PR fails
+    # instead of the publish.
+    It 'carries the dev-render anchor the publisher substitutes' {
+        $anchor = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1"'
+        $script:loaderText.Contains($anchor) | Should -BeTrue
+    }
+
+    # The publisher parses this to write version.json.loaderVersion and to run the
+    # version-bump guard.
+    It 'declares a parsable ScriptVersion' {
+        $script:loaderText -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"' | Should -BeTrue
+    }
+
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $script:loaderText -match '\$ExpectedPublisher\s*=\s*"\*O=' | Should -BeTrue
+    }
+
+    # The bootstrap MSI installs this same file and runs it with -LogFileName so the delivery
+    # channel stays visible in a diagnostics package. Renaming the parameter on either side
+    # would leave the MSI channel silently logging under the wrong name.
+    It 'keeps the -LogFileName contract the bootstrap MSI relies on' {
+        $script:loaderText -match '\[string\]\$LogFileName' | Should -BeTrue
+
+        $wxs = Get-Content (Join-Path $PSScriptRoot '..\..\src\Agent\AutopilotMonitor.BootstrapMsi\Package.wxs') -Raw
+        $wxs.Contains('[INSTALLFOLDER]Start-AutopilotMonitor.ps1') | Should -BeTrue
+        $wxs.Contains('-LogFileName bootstrap-msi.log') | Should -BeTrue
+    }
+}

scripts/Bootstrap/Start-AutopilotMonitor.ps1

@@ -0,0 +1,216 @@
+<#
+.SYNOPSIS
+    Stage 1 of the Autopilot Monitor bootstrap: fetches the current installer and runs it.
+
+.DESCRIPTION
+    This is the file an administrator assigns in Intune, and the same file the bootstrap MSI
+    installs and runs -- one implementation for both delivery channels; the MSI is only the
+    packaging. It carries no enrollment logic at all: it downloads the published
+    Install-AutopilotMonitor.ps1, proves that it was signed by Autopilot Monitor, and runs it
+    in this process.
+
+    Why two stages: the installer holds every guard, relax rule and download path, and those
+    change. Whoever assigns the installer directly has to replace their Intune copy each
+    time; whoever assigns this loader never does, because the part that changes lives on the
+    server. Assigning the installer directly stays supported and unchanged.
+
+    This file is deliberately boring. It is the one piece that cannot be fixed remotely, so
+    it does the least it can: download, verify, invoke, log.
+
+    Verification is by Authenticode publisher, not by hash. A hash oracle would have to be
+    fetched from the same host as the script itself, so it could not survive a compromise of
+    that host, while the expected publisher below travels with this file. It pins the
+    certificate SUBJECT and not a thumbprint, so a certificate renewal does not brick a
+    loader that is already deployed on devices.
+
+    Fail-soft: the loader always exits 0 and never throws into the caller. A device that
+    cannot reach the download endpoint is a device without monitoring, never a failed
+    enrollment step. Verification failures are the same: nothing runs, and the reason is in
+    the log. Refusing to execute unverified code as SYSTEM is the point of this file.
+
+    This file MUST remain pure ASCII (PS 5.1 reads BOM-less files as ANSI).
+
+.PARAMETER BootstrapUrl
+    Installer URL. Defaults to the published stable installer; the -Dev variant of this
+    loader is rendered from that default at publish time.
+
+.PARAMETER LogFileName
+    Log file inside the agent log directory. The MSI channel passes bootstrap-msi.log so the
+    delivery channel stays visible in a diagnostics package; the diag tooling keys on these
+    names, so do not rename them.
+
+.PARAMETER BootstrapArguments
+    Everything else is passed through to the installer unchanged, so any parameter the
+    installer accepts can be set here without this file knowing about it.
+
+.EXAMPLE
+    .\Start-AutopilotMonitor.ps1
+
+.EXAMPLE
+    .\Start-AutopilotMonitor.ps1 -MaxBootstrapWindowHours 24
+
+.NOTES
+    Author  : Oliver Kieselbach (autopilotmonitor.com)
+    Runtime : Windows PowerShell 5.1, SYSTEM context, during Autopilot enrollment
+
+.CHANGELOG
+    2026-09-08  v1.2  Log the signer CN instead of the full EV subject; the full subject is
+                      logged only when the publisher is why a script was rejected.
+    2026-09-08  v1.1  Also used by the bootstrap MSI, which replaced its own copy of this
+                      logic; -LogFileName keeps the channel visible in diagnostics.
+    2026-09-08  v1.0  Initial version: two-stage bootstrap, publisher-pinned verification.
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string]$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1",
+
+    [Parameter(Mandatory = $false)]
+    [ValidatePattern('^[A-Za-z0-9._-]+$')]
+    [string]$LogFileName = "bootstrap-loader.log",
+
+    [Parameter(Mandatory = $false, ValueFromRemainingArguments = $true)]
+    [string[]]$BootstrapArguments
+)
+
+# Script version (bump on meaningful changes; see .CHANGELOG above)
+$ScriptVersion = "1.2"
+
+# The publisher every downloaded stage-2 script must carry. A -like pattern on the subject,
+# NOT a thumbprint: certificates are renewed, deployed loaders are not.
+$ExpectedPublisher = "*O=glueckkanja AG*"
+
+$LoaderBasePath = "$env:ProgramData\AutopilotMonitor"
+$LoaderLogPath  = "$LoaderBasePath\Logs"
+$LogFile        = "$LoaderLogPath\$LogFileName"
+$BootstrapPath  = "$LoaderBasePath\Install-AutopilotMonitor.ps1"
+
+$DownloadAttempts = 3
+$RetryDelaySeconds = 10
+
+# Write-Host as well as the file: the Intune script output is what an administrator sees in
+# the portal, the file is what a support case reads.
+function Write-Log {
+    param([string]$Message)
+    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
+    $logMessage = "[$timestamp] $Message"
+    Write-Host $logMessage
+    Add-Content -Path $LogFile -Value $logMessage -ErrorAction SilentlyContinue
+}
+
+# True only when the file is signed, the signature validates against the machine's trust
+# chain, and the signer is us. Any error is a false -- an unreadable signature is an
+# unverified script.
+function Test-BootstrapSignature {
+    param([string]$Path)
+
+    try {
+        $sig = Get-AuthenticodeSignature -FilePath $Path -ErrorAction Stop
+    }
+    catch {
+        Write-Log "Signature check failed to run: $($_.Exception.Message)"
+        return $false
+    }
+
+    if ($null -eq $sig) {
+        Write-Log "Signature check returned nothing."
+        return $false
+    }
+
+    # The full subject of an EV certificate is a line of street address and registration
+    # numbers. The CN answers the only question the log has to answer; the full subject is
+    # logged when it is the reason for a rejection.
+    $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { "<unsigned>" }
+    $signer = if ($subject -match 'CN=([^,]+)') { $Matches[1] } else { $subject }
+    Write-Log "Signature status: $($sig.Status). Signer: $signer"
+
+    if ($sig.Status -ne 'Valid') {
+        Write-Log "REJECTED: expected signature status 'Valid'."
+        return $false
+    }
+    if ($subject -notlike $ExpectedPublisher) {
+        Write-Log "REJECTED: signer does not match the expected publisher. Full subject: $subject"
+        return $false
+    }
+
+    Write-Log "Signature accepted (thumbprint $($sig.SignerCertificate.Thumbprint))."
+    return $true
+}
+
+# Downloads the installer and returns $true once a downloaded copy passes verification.
+# Verification lives inside the retry loop on purpose: a truncated or proxy-mangled body
+# fails the signature check, and that is worth another attempt.
+function Get-VerifiedBootstrapScript {
+    param([string]$Url, [string]$Destination)
+
+    for ($attempt = 1; $attempt -le $DownloadAttempts; $attempt++) {
+        try {
+            Write-Log "Download attempt $attempt/$DownloadAttempts from $Url"
+            Invoke-WebRequest -Uri $Url -OutFile $Destination -UseBasicParsing -TimeoutSec 60 -ErrorAction Stop
+
+            if (Test-BootstrapSignature -Path $Destination) {
+                return $true
+            }
+        }
+        catch {
+            Write-Log "Download attempt $attempt failed: $($_.Exception.Message)"
+        }
+
+        if ($attempt -lt $DownloadAttempts) {
+            Start-Sleep -Seconds $RetryDelaySeconds
+        }
+    }
+
+    return $false
+}
+
+# Main flow. Only invoked when the script is run directly (see entry guard at the bottom),
+# so the Pester suite can dot-source this file without bootstrapping anything.
+function Start-BootstrapLoader {
+    New-Item -ItemType Directory -Force -Path $LoaderLogPath -ErrorAction SilentlyContinue | Out-Null
+
+    Write-Log "=== Autopilot Monitor bootstrap loader v$ScriptVersion started (user=$env:USERNAME, pid=$PID) ==="
+
+    # PS 5.1 on an OOBE device still defaults to TLS 1.0 for this process.
+    try {
+        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+    }
+    catch {
+        Write-Log "INFO: could not raise the TLS protocol: $($_.Exception.Message)"
+    }
+
+    if (-not (Get-VerifiedBootstrapScript -Url $BootstrapUrl -Destination $BootstrapPath)) {
+        Write-Log "No verified installer available after $DownloadAttempts attempt(s). Nothing was executed."
+        return
+    }
+
+    Write-Log "Executing $BootstrapPath"
+
+    # Same process, so the execution policy this loader runs under applies to stage 2 as
+    # well and no second policy decision can strand the installer. Splatting an array of
+    # remaining arguments keeps this file free of any knowledge about the installer's
+    # parameters.
+    $arguments = @()
+    if ($BootstrapArguments) { $arguments = $BootstrapArguments }
+
+    try {
+        & $BootstrapPath @arguments
+        Write-Log "Installer finished (exit code $LASTEXITCODE)."
+    }
+    catch {
+        Write-Log "Installer threw: $($_.Exception.Message)"
+    }
+}
+
+# Entry guard: dot-sourcing (Pester) loads the functions without running the loader.
+if ($MyInvocation.InvocationName -ne '.') {
+    try {
+        Start-BootstrapLoader
+    }
+    catch {
+        # Nothing above should throw; if it does, it must not become a failed Intune script.
+        Write-Log "Loader failed: $($_.Exception.Message)"
+    }
+    exit 0
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/EventTypeConstantGuardTests.cs

@@ -34,6 +34,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests
             new Regex("\\[\"eventType\"\\]\\s*=\\s*\"([a-z][a-z0-9_]*)\"", RegexOptions.Compiled),
         };
 
+        // Multi-line callback shape (2026-09-04, D-072 gap): `OnTraceEvent?.Invoke(` at the end
+        // of one line, the event-type literal alone on the NEXT line. The single-line patterns
+        // above never saw `desktop_real_user_detected` / `desktop_excluded_user` this way.
+        private static readonly Regex InvokeOpener = new Regex("\\.Invoke\\(\\s*$", RegexOptions.Compiled);
+        private static readonly Regex BareLiteralLine = new Regex("^\\s*\"([a-z][a-z0-9_]*)\"\\s*,?\\s*$", RegexOptions.Compiled);
+
         // The reducer/param key name itself ("eventType") and the like are not event types.
         private static readonly HashSet<string> NotEventTypes = new(StringComparer.Ordinal)
         {
@@ -59,33 +65,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests
                 Assert.True(Directory.Exists(full), $"V2 source dir not found: {full}");
 
                 foreach (var file in EnumerateSourceFiles(full))
-                {
-                    var lines = File.ReadAllLines(file);
-                    for (int i = 0; i < lines.Length; i++)
-                    {
-                        var line = lines[i];
-                        var trimmed = line.TrimStart();
-
-                        // Skip comments and const DEFINITIONS (Constants/DeadlineNames key names etc.).
-                        if (trimmed.StartsWith("//") || trimmed.StartsWith("*") || trimmed.StartsWith("///"))
-                            continue;
-                        if (line.Contains("const ")) continue;
-
-                        foreach (var pattern in EmitPatterns)
-                        {
-                            foreach (Match m in pattern.Matches(line))
-                            {
-                                var literal = m.Groups[1].Value;
-                                if (NotEventTypes.Contains(literal)) continue;
-                                if (!known.Contains(literal))
-                                {
-                                    offenders.Add(
-                                        $"{Path.GetFileName(file)}:{i + 1}  \"{literal}\"  ->  {line.Trim()}");
-                                }
-                            }
-                        }
-                    }
-                }
+                    offenders.AddRange(FindOffenders(Path.GetFileName(file), File.ReadAllLines(file), known));
             }
 
             Assert.True(
@@ -95,6 +75,65 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests
                 string.Join("\n  ", offenders));
         }
 
+        [Fact]
+        public void Guard_detects_multiline_Invoke_literal()
+        {
+            // Mutation proof for the multi-line shape: a synthetic emit site with an unknown
+            // literal on the line after `OnTraceEvent?.Invoke(` must be reported; the same
+            // shape with a known type must not.
+            var known = new HashSet<string>(StringComparer.Ordinal) { "desktop_arrived" };
+            string[] bad =
+            {
+                "                            OnTraceEvent?.Invoke(",
+                "                                \"desktop_not_a_real_type\",",
+                "                                $\"Real user desktop detected\",",
+            };
+            string[] good =
+            {
+                "                            OnTraceEvent?.Invoke(",
+                "                                \"desktop_arrived\",",
+            };
+
+            var offender = Assert.Single(FindOffenders("X.cs", bad, known));
+            Assert.Contains("desktop_not_a_real_type", offender);
+            Assert.Empty(FindOffenders("X.cs", good, known));
+        }
+
+        private static List<string> FindOffenders(string fileName, string[] lines, HashSet<string> known)
+        {
+            var offenders = new List<string>();
+            for (int i = 0; i < lines.Length; i++)
+            {
+                var line = lines[i];
+                var trimmed = line.TrimStart();
+
+                // Skip comments and const DEFINITIONS (Constants/DeadlineNames key names etc.).
+                if (trimmed.StartsWith("//") || trimmed.StartsWith("*") || trimmed.StartsWith("///"))
+                    continue;
+                if (line.Contains("const ")) continue;
+
+                foreach (var pattern in EmitPatterns)
+                {
+                    foreach (Match m in pattern.Matches(line))
+                        Check(m.Groups[1].Value, line, i);
+                }
+
+                if (i > 0 && InvokeOpener.IsMatch(lines[i - 1]))
+                {
+                    var bare = BareLiteralLine.Match(line);
+                    if (bare.Success) Check(bare.Groups[1].Value, line, i);
+                }
+            }
+            return offenders;
+
+            void Check(string literal, string line, int index)
+            {
+                if (NotEventTypes.Contains(literal)) return;
+                if (!known.Contains(literal))
+                    offenders.Add($"{fileName}:{index + 1}  \"{literal}\"  ->  {line.Trim()}");
+            }
+        }
+
         /// <summary>All string-const values declared on <see cref="Constants.EventTypes"/>.</summary>
         private static HashSet<string> KnownEventTypes()
         {
@@ -113,18 +152,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests
                 .Where(p => !p.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}")
                             && !p.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}"));
 
-        private static string RepoRoot()
-        {
-            var dir = AppContext.BaseDirectory;
-            for (int i = 0; i < 12; i++)
-            {
-                if (File.Exists(Path.Combine(dir, "AutopilotMonitor.sln"))) return dir;
-                var parent = Directory.GetParent(dir)?.FullName;
-                if (parent == null || parent == dir) break;
-                dir = parent;
-            }
-            throw new DirectoryNotFoundException(
-                "Could not locate repo root (AutopilotMonitor.sln) from " + AppContext.BaseDirectory);
-        }
+        private static string RepoRoot() => Harness.RepoPaths.Root();
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Harness/RepoPaths.cs

@@ -0,0 +1,27 @@
+using System;
+using System.IO;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Harness
+{
+    /// <summary>Repository paths for tests that read or write checked-in files (guards, fixtures).</summary>
+    internal static class RepoPaths
+    {
+        /// <summary>Walks up from the test binary to the directory holding <c>AutopilotMonitor.sln</c>.</summary>
+        public static string Root()
+        {
+            var dir = AppContext.BaseDirectory;
+            for (int i = 0; i < 12; i++)
+            {
+                if (File.Exists(Path.Combine(dir, "AutopilotMonitor.sln"))) return dir;
+                var parent = Directory.GetParent(dir)?.FullName;
+                if (parent == null || parent == dir) break;
+                dir = parent;
+            }
+            throw new DirectoryNotFoundException(
+                "Could not locate repo root (AutopilotMonitor.sln) from " + AppContext.BaseDirectory);
+        }
+
+        /// <summary><c>tests/fixtures/&lt;name&gt;</c> under the repo root.</summary>
+        public static string Fixtures(string name) => Path.Combine(Root(), "tests", "fixtures", name);
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Integration/EnrollmentOrchestratorFixture.cs

@@ -13,6 +13,7 @@ using AutopilotMonitor.DecisionCore.Classifiers;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Integration
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Integration/ScenarioTests.cs

@@ -5,6 +5,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Classifiers;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031 // SpinWait.SpinUntil for uploader-batch-arrival assertion
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/EntraUserAffinityDetectorTests.cs

@@ -0,0 +1,236 @@
+#nullable enable
+using System;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// Entra user affinity after the real-user desktop (2026-09-04, session a7140f98). The
+    /// contracts that matter: arm only on Hybrid devices and only at the desktop; the first
+    /// IME user-token line AFTER the desktop cancels and posts <c>ime_user_token_acquired</c>;
+    /// token lines from before the desktop (device phase) are ignored; the timer posts
+    /// <c>entra_user_affinity_pending</c> with the failure codes seen since the desktop; both
+    /// emissions are single-shot per process.
+    /// </summary>
+    public sealed class EntraUserAffinityDetectorTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 4, 13, 54, 6, DateTimeKind.Utc);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public VirtualClock Clock { get; } = new VirtualClock(Fixed);
+            public InformationalEventPost Post { get; }
+            public bool Hybrid { get; set; } = true;
+            public bool PlaceholderActive { get; set; } = true;
+
+            public Fixture()
+            {
+                Logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Post = new InformationalEventPost(Ingress, Clock);
+            }
+
+            public EntraUserAffinityDetector Build() => new EntraUserAffinityDetector(
+                Post, Logger,
+                isHybridJoinProbe: () => Hybrid,
+                placeholderActiveProbe: () => PlaceholderActive,
+                delay: TimeSpan.FromMinutes(10),
+                utcNow: () => Clock.UtcNow);
+
+            public void Dispose() => Tmp.Dispose();
+        }
+
+        private static FakeSignalIngressSink.PostedSignal? Find(FakeSignalIngressSink ingress, string eventType) =>
+            ingress.Posted.FirstOrDefault(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == eventType);
+
+        [Fact]
+        public void Desktop_on_hybrid_device_arms()
+        {
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+
+            Assert.True(d.IsArmedForTest);
+        }
+
+        [Fact]
+        public void Desktop_on_non_hybrid_device_does_not_arm()
+        {
+            using var f = new Fixture { Hybrid = false };
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.TriggerFromTest();
+
+            Assert.False(d.IsArmedForTest);
+            Assert.Null(Find(f.Ingress, SharedEventTypes.EntraUserAffinityPending));
+        }
+
+        [Fact]
+        public void Timer_without_token_emits_pending_with_failure_codes()
+        {
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.NotifyTokenFailureLine("3399548929", f.Clock.UtcNow.AddMinutes(1));
+            d.NotifyTokenFailureLine("3399548929", f.Clock.UtcNow.AddMinutes(3));
+            d.NotifyTokenFailureLine("3400073247", f.Clock.UtcNow.AddMinutes(5));
+            f.Clock.Advance(TimeSpan.FromMinutes(10));
+            d.TriggerFromTest();
+
+            var pending = Find(f.Ingress, SharedEventTypes.EntraUserAffinityPending);
+            Assert.NotNull(pending);
+            Assert.Equal("Warning", pending!.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("true", pending.Payload[SignalPayloadKeys.ImmediateUpload]);
+            Assert.Equal("EntraUserAffinityDetector", pending.Payload[SignalPayloadKeys.Source]);
+            Assert.Equal("10", pending.Payload["delayMinutes"]);
+            Assert.Equal("timer_fired", pending.Payload["reason"]);
+            Assert.Equal("3", pending.Payload["tokenFailureCount"]);
+            Assert.Equal("3399548929,3400073247", pending.Payload["tokenFailureCodes"]);
+            Assert.Equal("true", pending.Payload["placeholderActive"]);
+            Assert.Equal("10.0", pending.Payload["minutesSinceDesktop"]);
+            Assert.True(d.HasFiredForTest);
+            Assert.Null(Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired));
+        }
+
+        [Fact]
+        public void Token_after_desktop_cancels_and_posts_token_acquired()
+        {
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.NotifyTokenFailureLine("3399548929", f.Clock.UtcNow.AddSeconds(30));
+            var tokenAt = f.Clock.UtcNow.AddMinutes(3.7);
+            d.NotifyUserTokenAcquired(tokenAt);
+            f.Clock.Advance(TimeSpan.FromMinutes(10));
+            d.TriggerFromTest();
+
+            var acquired = Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired);
+            Assert.NotNull(acquired);
+            Assert.Equal("Info", acquired!.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("3.7", acquired.Payload["minutesAfterDesktop"]);
+            Assert.Equal("1", acquired.Payload["tokenFailuresBeforeSuccess"]);
+            Assert.Equal(tokenAt, acquired.OccurredAtUtc);
+            Assert.True(d.TokenAcquiredPostedForTest);
+            Assert.False(d.HasFiredForTest);
+            Assert.Null(Find(f.Ingress, SharedEventTypes.EntraUserAffinityPending));
+        }
+
+        [Fact]
+        public void Token_lines_from_before_the_desktop_are_ignored()
+        {
+            // Device-phase token lines ("Failed to get AAD token" is routine there; a success
+            // can be the device check-in) must neither count nor cancel — the 2-min tolerance
+            // only covers the desktop poll interval.
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.NotifyUserTokenAcquired(f.Clock.UtcNow.AddMinutes(-20));
+            d.NotifyTokenFailureLine("3399548929", f.Clock.UtcNow.AddMinutes(-15));
+            f.Clock.Advance(TimeSpan.FromMinutes(10));
+            d.TriggerFromTest();
+
+            Assert.Null(Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired));
+            var pending = Find(f.Ingress, SharedEventTypes.EntraUserAffinityPending);
+            Assert.NotNull(pending);
+            Assert.Equal("0", pending!.Payload!["tokenFailureCount"]);
+            Assert.Equal(string.Empty, pending.Payload["tokenFailureCodes"]);
+        }
+
+        [Fact]
+        public void Token_within_desktop_poll_tolerance_counts_as_after_desktop()
+        {
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.NotifyUserTokenAcquired(f.Clock.UtcNow.AddSeconds(-90));
+
+            Assert.NotNull(Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired));
+            Assert.Equal("0.0", Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired)!.Payload!["minutesAfterDesktop"]);
+        }
+
+        [Fact]
+        public void Token_without_arm_is_ignored()
+        {
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyUserTokenAcquired(f.Clock.UtcNow);
+
+            Assert.Null(Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired));
+        }
+
+        [Fact]
+        public void Pending_fires_once_and_a_late_token_still_resolves_it_once()
+        {
+            // A token that arrives AFTER the warning is the most useful thing the timeline can
+            // show ("affinity came late") and lets the backend rule drop the finding — so it is
+            // posted, but like the warning only once per process.
+            using var f = new Fixture();
+            using var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.NotifyRealUserDesktop();
+            f.Clock.Advance(TimeSpan.FromMinutes(10));
+            d.TriggerFromTest();
+            d.TriggerFromTest();
+            d.NotifyUserTokenAcquired(f.Clock.UtcNow);
+            d.NotifyUserTokenAcquired(f.Clock.UtcNow.AddMinutes(1));
+
+            Assert.Single(f.Ingress.Posted, p =>
+                p.Payload != null && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == SharedEventTypes.EntraUserAffinityPending);
+            Assert.Single(f.Ingress.Posted, p =>
+                p.Payload != null && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == SharedEventTypes.ImeUserTokenAcquired);
+            Assert.Equal("10.0", Find(f.Ingress, SharedEventTypes.ImeUserTokenAcquired)!.Payload!["minutesAfterDesktop"]);
+        }
+
+        [Fact]
+        public void Hybrid_probe_throwing_does_not_arm()
+        {
+            using var f = new Fixture();
+            using var d = new EntraUserAffinityDetector(
+                f.Post, f.Logger,
+                isHybridJoinProbe: () => throw new InvalidOperationException("registry"),
+                utcNow: () => f.Clock.UtcNow);
+
+            d.NotifyRealUserDesktop();
+
+            Assert.False(d.IsArmedForTest);
+        }
+
+        [Fact]
+        public void Dispose_after_arm_does_not_throw_and_blocks_emission()
+        {
+            using var f = new Fixture();
+            var d = f.Build();
+
+            d.NotifyRealUserDesktop();
+            d.Dispose();
+            d.TriggerFromTest();
+
+            Assert.Null(Find(f.Ingress, SharedEventTypes.EntraUserAffinityPending));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/EspAndHelloTrackerShellCoreFailureInheritanceTests.cs

@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Signals;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// Session 683f1eff — a Shell-Core 62407 failure (<c>WhiteGlove_Failed</c>) arrived four
+    /// seconds into the provisioning tracker's 30-s settle window and terminalised the session
+    /// with nothing but its failure type: the HRESULT (0x80070652) and the failed subcategory
+    /// (Apps) the registry had already named never reached the terminal event, the backend
+    /// FailureReason or the termination-time app classification. The coordinator now inherits
+    /// the pending settle detail onto the Shell-Core args and records the terminal-failure
+    /// snapshot from it.
+    /// </summary>
+    public sealed class EspAndHelloTrackerShellCoreFailureInheritanceTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 6, DateTimeKind.Utc);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public FakeSignalIngressSink TrackerPostSink { get; } = new FakeSignalIngressSink();
+            public VirtualClock Clock { get; } = new VirtualClock(Fixed);
+            public List<EspFailureDetectedEventArgs> Forwarded { get; } = new List<EspFailureDetectedEventArgs>();
+
+            public Fixture() { Logger = new AgentLogger(Tmp.Path, AgentLogLevel.Debug); }
+
+            public EspAndHelloTracker BuildCoordinator(Func<EspFailureDetectedEventArgs?> pendingProbe)
+            {
+                var coordinator = new EspAndHelloTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: new InformationalEventPost(TrackerPostSink, Clock),
+                    logger: Logger,
+                    skipConfigProbe: () => ((bool?)false, (bool?)false),
+                    accountSetupActivityProbe: () => false,
+                    pendingEspFailureProbe: pendingProbe);
+                coordinator.EspFailureDetected += (_, args) => Forwarded.Add(args);
+                return coordinator;
+            }
+
+            public FakeSignalIngressSink.PostedSignal TerminalSignal() =>
+                Assert.Single(Ingress.Posted, p => p.Kind == DecisionSignalKind.EspTerminalFailure);
+
+            public void Dispose() { Tmp.Dispose(); }
+        }
+
+        private static EspFailureDetectedEventArgs PendingAppsFailure() => new EspFailureDetectedEventArgs(
+            failureType: "Provisioning_DeviceSetup_Apps_Failed",
+            errorCode: "0x80070652",
+            failedSubcategory: "Apps",
+            category: "DeviceSetup",
+            likelyCulpritApps: new[] { "ESP Finalizer US" });
+
+        [Fact]
+        public void ShellCore_failure_inside_the_settle_window_inherits_the_registry_detail()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(PendingAppsFailure);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);   // the signal that terminalised
+            Assert.Equal("0x80070652", args.ErrorCode);
+            Assert.Equal("Apps", args.FailedSubcategory);
+            Assert.Equal("DeviceSetup", args.Category);
+            Assert.Equal(new[] { "ESP Finalizer US" }, args.LikelyCulpritApps);
+
+            // Wire-through: the EspTerminalFailure signal payload carries the detail the
+            // DecisionEngine copies onto enrollment_failed.
+            var signal = f.TerminalSignal();
+            Assert.Equal("WhiteGlove_Failed", signal.Payload!["failureType"]);
+            Assert.Equal("0x80070652", signal.Payload["errorCode"]);
+            Assert.Equal("Apps", signal.Payload["failedSubcategory"]);
+            Assert.Equal("DeviceSetup", signal.Payload["category"]);
+            Assert.Equal("ESP Finalizer US", signal.Payload["likelyCulpritApps"]);
+
+            // Termination-time classification reads the same context.
+            Assert.NotNull(coordinator.LastEspTerminalFailure);
+            Assert.Equal("0x80070652", coordinator.LastEspTerminalFailure.ErrorCode);
+            Assert.True(coordinator.LastEspTerminalFailure.IsAppsSubcategory);
+        }
+
+        [Fact]
+        public void ShellCore_failure_without_a_pending_window_stays_bare()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => null);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("ESPProgress_Timeout");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("ESPProgress_Timeout", args.FailureType);
+            Assert.Null(args.ErrorCode);
+            Assert.Null(args.FailedSubcategory);
+            Assert.Null(args.Category);
+            Assert.Empty(args.LikelyCulpritApps);
+            Assert.Null(coordinator.LastEspTerminalFailure);
+
+            var signal = f.TerminalSignal();
+            Assert.False(signal.Payload!.ContainsKey("errorCode"));
+            Assert.False(signal.Payload.ContainsKey("failedSubcategory"));
+        }
+
+        [Fact]
+        public void A_throwing_probe_degrades_to_the_bare_failure()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => throw new InvalidOperationException("probe"));
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);
+            Assert.Null(args.ErrorCode);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleCollectorGuardTests.cs

@@ -456,5 +456,124 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
 
             SingleSecurityWarning();
         }
+
+        // -------------------------------------------------------------------
+        // %LOGGED_ON_USER_PROFILE% exception (userProfilePath overload)
+        //
+        // The token lifts the C:\Users hard block for AppData\Local and
+        // AppData\Roaming — and nothing more. The allowlist still decides,
+        // which is what the cases below pin down: the exception is a gate the
+        // allowlist has to open, never an allowance of its own.
+        // -------------------------------------------------------------------
+
+        private const string TestProfile = @"C:\Users\TestUser";
+
+        [Fact]
+        public void UserProfile_AppDataPath_WithoutAllowlistEntry_IsStillBlocked()
+        {
+            // The lifted hard block alone admits nothing: without a matching
+            // userProfileFilePrefixes entry the path falls through to the
+            // allowlist and is refused there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_OutsideAppData_IsBlockedByTheHardBlock()
+        {
+            foreach (var target in new[] { @"\Desktop\secret.txt", @"\Documents\notes.txt", @"\ntuser.dat" })
+            {
+                Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + target, unrestrictedMode: false, userProfilePath: TestProfile));
+            }
+        }
+
+        [Fact]
+        public void UserProfile_NullProfile_KeepsTheUsersHardBlock()
+        {
+            // No interactive user detected — the exception cannot apply and the
+            // path stays under the plain C:\Users block.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_TraversalOutOfAppData_IsBlocked()
+        {
+            // Spelling Documents as a traversal out of AppData must not survive
+            // Path.GetFullPath normalisation.
+            const string traversal = @"C:\Users\TestUser\AppData\Local\..\..\Documents\secret.txt";
+
+            Assert.Equal(@"C:\Users\TestUser\Documents\secret.txt", Path.GetFullPath(traversal));
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                traversal, unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_ForeignProfile_IsBlockedEvenUnderAppData()
+        {
+            // The exception is scoped to the DETECTED profile — a rule must not
+            // reach a second user's AppData by spelling the path out.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_IsAllowed()
+        {
+            // AppData\Local\RealmJoin is on userProfileFilePrefixes: the file itself, a
+            // subfolder below it, and the folder itself all pass.
+            foreach (var target in new[] { @"\tray.log", @"\Logs\rj.log", "" })
+            {
+                Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + @"\AppData\Local\RealmJoin" + target,
+                    unrestrictedMode: false, userProfilePath: TestProfile),
+                    $"expected allowed: ...\\RealmJoin{target}");
+            }
+        }
+
+        [Fact]
+        public void UserProfile_SiblingOfAnAllowlistedVendorFolder_IsBlocked()
+        {
+            // Segment-bounded: "RealmJoin" must not admit "RealmJoinSomethingElse".
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\RealmJoinSomethingElse\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_InAForeignProfile_IsBlocked()
+        {
+            // The allowlist is anchored to the DETECTED profile, not to C:\Users\*.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_WithoutADetectedUser_IsBlocked()
+        {
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_AppDataPath_IsAllowedInUnrestrictedMode()
+        {
+            // Where the exception does bite today: unrestricted mode returns
+            // before the allowlist, so the lifted hard block is the whole story.
+            Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+
+            // ...but only under AppData — Documents stays blocked even there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\Documents\secret.txt",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorEnrichErrorCodesTests.cs

@@ -0,0 +1,111 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// <see cref="GatherRule.EnrichErrorCodes"/> is an opt-in the backend honours at response time:
+    /// the agent stamps <c>enrichErrorCodes: true</c> into the event data of a rule that set it and
+    /// nothing at all otherwise (the default payload stays as it was).
+    /// </summary>
+    [Collection("SerialThreading")] // startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorEnrichErrorCodesTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_7e3a1f4b-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorEnrichErrorCodesTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private EnrollmentEvent SingleEvent()
+        {
+            lock (_eventsGate) return Assert.Single(_events);
+        }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                lock (_eventsGate) if (_events.Count >= count) return true;
+                Thread.Sleep(25);
+            }
+            lock (_eventsGate) return _events.Count >= count;
+        }
+
+        private static GatherRule StartupRule(bool enrichErrorCodes) => new GatherRule
+        {
+            RuleId = "GATHER-EEC-001",
+            Title = "enrich test",
+            CollectorType = "registry",
+            Target = AbsentPath,
+            Trigger = "startup",
+            OutputEventType = "gather_test",
+            Enabled = true,
+            EnrichErrorCodes = enrichErrorCodes,
+        };
+
+        [Fact]
+        public void StampRuleMarkers_AddsMarkerOnlyWhenOptedIn()
+        {
+            var optedIn = new Dictionary<string, object> { ["exitCode"] = "1603" };
+            GatherRuleExecutor.StampRuleMarkers(StartupRule(enrichErrorCodes: true), optedIn);
+            Assert.Equal(true, optedIn[Constants.GatherRuleDataKeys.EnrichErrorCodes]);
+
+            var defaultRule = new Dictionary<string, object> { ["exitCode"] = "1603" };
+            GatherRuleExecutor.StampRuleMarkers(StartupRule(enrichErrorCodes: false), defaultRule);
+            Assert.False(defaultRule.ContainsKey(Constants.GatherRuleDataKeys.EnrichErrorCodes));
+            Assert.Single(defaultRule);
+        }
+
+        [Fact]
+        public void ExecuteRule_StampsMarker_WhenRuleOptsIn()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule(enrichErrorCodes: true) });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            var evt = SingleEvent();
+            Assert.Equal(GatherRuleExecutor.SourceName, evt.Source);
+            Assert.Equal(true, evt.Data[Constants.GatherRuleDataKeys.EnrichErrorCodes]);
+        }
+
+        [Fact]
+        public void ExecuteRule_LeavesPayloadUnchanged_ByDefault()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule(enrichErrorCodes: false) });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            Assert.False(SingleEvent().Data.ContainsKey(Constants.GatherRuleDataKeys.EnrichErrorCodes));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/HelloTrackerImmediateUploadTests.cs

@@ -73,6 +73,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
             Assert.Equal("true", info.Payload![SignalPayloadKeys.ImmediateUpload]);
         }
 
+        [Theory]
+        [InlineData(304, "join phase")]
+        [InlineData(305, "authentication phase")]
+        public void ProcessHelloEvent_304_305_emit_device_registration_event_with_immediate_upload(int eventId, string phaseLabel)
+        {
+            // Hybrid affinity companion (2026-09-04): UDR 304/305 ride the already-armed
+            // watcher and surface as device_registration_event — a Warning, flushed at once,
+            // and never a Hello completion.
+            using var f = new Fixture();
+
+            f.Tracker.ProcessHelloEvent(eventId, Fixed, "Microsoft-Windows-User Device Registration", isBackfill: false);
+
+            var info = f.InfoEvent("device_registration_event");
+            Assert.Equal("Warning", info.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("true", info.Payload[SignalPayloadKeys.ImmediateUpload]);
+            Assert.Contains(phaseLabel, info.Payload[SignalPayloadKeys.Message]);
+            Assert.DoesNotContain(f.Ingress.Posted, p =>
+                p.Payload != null && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et.StartsWith("hello_provisioning"));
+        }
+
         [Fact]
         public void ProcessHelloEvent_358_willlaunch_is_suppressed()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/HybridLoginPendingDetectorTests.cs

@@ -194,6 +194,58 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
             Assert.NotNull(FindHybridLoginPending(f.Ingress));
         }
 
+        // ============================================================================
+        // Real-user desktop cancel path (2026-09-04, session a7140f98)
+        // ============================================================================
+
+        [Fact]
+        public void Real_user_desktop_after_Arm_cancels_emission()
+        {
+            using var f = new Fixture();
+            using var detector = new HybridLoginPendingDetector(f.Watcher, f.Post, f.Logger);
+
+            detector.Arm();
+            detector.NotifyRealUserDesktop();
+            detector.TriggerFromTest();
+
+            Assert.True(detector.IsCancelledByDesktopForTest);
+            Assert.False(detector.HasFiredForTest);
+            Assert.Null(FindHybridLoginPending(f.Ingress));
+        }
+
+        [Fact]
+        public void Real_user_desktop_before_Arm_short_circuits_Arm()
+        {
+            // The DAD first poll runs seconds after start; the arm request comes from the
+            // runtime host slightly later. A desktop seen first must make the arm a no-op.
+            using var f = new Fixture();
+            using var detector = new HybridLoginPendingDetector(f.Watcher, f.Post, f.Logger);
+
+            detector.NotifyRealUserDesktop();
+            detector.Arm();
+            detector.TriggerFromTest();
+
+            Assert.False(detector.IsArmedForTest);
+            Assert.Null(FindHybridLoginPending(f.Ingress));
+        }
+
+        [Fact]
+        public void Emission_reports_desktop_absence_and_placeholder_as_fact()
+        {
+            using var f = new Fixture();
+            using var detector = new HybridLoginPendingDetector(f.Watcher, f.Post, f.Logger);
+
+            detector.Arm();
+            detector.TriggerFromTest();
+
+            var info = FindHybridLoginPending(f.Ingress);
+            Assert.NotNull(info);
+            Assert.Equal("false", info!.Payload!["realUserDesktopSeen"]);
+            Assert.Equal("false", info.Payload["placeholderActive"]); // watcher never saw JoinInfo in this fixture
+            Assert.Contains("no real-user desktop", info.Payload[SignalPayloadKeys.Message]);
+            Assert.DoesNotContain("placeholder still active", info.Payload[SignalPayloadKeys.Message]);
+        }
+
         // ============================================================================
         // Lifecycle / Dispose
         // ============================================================================

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogEraPreScanTests.cs

@@ -0,0 +1,215 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Backlog era anchoring (2026-09-04, session a7140f98). The property under test: the
+    /// bootstrap execution record — stdout in AgentExecutor.log, policy result in the service
+    /// log — measured against the install marker anchors exactly the era it sits in; a SKIP
+    /// re-run, a missing marker, an MSI bootstrap and an off-grid residual anchor nothing; the
+    /// anchor never crosses an "EMS Agent Started" boundary; sibling files join by local time
+    /// only while the service eras are unambiguous.
+    /// </summary>
+    public sealed class ImeLogEraPreScanTests
+    {
+        private static readonly DateTime Deployed = new DateTime(2026, 9, 4, 13, 31, 49, 100, DateTimeKind.Utc);
+        private static readonly TimeSpan Pacific = TimeSpan.FromHours(-7);
+        private static readonly TimeSpan Eastern = TimeSpan.FromHours(-4);
+        private const string PolicyId = "93d9df23-1111-2222-3333-444455556666";
+
+        private static string Entry(string message, DateTime utcInstant, TimeSpan writerOffset)
+        {
+            var local = utcInstant + writerOffset;
+            return $"<![LOG[{message}]LOG]!><time=\"{local:HH:mm:ss.fffffff}\" date=\"{local:M-d-yyyy}\" " +
+                   "component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">";
+        }
+
+        private static string ScriptStart(DateTime utc, TimeSpan offset) =>
+            Entry($@"Adding argument powershell with value C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_{PolicyId}.ps1", utc, offset);
+
+        private static string BootstrapStdout(DateTime utc, TimeSpan offset, string tail = "===== Bootstrap Completed Successfully =====") =>
+            Entry("write output done. output = ===== Autopilot Monitor Bootstrap Started =====\nBootstrap script version: v2.0\nAgent install mode completed successfully\n" + tail + ", error = ", utc, offset);
+
+        private static string PolicyResult(DateTime utc, TimeSpan offset, string policyId = PolicyId) =>
+            Entry($"[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = {policyId}, policy result = Success", utc, offset);
+
+        private static string ServiceStarted(DateTime utc, TimeSpan offset) => Entry("EMS Agent Started", utc, offset);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            private readonly List<ImeLogEraPreScan.ScanInput> _inputs = new List<ImeLogEraPreScan.ScanInput>();
+
+            public string Write(string fileName, params string[] entries)
+            {
+                var path = Path.Combine(Tmp.Path, fileName);
+                File.WriteAllText(path, string.Join(Environment.NewLine, entries) + Environment.NewLine);
+                _inputs.Add(new ImeLogEraPreScan.ScanInput(path, 0));
+                return path;
+            }
+
+            public long OffsetOfLine(string fileName, int lineIndex)
+            {
+                // Entries are written line by line; the byte offset of entry N is the sum of the
+                // preceding lines (CRLF-agnostic through Environment.NewLine).
+                var path = Path.Combine(Tmp.Path, fileName);
+                var lines = File.ReadAllLines(path);
+                long offset = 0;
+                for (var i = 0; i < lineIndex; i++)
+                    offset += System.Text.Encoding.UTF8.GetByteCount(lines[i]) + Environment.NewLine.Length;
+                return offset;
+            }
+
+            public CmTraceEraTable Build(DateTime? deployed) =>
+                ImeLogEraPreScan.Build(_inputs, deployed, ImeLogTracker.MaxEntryBytes, null);
+
+            public void Dispose() => Tmp.Dispose();
+        }
+
+        [Fact]
+        public void Bootstrap_record_anchors_service_era_and_executor_block_only_within_their_boundaries()
+        {
+            using var f = new Fixture();
+            f.Write("AgentExecutor.log",
+                ScriptStart(Deployed.AddSeconds(-20), Pacific),
+                BootstrapStdout(Deployed.AddMilliseconds(200), Pacific),
+                Entry("Adding argument powershell with value C:\\x\\Policies\\Scripts\\u_aaaaaaaa-0000-0000-0000-000000000000.ps1", Deployed.AddMinutes(5), Pacific),
+                Entry("write output done. output = other script, error = ", Deployed.AddMinutes(5).AddSeconds(2), Pacific));
+            f.Write("IntuneManagementExtension.log",
+                Entry("In EspPhase: DeviceSetup", Deployed.AddMinutes(-1), Pacific),                       // line 0, era 0
+                PolicyResult(Deployed.AddMilliseconds(260), Pacific),                                   // line 1, anchor
+                Entry("In EspPhase: DeviceSetup", Deployed.AddMinutes(10), Pacific),                      // line 2, era 0
+                ServiceStarted(Deployed.AddMinutes(20), Eastern),                                       // line 3, era 1 (post-boot, new zone)
+                Entry("Successfully get the token", Deployed.AddMinutes(21), Eastern));                   // line 4, era 1
+
+            var table = f.Build(Deployed);
+
+            Assert.Equal(2, table.AnchoredEraCount);
+            Assert.False(table.TransferAmbiguous);
+
+            // Service era 0: every offset before "EMS Agent Started" resolves to the Pacific offset.
+            Assert.True(table.TryResolveByOffset("IntuneManagementExtension.log", f.OffsetOfLine("IntuneManagementExtension.log", 0), out var off0, out var kind0));
+            Assert.Equal(Pacific, off0);
+            Assert.Equal(ImeLogEraPreScan.AnchorKindBootstrapPolicyResult, kind0);
+            Assert.True(table.TryResolveByOffset("IntuneManagementExtension.log", f.OffsetOfLine("IntuneManagementExtension.log", 2), out var off2, out _));
+            Assert.Equal(Pacific, off2);
+
+            // Era 1 has no anchor of its own — the Pacific anchor must not leak across the boundary.
+            Assert.False(table.TryResolveByOffset("IntuneManagementExtension.log", f.OffsetOfLine("IntuneManagementExtension.log", 3), out _, out _));
+            Assert.False(table.TryResolveByOffset("IntuneManagementExtension.log", f.OffsetOfLine("IntuneManagementExtension.log", 4), out _, out _));
+
+            // Executor: only the bootstrap execution block is anchored, not the next script's block.
+            Assert.True(table.TryResolveByOffset("AgentExecutor.log", f.OffsetOfLine("AgentExecutor.log", 0), out var offX, out var kindX));
+            Assert.Equal(Pacific, offX);
+            Assert.Equal(ImeLogEraPreScan.AnchorKindBootstrapStdout, kindX);
+            Assert.False(table.TryResolveByOffset("AgentExecutor.log", f.OffsetOfLine("AgentExecutor.log", 5), out _, out _));
+
+            // Transfer for in-process sibling files: a local time inside era 0's range resolves,
+            // one inside era 1's range does not.
+            Assert.True(table.TryResolveByLocalTime(Deployed.AddMinutes(5) + Pacific, out var offT, out var kindT));
+            Assert.Equal(Pacific, offT);
+            Assert.EndsWith("/service-era-transfer", kindT);
+            Assert.False(table.TryResolveByLocalTime(Deployed.AddMinutes(25) + Eastern, out _, out _));
+        }
+
+        [Fact]
+        public void Without_deployed_marker_nothing_is_anchored()
+        {
+            using var f = new Fixture();
+            f.Write("AgentExecutor.log", ScriptStart(Deployed.AddSeconds(-20), Pacific), BootstrapStdout(Deployed.AddMilliseconds(200), Pacific));
+            f.Write("IntuneManagementExtension.log", PolicyResult(Deployed.AddMilliseconds(260), Pacific));
+
+            var table = f.Build(null);
+
+            Assert.Equal(0, table.AnchoredEraCount);
+        }
+
+        [Fact]
+        public void Msi_bootstrap_without_stdout_record_anchors_nothing()
+        {
+            // The MSI runner never passes through AgentExecutor; without the policy id the
+            // service log's result lines cannot be told apart from any other script's.
+            using var f = new Fixture();
+            f.Write("AgentExecutor.log", Entry("Adding argument powershell with value C:\\x\\Policies\\Scripts\\u_aaaaaaaa-0000-0000-0000-000000000000.ps1", Deployed.AddMinutes(3), Pacific));
+            f.Write("IntuneManagementExtension.log", PolicyResult(Deployed.AddMilliseconds(260), Pacific));
+
+            var table = f.Build(Deployed);
+
+            Assert.Equal(0, table.AnchoredEraCount);
+        }
+
+        [Fact]
+        public void Skip_rerun_record_is_never_offered_and_first_record_off_grid_anchors_nothing()
+        {
+            // The install run is the FIRST bootstrap record; a SKIP re-run 15 minutes later
+            // would round onto the grid with zero residual and anchor a wrong offset.
+            using var f = new Fixture();
+            f.Write("AgentExecutor.log",
+                ScriptStart(Deployed.AddMinutes(-9), Pacific),
+                BootstrapStdout(Deployed.AddMinutes(-8), Pacific),                                          // first record: residual 8 min → rejected
+                ScriptStart(Deployed.AddMinutes(15).AddSeconds(-2), Pacific),
+                BootstrapStdout(Deployed.AddMinutes(15), Pacific));                                         // would be a perfect (wrong) grid hit
+            f.Write("IntuneManagementExtension.log",
+                PolicyResult(Deployed.AddMinutes(-8), Pacific),
+                PolicyResult(Deployed.AddMinutes(15), Pacific));
+
+            var table = f.Build(Deployed);
+
+            Assert.Equal(0, table.AnchoredEraCount);
+        }
+
+        [Fact]
+        public void Service_era_continues_across_a_log_rotation()
+        {
+            using var f = new Fixture();
+            f.Write("AgentExecutor.log", ScriptStart(Deployed.AddSeconds(-20), Pacific), BootstrapStdout(Deployed.AddMilliseconds(200), Pacific));
+            f.Write("IntuneManagementExtension-20260904-133000.log",
+                PolicyResult(Deployed.AddMilliseconds(260), Pacific),
+                Entry("In EspPhase: DeviceSetup", Deployed.AddMinutes(2), Pacific));
+            f.Write("IntuneManagementExtension.log",
+                Entry("In EspPhase: DeviceSetup", Deployed.AddMinutes(12), Pacific),   // same process, rotated file
+                ServiceStarted(Deployed.AddMinutes(20), Eastern));
+
+            var table = f.Build(Deployed);
+
+            Assert.True(table.TryResolveByOffset("IntuneManagementExtension.log", 0, out var off, out _));
+            Assert.Equal(Pacific, off);
+            Assert.False(table.TryResolveByOffset("IntuneManagementExtension.log", f.OffsetOfLine("IntuneManagementExtension.log", 1), out _, out _));
+        }
+
+        [Fact]
+        public void Overlapping_service_era_local_ranges_disable_the_transfer()
+        {
+            // A westward zone change between two service starts makes era 1 start "before"
+            // era 0 in local time; the sibling-file transfer must refuse rather than guess.
+            using var f = new Fixture();
+            f.Write("AgentExecutor.log", ScriptStart(Deployed.AddSeconds(-20), TimeSpan.FromHours(2)), BootstrapStdout(Deployed.AddMilliseconds(200), TimeSpan.FromHours(2)));
+            f.Write("IntuneManagementExtension.log",
+                ServiceStarted(Deployed.AddMinutes(-30), TimeSpan.FromHours(2)),
+                PolicyResult(Deployed.AddMilliseconds(260), TimeSpan.FromHours(2)),
+                ServiceStarted(Deployed.AddMinutes(20), TimeSpan.FromHours(-7)));
+
+            var table = f.Build(Deployed);
+
+            Assert.True(table.TransferAmbiguous);
+            Assert.False(table.TryResolveByLocalTime(Deployed.AddMinutes(5) + TimeSpan.FromHours(2), out _, out _));
+            // Offset-based lookup is unaffected.
+            Assert.True(table.TryResolveByOffset("IntuneManagementExtension.log", f.OffsetOfLine("IntuneManagementExtension.log", 1), out var off, out _));
+            Assert.Equal(TimeSpan.FromHours(2), off);
+        }
+
+        [Fact]
+        public void Deployment_marker_parses_roundtrip_utc()
+        {
+            Assert.Equal(Deployed, AutopilotMonitor.Agent.V2.Core.Security.DeploymentMarker.Parse("2026-09-04T13:31:49.1000000Z"));
+            Assert.Null(AutopilotMonitor.Agent.V2.Core.Security.DeploymentMarker.Parse(""));
+            Assert.Null(AutopilotMonitor.Agent.V2.Core.Security.DeploymentMarker.Parse("not a date"));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs

@@ -311,6 +311,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
                 "[Win32App] Admin did NOT set mapping for lpExitCode: 1603 of app: " + Guid1,
                 new[] { "exitCode=1603", "id=" + Guid1 }
             };
+            // Win32AppInstaller.cs "[Win32App] lpExitCode is defined as {0}", enum AppReturnCodeType
+            // (identical 1.50–1.105).
+            yield return new object[]
+            {
+                "IME-EXITCODE-CLASS",
+                "[Win32App] lpExitCode is defined as SoftReboot",
+                new[] { "exitCodeClass=SoftReboot" }
+            };
             yield return new object[]
             {
                 "IME-GRS-SKIP",
@@ -361,6 +369,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             }
         }
 
+        [Theory]
+        [InlineData("Success")]
+        [InlineData("SoftReboot")]
+        [InlineData("HardReboot")]
+        [InlineData("Retry")]
+        [InlineData("Failed")]
+        public void IME_EXITCODE_CLASS_captures_every_AppReturnCodeType_member(string member)
+        {
+            var m = Compile(Get("IME-EXITCODE-CLASS")).Match("[Win32App] lpExitCode is defined as " + member);
+            Assert.True(m.Success);
+            Assert.Equal(member, m.Groups["exitCodeClass"].Value);
+        }
+
+        [Fact]
+        public void IME_EXITCODE_CLASS_ignores_the_no_mapping_warning_and_raw_numeric_types()
+        {
+            // The default branch logs "... defined as {0}, fall into default now." and an admin
+            // type outside the enum prints as a raw number; neither is a class the app carries.
+            var regex = Compile(Get("IME-EXITCODE-CLASS"));
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode is defined as 5, fall into default now.");
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode is defined as SoftReboot, fall into default now.");
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode is defined as 5");
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode 3010");
+        }
+
         [Fact]
         public void PS_SCRIPT_CONTEXT_no_longer_fires_on_Win32App_detection_script_lines()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerEraAnchoringTests.cs

@@ -0,0 +1,171 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// End-to-end through the tracker: a restart/first-sight backlog whose pre-reboot era was
+    /// written under the OOBE default zone (a7140f98: Pacific) while the agent believes the
+    /// zone Windows set later (Eastern). With the bootstrap record anchoring that era, every
+    /// pre-reboot line resolves to its true instant with origin <c>era-anchored</c>; the
+    /// post-reboot era without an anchor keeps the marked fallback; in-process sibling files
+    /// join by local time; a fresh pass still self-anchors per line.
+    /// </summary>
+    public sealed class ImeLogTrackerEraAnchoringTests
+    {
+        private static readonly DateTime Deployed = new DateTime(2026, 9, 4, 13, 31, 49, 100, DateTimeKind.Utc);
+        private static readonly TimeSpan Pacific = TimeSpan.FromHours(-7);
+        private static readonly TimeSpan Eastern = TimeSpan.FromHours(-4);
+        private const string PolicyId = "93d9df23-1111-2222-3333-444455556666";
+
+        private static List<ImeLogPattern> Patterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-ALL", Category = "always", Enabled = true,
+                Pattern = @"marker (?<n>\d+)",
+                Action = "noop",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private static string Entry(string message, DateTime utcInstant, TimeSpan writerOffset)
+        {
+            var local = utcInstant + writerOffset;
+            return $"<![LOG[{message}]LOG]!><time=\"{local:HH:mm:ss.fffffff}\" date=\"{local:M-d-yyyy}\" " +
+                   "component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">";
+        }
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public ImeLogTracker Tracker { get; }
+            public DateTime Now { get; set; } = Deployed.AddMinutes(30);
+            public List<(string Message, DateTime? Ts, CmTraceOffsetOrigin Origin, int? Offset, string Anchor)> Resolved { get; } =
+                new List<(string, DateTime?, CmTraceOffsetOrigin, int?, string)>();
+
+            public Harness()
+            {
+                Tracker = new ImeLogTracker(
+                    logFolder: _tmp.Path,
+                    patterns: Patterns(),
+                    logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info));
+                Tracker.UtcNowProvider = () => Now;
+                Tracker.DeployedUtcProvider = () => Deployed;
+                Tracker.OnPatternMatched += _ => Resolved.Add((
+                    Tracker.LastMatchedPatternId ?? string.Empty,
+                    Tracker.LastMatchedLogTimestamp,
+                    Tracker.LastMatchedSourceOffsetOrigin,
+                    Tracker.LastMatchedSourceOffsetMinutes,
+                    Tracker.LastMatchedEraAnchorKind));
+            }
+
+            public void Append(string fileName, params string[] lines)
+                => File.AppendAllText(Path.Combine(_tmp.Path, fileName), string.Join(Environment.NewLine, lines) + Environment.NewLine);
+
+            public Task Pass() => Tracker.CheckLogFilesAsync(CancellationToken.None);
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public async Task Backlog_lines_of_the_bootstrap_era_resolve_through_the_anchor_and_the_next_era_stays_on_fallback()
+        {
+            using var h = new Harness();
+            h.Append("AgentExecutor.log",
+                Entry($@"Adding argument powershell with value C:\x\Policies\Scripts\u_{PolicyId}.ps1", Deployed.AddSeconds(-20), Pacific),
+                Entry("write output done. output = ===== Autopilot Monitor Bootstrap Started =====\n===== Bootstrap Completed Successfully =====, error = ", Deployed.AddMilliseconds(200), Pacific),
+                Entry("marker 10", Deployed.AddSeconds(1), Pacific));
+            h.Append("IntuneManagementExtension.log",
+                Entry("marker 1", Deployed.AddMinutes(-1), Pacific),
+                Entry($"[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = {PolicyId}, policy result = Success", Deployed.AddMilliseconds(260), Pacific),
+                Entry("marker 2", Deployed.AddMinutes(10), Pacific),
+                Entry("EMS Agent Started", Deployed.AddMinutes(20), Eastern),
+                Entry("marker 3", Deployed.AddMinutes(21), Eastern));
+            h.Append("AppWorkload.log",
+                Entry("marker 4", Deployed.AddMinutes(5), Pacific),
+                Entry("marker 5", Deployed.AddMinutes(25), Eastern));
+
+            h.Tracker.PreScanEras();
+            await h.Pass();   // first sight: backlog, never fresh
+
+            var byMarker = new Dictionary<string, (string Message, DateTime? Ts, CmTraceOffsetOrigin Origin, int? Offset, string Anchor)>();
+            foreach (var r in h.Resolved) byMarker[r.Message] = r;
+            Assert.Equal(6, h.Resolved.Count);
+
+            // Marker text is the pattern id (T-ALL) — index by resolution order instead.
+            var r1 = h.Resolved[0];  // AgentExecutor marker 10 (files sort: AgentExecutor < AppWorkload < IntuneManagementExtension)
+            Assert.Equal(CmTraceOffsetOrigin.EraAnchored, r1.Origin);
+            Assert.Equal(Deployed.AddSeconds(1), r1.Ts);
+            Assert.Equal(-420, r1.Offset);
+            Assert.Equal(ImeLogEraPreScan.AnchorKindBootstrapStdout, r1.Anchor);
+
+            var r4 = h.Resolved[1];  // AppWorkload marker 4 — transfer by local time into the service era
+            Assert.Equal(CmTraceOffsetOrigin.EraAnchored, r4.Origin);
+            Assert.Equal(Deployed.AddMinutes(5), r4.Ts);
+            Assert.EndsWith("/service-era-transfer", r4.Anchor);
+
+            var r5 = h.Resolved[2];  // AppWorkload marker 5 — post-boot era, unanchored
+            Assert.Equal(CmTraceOffsetOrigin.None, r5.Origin);
+            Assert.Equal(string.Empty, r5.Anchor);
+
+            var rm1 = h.Resolved[3]; // IME marker 1
+            Assert.Equal(CmTraceOffsetOrigin.EraAnchored, rm1.Origin);
+            Assert.Equal(Deployed.AddMinutes(-1), rm1.Ts);
+            Assert.Equal(ImeLogEraPreScan.AnchorKindBootstrapPolicyResult, rm1.Anchor);
+
+            var rm2 = h.Resolved[4]; // IME marker 2
+            Assert.Equal(CmTraceOffsetOrigin.EraAnchored, rm2.Origin);
+            Assert.Equal(Deployed.AddMinutes(10), rm2.Ts);
+
+            var rm3 = h.Resolved[5]; // IME marker 3 — after "EMS Agent Started", no anchor
+            Assert.Equal(CmTraceOffsetOrigin.None, rm3.Origin);
+        }
+
+        [Fact]
+        public async Task Fresh_lines_still_self_anchor_after_the_pre_scan()
+        {
+            using var h = new Harness();
+            h.Append("IntuneManagementExtension.log", Entry("marker 1", h.Now, Eastern));
+            h.Tracker.PreScanEras();
+            await h.Pass();
+
+            h.Now = h.Now.AddSeconds(10);
+            var writtenAt = h.Now.AddMilliseconds(-80);
+            h.Append("IntuneManagementExtension.log", Entry("marker 2", writtenAt, Eastern));
+            await h.Pass();
+
+            var last = h.Resolved[h.Resolved.Count - 1];
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, last.Origin);
+            Assert.Equal(writtenAt, last.Ts);
+            Assert.Equal(string.Empty, last.Anchor);
+        }
+
+        [Fact]
+        public async Task Without_marker_the_backlog_keeps_the_reader_zone_fallback()
+        {
+            using var h = new Harness();
+            h.Tracker.DeployedUtcProvider = () => null;
+            h.Append("IntuneManagementExtension.log", Entry("marker 1", Deployed.AddMinutes(-1), Pacific));
+            h.Tracker.PreScanEras();
+            await h.Pass();
+
+            Assert.Single(h.Resolved);
+            Assert.Equal(CmTraceOffsetOrigin.None, h.Resolved[0].Origin);
+            Assert.Equal(0, h.Tracker.EraTable.AnchoredEraCount);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerExitCodeClassTests.cs

@@ -0,0 +1,248 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Return-code class of the installer exit code (IME "[Win32App] lpExitCode is defined as
+    /// {AppReturnCodeType}"): captured by the shipped IME-EXITCODE-CLASS pattern into
+    /// <see cref="AppPackageState.ExitCodeClass"/>, last value wins across a Retry loop, the
+    /// no-mapping/default-branch variants are ignored, and the value survives the agent
+    /// restart that a SoftReboot/HardReboot app causes (persistence round trip).
+    /// </summary>
+    public sealed class ImeLogTrackerExitCodeClassTests
+    {
+        private const string AppId = "5c95bf94-1cf4-4629-88d1-3f616e7a405c";
+
+        // ---------------------------------------------------------------- AppPackageState
+
+        [Fact]
+        public void UpdateExitCodeClass_last_value_wins_and_ignores_empty()
+        {
+            var pkg = new AppPackageState(AppId, 0);
+            Assert.Null(pkg.ExitCodeClass);
+
+            Assert.True(pkg.UpdateExitCodeClass("Retry"));
+            Assert.True(pkg.UpdateExitCodeClass(" Success "));
+            Assert.Equal("Success", pkg.ExitCodeClass);
+            Assert.False(pkg.UpdateExitCodeClass("Success"));
+            Assert.False(pkg.UpdateExitCodeClass(""));
+            Assert.False(pkg.UpdateExitCodeClass(null));
+            Assert.Equal("Success", pkg.ExitCodeClass);
+        }
+
+        [Fact]
+        public void ToEventData_carries_the_class_only_when_known()
+        {
+            var pkg = new AppPackageState(AppId, 0);
+            Assert.False(pkg.ToEventData().ContainsKey("exitCodeClass"));
+
+            pkg.UpdateExitCode("3010");
+            pkg.UpdateExitCodeClass("SoftReboot");
+            var data = pkg.ToEventData();
+            Assert.Equal("3010", data["exitCode"]);
+            Assert.Equal("SoftReboot", data["exitCodeClass"]);
+        }
+
+        [Fact]
+        public void Restore_round_trips_the_class()
+        {
+            var pkg = AppPackageState.Restore(
+                AppId, 0, "Contoso VPN",
+                AppRunAs.System, AppIntent.Install, AppTargeted.Device,
+                new HashSet<string>(),
+                AppInstallationState.Installed, true, 100, 0, 0,
+                exitCode: "3010", exitCodeClass: "SoftReboot");
+
+            Assert.Equal("SoftReboot", pkg.ExitCodeClass);
+        }
+
+        // ---------------------------------------------------------------- shipped pack, end to end
+
+        private static string FindRulesPatternDir()
+        {
+            var dir = new DirectoryInfo(AppContext.BaseDirectory);
+            while (dir != null)
+            {
+                var candidate = Path.Combine(dir.FullName, "rules", "ime-log-patterns");
+                if (Directory.Exists(candidate)) return candidate;
+                dir = dir.Parent;
+            }
+            throw new DirectoryNotFoundException($"Could not locate rules/ime-log-patterns walking up from {AppContext.BaseDirectory}");
+        }
+
+        /// <summary>The shipped pack, exactly as combine.js embeds it (sorted by file name).</summary>
+        private static List<ImeLogPattern> ShippedPack()
+            => Directory.GetFiles(FindRulesPatternDir(), "*.json")
+                .OrderBy(f => f, StringComparer.Ordinal)
+                .Select(f => JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(f))!)
+                .ToList();
+
+        private static string Entry(string message, DateTime utcInstant)
+        {
+            // CMTrace line with a zero writer offset: the tracker reads the local time and
+            // resolves it against the reader zone; only freshness (< 24 h) matters here.
+            return $"<![LOG[{message}]LOG]!><time=\"{utcInstant:HH:mm:ss.fffffff}\" date=\"{utcInstant:M-d-yyyy}\" " +
+                   "component=\"IntuneManagementExtension\" context=\"\" type=\"1\" thread=\"1\" file=\"\">";
+        }
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public ImeLogTracker Tracker { get; }
+            public string StateDir { get; }
+            public DateTime Now { get; } = new DateTime(2026, 9, 6, 12, 0, 0, DateTimeKind.Utc);
+
+            public Harness()
+            {
+                StateDir = Path.Combine(_tmp.Path, "State");
+                Tracker = Build();
+            }
+
+            public ImeLogTracker Build()
+            {
+                var tracker = new ImeLogTracker(
+                    logFolder: _tmp.Path,
+                    patterns: ShippedPack(),
+                    logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                    stateDirectory: StateDir);
+                // The historic-replay guard skips app-mutating actions for lines older than 24 h
+                // relative to "now": pin both so the CMTrace entries below are always fresh.
+                tracker.UtcNowProvider = () => Now;
+                return tracker;
+            }
+
+            public void Append(params string[] messages)
+            {
+                var lines = messages.Select((m, i) => Entry(m, Now.AddSeconds(-60 + i)));
+                File.AppendAllText(Path.Combine(_tmp.Path, "IntuneManagementExtension.log"),
+                    string.Join(Environment.NewLine, lines) + Environment.NewLine);
+            }
+
+            public Task Pass() => Tracker.CheckLogFilesAsync(CancellationToken.None);
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        private static string PhaseLine => "[Win32App] In EspPhase: DeviceSetup.";
+        private static string CurrentAppLine => @"[Win32App] SetCurrentDirectory: C:\Windows\IMECache\" + AppId + "_1";
+
+        [Fact]
+        public async Task Shipped_pattern_captures_the_class_for_the_current_app()
+        {
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine,          // activates the currentPhase pack (IME-EXITCODE, IME-EXITCODE-CLASS)
+                CurrentAppLine,     // IME-SET-CURRENT-4 → current app
+                "[Win32App] lpExitCode 3010",
+                "[Win32App] lpExitCode is defined as SoftReboot");
+
+            await h.Pass();
+
+            var pkg = h.Tracker.PackageStates.GetPackage(AppId);
+            Assert.NotNull(pkg);
+            Assert.Equal("3010", pkg!.ExitCode);
+            Assert.Equal("SoftReboot", pkg.ExitCodeClass);
+            Assert.NotEqual(AppInstallationState.Error, pkg.InstallationState);
+        }
+
+        [Fact]
+        public async Task Retry_loop_that_ends_in_success_reports_the_last_class()
+        {
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 1618",
+                "[Win32App] lpExitCode is defined as Retry",
+                "[Win32App] lpExitCode 1618",
+                "[Win32App] lpExitCode is defined as Retry",
+                "[Win32App] lpExitCode 0",
+                "[Win32App] lpExitCode is defined as Success");
+
+            await h.Pass();
+
+            var pkg = h.Tracker.PackageStates.GetPackage(AppId)!;
+            Assert.Equal("0", pkg.ExitCode);
+            Assert.Equal("Success", pkg.ExitCodeClass);
+        }
+
+        [Fact]
+        public async Task Failed_class_still_drives_the_error_transition_and_carries_the_class()
+        {
+            // IME-EXITCODE-CLASS and IME-EXITCODE-MAPPED-FAILED both match the Failed line: the
+            // class is captured and the existing error path stays intact.
+            using var h = new Harness();
+            var pkg = new AppPackageState(AppId, 0);
+            pkg.UpdateState(AppInstallationState.Installing);
+            h.Tracker.PackageStates.Add(pkg);
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 1603",
+                "[Win32App] lpExitCode is defined as Failed");
+
+            await h.Pass();
+
+            Assert.Equal(AppInstallationState.Error, pkg.InstallationState);
+            Assert.Equal("Failed", pkg.ExitCodeClass);
+            Assert.Equal("IME-EXITCODE-MAPPED-FAILED", pkg.ErrorPatternId);
+        }
+
+        [Fact]
+        public async Task Default_branch_and_raw_numeric_types_leave_the_class_unset()
+        {
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 5",
+                "[Win32App] lpExitCode is defined as 5",
+                "[Win32App] lpExitCode is defined as 5, fall into default now.",
+                "[Win32App] Setting enforcementState as: Error with lpExitCode: 5 without mapping");
+
+            await h.Pass();
+
+            var pkg = h.Tracker.PackageStates.GetPackage(AppId)!;
+            Assert.Equal("5", pkg.ExitCode);
+            Assert.Null(pkg.ExitCodeClass);
+        }
+
+        [Fact]
+        public async Task Class_survives_the_state_round_trip_of_an_agent_restart()
+        {
+            // A SoftReboot/HardReboot app completes only after the reboot; the restarted agent
+            // must still know the class when the post-reboot Success line arrives.
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 1641",
+                "[Win32App] lpExitCode is defined as HardReboot");
+            await h.Pass();
+            h.Tracker.SaveStateForTest();
+
+            using var restarted = h.Build();
+            restarted.LoadStateForTest();
+
+            var pkg = restarted.GetAllKnownPackageStates().Single(p => p.Id == AppId);
+            Assert.Equal("1641", pkg.ExitCode);
+            Assert.Equal("HardReboot", pkg.ExitCodeClass);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.cs

@@ -0,0 +1,537 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Session 46749560: IME's trace listener writes every log through one FileMode.Append
+    /// stream per process, so a process that resumes logging after another one appended
+    /// overwrites those bytes at its own stale position. The tracker had read the first version
+    /// and never saw the second — 6 of 16 script results and 4 of 16 executor end blocks were
+    /// lost while the final files looked intact. These tests drive that exact write pattern
+    /// (positional overwrite behind the bookmark) against the two multi-writer logs and pin the
+    /// contract: unchanged bytes never rewind, changed bytes are processed exactly once, and the
+    /// executor lines a rewind uncovers belong to the invocation that owns their file position.
+    /// </summary>
+    public sealed class ImeLogTrackerOverwriteRewindTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 10, 19, 30, 0, DateTimeKind.Utc);
+
+        private static List<ImeLogPattern> MarkerPatterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-MARK", Category = "always", Enabled = true,
+                Pattern = @"^marker (?<n>\d+)", Action = "noop",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private static readonly string[] ScriptPatternIds =
+        {
+            "PS-AGENT-INVOCATION", "PS-AGENT-ARG", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
+            "PS-AGENT-OUTPUT", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT", "PS-SCRIPT-RESULT",
+        };
+
+        /// <summary>The shipped pattern JSON — the same source combine.js embeds — so the contract is the real one.</summary>
+        private static List<ImeLogPattern> ScriptPatterns()
+        {
+            DirectoryInfo? dir = new DirectoryInfo(AppContext.BaseDirectory);
+            string? patternDir = null;
+            while (dir != null)
+            {
+                var candidate = Path.Combine(dir.FullName, "rules", "ime-log-patterns");
+                if (Directory.Exists(candidate)) { patternDir = candidate; break; }
+                dir = dir.Parent;
+            }
+            Assert.NotNull(patternDir);
+
+            var byId = new Dictionary<string, ImeLogPattern>(StringComparer.OrdinalIgnoreCase);
+            foreach (var file in Directory.GetFiles(patternDir, "*.json"))
+            {
+                var pattern = JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(file));
+                if (pattern?.PatternId != null) byId[pattern.PatternId] = pattern;
+            }
+            return ScriptPatternIds.Select(id =>
+            {
+                Assert.True(byId.TryGetValue(id, out var p), $"Shipped IME pattern '{id}' not found under {patternDir}.");
+                return p!;
+            }).ToList();
+        }
+
+        private static string Entry(string message, string thread = "1")
+            => $"<![LOG[{message}]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"X\" context=\"\" type=\"1\" thread=\"{thread}\" file=\"\">\r\n";
+
+        private const string PlatformId = "d39eeef3-e88e-41a0-82d7-5e28ee7b5acf";
+        private const string PlatformStartLine =
+            @"Adding argument powershell with value C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\73d664e4-0886-4a73-b745-c694da45ddb4_d39eeef3-e88e-41a0-82d7-5e28ee7b5acf.ps1 to the named argument list.";
+        private const string DetectionStartLine =
+            @"Adding argument detectionScript with value C:\Windows\IMECache\DetectionScripts\App_cc46aa62-e93a-41a1-bdd0-44f57e92a66d.ps1 to the named argument list.";
+        private const string GeneratedLine =
+            @"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\73d664e4-0886-4a73-b745-c694da45ddb4_d39eeef3-e88e-41a0-82d7-5e28ee7b5acf.ps1 is generated.";
+        private const string ResultLine =
+            "[PowerShell] User Id = 73d664e4-0886-4a73-b745-c694da45ddb4, Policy id = " + PlatformId + ", policy result = Success";
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            private readonly string _matchLog;
+            private readonly List<ImeLogPattern> _patterns;
+            public ImeLogTracker Tracker { get; private set; }
+            public DateTime Now { get; set; } = T0;
+            public string LogName { get; }
+            public string LogPath => Path.Combine(_tmp.Path, LogName);
+            public string StateDir { get; }
+            public List<ScriptExecutionState> Completed { get; } = new List<ScriptExecutionState>();
+
+            public Harness(string logName, List<ImeLogPattern> patterns)
+            {
+                LogName = logName;
+                _patterns = patterns;
+                var logDir = Path.Combine(_tmp.Path, "agent");
+                Directory.CreateDirectory(logDir);
+                _matchLog = Path.Combine(logDir, "ime-pattern-matches.log");
+                StateDir = Path.Combine(_tmp.Path, "state");
+                Tracker = Build();
+            }
+
+            private ImeLogTracker Build()
+            {
+                var t = new ImeLogTracker(_tmp.Path, _patterns, new AgentLogger(Path.Combine(_tmp.Path, "agent"), AgentLogLevel.Debug),
+                    matchLogPath: _matchLog, stateDirectory: StateDir);
+                t.UtcNowProvider = () => Now;
+                t.OnScriptCompleted = s => Completed.Add(s);
+                return t;
+            }
+
+            /// <summary>Agent restart: dispose, rebuild over the same state directory, restore the bookmark.</summary>
+            public void Restart()
+            {
+                Tracker.SaveStateForTest();
+                Tracker.Dispose();
+                Tracker = Build();
+                Tracker.LoadStateForTest();
+            }
+
+            public void Append(string text) => File.AppendAllText(LogPath, text, new UTF8Encoding(false));
+
+            /// <summary>What IME's stale writer does: write at its own position, over whatever is there.</summary>
+            public void Overwrite(long offset, string text)
+            {
+                using (var fs = new FileStream(LogPath, FileMode.Open, FileAccess.Write, FileShare.ReadWrite))
+                {
+                    fs.Seek(offset, SeekOrigin.Begin);
+                    var bytes = new UTF8Encoding(false).GetBytes(text);
+                    fs.Write(bytes, 0, bytes.Length);
+                }
+            }
+
+            public long Length => new FileInfo(LogPath).Length;
+
+            public Task Pass(CancellationToken token = default) => Tracker.CheckLogFilesAsync(token);
+
+            /// <summary>Marker numbers matched so far, in match order.</summary>
+            public List<int> Matched()
+            {
+                if (!File.Exists(_matchLog)) return new List<int>();
+                return File.ReadAllLines(_matchLog)
+                    .Select(l => Regex.Match(l, @"\[T-MARK\] <!\[LOG\[marker (\d+)"))
+                    .Where(m => m.Success).Select(m => int.Parse(m.Groups[1].Value)).ToList();
+            }
+
+            public ImeTrackerHealth Health => Tracker.GetHealthSnapshot();
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        // -----------------------------------------------------------------------
+        // Marker-level contract on AgentExecutor.log
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public async Task Unchanged_bytes_never_rewind_however_often_they_are_verified()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + "<![LOG[marker 2\nsecond line\n]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n" + Entry("marker 3"));
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+
+            for (var i = 0; i < 5; i++)
+            {
+                h.Tracker.RequestOverwriteCheckForTest();
+                h.Now = h.Now.AddSeconds(2);
+                await h.Pass();
+            }
+
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+            Assert.Equal(5, h.Health.VerifyPasses);
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+        }
+
+        [Fact]
+        public async Task Non_multi_writer_files_keep_no_ledger_and_are_never_verified()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+            Assert.Equal(0, h.Tracker.LedgerEntryCountForTest("AppWorkload.log"));
+            Assert.Equal(0, h.Health.VerifyPasses);
+            Assert.Equal(0, h.Health.VerifiedBytes);
+        }
+
+        [Fact]
+        public async Task Block_written_over_read_bytes_is_processed_once_and_the_surviving_tail_is_not_repeated()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            var one = Entry("marker 1");
+            h.Append(one + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+
+            // A stale writer lays two entries over the first two (same length: marker 3 survives
+            // intact at its old offset). No growth, no fragment — only the end signal finds it.
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8"));
+            Assert.Equal(3 * one.Length, h.Length);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            Assert.Equal(3 * one.Length, h.Health.OverwriteBytesReprocessed);
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            // Nothing left to find.
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Block_that_cuts_an_old_entry_leaves_a_fragment_that_is_never_matched()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // Longer than two old entries, shorter than three: the tail of marker 3's line survives
+            // as a fragment behind the new block.
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8 is a little longer"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Guard_zone_catches_a_short_block_when_the_file_grows_without_any_signal()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // Same-length replacement of marker 1 (no fragment), then an ordinary append by
+            // another writer: the growth pass re-checks the last 4 KB and finds the change.
+            h.Overwrite(0, Entry("marker 7"));
+            h.Append(Entry("marker 4"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 4 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            Assert.Equal(1, h.Health.VerifyPasses); // the full check that follows a guard hit
+            Assert.True(h.Health.VerifiedBytes > 0);
+        }
+
+        [Fact]
+        public async Task Guard_hit_rewinds_to_the_true_start_of_the_block_not_the_guard_zone()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            // ~6 KB of entries so the guard zone covers only the last few.
+            var sb = new StringBuilder();
+            for (var i = 1; i <= 60; i++) sb.Append(Entry($"marker {i}"));
+            h.Append(sb.ToString());
+            await h.Pass();
+            Assert.Equal(60, h.Matched().Count);
+
+            // A block over everything plus one more entry: the guard sees a change at its
+            // zone start, the full check must place the rewind at offset 0.
+            var block = new StringBuilder();
+            for (var i = 101; i <= 161; i++) block.Append(Entry($"marker {i}"));
+            h.Overwrite(0, block.ToString());
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            var matched = h.Matched();
+            Assert.Equal(60 + 61, matched.Count);
+            Assert.Equal(Enumerable.Range(101, 61), matched.Skip(60));
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Fragment_at_the_bookmark_triggers_the_check_when_no_ledger_entry_starts_in_the_guard_zone()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            var one = Entry("marker 1");
+            var big = Entry("marker 2 " + new string('x', 6000));
+            h.Append(one + big);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+
+            // The 6 KB entry is the last ledger entry and starts before the 4 KB guard zone, so
+            // the guard has nothing to check. The stale writer's block is longer than that entry:
+            // the pass after it starts mid-line — a fragment — and must not match it raw.
+            h.Overwrite(one.Length, Entry("marker 7 " + new string('y', 3000)) + Entry("marker 8 " + new string('z', 3100)));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Hidden_block_is_found_by_the_cadence_while_a_script_is_in_flight_and_the_cadence_is_throttled()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // A platform script is pending → contention. First pass in contention verifies at once.
+            h.Tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: null, exitObservedAtUtc: null, startedAtUtc: T0);
+            h.Now = T0.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.VerifyPasses);
+
+            // Same-length replacement, no growth, no signal: only the cadence can find it —
+            // and not before a second has passed since the last verification.
+            h.Overwrite(0, Entry("marker 7"));
+            h.Now = T0.AddMilliseconds(500);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+            Assert.Equal(1, h.Health.VerifyPasses);
+
+            h.Now = T0.AddMilliseconds(1200);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7 }, h.Matched());
+            Assert.Equal(2, h.Health.VerifyPasses);
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Without_contention_or_signal_nothing_is_verified()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+
+            for (var i = 0; i < 20; i++)
+            {
+                h.Now = h.Now.AddSeconds(1);
+                await h.Pass();
+            }
+
+            Assert.Equal(0, h.Health.VerifyPasses);
+            Assert.Equal(0, h.Health.VerifiedBytes);
+        }
+
+        [Fact]
+        public async Task Restart_seeds_the_ledger_so_an_overwrite_after_the_restart_is_still_found()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            h.Restart();
+            Assert.Equal(0, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            // First pass after the restart: nothing new to read, but the ledger is seeded from
+            // the bytes behind the persisted bookmark.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            h.Overwrite(0, Entry("marker 7"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // The counter is part of the persisted health.
+            h.Restart();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Rollover_clears_the_ledger_and_the_new_file_is_read_without_a_false_rewind()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            File.WriteAllText(h.LogPath, Entry("marker 7") + Entry("marker 8"), new UTF8Encoding(false));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+            Assert.Equal(2, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+        }
+
+        [Fact]
+        public async Task Cancelled_pass_does_not_lose_a_pending_check()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+
+            using (var cts = new CancellationTokenSource())
+            {
+                cts.Cancel();
+                await h.Pass(cts.Token);
+            }
+
+            // The cancelled pass touched nothing after the rewind; the next one reads it all.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+        }
+
+        // -----------------------------------------------------------------------
+        // The field scenario with the shipped patterns
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public async Task Executor_end_block_written_over_a_detection_invocation_belongs_to_its_own_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Executor E starts its platform script and waits for PowerShell.
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 12708"));
+            await h.Pass();
+            var executorPosition = h.Length;
+
+            // Detection executor D appends its whole run while E waits — the tracker reads it.
+            var detectionBlock = Entry("ExecutorLog AgentExecutor gets invoked") + Entry(DetectionStartLine)
+                + Entry("Powershell exit code is 3") + Entry("write output done. output = detected nothing, error = ")
+                + Entry("Agent executor completed.") + Entry(@"Writing result: False to resultFilePath: C:\x\App_cc46aa62.txt");
+            h.Append(detectionBlock);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // E ends: its end block lands at its own stale position, over D's lines.
+            var endBlock = Entry("Powershell exit code is 0") + Entry("write output done. output = Hello from E, error = ") + Entry("Agent executor completed.");
+            Assert.True(endBlock.Length < detectionBlock.Length);
+            h.Overwrite(executorPosition, endBlock);
+
+            // Nothing visible signalled the end; the cadence (E is pending) finds the block.
+            h.Now = h.Now.AddSeconds(1.5);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // IME's result line (in the other file) completes the script with E's own data.
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal("Hello from E", script.Stdout);
+        }
+
+        [Fact]
+        public async Task Detection_exit_lines_read_before_the_overwrite_never_reach_the_platform_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 1"));
+            await h.Pass();
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(DetectionStartLine)
+                + Entry("Powershell exit code is 3") + Entry("write output done. output = detected nothing, error = ") + Entry("Agent executor completed."));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // The platform result arrives without any end block ever becoming visible: held for
+            // the grace, then emitted — the detection's exit code 3 must not stand in.
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            Assert.Empty(h.Completed);
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Success", script.Result);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Ime_result_line_hidden_by_an_executor_start_line_is_recovered_from_the_ime_log()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            h.Append(Entry(GeneratedLine, "17") + Entry("Launch powershell executor in user session", "17") + Entry("process id = 10608", "17"));
+            await h.Pass();
+            var servicePosition = h.Length;
+
+            // The executor process appends its telemetry start line at the true end of file.
+            h.Append(Entry("[Telemetry] Telemetry is enabled. Starting mananger...", "1"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Empty(h.Completed);
+
+            // The service's first write after the script wait lands at ITS position — over the
+            // executor's line; the block is longer, so the pass sees a fragment at the bookmark.
+            h.Overwrite(servicePosition, Entry("Execution is done, collecting result", "17") + Entry(ResultLine, "17") + Entry("[PowerShell] Success, Result details length: 315", "17"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // Recovered on the IME side alone (this harness has no AgentExecutor.log): held for
+            // the end block, emitted without an exit code after the grace.
+            Assert.Empty(h.Completed);
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal("User", script.RunContext);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerPlatformScriptContaminationTests.cs

@@ -36,8 +36,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         // silently passing against a stale inline copy.
         private static readonly string[] RequiredPatternIds =
         {
-            "PS-AGENT-INVOCATION", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
-            "PS-AGENT-OUTPUT", "PS-SCRIPT-RESULT",
+            "PS-AGENT-INVOCATION", "PS-AGENT-ARG", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
+            "PS-AGENT-OUTPUT", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT",
+            "PS-SCRIPT-RESULT", "HS-INVOCATION",
         };
 
         private static List<ImeLogPattern> ScriptPatterns()
@@ -83,6 +84,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         private const string RemediationStartLine =
             @"Adding argument remediationScript with value C:\Windows\IMECache\HealthScripts\446f0450-d0ee-404c-8dc0-a74123bde31f_1\detect.ps1 to the named argument list.";
 
+        private const string ImeLog = "IntuneManagementExtension.log";
+        private const string HealthLog = "HealthScripts.log";
+        private const string ExecutorLog = "AgentExecutor.log";
+
+        private const string PlatformGeneratedLine =
+            @"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_c3e0124c-4936-4bfd-afcc-c7fe1d84d104.ps1 is generated";
+
+        private static readonly string PlatformResultLine =
+            $"[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = {PlatformId}, policy result = Success";
+
+        // The health-script worker (IME AgentCommon ScriptWorker) writes its command line, the launch
+        // line and the exit line to IntuneManagementExtension.log AND HealthScripts.log — session
+        // 24dc69d1 (IME 1.105.152.0), where the exit line pre-filled a pending platform script's exit
+        // code and the launch line its context.
+        private const string HealthScriptCommandLine =
+            @"""C:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe""  -remediationScript  """"C:\WINDOWS\IMECache\HealthScripts\446f0450-d0ee-404c-8dc0-a74123bde31f_1\detect.ps1"""" ""C:\WINDOWS\IMECache\HealthScripts\446f0450-d0ee-404c-8dc0-a74123bde31f_1\detect.ps1.result"" 60";
+        private const string HealthScriptExitLine = "Powershell execution is done, exitCode = 5";
+
         private static ImeLogTracker BuildTracker(TempDirectory tmp, out List<ScriptExecutionState> emitted)
         {
             var captured = new List<ScriptExecutionState>();
@@ -111,9 +130,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.ProcessLogMessageForTest("Powershell exit code is 0");
             tracker.ProcessLogMessageForTest("write output done. output = [Compliant] No Classic Teams found, error = ");
 
-            // Authoritative IME result for the PLATFORM script (keyed by policyId).
+            // Authoritative IME result for the PLATFORM script (keyed by policyId). Its own end
+            // block never comes here, so the result is held until the shutdown flush — which must
+            // not pick up the remediation's exit/output either.
             tracker.ProcessLogMessageForTest(
                 $"[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = {PlatformId}, policy result = Failed");
+            Assert.Empty(emitted);
+            tracker.FlushPendingPlatformScriptResults(System.DateTime.UtcNow, force: true);
 
             var script = Assert.Single(emitted);
             Assert.Equal(PlatformId, script.PolicyId);
@@ -145,5 +168,100 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Equal(0, script.ExitCode);
             Assert.Equal("Hello from c3e0124c", script.Stdout);
         }
+
+        // -----------------------------------------------------------------------
+        // Health-script lines never feed a platform slot (session 24dc69d1)
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public void No_shipped_pattern_reads_the_health_script_workers_exit_line()
+        {
+            // "Powershell execution is done, exitCode = N" is the health-script worker's line only;
+            // as PS-SCRIPT-EXITCODE (no scriptType) it pre-filled the exit code of whichever platform
+            // script was pending, which then emitted without waiting for its own end block.
+            foreach (var file in Directory.GetFiles(FindRulesPatternDir(), "*.json"))
+            {
+                var pattern = JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(file))!;
+                Assert.False(System.Text.RegularExpressions.Regex.IsMatch(HealthScriptExitLine, pattern.Pattern),
+                    $"{pattern.PatternId} matches the health-script worker's exit line");
+            }
+        }
+
+        [Fact]
+        public void Health_script_exit_line_in_the_ime_log_never_pre_fills_the_platform_slot()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest(PlatformGeneratedLine, sourceFileName: ImeLog);
+            // A health script that ran in parallel finishes: its exit line lands inside the platform
+            // run's window (c81b8053 had "exit code 0" before its executor even started).
+            tracker.ProcessLogMessageForTest(HealthScriptExitLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+
+            // No exit code of its own → held for the end block, never emitted with the health script's 5.
+            Assert.Empty(emitted);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+            var script = Assert.Single(emitted);
+            Assert.Null(script.ExitCode);
+            Assert.Equal("Success", script.Result);
+        }
+
+        [Fact]
+        public void Health_script_launch_line_in_the_ime_log_does_not_flip_the_platform_context()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest(PlatformGeneratedLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest("Launch powershell executor in user session", sourceFileName: ImeLog);
+            // The health-script worker launches its executor while the platform script runs: its
+            // command line opens an invocation that owns nothing, so its launch line stays there.
+            tracker.ProcessLogMessageForTest(HealthScriptCommandLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest("Launch powershell executor in machine session", sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("User", script.RunContext);
+        }
+
+        [Fact]
+        public void Lines_from_the_health_scripts_log_never_resolve_to_a_platform_script()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest("ExecutorLog AgentExecutor gets invoked", sourceFileName: ExecutorLog);
+            tracker.ProcessLogMessageForTest(PlatformStartLine, sourceFileName: ExecutorLog);
+            // HealthScripts.log never carries a platform marker — the run in flight is not the
+            // fallback owner of the lines there.
+            tracker.ProcessLogMessageForTest("Launch powershell executor in machine session", sourceFileName: HealthLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+
+            var script = Assert.Single(emitted);
+            Assert.Null(script.RunContext);
+        }
+
+        [Fact]
+        public void Context_line_after_an_ime_log_rollover_still_finds_the_run_in_flight()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest(PlatformGeneratedLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest("ExecutorLog AgentExecutor gets invoked", sourceFileName: ExecutorLog);
+            tracker.ProcessLogMessageForTest(PlatformStartLine, sourceFileName: ExecutorLog);
+            // IME rolls the log over between its two lines: the fresh file has no markers, but
+            // platform runs open there — the run in flight still owns the context line.
+            tracker.ClearInvocationMarkersForTest(ImeLog);
+            tracker.ProcessLogMessageForTest("Launch powershell executor in user session", sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("User", script.RunContext);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerPlatformScriptFallbackTests.cs

@@ -39,7 +39,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.SeedPendingPlatformScriptForTesting("dece354a", exitCode: 0, exitObservedAtUtc: observedAt, stdout: "Script start.\nScript end.");
 
             // Well past the grace window — should emit.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             var script = Assert.Single(emitted);
             Assert.Equal("dece354a", script.PolicyId);
@@ -60,11 +60,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.SeedPendingPlatformScriptForTesting("60b43a2e", exitCode: 0, exitObservedAtUtc: observedAt);
 
             // Inside the grace window — IME might still log its result; do not emit yet.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(5));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(5));
             Assert.Empty(emitted);
 
             // Past the grace window — emit.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
             Assert.Single(emitted);
         }
 
@@ -78,7 +78,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.SeedPendingPlatformScriptForTesting("846cea22", exitCode: 0, exitObservedAtUtc: observedAt);
 
             // Shutdown flush right after exit — grace not elapsed, but force emits anyway.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(1), force: true);
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(1), force: true);
 
             Assert.Single(emitted);
         }
@@ -92,7 +92,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             tracker.SeedPendingPlatformScriptForTesting("bad5c0de", exitCode: 1, exitObservedAtUtc: observedAt);
 
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             var script = Assert.Single(emitted);
             Assert.Equal(1, script.ExitCode);
@@ -109,7 +109,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             // Started but no exit code yet → still running, must not be emitted even on force flush.
             tracker.SeedPendingPlatformScriptForTesting("running", exitCode: null, exitObservedAtUtc: null);
 
-            tracker.FlushStalePlatformScriptResults(DateTime.UtcNow, force: true);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
 
             Assert.Empty(emitted);
         }
@@ -122,7 +122,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
 
             tracker.SeedPendingPlatformScriptForTesting("dece354a", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
             Assert.Single(emitted);
 
             // IME finally logs its PS-SCRIPT-RESULT line — must NOT produce a second event.
@@ -138,7 +138,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
 
             tracker.SeedPendingPlatformScriptForTesting("dece354a", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             // The exit-observed timestamp must travel on the emitted state so the adapter can bind
             // the event to it instead of an unrelated "last matched" line parsed during the grace.
@@ -156,14 +156,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             // Run 1 of policy X — fallback emits.
             tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: 0, exitObservedAtUtc: firstRun);
-            tracker.FlushStalePlatformScriptResults(firstRun.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(firstRun.AddSeconds(20));
             Assert.Single(emitted);
 
             // Run 2 of the SAME policy later in the same agent lifetime (IME re-evaluation / retry)
             // must NOT be deduped away — the fresh start clears the prior emitted-marker.
             var secondRun = firstRun.AddMinutes(30);
             tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: 0, exitObservedAtUtc: secondRun);
-            tracker.FlushStalePlatformScriptResults(secondRun.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(secondRun.AddSeconds(20));
             Assert.Equal(2, emitted.Count);
         }
 
@@ -182,7 +182,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Equal("ime_policy_result", script.ResultSource);
 
             // Later fallback pass must find nothing pending → no duplicate.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
             Assert.Single(emitted);
         }
     }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerResultHoldTests.cs

@@ -0,0 +1,308 @@
+using System;
+using System.Collections.Generic;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// The IME result waits for its executor end block (session e7f3c910): PS-SCRIPT-RESULT can
+    /// reach the tracker before the AgentExecutor.log end block of the same run — an overwritten
+    /// block is recovered one pass after the result that triggers the ledger check, the
+    /// AgentExecutor.log read of a pass may precede the exit line by milliseconds, or the poll
+    /// loop stalled. Emitting at once lost the exit code and, when the late start line reopened
+    /// the slot, produced a fallback duplicate 15 s later.
+    /// </summary>
+    public sealed class ImeLogTrackerResultHoldTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 10, 22, 13, 35, DateTimeKind.Utc);
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public ImeLogTracker Tracker { get; private set; }
+            public DateTime Now { get; set; } = T0;
+            public List<ScriptExecutionState> Completed { get; } = new List<ScriptExecutionState>();
+            public List<ScriptStartedInfo> Started { get; } = new List<ScriptStartedInfo>();
+
+            public Harness() { Tracker = Build(); }
+
+            private ImeLogTracker Build()
+            {
+                var t = new ImeLogTracker(_tmp.Path, new List<ImeLogPattern>(), new AgentLogger(_tmp.Path, AgentLogLevel.Info), stateDirectory: _tmp.Path);
+                t.UtcNowProvider = () => Now;
+                t.OnScriptCompleted = s => Completed.Add(s);
+                t.OnScriptStarted = s => Started.Add(s);
+                return t;
+            }
+
+            /// <summary>Agent restart over the same state directory.</summary>
+            public void Restart()
+            {
+                Tracker.SaveStateForTest();
+                Tracker.Dispose();
+                Tracker = Build();
+                Tracker.LoadStateForTest();
+            }
+
+            /// <summary>A start line (IME "Script file … is generated" or the executor's argument line) with its source timestamp.</summary>
+            public void Start(string id, DateTime lineTs)
+            {
+                Tracker.LastMatchedLogTimestamp = lineTs;
+                Tracker.NextTestEntry();
+                Tracker.HandlePlatformScriptStarted(id);
+            }
+
+            public void Result(string id, DateTime lineTs, string result = "Success")
+                => Tracker.CompletePlatformScriptFromImeResultForTesting(id, result, lineTs);
+
+            public void Exit(string id, DateTime lineTs, int exitCode = 0)
+                => Tracker.RecordPlatformScriptExitCodeForTesting(id, exitCode, lineTs);
+
+            /// <summary>The end-of-pass flush at the harness clock.</summary>
+            public void Flush(bool force = false) => Tracker.FlushPendingPlatformScriptResults(Now, force);
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Result_before_the_end_block_is_held_and_emits_once_with_the_exit_code()
+        {
+            using var h = new Harness();
+            h.Start("376ee51a", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("376ee51a", T0.AddSeconds(2));
+            Assert.Empty(h.Completed);
+            h.Now = T0.AddSeconds(2.1);
+            h.Flush();
+            Assert.Empty(h.Completed);
+
+            // The end block surfaces on the next pass (ledger rewind or plain read lag).
+            h.Exit("376ee51a", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2.2);
+            h.Flush();
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal(T0.AddSeconds(2), script.ResultObservedAtUtc);
+            Assert.Equal("PS-SCRIPT-RESULT", script.ResultPatternId);
+            Assert.Equal(T0, script.StartedAtUtc);
+
+            // Nothing fires twice: later passes, a repeated result line, the 15 s fallback window.
+            h.Now = T0.AddSeconds(30);
+            h.Flush();
+            h.Result("376ee51a", T0.AddSeconds(2));
+            Assert.Single(h.Completed);
+        }
+
+        [Fact]
+        public void Result_with_the_end_block_already_read_emits_at_once()
+        {
+            using var h = new Harness();
+            h.Start("847da54e", T0);
+            h.Exit("847da54e", T0.AddSeconds(2.3));
+            h.Now = T0.AddSeconds(2.31);
+            h.Result("847da54e", T0.AddSeconds(2.31));
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Null(script.ResultHeldSinceUtc);
+            Assert.Equal(T0.AddSeconds(2.31), script.ResultObservedAtUtc);
+        }
+
+        [Fact]
+        public void Held_result_emits_without_exit_code_after_the_grace()
+        {
+            using var h = new Harness();
+            h.Start("784fcaf5", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("784fcaf5", T0.AddSeconds(2));
+
+            h.Now = T0.AddSeconds(2).Add(ImeLogTracker.PlatformScriptEndBlockGrace).AddMilliseconds(-100);
+            h.Flush();
+            Assert.Empty(h.Completed);
+
+            h.Now = T0.AddSeconds(2).Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Flush();
+            var script = Assert.Single(h.Completed);
+            Assert.Null(script.ExitCode);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+
+            // An exit line surfacing after the emit is dropped — no second event, no fallback.
+            h.Exit("784fcaf5", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(40);
+            h.Flush();
+            Assert.Single(h.Completed);
+        }
+
+        [Fact]
+        public void Shutdown_flush_emits_a_held_result_at_once()
+        {
+            using var h = new Harness();
+            h.Start("a52e4f47", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("a52e4f47", T0.AddSeconds(2), "Failed");
+            Assert.Empty(h.Completed);
+
+            h.Flush(force: true);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Failed", script.Result);
+            Assert.Null(script.ExitCode);
+        }
+
+        [Fact]
+        public void Late_start_line_of_an_emitted_run_opens_no_new_run()
+        {
+            // Session e7f3c910, 376ee51a: the result was emitted, THEN the executor's start and
+            // exit lines of the same run were read (a 2 s poll stall) — the start opened a second
+            // slot and the exit code became a fallback duplicate 15 s later.
+            using var h = new Harness();
+            h.Start("376ee51a", T0);
+            h.Exit("376ee51a", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2);
+            h.Result("376ee51a", T0.AddSeconds(2));
+            Assert.Single(h.Completed);
+            Assert.Single(h.Started);
+
+            h.Start("376ee51a", T0.AddMilliseconds(300));
+            Assert.Single(h.Started);
+            h.Exit("376ee51a", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(30);
+            h.Flush();
+            Assert.Single(h.Completed);
+        }
+
+        [Fact]
+        public void Start_line_newer_than_the_emitted_result_is_the_next_run()
+        {
+            using var h = new Harness();
+            h.Start("338d9434", T0);
+            h.Exit("338d9434", T0.AddSeconds(1));
+            h.Now = T0.AddSeconds(1);
+            h.Result("338d9434", T0.AddSeconds(1));
+            Assert.Single(h.Completed);
+
+            // IME re-runs the policy after the user signed in.
+            h.Start("338d9434", T0.AddMinutes(7));
+            Assert.Equal(2, h.Started.Count);
+            h.Exit("338d9434", T0.AddMinutes(7).AddSeconds(3));
+            h.Now = T0.AddMinutes(7).AddSeconds(3);
+            h.Result("338d9434", T0.AddMinutes(7).AddSeconds(3));
+            Assert.Equal(2, h.Completed.Count);
+            Assert.Equal(T0.AddMinutes(7), h.Completed[1].StartedAtUtc);
+        }
+
+        [Fact]
+        public void Newer_start_line_closes_a_held_result_and_starts_the_next_run()
+        {
+            using var h = new Harness();
+            h.Start("c81b8053", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("c81b8053", T0.AddSeconds(2));
+            Assert.Empty(h.Completed);
+
+            // The end block never surfaced before the policy ran again.
+            h.Start("c81b8053", T0.AddSeconds(4));
+            var first = Assert.Single(h.Completed);
+            Assert.Null(first.ExitCode);
+            Assert.Equal(T0, first.StartedAtUtc);
+            Assert.Equal(2, h.Started.Count);
+
+            h.Exit("c81b8053", T0.AddSeconds(6));
+            h.Now = T0.AddSeconds(6);
+            h.Result("c81b8053", T0.AddSeconds(6));
+            Assert.Equal(2, h.Completed.Count);
+            Assert.Equal(0, h.Completed[1].ExitCode);
+            Assert.Equal(T0.AddSeconds(4), h.Completed[1].StartedAtUtc);
+        }
+
+        [Fact]
+        public void Result_without_a_start_takes_the_recovered_start_line_and_end_block()
+        {
+            // Both the start block and the end block were hidden when the result arrived; the
+            // ledger rewind the result triggers brings both back on the next pass.
+            using var h = new Harness();
+            h.Now = T0.AddSeconds(2);
+            h.Result("d39eeef3", T0.AddSeconds(2));
+            Assert.Empty(h.Completed);
+
+            h.Start("d39eeef3", T0);
+            Assert.Empty(h.Started);
+            h.Exit("d39eeef3", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2.2);
+            h.Flush();
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(T0, script.StartedAtUtc);
+            Assert.Equal(0, script.ExitCode);
+        }
+
+        [Fact]
+        public void Held_result_survives_a_restart()
+        {
+            using var h = new Harness();
+            h.Start("832e27bc", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("832e27bc", T0.AddSeconds(2));
+            h.Restart();
+            Assert.Empty(h.Completed);
+
+            h.Exit("832e27bc", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2.5);
+            h.Flush();
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal(T0.AddSeconds(2), script.ResultObservedAtUtc);
+            Assert.Equal("PS-SCRIPT-RESULT", script.ResultPatternId);
+        }
+
+        [Fact]
+        public void Emitted_marker_keeps_the_run_timestamp_across_a_restart()
+        {
+            using var h = new Harness();
+            h.Start("89b3cbcd", T0);
+            h.Exit("89b3cbcd", T0.AddSeconds(1));
+            h.Now = T0.AddSeconds(1);
+            h.Result("89b3cbcd", T0.AddSeconds(1));
+            h.Restart();
+
+            h.Start("89b3cbcd", T0.AddMilliseconds(500)); // late line of the emitted run
+            Assert.Single(h.Started);
+            h.Start("89b3cbcd", T0.AddMinutes(5));        // the next run
+            Assert.Equal(2, h.Started.Count);
+        }
+
+        [Fact]
+        public void Marker_list_from_an_older_state_file_still_dedups()
+        {
+            using var tmp = new TempDirectory();
+            var persistence = new ImeTrackerStatePersistence(tmp.Path, new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            persistence.Save(new ImeTrackerStateData { PlatformScriptResultEmitted = new List<string> { "policyZ" } });
+
+            var completed = new List<ScriptExecutionState>();
+            var started = new List<ScriptStartedInfo>();
+            var tracker = new ImeLogTracker(tmp.Path, new List<ImeLogPattern>(), new AgentLogger(tmp.Path, AgentLogLevel.Info), stateDirectory: tmp.Path);
+            tracker.OnScriptCompleted = s => completed.Add(s);
+            tracker.OnScriptStarted = s => started.Add(s);
+            tracker.LoadStateForTest();
+
+            tracker.CompletePlatformScriptFromImeResultForTesting("policyZ", "Success", T0);
+            Assert.Empty(completed);
+
+            // Without a timestamp on the marker every start line is a new run, as before.
+            tracker.LastMatchedLogTimestamp = T0;
+            tracker.HandlePlatformScriptStarted("policyZ");
+            Assert.Single(started);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerScriptStatePersistenceTests.cs

@@ -41,7 +41,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             // Run 1: exit code seen, shutdown force-flush emits the fallback completion.
             var tracker1 = BuildTracker(tmp, out var emitted1);
             tracker1.SeedPendingPlatformScriptForTesting("policyA", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker1.FlushStalePlatformScriptResults(observedAt.AddSeconds(1), force: true);
+            tracker1.FlushPendingPlatformScriptResults(observedAt.AddSeconds(1), force: true);
             Assert.Single(emitted1);
             tracker1.SaveStateForTest();
 
@@ -68,7 +68,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             // Restarted tracker continues the grace window instead of dropping the script.
             var tracker2 = BuildTracker(tmp, out var emitted2);
             tracker2.LoadStateForTest();
-            tracker2.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker2.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             var script = Assert.Single(emitted2);
             Assert.Equal("policyB", script.PolicyId);
@@ -84,7 +84,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             var tracker1 = BuildTracker(tmp, out _);
             tracker1.SeedPendingPlatformScriptForTesting("policyC", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker1.FlushStalePlatformScriptResults(observedAt.AddSeconds(1), force: true);
+            tracker1.FlushPendingPlatformScriptResults(observedAt.AddSeconds(1), force: true);
             tracker1.SaveStateForTest();
 
             // Restart, then a genuine RE-RUN of the same policy (fresh start clears the marker).
@@ -109,8 +109,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             var tracker = BuildTracker(tmp, out var emitted);
             tracker.LoadStateForTest(); // must not throw
 
-            // Degrades to pre-fix behavior: no markers restored, normal emission works.
+            // Degrades to pre-fix behavior: no markers restored, normal emission works (the
+            // result waits for its end block until the shutdown flush).
             tracker.CompletePlatformScriptFromImeResultForTesting("policyD", "Success");
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
             Assert.Single(emitted);
         }
 
@@ -128,8 +130,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.CompletePlatformScriptFromImeResultForTesting("policyE", "Failed", run2Start.AddMinutes(-5));
             Assert.Empty(emitted);
 
-            // Run 2's own result (newer than its start) still emits normally.
+            // Run 2's own result (newer than its start) still emits normally — held for the end
+            // block until the shutdown flush, since none is seeded here.
             tracker.CompletePlatformScriptFromImeResultForTesting("policyE", "Success", run2Start.AddMinutes(2));
+            tracker.FlushPendingPlatformScriptResults(run2Start.AddMinutes(2), force: true);
             var script = Assert.Single(emitted);
             Assert.Equal("Success", script.Result);
             Assert.Equal(run2Start, script.StartedAtUtc);

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerTokenLineCallbackTests.cs

@@ -0,0 +1,115 @@
+using System;
+using System.Collections.Generic;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Raw per-line token callbacks for the Entra user-affinity detector (2026-09-04).
+    /// <c>OnUserTokenAcquired</c> fires on EVERY IME-TOKEN-SUCCESS line — independent of the
+    /// phase-change dedup that swallows the second AccountSetup detection — and
+    /// <c>OnTokenFailureLine</c> on every failure line; both honour the historic-replay gate.
+    /// </summary>
+    public sealed class ImeLogTrackerTokenLineCallbackTests
+    {
+        private static readonly DateTime Now = new DateTime(2026, 9, 4, 14, 0, 0, DateTimeKind.Utc);
+
+        private static List<ImeLogPattern> Patterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "IME-TOKEN-SUCCESS", Category = "always", Enabled = true,
+                Pattern = "^Successfully get the token",
+                Action = "espPhaseDetected",
+                Parameters = new Dictionary<string, string> { ["phase"] = "AccountSetup" },
+            },
+            new ImeLogPattern
+            {
+                PatternId = "IME-TOKEN-FAILURE", Category = "always", Enabled = true,
+                Pattern = @"^Failed to get AAD token\..*?errorCode = (?<errorCode>.*?)$",
+                Action = "imeTokenFailure",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private static ImeLogTracker Build(TempDirectory tmp)
+        {
+            var tracker = new ImeLogTracker(
+                logFolder: tmp.Path,
+                patterns: Patterns(),
+                logger: new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            tracker.UtcNowProvider = () => Now;
+            return tracker;
+        }
+
+        private const string Success = "Successfully get the token with client id fc0f3af4-6835-4174-b806-f7db311fd2f3 and resource id 26a4ae64-5862-427f-a9b0-044e62572a4f";
+        private const string Failure = "Failed to get AAD token. len = 34 using client id fc0f3af4-6835-4174-b806-f7db311fd2f3 and resource id 26a4ae64-5862-427f-a9b0-044e62572a4f, errorCode = 3399548929";
+
+        [Fact]
+        public void Every_token_success_line_invokes_callback_even_when_phase_is_deduplicated()
+        {
+            using var tmp = new TempDirectory();
+            using var tracker = Build(tmp);
+            var tokens = new List<DateTime?>();
+            tracker.OnUserTokenAcquired = ts => tokens.Add(ts);
+
+            // The phase-change dedup lives in the adapter (AccountSetup is emitted once);
+            // the raw token callback must fire for BOTH lines regardless.
+            tracker.ProcessLogMessageForTest(Success, Now.AddMinutes(-6));
+            tracker.ProcessLogMessageForTest(Success, Now.AddMinutes(-2));
+
+            Assert.Equal(2, tokens.Count);
+            Assert.Equal(Now.AddMinutes(-6), tokens[0]);
+            Assert.Equal(Now.AddMinutes(-2), tokens[1]);
+        }
+
+        [Fact]
+        public void Every_failure_line_invokes_callback_with_error_code()
+        {
+            using var tmp = new TempDirectory();
+            using var tracker = Build(tmp);
+            var failures = new List<(string code, DateTime? ts)>();
+            tracker.OnTokenFailureLine = (code, ts) => failures.Add((code, ts));
+
+            tracker.ProcessLogMessageForTest(Failure, Now.AddMinutes(-5));
+            tracker.ProcessLogMessageForTest(Failure, Now.AddMinutes(-4));
+
+            Assert.Equal(2, failures.Count);
+            Assert.All(failures, f => Assert.Equal("3399548929", f.code));
+            Assert.Equal(Now.AddMinutes(-5), failures[0].ts);
+        }
+
+        [Fact]
+        public void Historic_replay_lines_do_not_invoke_either_callback()
+        {
+            using var tmp = new TempDirectory();
+            using var tracker = Build(tmp);
+            var tokens = 0;
+            var failures = 0;
+            tracker.OnUserTokenAcquired = _ => tokens++;
+            tracker.OnTokenFailureLine = (_, __) => failures++;
+
+            tracker.ProcessLogMessageForTest(Success, Now.AddDays(-3));
+            tracker.ProcessLogMessageForTest(Failure, Now.AddDays(-3));
+
+            Assert.Equal(0, tokens);
+            Assert.Equal(0, failures);
+        }
+
+        [Fact]
+        public void Callback_exception_does_not_break_the_drain()
+        {
+            using var tmp = new TempDirectory();
+            using var tracker = Build(tmp);
+            tracker.OnUserTokenAcquired = _ => throw new InvalidOperationException("boom");
+            tracker.OnTokenFailureLine = (_, __) => throw new InvalidOperationException("boom");
+
+            tracker.ProcessLogMessageForTest(Success, Now.AddMinutes(-1));
+            tracker.ProcessLogMessageForTest(Failure, Now.AddMinutes(-1));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/DiagnosticsPackageServiceTests.cs

@@ -903,5 +903,87 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
                 NtfsLinks.RemoveLink(link);
             }
         }
+
+        // ============================================================= packaging counters
+
+        [Fact]
+        public void BuildArchiveBytes_records_packaging_counters_by_reason_and_kind_without_paths()
+        {
+            using var rig = new Rig();
+            File.WriteAllText(Path.Combine(rig.StateFolder, "small.json"), "{}");
+            File.WriteAllText(Path.Combine(rig.StateFolder, "big-1.json"), new string('x', 64));
+            File.WriteAllText(Path.Combine(rig.StateFolder, "big-2.json"), new string('y', 64));
+            var blockedPath = @"C:\Windows\System32\config\SYSTEM";
+
+            var service = rig.Build(cfg => cfg.DiagnosticsLogPaths.Add(
+                new AutopilotMonitor.Shared.Models.DiagnosticsLogPath { Path = blockedPath }));
+            service.Budget = new DiagnosticsBudget { MaxSingleFileBytes = 16, MaxTotalUncompressedBytes = 1L << 30, MaxFileCount = 5000 };
+
+            Assert.Null(service.LastPackaging);
+            var bytes = service.BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var stats = service.LastPackaging;
+            Assert.NotNull(stats);
+            Assert.True(stats!.Truncated);
+            Assert.Equal(2, stats.SkippedFiles);
+            Assert.Equal(2, stats.SkippedByReason["size"]);
+            Assert.Single(stats.SkippedByReason);
+            Assert.Equal(1, stats.ProblemsByKind["path-guard"]);
+            Assert.Single(stats.ProblemsByKind);
+            Assert.True(stats.IncludedFiles >= 1, "the small file must have been included");
+            Assert.True(stats.IncludedBytes >= 2);
+
+            // The ZIP still carries the per-file list; the counters never do.
+            Assert.NotNull(ReadZipEntryText(bytes, "_TRUNCATED.txt"));
+            foreach (var key in stats.SkippedByReason.Keys.Concat(stats.ProblemsByKind.Keys))
+            {
+                Assert.DoesNotContain("\\", key);
+                Assert.DoesNotContain(":", key);
+                Assert.DoesNotContain("/", key);
+            }
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_reports_a_clean_build_as_not_truncated_with_empty_maps()
+        {
+            using var rig = new Rig();
+            File.WriteAllText(Path.Combine(rig.StateFolder, "snapshot.json"), "{}");
+
+            var service = rig.Build();
+            service.BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var stats = service.LastPackaging;
+            Assert.NotNull(stats);
+            Assert.False(stats!.Truncated);
+            Assert.Equal(0, stats.SkippedFiles);
+            Assert.Empty(stats.SkippedByReason);
+            Assert.Empty(stats.ProblemsByKind);
+            Assert.True(stats.IncludedFiles >= 1);
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_counts_a_rejected_source_folder_as_a_problem()
+        {
+            using var rig = new Rig();
+            using var outside = new TempDirectory();
+            File.WriteAllText(Path.Combine(outside.Path, "snapshot.json"), "{}");
+            var link = Path.Combine(rig.Tmp.Path, "StateLink");
+            NtfsLinks.CreateJunction(link, outside.Path);
+
+            try
+            {
+                var service = rig.Build(sectionFolderOverrides: new Dictionary<string, string> { ["AgentState"] = link });
+                service.BuildArchiveBytes(enrollmentSucceeded: true);
+
+                // The section is walked once per search pattern (11 patterns) but the folder
+                // failed once — the counter says so.
+                Assert.Equal(1, service.LastPackaging!.ProblemsByKind["folder-rejected"]);
+                Assert.False(service.LastPackaging.Truncated);
+            }
+            finally
+            {
+                NtfsLinks.RemoveLink(link);
+            }
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ProvisioningStatusTrackerAccountSetupActivityTests.cs

@@ -0,0 +1,142 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// Backlog q8n — pins the two AccountSetup probes side by side.
+    /// <para>
+    /// <see cref="ProvisioningStatusTracker.HasAccountSetupActivity"/> keeps PRESENCE semantics:
+    /// Windows writes <c>AccountSetupCategory.Status</c> with every subcategory <c>notStarted</c>
+    /// before the Device-ESP page exits, and about one in five Classic sessions sees only that
+    /// single Shell-Core 62407 for the whole enrollment — those resolve AccountSetup solely via
+    /// the user-apps-settled synthesis, which needs the exit remembered as the edge. Tightening
+    /// this property strands them (verified on 485 SkipUser=false sessions, 2026-09-01..04).
+    /// </para>
+    /// <para>
+    /// <see cref="ProvisioningStatusTracker.HasAccountSetupProgress"/> is the additive PROGRESS
+    /// probe for the User-ESP keep-awake host: true only once a subcategory left
+    /// <c>notStarted</c>, so the host can tell the real user-ESP page exit (session a2256107:
+    /// 09:47:12) from the Device→Account handoff exit (09:37:53) that released the hold early.
+    /// </para>
+    /// </summary>
+    public sealed class ProvisioningStatusTrackerAccountSetupActivityTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 4, 9, 37, 42, DateTimeKind.Utc);
+
+        // Verbatim shape of the pre-written registry JSON seen at first_seen on 25H2/26200.
+        private const string AllNotStartedJson = @"{
+            ""categoryState"":""notStarted"",
+            ""AccountSetup.WaitingForAadRegistrationSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.PrepareMultifactorAuth"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.SecurityPoliciesSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.CertificatesSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.NetworkConnectionsSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.AppsSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.SendResultsToMdmServer"":{""subcategoryState"":""notStarted""}
+        }";
+
+        private const string FirstProgressJson = @"{
+            ""categoryState"":""inProgress"",
+            ""AccountSetup.WaitingForAadRegistrationSubcategory"":{""subcategoryState"":""succeeded"",""subcategoryStatusText"":""succeeded""},
+            ""AccountSetup.PrepareMultifactorAuth"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.SecurityPoliciesSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.CertificatesSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.NetworkConnectionsSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.AppsSubcategory"":{""subcategoryState"":""notStarted""},
+            ""AccountSetup.SendResultsToMdmServer"":{""subcategoryState"":""notStarted""}
+        }";
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public FakeSignalIngressSink Sink { get; } = new FakeSignalIngressSink();
+            public ProvisioningStatusTracker Tracker { get; }
+
+            public Fixture()
+            {
+                var clock = new VirtualClock(Fixed);
+                var post = new InformationalEventPost(Sink, clock);
+                var logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Tracker = new ProvisioningStatusTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: post,
+                    logger: logger);
+            }
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void NothingTracked_NeitherActivityNorProgress()
+        {
+            using var f = new Fixture();
+            Assert.False(f.Tracker.HasAccountSetupActivity);
+            Assert.False(f.Tracker.HasAccountSetupProgress);
+        }
+
+        [Fact]
+        public void PreWrittenAllNotStartedJson_IsActivity_ButNotProgress()
+        {
+            // The registry JSON exists (7 subcategories) but nothing has started — the state at
+            // the intermediate Device-ESP exit. Activity (presence) must stay true so the
+            // completion guards keep remembering single-exit sessions; progress must be false so
+            // the keep-awake host does not treat this exit as the user-ESP page exit.
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("AccountSetupCategory.Status", AllNotStartedJson);
+
+            Assert.True(f.Tracker.HasAccountSetupActivity);
+            Assert.False(f.Tracker.HasAccountSetupProgress);
+        }
+
+        [Fact]
+        public void FirstSubcategoryLeavingNotStarted_IsProgress()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("AccountSetupCategory.Status", AllNotStartedJson);
+            f.Tracker.ProcessCategoryStatusForTest("AccountSetupCategory.Status", FirstProgressJson);
+
+            Assert.True(f.Tracker.HasAccountSetupActivity);
+            Assert.True(f.Tracker.HasAccountSetupProgress);
+        }
+
+        [Theory]
+        [InlineData("inProgress")]
+        [InlineData("in_progress")]
+        [InlineData("failed")]
+        [InlineData("notRequired")]
+        public void AnyNonNotStartedState_IsProgress(string state)
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("AccountSetupCategory.Status",
+                "{\"categoryState\":\"inProgress\"," +
+                "\"AccountSetup.AppsSubcategory\":{\"subcategoryState\":\"" + state + "\"}," +
+                "\"AccountSetup.CertificatesSubcategory\":{\"subcategoryState\":\"notStarted\"}}");
+
+            Assert.True(f.Tracker.HasAccountSetupProgress);
+        }
+
+        [Fact]
+        public void DeviceSetupProgress_DoesNotCountAsAccountSetupProgress()
+        {
+            // Adversarial: a fully progressed DeviceSetup category must not leak into the
+            // AccountSetup answer.
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status",
+                "{\"categoryState\":\"succeeded\",\"DeviceSetup.AppsSubcategory\":{\"subcategoryState\":\"succeeded\"}}");
+            f.Tracker.ProcessCategoryStatusForTest("AccountSetupCategory.Status", AllNotStartedJson);
+
+            Assert.False(f.Tracker.HasAccountSetupProgress);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ProvisioningStatusTrackerPendingFailureTests.cs

@@ -0,0 +1,92 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// <see cref="ProvisioningStatusTracker.TryGetPendingFailureArgs"/> exposes the registry
+    /// failure detail while its settle window is open and nothing once the window has fired —
+    /// the coordinator reads it when a Shell-Core failure terminalises first (session 683f1eff).
+    /// </summary>
+    public sealed class ProvisioningStatusTrackerPendingFailureTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 2, DateTimeKind.Utc);
+
+        private const string InProgressJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""inProgress"",""subcategoryStatusText"":""Apps (Working)""}
+        }";
+        private const string AppsFailedJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""failed"",""subcategoryStatusText"":""Apps (0x80070652)""}
+        }";
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public ProvisioningStatusTracker Tracker { get; }
+
+            public Fixture()
+            {
+                var post = new InformationalEventPost(new FakeSignalIngressSink(), new VirtualClock(Fixed));
+                var logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Tracker = new ProvisioningStatusTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: post,
+                    logger: logger,
+                    appxScanner: new FakeAppxDeploymentFailureScanner(),
+                    backgroundDispatcher: action => action());
+            }
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Nothing_pending_before_any_failure()
+        {
+            using var f = new Fixture();
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+
+        [Fact]
+        public void Armed_settle_window_exposes_the_registry_detail()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            var pending = f.Tracker.TryGetPendingFailureArgs();
+
+            Assert.NotNull(pending);
+            Assert.Equal("Provisioning_DeviceSetup_Apps_Failed", pending!.FailureType);
+            Assert.Equal("0x80070652", pending.ErrorCode);
+            Assert.Equal("Apps", pending.FailedSubcategory);
+            Assert.Equal("DeviceSetup", pending.Category);
+        }
+
+        [Fact]
+        public void Expired_settle_window_leaves_nothing_pending()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            f.Tracker.TriggerSettleTimerForTest("DeviceSetupCategory.Status");
+
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/WindowsUpdateTrackerTests.cs

@@ -243,12 +243,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         }
 
         [Fact]
-        public void DecodeHResult_KnownAndUnknown()
+        public void ResolveHResultSymbol_ReadsTheSharedCatalog()
         {
-            Assert.Equal("WU_E_ALL_UPDATES_FAILED", WindowsUpdateTracker.DecodeHResult(0x80240022));
-            Assert.Equal("CBS_E_INSTALLERS_FAILED", WindowsUpdateTracker.DecodeHResult(0x800F0922));
-            Assert.Equal("S_OK", WindowsUpdateTracker.DecodeHResult(0x00000000));
-            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.DecodeHResult(0x8888DEAD));
+            Assert.Equal("WU_E_ALL_UPDATES_FAILED", WindowsUpdateTracker.ResolveHResultSymbol(0x80240022));
+            Assert.Equal("CBS_E_INSTALLERS_FAILED", WindowsUpdateTracker.ResolveHResultSymbol(0x800F0922));
+            Assert.Equal("ERROR_TIMEOUT", WindowsUpdateTracker.ResolveHResultSymbol(0x800705B4));
+            Assert.Equal("S_OK", WindowsUpdateTracker.ResolveHResultSymbol(0x00000000));
+            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.ResolveHResultSymbol(0x8888DEAD));
+        }
+
+        [Fact]
+        public void ResolveHResultSymbol_FallsBackWhenTheCatalogHasNoSymbolOrThrows()
+        {
+            // An entry without a symbol (IME/Intune paraphrases) still yields the sentinel.
+            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.ResolveHResultSymbol(0x87D1041C));
+            // A catalog load failure is decoration lost, never an event lost.
+            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.ResolveHResultSymbol(0x80240022, _ => throw new InvalidOperationException("catalog")));
+            Assert.Equal("S_OK", WindowsUpdateTracker.ResolveHResultSymbol(0, _ => throw new InvalidOperationException("catalog")));
         }
 
         // ---------------------------------------------------------------------------

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Telemetry/Gather/GuardrailsParityTests.cs

@@ -56,6 +56,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Telemetry.Gather
                 LoadEmbeddedGuardrails()["maxCommandLength"]!.Value<int>());
         }
 
+        [Fact]
+        public void User_profile_prefixes_are_all_accepted_by_the_loader()
+        {
+            // The loader drops entries outside AppData\Local / AppData\Roaming (the hard block
+            // would never release them anyway). A dropped entry is invisible at runtime — it
+            // just never matches — so a typo in the JSON must fail here instead.
+            var json = LoadEmbeddedGuardrails()["userProfileFilePrefixes"]?.ToObject<string[]>()
+                       ?? new string[0];
+
+            Assert.Equal(
+                json.Select(p => p.Trim().TrimEnd('\\')).OrderBy(p => p),
+                GatherRuleGuards.AllowedUserProfileFilePrefixes.OrderBy(p => p));
+        }
+
+        [Fact]
+        public void User_profile_prefixes_stay_under_the_hard_blocks_exception()
+        {
+            Assert.All(
+                GatherRuleGuards.AllowedUserProfileFilePrefixes,
+                prefix => Assert.Contains(
+                    GatherRuleGuards.AllowedUserProfileSubdirs,
+                    subdir => prefix.StartsWith(subdir, System.StringComparison.OrdinalIgnoreCase) &&
+                              (prefix.Length == subdir.Length || prefix[subdir.Length] == '\\')));
+        }
+
         [Fact]
         public void Blocked_event_log_channels_match_code_constants()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/DecisionStepProcessorUploadPathTests.cs

@@ -11,6 +11,7 @@ using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/EnrollmentOrchestratorPart2EmissionTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031
 
@@ -42,7 +43,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             // items must be a whiteglove_resumed event.
             Assert.DoesNotContain(
                 rig.Uploader.Received.SelectMany(b => b),
-                item => item.Kind == AutopilotMonitor.Agent.V2.Core.Transport.Telemetry.TelemetryItemKind.Event &&
+                item => item.Kind == TelemetryItemKind.Event &&
                         item.PayloadJson != null &&
                         item.PayloadJson.Contains("\"whiteglove_resumed\""));
         }
@@ -75,7 +76,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             var resumedEvents = rig.Uploader.Received
                 .SelectMany(b => b)
                 .Where(item =>
-                    item.Kind == AutopilotMonitor.Agent.V2.Core.Transport.Telemetry.TelemetryItemKind.Event &&
+                    item.Kind == TelemetryItemKind.Event &&
                     item.PayloadJson != null &&
                     item.PayloadJson.Contains("\"whiteglove_resumed\""))
                 .ToList();

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/EnrollmentOrchestratorTests.cs

@@ -265,6 +265,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             sut.Stop();
         }
 
+        [Fact]
+        public void Deadline_fired_late_keeps_the_due_time_as_stamp_and_carries_it_in_the_payload()
+        {
+            // A deadline that was due while the device slept (or the agent was down) fires only
+            // afterwards. The signal keeps the due time as OccurredAtUtc (D-238: the outage must not
+            // become session duration) and repeats it in the payload so the stale-fire guards
+            // identify the incarnation independently of the stamp.
+            using var rig = new EnrollmentOrchestratorRig(At);
+            var sut = rig.Build();
+            sut.Start();
+
+            var dueAt = At.AddMinutes(-5);
+            var scheduler = GetScheduler(sut);
+            scheduler.Schedule(new ActiveDeadline(
+                name: "hello_safety",
+                dueAtUtc: dueAt,
+                firesSignalKind: DecisionSignalKind.DeadlineFired,
+                firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = "hello_safety" }));
+
+            var signalLog = GetSignalLog(sut);
+            Assert.True(SpinWait.SpinUntil(() => ContainsDeadlineFired(signalLog), 3000));
+
+            DecisionSignal? fired = null;
+            foreach (var sig in signalLog.ReadAll())
+            {
+                if (sig.Kind == DecisionSignalKind.DeadlineFired) { fired = sig; break; }
+            }
+            Assert.NotNull(fired);
+            Assert.Equal(dueAt, fired!.OccurredAtUtc);
+            Assert.NotNull(fired.Payload);
+            Assert.Equal("hello_safety", fired.Payload![SignalPayloadKeys.Deadline]);
+            Assert.Equal(dueAt.ToString("O"), fired.Payload[SignalPayloadKeys.DeadlineDueAtUtc]);
+
+            sut.Stop();
+        }
+
         // ========================================================================= Quarantine
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/RecoveryPathTests.cs

@@ -15,6 +15,7 @@ using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/SignalIngressUploadPathTests.cs

@@ -9,6 +9,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/UserEspKeepAwakeHostTests.cs

@@ -114,14 +114,80 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             ing.Stop();
         }
 
+        private static void PostEspExiting(SignalIngress ing) =>
+            ing.Post(DecisionSignalKind.EspExiting, At, "EspAndHelloTracker", Raw("exit"));
+
         [Fact]
-        public void Releases_on_AccountSetupProvisioningComplete()
+        public void Releases_on_EspExiting_once_AccountSetup_shows_progress()
         {
+            // q8n: the real user-ESP page exit is a 62407 that arrives after the AccountSetup
+            // registry left notStarted (session a2256107: 09:47:12, progress since 09:38:25).
             var clock = new VirtualClock(At);
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
+            var progress = false;
+            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+                espTimeoutProvider: () => null, accountSetupProgressProbe: () => Volatile.Read(ref progress));
+
+            ing.Start();
+            host.Start();
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+
+            Volatile.Write(ref progress, true);
+            PostEspExiting(ing);
+
+            Assert.True(WaitFor(() => api.AllowCount == 1), "AllowSleep should be called once on the user-ESP page exit");
+            Assert.False(controller.IsEngaged);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void Handoff_exit_before_AccountSetup_progress_keeps_the_hold()
+        {
+            // The Device→Account handoff 62407 (a2256107: 09:37:53) precedes any AccountSetup
+            // progress — Windows pre-writes the AccountSetup JSON all-notStarted — and must not
+            // release. The later exit with progress does.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var progress = false;
+            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+                espTimeoutProvider: () => null, accountSetupProgressProbe: () => Volatile.Read(ref progress));
+
+            ing.Start();
+            host.Start();
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+
+            PostEspExiting(ing); // handoff exit, no progress yet
+            Assert.False(WaitFor(() => api.AllowCount > 0, 500), "the handoff exit must not release the hold");
+            Assert.True(controller.IsEngaged);
+
+            Volatile.Write(ref progress, true);
+            PostEspExiting(ing); // the real user-ESP page exit
+            Assert.True(WaitFor(() => api.AllowCount == 1));
+            Assert.False(controller.IsEngaged);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void AccountSetupProvisioningComplete_no_longer_releases()
+        {
+            // The synthesized completion fired a median 3 min before the page closed in 77 % of
+            // keep-awake sessions (q8n) — it is no longer a release trigger; the cap/stop/exit are.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+                espTimeoutProvider: () => null, accountSetupProgressProbe: () => true);
 
             ing.Start();
             host.Start();
@@ -130,8 +196,34 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
 
             ing.Post(DecisionSignalKind.AccountSetupProvisioningComplete, At, "ProvisioningStatusTracker", Raw("done"));
 
-            Assert.True(WaitFor(() => api.AllowCount == 1), "AllowSleep should be called once on AccountSetup completion");
-            Assert.False(controller.IsEngaged);
+            Assert.False(WaitFor(() => api.AllowCount > 0, 500), "completion must not release the hold any more");
+            Assert.True(controller.IsEngaged);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void EspExiting_before_engage_is_ignored()
+        {
+            // Exit signals while idle (e.g. a Device-ESP exit before AccountSetup) neither release
+            // nor poison the later engage.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+                espTimeoutProvider: () => null, accountSetupProgressProbe: () => true);
+
+            ing.Start();
+            host.Start();
+            PostEspExiting(ing);
+            Assert.False(WaitFor(() => api.AllowCount > 0, 300));
+
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+            Assert.True(controller.IsEngaged);
+            Assert.Equal(0, api.AllowCount);
 
             host.Dispose();
             ing.Stop();

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterHistoricReplayTests.cs

@@ -247,6 +247,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
 
             f.Tracker.LastMatchedLogTimestamp = ClockNow;
             f.Tracker.CompletePlatformScriptFromImeResultForTesting("beef7777", "Success", ClockNow);
+            // No end block is seeded — the held result goes out with the shutdown flush.
+            f.Tracker.FlushPendingPlatformScriptResults(f.Clock.UtcNow, force: true);
 
             var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
             // Without the hardening the slot kept the 7-day-old start: the duration would have

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterResultHoldTests.cs

@@ -0,0 +1,49 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
+{
+    /// <summary>
+    /// A held platform-script completion (IME result read before the executor end block) is
+    /// emitted at the end of a later pass, when the tracker's "last matched" line is an unrelated
+    /// one — the event stays bound to the result line's timestamp and pattern.
+    /// </summary>
+    public sealed class ImeLogTrackerAdapterResultHoldTests
+    {
+        private static readonly DateTime ClockNow = new DateTime(2026, 9, 10, 22, 13, 40, DateTimeKind.Utc);
+
+        [Fact]
+        public void Held_completion_is_bound_to_the_result_line_not_to_the_last_matched_one()
+        {
+            using var f = new ImeLogTrackerAdapterFixture(ClockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startTs = ClockNow.AddSeconds(-95);
+            var resultTs = ClockNow.AddSeconds(-3);
+
+            f.Tracker.LastMatchedLogTimestamp = startTs;
+            f.Tracker.HandlePlatformScriptStarted("376ee51a");
+
+            f.Tracker.LastMatchedLogTimestamp = resultTs;
+            f.Tracker.LastMatchedPatternId = "PS-SCRIPT-RESULT";
+            f.Tracker.CompletePlatformScriptFromImeResultForTesting("376ee51a", "Success", resultTs);
+            Assert.Empty(f.InfoEvents(SharedEventTypes.ScriptCompleted));
+
+            // Other lines were matched before the end block was read and the pass ended.
+            f.Tracker.LastMatchedLogTimestamp = ClockNow.AddSeconds(-1);
+            f.Tracker.LastMatchedPatternId = "IME-DOWNLOADING";
+            f.Tracker.RecordPlatformScriptExitCodeForTesting("376ee51a", 0, resultTs.AddMilliseconds(-8));
+            f.Tracker.FlushPendingPlatformScriptResults(f.Clock.UtcNow);
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal(resultTs, info.OccurredAtUtc);
+            Assert.Equal("PS-SCRIPT-RESULT", info.Payload!["patternId"]);
+            Assert.Equal("0", info.Payload["exitCode"]);
+            Assert.Equal("ime_policy_result", info.Payload["resultSource"]);
+            Assert.Equal("92.00", info.Payload["durationSeconds"]);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterTests.cs

@@ -282,8 +282,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
                 errorPatternId: null,
                 errorDetail: null,
                 errorCode: null,
-                exitCode: null,
+                exitCode: "0",
                 hresultFromWin32: null,
+                exitCodeClass: "Success",
                 appVersion: "11.2.1787.0",
                 appType: "WinGet",
                 attemptNumber: 1,
@@ -293,6 +294,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
 
             var info = Assert.Single(f.InfoEvents(SharedEventTypes.AppInstallComplete));
             Assert.Equal("app-xyz", info.Payload!["appId"]);
+            // Installer outcome surfaces on the terminal event even when the app succeeded: the
+            // return-code class is the only evidence of a SoftReboot/HardReboot mapping and the
+            // number says which code was mapped (IME-EXITCODE-CLASS, ANALYZE-APP-018).
+            Assert.Equal("Success", info.Payload["exitCodeClass"]);
+            Assert.Equal("0", info.Payload["exitCode"]);
             Assert.Equal("Company Portal", info.Payload["appName"]);
             Assert.Equal("Installed", info.Payload["state"]);
             Assert.Equal("Install", info.Payload["intent"]);
@@ -331,6 +337,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
                 errorCode: "60001",
                 exitCode: "60001",
                 hresultFromWin32: "-2146964895",
+                exitCodeClass: "Failed",
                 attemptNumber: 1,
                 detectionResult: "NotDetected");
 
@@ -340,6 +347,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             Assert.Equal("true", info.Payload!["isError"]);
             Assert.Equal("IME-ERROR-UNMAPPED-EXIT", info.Payload["errorPatternId"]);
             Assert.Equal("60001", info.Payload["errorCode"]);
+            Assert.Equal("60001", info.Payload["exitCode"]);
+            Assert.Equal("Failed", info.Payload["exitCodeClass"]);
             Assert.Equal("-2146964895", info.Payload["hresultFromWin32"]);
             Assert.Equal(EventSeverity.Error.ToString(), info.Payload[SignalPayloadKeys.Severity]);
             // Codex review follow-up (P1): an unrelated ErrorPatternId (here a regular

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Signals/TelemetrySignalEmitterTests.cs

@@ -5,6 +5,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Signals;
 using Newtonsoft.Json.Linq;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Signals
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Transitions/TelemetryTransitionEmitterTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.State;
 using Newtonsoft.Json.Linq;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Transitions
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Termination/EnrollmentTerminationHandlerTests.cs

@@ -1701,5 +1701,86 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
                 rig.PromotionCalls[0].failureType);
             Assert.Null(rig.PromotionCalls[0].errorCode);
         }
+
+        // ============================================================= packaging counters on the diag events
+
+        [Fact]
+        public void Handle_diagnostics_uploaded_carries_packaging_counters_when_the_packager_reported_them()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Completed }.Build();
+            rig.DiagnosticsResult = new DiagnosticsUploadResult
+            {
+                BlobName = "diag-blob.zip",
+                Packaging = new DiagnosticsPackagingStats
+                {
+                    IncludedFiles = 412,
+                    IncludedBytes = 123456,
+                    SkippedFiles = 3,
+                    SkippedByReason = new Dictionary<string, int> { ["size"] = 2, ["total"] = 1 },
+                    ProblemsByKind = new Dictionary<string, int> { ["copy"] = 1 },
+                },
+            };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: false);
+
+            rig.Build(cfg).Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Succeeded, SessionStage.Completed));
+
+            var uploaded = rig.DataOf("diagnostics_uploaded");
+            Assert.NotNull(uploaded);
+            Assert.Equal(true, uploaded!["truncated"]);
+            Assert.Equal(412, uploaded["includedFiles"]);
+            Assert.Equal(123456L, uploaded["includedBytes"]);
+            Assert.Equal(3, uploaded["skippedFiles"]);
+            var byReason = Assert.IsType<Dictionary<string, int>>(uploaded["skippedByReason"]);
+            Assert.Equal(2, byReason["size"]);
+            Assert.Equal(1, byReason["total"]);
+            var problems = Assert.IsType<Dictionary<string, int>>(uploaded["problemsByKind"]);
+            Assert.Equal(1, problems["copy"]);
+            // Counters only — no key or value carries a file path.
+            foreach (var kv in uploaded)
+                Assert.False(kv.Value is string s && (s.Contains("\\") || s.Contains("/")) && kv.Key != "sasUrlPrefix",
+                    $"payload key {kv.Key} looks like a path: {kv.Value}");
+        }
+
+        [Fact]
+        public void Handle_diagnostics_upload_failed_after_a_build_carries_the_counters_too()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Failed }.Build();
+            rig.DiagnosticsResult = new DiagnosticsUploadResult
+            {
+                ErrorCode = "upload_5xx",
+                Packaging = new DiagnosticsPackagingStats { IncludedFiles = 40, IncludedBytes = 1000 },
+            };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: false);
+
+            rig.Build(cfg).Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Failed, SessionStage.Failed));
+
+            var failed = rig.DataOf("diagnostics_upload_failed");
+            Assert.NotNull(failed);
+            Assert.Equal("upload_5xx", (string)failed!["errorCode"]);
+            Assert.Equal(false, failed["truncated"]);
+            Assert.Equal(40, failed["includedFiles"]);
+            Assert.Empty(Assert.IsType<Dictionary<string, int>>(failed["skippedByReason"]));
+        }
+
+        [Fact]
+        public void Handle_diagnostics_events_omit_the_counters_when_no_package_was_built()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Completed }.Build();
+            rig.DiagnosticsResult = new DiagnosticsUploadResult { BlobName = "diag-blob.zip" };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: false);
+
+            rig.Build(cfg).Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Succeeded, SessionStage.Completed));
+
+            var uploaded = rig.DataOf("diagnostics_uploaded");
+            Assert.NotNull(uploaded);
+            Assert.False(uploaded!.ContainsKey("truncated"));
+            Assert.False(uploaded.ContainsKey("skippedByReason"));
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderControlSignalsTests.cs

@@ -6,6 +6,7 @@ using System.Net.Http;
 using System.Threading;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderLoggingTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderTests.cs

@@ -7,6 +7,7 @@ using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Newtonsoft.Json.Linq;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetrySpoolTests.cs

@@ -4,6 +4,7 @@ using System.Text;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetryUploadOrchestratorTests.cs

@@ -4,6 +4,7 @@ using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetryWireContractTests.cs

@@ -0,0 +1,250 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Reflection;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Telemetry.Events;
+using AutopilotMonitor.Agent.V2.Core.Telemetry.Signals;
+using AutopilotMonitor.Agent.V2.Core.Telemetry.Transitions;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events;
+using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
+{
+    /// <summary>
+    /// The agent → backend wire contract of <c>POST /api/agent/telemetry</c>, proven from the
+    /// WRITER side. <see cref="TelemetryItemDto"/> (Shared) is the one class both ends serialise;
+    /// <see cref="TelemetryItem.ToWire"/> is the only mapping onto it.
+    /// <list type="bullet">
+    ///   <item>Round trip + reflection: every DTO property is populated by <c>ToWire()</c> and
+    ///   survives Newtonsoft defaults — a DTO field added without a mapping fails here.</item>
+    ///   <item>Frozen body: the real batch serialiser's output for one item per
+    ///   <see cref="TelemetryItemKind"/> is pinned under <c>tests/fixtures/telemetry-wire/</c>.
+    ///   The backend's <c>TelemetryWireFixtureTests</c> reads the same files and demands zero
+    ///   rejections, so a rename on either side breaks a test until both sides and the fixture
+    ///   agree. Regenerate with <c>AM_WRITE_WIRE_FIXTURES=1</c>.</item>
+    ///   <item>Poison body: the exact 422 shape the backend writes (pinned there by
+    ///   <c>TelemetryWireFixtureTests</c>) is parsed as an item-level poison signal here.</item>
+    /// </list>
+    /// </summary>
+    public sealed class TelemetryWireContractTests
+    {
+        private const string TenantId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+        private const string SessionId = "b2c3d4e5-f6a7-8901-bcde-f12345678901";
+        private const string FixtureFile = "agent-v2.json";
+
+        private static readonly DateTime At = new DateTime(2026, 4, 20, 10, 0, 0, DateTimeKind.Utc);
+
+        private static TelemetryItem FullyPopulatedItem() =>
+            new TelemetryItem(
+                kind: TelemetryItemKind.DecisionTransition,
+                partitionKey: $"{TenantId}_{SessionId}",
+                rowKey: "0000000007",
+                telemetryItemId: 42,
+                sessionTraceOrdinal: 7,
+                payloadJson: "{\"StepIndex\":7}",
+                requiresImmediateFlush: true,
+                enqueuedAtUtc: At,
+                retryCount: 3);
+
+        // ============================================================ ToWire mapping
+
+        [Fact]
+        public void ToWire_round_trips_every_property_through_Newtonsoft_defaults()
+        {
+            var item = FullyPopulatedItem();
+
+            var json = JsonConvert.SerializeObject(item.ToWire());
+            var dto = JsonConvert.DeserializeObject<TelemetryItemDto>(json)!;
+
+            Assert.Equal("DecisionTransition", dto.Kind);
+            Assert.Equal(item.PartitionKey, dto.PartitionKey);
+            Assert.Equal(item.RowKey, dto.RowKey);
+            Assert.Equal(item.TelemetryItemId, dto.TelemetryItemId);
+            Assert.Equal(item.SessionTraceOrdinal, dto.SessionTraceOrdinal);
+            Assert.Equal(item.PayloadJson, dto.PayloadJson);
+            Assert.Equal(item.RequiresImmediateFlush, dto.RequiresImmediateFlush);
+            Assert.Equal(item.EnqueuedAtUtc, dto.EnqueuedAtUtc);
+            Assert.Equal(DateTimeKind.Utc, dto.EnqueuedAtUtc.Kind);
+            Assert.Equal(item.RetryCount, dto.RetryCount);
+        }
+
+        [Fact]
+        public void ToWire_populates_every_TelemetryItemDto_property()
+        {
+            // A DTO property that ToWire() does not set keeps its default — this catches a field
+            // added to the wire type without a mapping (the backend would read the default forever).
+            var dto = FullyPopulatedItem().ToWire();
+
+            var unset = typeof(TelemetryItemDto)
+                .GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .Where(p => IsDefault(p.GetValue(dto), p.PropertyType))
+                .Select(p => p.Name)
+                .ToList();
+
+            Assert.True(unset.Count == 0,
+                "TelemetryItem.ToWire() leaves these TelemetryItemDto properties at their default: " + string.Join(", ", unset));
+        }
+
+        [Fact]
+        public void TelemetryItemDto_properties_mirror_TelemetryItem()
+        {
+            var itemProps = typeof(TelemetryItem).GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .ToDictionary(p => p.Name, p => p.PropertyType);
+
+            foreach (var dtoProp in typeof(TelemetryItemDto).GetProperties(BindingFlags.Public | BindingFlags.Instance))
+            {
+                Assert.True(itemProps.TryGetValue(dtoProp.Name, out var itemType),
+                    $"TelemetryItemDto.{dtoProp.Name} has no counterpart on TelemetryItem");
+                var expected = dtoProp.Name == nameof(TelemetryItemDto.Kind) ? typeof(TelemetryItemKind) : dtoProp.PropertyType;
+                Assert.True(itemType == expected,
+                    $"TelemetryItemDto.{dtoProp.Name} is {dtoProp.PropertyType.Name}, TelemetryItem.{dtoProp.Name} is {itemType.Name}");
+            }
+        }
+
+        [Fact]
+        public void Every_kind_serialises_by_name_on_the_wire_and_on_the_spool_line()
+        {
+            foreach (var kind in TelemetryItemKinds.All)
+            {
+                var item = new TelemetryItem(kind, "T_S", "rk", 1, 1, "{}", false, At);
+
+                var wire = JObject.Parse(JsonConvert.SerializeObject(item.ToWire()));
+                Assert.Equal(kind.ToString(), (string?)wire["Kind"]);
+
+                // The spool line (TelemetryItemSerializer) has always written the NAME too; the enum's
+                // move to Shared must not turn it into an ordinal (a crash-restart rehydrates it).
+                var spool = JObject.Parse(TelemetryItemSerializer.Serialize(item));
+                Assert.Equal(kind.ToString(), (string?)spool["Kind"]);
+                Assert.Equal(kind, TelemetryItemSerializer.Deserialize(spool.ToString(Formatting.None)).Kind);
+
+                Assert.True(TelemetryItemKinds.TryParse(kind.ToString(), out var parsed));
+                Assert.Equal(kind, parsed);
+            }
+        }
+
+        // ============================================================ Frozen wire body
+
+        [Fact]
+        public void Frozen_wire_body_matches_the_current_serializer()
+        {
+            var items = OneItemPerKind();
+            Assert.Equal(TelemetryItemKinds.All.OrderBy(k => k), items.Select(i => i.Kind).Distinct().OrderBy(k => k));
+
+            var body = BackendTelemetryUploader.SerializeBatch(items);
+            var path = Path.Combine(RepoPaths.Fixtures("telemetry-wire"), FixtureFile);
+
+            if (Environment.GetEnvironmentVariable("AM_WRITE_WIRE_FIXTURES") == "1")
+            {
+                Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+                File.WriteAllText(path, body + "\n", new UTF8Encoding(false));
+            }
+
+            Assert.True(File.Exists(path), "Missing wire fixture " + path + " — run this test with AM_WRITE_WIRE_FIXTURES=1 to create it.");
+            var frozen = File.ReadAllText(path).TrimEnd('\r', '\n');
+            Assert.True(string.Equals(frozen, body, StringComparison.Ordinal),
+                "The agent's telemetry wire body changed. If the change is intended, update the backend ingest " +
+                "(TelemetryWireFixtureTests must still dispatch every frozen body) and regenerate with " +
+                "AM_WRITE_WIRE_FIXTURES=1.\nExpected: " + frozen + "\nActual:   " + body);
+        }
+
+        /// <summary>
+        /// One item per kind through the REAL emitters (payload shapes are theirs, not hand-typed),
+        /// re-based onto fixed transport fields so the body is byte-stable.
+        /// </summary>
+        private static IReadOnlyList<TelemetryItem> OneItemPerKind()
+        {
+            using var tmp = new TempDirectory();
+            var transport = new FakeTelemetryTransport();
+            var counter = new EventSequenceCounter(new EventSequencePersistence(tmp.File("seq.json")));
+
+            new TelemetryEventEmitter(transport, counter, SessionId, TenantId).Emit(new EnrollmentEvent
+            {
+                EventId = "00000000-0000-4000-8000-000000000001",
+                EventType = Constants.EventTypes.AgentStarted,
+                Severity = EventSeverity.Info,
+                Source = "Agent",
+                Timestamp = At,
+                Phase = EnrollmentPhase.Unknown,
+                Message = "Agent started",
+                Data = new Dictionary<string, object> { ["agentVersion"] = "2.0.0" },
+            });
+
+            new TelemetrySignalEmitter(transport, SessionId, TenantId).Emit(new DecisionSignal(
+                sessionSignalOrdinal: 1,
+                sessionTraceOrdinal: 1,
+                kind: DecisionSignalKind.SessionStarted,
+                kindSchemaVersion: 1,
+                occurredAtUtc: At,
+                sourceOrigin: "Fixture",
+                evidence: new Evidence(EvidenceKind.Raw, "raw-1", "session start")));
+
+            new TelemetryTransitionEmitter(transport, SessionId, TenantId).Emit(new DecisionTransition(
+                stepIndex: 1,
+                sessionTraceOrdinal: 2,
+                signalOrdinalRef: 1,
+                occurredAtUtc: At,
+                trigger: "SessionStarted",
+                fromStage: SessionStage.Unknown,
+                toStage: SessionStage.AwaitingEspPhaseChange,
+                taken: true,
+                deadEndReason: null,
+                reducerVersion: "1.0.0"));
+
+            return transport.Enqueued
+                .Select(e => new TelemetryItem(e.Kind, e.PartitionKey, e.RowKey, e.TelemetryItemId, e.SessionTraceOrdinal,
+                    e.PayloadJson, e.RequiresImmediateFlush, At))
+                .ToList();
+        }
+
+        // ============================================================ Poison body
+
+        /// <summary>
+        /// The exact 422 body the backend writes for rejected items (pinned byte-for-byte in the
+        /// backend's TelemetryWireFixtureTests). camelCase because the backend serialises with
+        /// its wire options; the agent's parser accepts both casings.
+        /// </summary>
+        internal const string BackendPoisonBody =
+            "{\"error\":\"2 of 3 telemetry item(s) cannot be ingested (unknown Kind or unusable payload); they were not stored.\"," +
+            "\"code\":\"TelemetryItemsRejected\",\"correlationId\":\"cid-1\",\"poison\":true,\"rejectedRowKeys\":[\"rk-1\",\"rk-3\"]," +
+            "\"reason\":\"unknown_kind=1;unparseable=1\",\"received\":3,\"rejected\":2}";
+
+        [Fact]
+        public async Task Backend_422_poison_body_is_parsed_as_item_level_poison()
+        {
+            using var handler = new RecordingHttpMessageHandler().QueueStatus((HttpStatusCode)422, BackendPoisonBody);
+            using var http = new HttpClient(handler);
+            var sut = new BackendTelemetryUploader(http, baseUrl: "https://backend.example.invalid", tenantId: TenantId, agentVersion: "2.0.0");
+
+            var result = await sut.UploadBatchAsync(new[] { FullyPopulatedItem() }, CancellationToken.None);
+
+            Assert.False(result.Success);
+            Assert.True(result.IsPoison);
+            Assert.Equal(new[] { "rk-1", "rk-3" }, result.PoisonRowKeys);
+            Assert.Equal("unknown_kind=1;unparseable=1", result.ErrorReason);
+        }
+
+        private static bool IsDefault(object? value, Type type)
+        {
+            if (value == null) return true;
+            if (type == typeof(string)) return ((string)value).Length == 0;
+            var underlying = Nullable.GetUnderlyingType(type) ?? type;
+            return underlying.IsValueType && value.Equals(Activator.CreateInstance(underlying));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/AppPackageState.cs

@@ -99,6 +99,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // Installer result codes (captured from lpExitCode / hResultFromWin32 log lines)
         public string ExitCode { get; private set; }
         public string HResultFromWin32 { get; private set; }
+        /// <summary>
+        /// Admin-defined return-code class of the last installer exit code: Success, SoftReboot,
+        /// HardReboot, Retry or Failed (IME's AppReturnCodeType, captured from the
+        /// "lpExitCode is defined as X" line by IME-EXITCODE-CLASS). Last value wins, so a Retry
+        /// loop that ends in Success reports Success.
+        /// </summary>
+        public string ExitCodeClass { get; private set; }
 
         // App metadata (captured from IME log patterns — used by App Dashboard / reports)
         /// <summary>Product version detected after install (e.g. "11.2.1787.0"). From ReportingManager DetectedIdentityVersion.</summary>
@@ -167,6 +174,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             int? progressPercent, long bytesDownloaded, long bytesTotal,
             string errorPatternId = null, string errorDetail = null, string errorCode = null,
             string exitCode = null, string hresultFromWin32 = null,
+            string exitCodeClass = null,
             long doFileSize = 0, long doTotalBytesDownloaded = 0,
             long doBytesFromPeers = 0, int doPercentPeerCaching = 0,
             long doBytesFromLanPeers = 0, long doBytesFromGroupPeers = 0,
@@ -195,6 +203,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 ErrorCode = errorCode,
                 ExitCode = exitCode,
                 HResultFromWin32 = hresultFromWin32,
+                ExitCodeClass = exitCodeClass,
                 InstallationStateLastChangedTicks = Stopwatch.GetTimestamp(),
                 DoFileSize = doFileSize,
                 DoTotalBytesDownloaded = doTotalBytesDownloaded,
@@ -302,6 +311,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             HResultFromWin32 = code;
         }
 
+        /// <summary>
+        /// Captures the return-code class (Success/SoftReboot/HardReboot/Retry/Failed) IME assigned
+        /// to the last exit code. Last value wins; empty values are ignored.
+        /// </summary>
+        public bool UpdateExitCodeClass(string exitCodeClass)
+        {
+            if (string.IsNullOrWhiteSpace(exitCodeClass)) return false;
+            var trimmed = exitCodeClass.Trim();
+            if (ExitCodeClass == trimmed) return false;
+            ExitCodeClass = trimmed;
+            return true;
+        }
+
         /// <summary>
         /// Updates the product version detected for this app (e.g. "11.2.1787.0").
         /// Only applies non-empty values so a later detection without version cannot wipe it.
@@ -547,6 +569,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 data["exitCode"] = ExitCode;
             if (!string.IsNullOrEmpty(HResultFromWin32))
                 data["hresultFromWin32"] = HResultFromWin32;
+            if (!string.IsNullOrEmpty(ExitCodeClass))
+                data["exitCodeClass"] = ExitCodeClass;
 
             // App metadata fields (emitted whenever available so ingest can merge them).
             if (!string.IsNullOrEmpty(AppVersion))

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/BoundedLineReader.cs

@@ -33,6 +33,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
         private readonly Stream _stream;
         private readonly int _maxLineBytes;
+        private readonly bool _hashLines;
         private readonly byte[] _readBuffer = new byte[ReadBufferSize];
         private int _readPos;
         private int _readLen;
@@ -41,21 +42,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
         private byte[] _line = new byte[4096];
         private int _lineLen;
+        private ulong _lineHash;
 
         /// <param name="stream">Seekable stream positioned at the first byte to read.</param>
         /// <param name="maxLineBytes">Upper bound of bytes kept per line; the remainder is discarded.</param>
-        public BoundedLineReader(Stream stream, int maxLineBytes)
+        /// <param name="hashLines">Fingerprint the raw bytes of every line (<see cref="LastLineHash"/>) — the
+        /// tracker's byte ledger needs it for multi-writer files only.</param>
+        public BoundedLineReader(Stream stream, int maxLineBytes, bool hashLines = false)
         {
             if (stream == null) throw new ArgumentNullException(nameof(stream));
             if (maxLineBytes <= 0) throw new ArgumentOutOfRangeException(nameof(maxLineBytes));
             _stream = stream;
             _maxLineBytes = maxLineBytes;
+            _hashLines = hashLines;
             _readBufferFileOffset = stream.Position;
         }
 
         /// <summary>Cap in bytes applied to every line.</summary>
         public int MaxLineBytes => _maxLineBytes;
 
+        /// <summary>
+        /// FNV-1a 64 over the bytes the most recently returned line was decoded from (BOM and
+        /// line terminator excluded; the capped prefix of a truncated line). Zero unless the
+        /// reader was created with hashing on.
+        /// </summary>
+        public ulong LastLineHash => _lineHash;
+
         /// <summary>Absolute file offset of the next unread byte (exact — no decoder read-ahead).</summary>
         public long Position => _readBufferFileOffset + _readPos;
 
@@ -78,6 +90,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             LastLineTerminated = false;
             LastLineTruncated = false;
             _lineLen = 0;
+            _lineHash = _hashLines ? Fnv1a64.OffsetBasis : 0UL;
             var sawAnyByte = false;
 
             while (true)
@@ -154,6 +167,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             // tail (and thus any CR) discarded, so the check is skipped there.
             if (LastLineTerminated && !LastLineTruncated && len > 0 && _line[start + len - 1] == (byte)'\r')
                 len--;
+            if (_hashLines)
+            {
+                // Fingerprint exactly the bytes the string is decoded from, so a tail that was
+                // first read unterminated and later gained its CRLF hashes the same.
+                var h = Fnv1a64.OffsetBasis;
+                var end = start + len;
+                for (var i = start; i < end; i++)
+                    h = (h ^ _line[i]) * Fnv1a64.Prime;
+                _lineHash = h;
+            }
             return len == 0 ? string.Empty : Encoding.UTF8.GetString(_line, start, len);
         }
     }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/CmTraceEntryAssembler.cs

@@ -0,0 +1,171 @@
+using System.Text;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>FNV-1a 64-bit — the entry fingerprint used by the tracker's byte ledger.</summary>
+    internal static class Fnv1a64
+    {
+        public const ulong OffsetBasis = 14695981039346656037UL;
+        public const ulong Prime = 1099511628211UL;
+
+        public static ulong Fold(ulong hash, ulong value) => (hash ^ value) * Prime;
+    }
+
+    /// <summary>One assembled CMTrace entry: its byte range in the file, the fingerprint of those bytes and the text.</summary>
+    internal struct AssembledEntry
+    {
+        public long Offset;
+        public int Length;
+        public ulong Hash;
+        public string Text;
+    }
+
+    /// <summary>
+    /// Turns physical lines into CMTrace entries: a line is one entry, unless it opens
+    /// <c>&lt;![LOG[</c> without its <c>]LOG]!&gt;</c> close — then the continuation lines up to the
+    /// closing one belong to it. Oversized lines and capped entries are dropped together with
+    /// their remaining continuation lines, so no fragment is ever matched as an entry.
+    /// <para>
+    /// The read loop and the ledger verification (<c>ImeLogTracker.Overwrite.cs</c>) both feed
+    /// this class, which is what makes their entry boundaries — and therefore the fingerprints
+    /// they compare — identical by construction.
+    /// </para>
+    /// </summary>
+    internal sealed class CmTraceEntryAssembler
+    {
+        public enum Outcome
+        {
+            /// <summary>The line was absorbed into an open multiline entry.</summary>
+            Buffered,
+            /// <summary>An entry is complete.</summary>
+            Entry,
+            /// <summary>A line over the byte cap was dropped (its entry with it).</summary>
+            OversizedDropped,
+            /// <summary>An open multiline entry hit the line/char cap and was dropped.</summary>
+            CapDropped,
+            /// <summary>A continuation line of a dropped entry was skipped.</summary>
+            Skipped,
+        }
+
+        private const string LogOpen = "<![LOG[";
+        private const string LogClose = "]LOG]!>";
+
+        private readonly int _maxLines;
+        private readonly int _maxChars;
+
+        private StringBuilder _buffer;
+        private int _lineCount;
+        private long _entryStart;
+        private ulong _entryHash;
+        private bool _skippingDroppedEntry;
+
+        public CmTraceEntryAssembler(int maxMultiLineBufferLines, int maxEntryBytes)
+        {
+            _maxLines = maxMultiLineBufferLines;
+            _maxChars = maxEntryBytes;
+        }
+
+        /// <summary>True while a multiline entry is being assembled.</summary>
+        public bool HasOpenEntry => _buffer != null;
+
+        /// <summary>File offset of the open multiline entry (valid while <see cref="HasOpenEntry"/>).</summary>
+        public long OpenEntryStart => _entryStart;
+
+        /// <summary>Line count of the entry dropped by the last <see cref="Outcome.CapDropped"/>.</summary>
+        public int DroppedLines { get; private set; }
+
+        /// <summary>Char count of the entry dropped by the last <see cref="Outcome.CapDropped"/>.</summary>
+        public int DroppedChars { get; private set; }
+
+        /// <summary>
+        /// Feeds one physical line. <paramref name="lineStart"/> / <paramref name="positionAfter"/>
+        /// are the line's file offsets (start, next unread byte), <paramref name="lineHash"/> the
+        /// reader's raw-byte fingerprint of the line.
+        /// </summary>
+        public Outcome Feed(string line, long lineStart, long positionAfter, bool truncated, ulong lineHash, out AssembledEntry entry)
+        {
+            entry = default(AssembledEntry);
+
+            if (truncated)
+            {
+                // The capped prefix only tells whether the line opened an entry whose remaining
+                // lines must be skipped rather than matched as raw text.
+                if (_buffer != null)
+                {
+                    _buffer = null;
+                    _lineCount = 0;
+                    _skippingDroppedEntry = true;
+                }
+                else if (line.StartsWith(LogOpen) && !line.Contains(LogClose))
+                {
+                    _skippingDroppedEntry = true;
+                }
+                return Outcome.OversizedDropped;
+            }
+
+            if (_skippingDroppedEntry)
+            {
+                // A line opening a new entry ends the skip and is processed itself — checked
+                // BEFORE the close-tag test, because a complete single-line entry contains both.
+                if (line.StartsWith(LogOpen))
+                    _skippingDroppedEntry = false;
+                else
+                {
+                    if (line.Contains(LogClose)) _skippingDroppedEntry = false;
+                    return Outcome.Skipped;
+                }
+            }
+
+            if (_buffer != null)
+            {
+                _buffer.Append('\n').Append(line);
+                _lineCount++;
+                _entryHash = Fnv1a64.Fold(_entryHash, lineHash);
+
+                if (line.Contains(LogClose))
+                {
+                    entry = new AssembledEntry
+                    {
+                        Offset = _entryStart,
+                        Length = (int)(positionAfter - _entryStart),
+                        Hash = _entryHash,
+                        Text = _buffer.ToString(),
+                    };
+                    _buffer = null;
+                    _lineCount = 0;
+                    return Outcome.Entry;
+                }
+
+                if (_lineCount >= _maxLines || _buffer.Length >= _maxChars)
+                {
+                    DroppedLines = _lineCount;
+                    DroppedChars = _buffer.Length;
+                    _buffer = null;
+                    _lineCount = 0;
+                    _skippingDroppedEntry = true;
+                    return Outcome.CapDropped;
+                }
+
+                return Outcome.Buffered;
+            }
+
+            if (line.StartsWith(LogOpen) && !line.Contains(LogClose))
+            {
+                _buffer = new StringBuilder(line);
+                _lineCount = 1;
+                _entryStart = lineStart;
+                _entryHash = lineHash;
+                return Outcome.Buffered;
+            }
+
+            entry = new AssembledEntry
+            {
+                Offset = lineStart,
+                Length = (int)(positionAfter - lineStart),
+                Hash = lineHash,
+                Text = line,
+            };
+            return Outcome.Entry;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/CmTraceEraTable.cs

@@ -0,0 +1,157 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>
+    /// A writer era: the stretch of log written by ONE process lifetime, i.e. under one
+    /// timezone belief. For the IME service family (IntuneManagementExtension*.log) an era
+    /// starts at an "EMS Agent Started" entry and may continue across a log rotation into the
+    /// next file; for AgentExecutor.log every script execution is its own short-lived process
+    /// and therefore its own era. An era carries an offset only when an anchor inside it was
+    /// matched against an instant the agent knows in UTC (<see cref="ImeLogEraPreScan"/>).
+    /// </summary>
+    internal sealed class CmTraceEra
+    {
+        /// <summary>File segments (file name → [start, end) byte range) that belong to this era, in write order.</summary>
+        public List<CmTraceEraSegment> Segments { get; } = new List<CmTraceEraSegment>();
+
+        /// <summary>Local time of the era's first entry as written (null for a leading era whose start predates the scanned region).</summary>
+        public DateTime? StartLocal { get; set; }
+
+        /// <summary>Local time of the next era's first entry (null for the last era).</summary>
+        public DateTime? EndLocal { get; set; }
+
+        /// <summary>The writer's UTC offset (local = UTC + offset) when anchored.</summary>
+        public TimeSpan? Offset { get; set; }
+
+        /// <summary>What established <see cref="Offset"/> ("bootstrap-policy-result", "bootstrap-stdout", …).</summary>
+        public string? AnchorKind { get; set; }
+
+        public bool IsAnchored => Offset.HasValue;
+    }
+
+    internal sealed class CmTraceEraSegment
+    {
+        public CmTraceEraSegment(string fileName, long startOffset, long endOffset)
+        {
+            FileName = fileName;
+            StartOffset = startOffset;
+            EndOffset = endOffset;
+        }
+
+        public string FileName { get; }
+        public long StartOffset { get; }
+        /// <summary><c>long.MaxValue</c> while the era is still open in this file.</summary>
+        public long EndOffset { get; set; }
+
+        public bool Contains(string fileName, long offset) =>
+            string.Equals(FileName, fileName, StringComparison.OrdinalIgnoreCase)
+            && offset >= StartOffset && offset < EndOffset;
+    }
+
+    /// <summary>
+    /// Era lookup for backlog lines (2026-09-04, session a7140f98). Two lookups:
+    /// <list type="bullet">
+    /// <item><description><see cref="TryResolveByOffset"/> — the line's own file and byte offset
+    ///   (IME service family and AgentExecutor.log: eras are byte ranges).</description></item>
+    /// <item><description><see cref="TryResolveByLocalTime"/> — transfer for files written by the
+    ///   SAME process as the IME service log but without their own era marker (AppWorkload.log,
+    ///   AppActionProcessor.log: plugins hosted in IntuneManagementExtension.exe, verified in the
+    ///   decompiled build). Within one process every file shares the zone belief, so a local
+    ///   timestamp places the line in the service era whose local range contains it. Disabled
+    ///   entirely when the service eras' local ranges are not monotonic (a westward zone change
+    ///   between two service starts makes the ranges overlap) — ambiguity must never anchor.</description></item>
+    /// </list>
+    /// Everything not resolvable here stays on the marked reader-zone fallback; a partially
+    /// corrected era is never produced because an anchor applies to a whole era or not at all.
+    /// </summary>
+    internal sealed class CmTraceEraTable
+    {
+        private readonly List<CmTraceEra> _offsetEras = new List<CmTraceEra>();
+        private readonly List<CmTraceEra> _serviceEras = new List<CmTraceEra>();
+        private bool _transferAmbiguous;
+
+        public IReadOnlyList<CmTraceEra> ServiceEras => _serviceEras;
+        public bool TransferAmbiguous => _transferAmbiguous;
+        public int AnchoredEraCount
+        {
+            get
+            {
+                var n = 0;
+                foreach (var e in _offsetEras) if (e.IsAnchored) n++;
+                return n;
+            }
+        }
+
+        /// <summary>Register an era addressable by (file, offset). Service eras also take part in the local-time transfer.</summary>
+        public void Add(CmTraceEra era, bool isServiceEra)
+        {
+            _offsetEras.Add(era);
+            if (isServiceEra) _serviceEras.Add(era);
+        }
+
+        /// <summary>Call once after all service eras are added: validates the local ranges used by the transfer.</summary>
+        public void Seal()
+        {
+            _transferAmbiguous = false;
+            DateTime? previousStart = null;
+            foreach (var era in _serviceEras)
+            {
+                if (!era.StartLocal.HasValue) continue;
+                if (previousStart.HasValue && era.StartLocal.Value <= previousStart.Value)
+                {
+                    _transferAmbiguous = true;
+                    break;
+                }
+                previousStart = era.StartLocal;
+            }
+        }
+
+        public bool TryResolveByOffset(string fileName, long offset, out TimeSpan writerOffset, out string anchorKind)
+        {
+            writerOffset = TimeSpan.Zero;
+            anchorKind = string.Empty;
+            if (string.IsNullOrEmpty(fileName) || offset < 0) return false;
+
+            foreach (var era in _offsetEras)
+            {
+                if (!era.IsAnchored) continue;
+                foreach (var seg in era.Segments)
+                {
+                    if (seg.Contains(fileName, offset))
+                    {
+                        writerOffset = era.Offset!.Value;
+                        anchorKind = era.AnchorKind ?? string.Empty;
+                        return true;
+                    }
+                }
+            }
+            return false;
+        }
+
+        public bool TryResolveByLocalTime(DateTime localTimestamp, out TimeSpan writerOffset, out string anchorKind)
+        {
+            writerOffset = TimeSpan.Zero;
+            anchorKind = string.Empty;
+            if (_transferAmbiguous) return false;
+
+            var local = DateTime.SpecifyKind(localTimestamp, DateTimeKind.Unspecified);
+            foreach (var era in _serviceEras)
+            {
+                if (!era.IsAnchored) continue;
+                // A leading era with unknown start covers everything before its end.
+                var afterStart = !era.StartLocal.HasValue || local >= era.StartLocal.Value;
+                var beforeEnd = !era.EndLocal.HasValue || local < era.EndLocal.Value;
+                if (afterStart && beforeEnd)
+                {
+                    writerOffset = era.Offset!.Value;
+                    anchorKind = era.AnchorKind + "/service-era-transfer";
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/CmTraceOffsetCalibrator.cs

@@ -27,6 +27,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <see cref="CmTraceOffsetCalibrator.TryMeasureOffset"/>.
         /// </summary>
         LineAnchored = 3,
+
+        /// <summary>
+        /// A backlog line resolved through its writer ERA: the stretch of log written by one
+        /// process lifetime, anchored by an entry inside that era whose UTC instant the agent
+        /// knows exactly (the install marker vs. the IME's own record of the bootstrap script's
+        /// result — a few hundred milliseconds apart). An anchor applies to a whole era or not
+        /// at all, never across an "EMS Agent Started" boundary. See <c>ImeLogEraPreScan</c>
+        /// (2026-09-04, session a7140f98).
+        /// </summary>
+        EraAnchored = 4,
     }
 
     /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogEraPreScan.cs

@@ -0,0 +1,316 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Text;
+using System.Text.RegularExpressions;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Shared.Logging;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>
+    /// Builds the <see cref="CmTraceEraTable"/> for the backlog the tracker is about to read
+    /// (2026-09-04, session a7140f98: the IME service wrote the whole device-ESP era under the
+    /// OOBE default zone, Windows moved the zone before the agent started, and the restart
+    /// replay put every pre-reboot line three hours early — a 20-minute DeviceSetup became a
+    /// "blocking app timeout").
+    /// <para>
+    /// Backlog lines can never self-anchor (their age would round onto the offset grid), so an
+    /// era needs an entry whose UTC instant is known independently. The one such entry every
+    /// platform-script bootstrap leaves behind is the bootstrap script's own execution: the
+    /// install marker (<c>HKLM\SOFTWARE\AutopilotMonitor\Deployed</c>, UTC) is written
+    /// milliseconds before the script exits, and the IME logs that exit twice — AgentExecutor.log
+    /// records the script's stdout ("Bootstrap Completed Successfully"), and the service log
+    /// records "[PowerShell] … Policy id = &lt;bootstrap&gt;, policy result = …". Field measurement
+    /// (4 sessions, 2026-09-04): 0.13–0.28 s between marker and stdout record, 0.02–0.08 s more to
+    /// the service record — against a 15-minute grid with a 2-minute residual guard.
+    /// </para>
+    /// <para>
+    /// Rules that keep this sound: only the FIRST bootstrap record of each file is offered (a
+    /// SKIP re-run minutes later could round onto the grid); the residual guard is
+    /// <see cref="CmTraceOffsetCalibrator.TryMeasureOffset"/>; an anchor applies to the whole
+    /// era between two "EMS Agent Started" entries (service) or one script execution
+    /// (AgentExecutor) and never beyond; nothing is anchored without a marker (MSI bootstrap,
+    /// replay tooling). Everything else stays on the marked reader-zone fallback.
+    /// </para>
+    /// </summary>
+    internal static class ImeLogEraPreScan
+    {
+        internal const string AnchorKindBootstrapStdout = "bootstrap-stdout";
+        internal const string AnchorKindBootstrapPolicyResult = "bootstrap-policy-result";
+
+        private const string ServiceStartedPrefix = "EMS Agent Started";
+        private const string ExecutorScriptStartPrefix = "Adding argument powershell with value ";
+        private const string ExecutorOutputPrefix = "write output done.";
+        private const string BootstrapInstallRunMarker = "Bootstrap Completed Successfully";
+        private const string BootstrapInstallRunMarkerAlt = "Agent install mode completed successfully";
+
+        private static readonly Regex ExecutorScriptPolicyId = new Regex(
+            @"Policies\\Scripts\\[a-z0-9\-]+_(?<id>[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\.ps1",
+            RegexOptions.Compiled | RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
+
+        private static readonly Regex ServicePolicyResult = new Regex(
+            @"^\[PowerShell\] User Id = [a-f0-9\-]+, Policy id = (?<id>[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}), policy result = ",
+            RegexOptions.Compiled | RegexOptions.IgnoreCase, TimeSpan.FromSeconds(1));
+
+        private const int MaxEntryLines = 100;
+
+        public sealed class ScanInput
+        {
+            public ScanInput(string filePath, long startOffset)
+            {
+                FilePath = filePath;
+                StartOffset = startOffset;
+            }
+
+            public string FilePath { get; }
+            public long StartOffset { get; }
+        }
+
+        public static bool IsServiceLogFile(string fileName) =>
+            fileName.StartsWith("IntuneManagementExtension", StringComparison.OrdinalIgnoreCase)
+            || fileName.StartsWith("_IntuneManagementExtension", StringComparison.OrdinalIgnoreCase);
+
+        public static bool IsExecutorLogFile(string fileName) =>
+            fileName.StartsWith("AgentExecutor", StringComparison.OrdinalIgnoreCase);
+
+        /// <summary>Files written in-process by the IME service without an era marker of their own (transfer by local time).</summary>
+        public static bool IsServiceHostedFile(string fileName) =>
+            fileName.StartsWith("AppWorkload", StringComparison.OrdinalIgnoreCase)
+            || fileName.StartsWith("AppActionProcessor", StringComparison.OrdinalIgnoreCase);
+
+        /// <summary>
+        /// Scan the given files (sort order = write order; archived before current) from their
+        /// start offsets to EOF and return the era table. Never throws; a file that cannot be
+        /// read contributes no eras.
+        /// </summary>
+        public static CmTraceEraTable Build(
+            IReadOnlyList<ScanInput> files,
+            DateTime? deployedUtc,
+            int maxEntryBytes,
+            AgentLogger? logger)
+        {
+            var table = new CmTraceEraTable();
+            if (!deployedUtc.HasValue)
+            {
+                logger?.Info("ImeLogEraPreScan: no Deployed marker — backlog eras stay on the reader-zone fallback");
+                return table;
+            }
+
+            string? bootstrapPolicyId = null;
+
+            // AgentExecutor first: it is where the bootstrap policy id becomes known.
+            foreach (var input in files)
+            {
+                if (!IsExecutorLogFile(Path.GetFileName(input.FilePath))) continue;
+                try { ScanExecutorFile(input, deployedUtc.Value, maxEntryBytes, table, ref bootstrapPolicyId, logger); }
+                catch (Exception ex) { logger?.Debug($"ImeLogEraPreScan: {Path.GetFileName(input.FilePath)} skipped: {ex.Message}"); }
+            }
+
+            var serviceFiles = new List<ScanInput>();
+            foreach (var input in files)
+                if (IsServiceLogFile(Path.GetFileName(input.FilePath))) serviceFiles.Add(input);
+
+            try { ScanServiceFiles(serviceFiles, deployedUtc.Value, maxEntryBytes, table, bootstrapPolicyId, logger); }
+            catch (Exception ex) { logger?.Debug($"ImeLogEraPreScan: service scan aborted: {ex.Message}"); }
+
+            table.Seal();
+
+            logger?.Info(
+                $"ImeLogEraPreScan: {table.AnchoredEraCount} anchored era(s), {table.ServiceEras.Count} service era(s), " +
+                $"bootstrapPolicyId={(bootstrapPolicyId ?? "(unknown)")}, transfer={(table.TransferAmbiguous ? "ambiguous-disabled" : "enabled")}");
+            return table;
+        }
+
+        private static void ScanExecutorFile(
+            ScanInput input, DateTime deployedUtc, int maxEntryBytes, CmTraceEraTable table,
+            ref string? bootstrapPolicyId, AgentLogger? logger)
+        {
+            var fileName = Path.GetFileName(input.FilePath);
+            CmTraceEra? current = null;
+            string? currentPolicyId = null;
+            var anchored = false;
+
+            foreach (var e in ReadEntries(input, maxEntryBytes))
+            {
+                if (e.Message.StartsWith(ExecutorScriptStartPrefix, StringComparison.Ordinal))
+                {
+                    if (current != null) current.Segments[0].EndOffset = e.Offset;
+                    current = new CmTraceEra();
+                    current.Segments.Add(new CmTraceEraSegment(fileName, e.Offset, long.MaxValue));
+                    current.StartLocal = e.HasTimestamp ? e.LocalTimestamp : (DateTime?)null;
+                    table.Add(current, isServiceEra: false);
+                    var m = ExecutorScriptPolicyId.Match(e.Message);
+                    currentPolicyId = m.Success ? m.Groups["id"].Value : null;
+                    continue;
+                }
+
+                if (anchored || current == null || !e.HasTimestamp) continue;
+                if (!e.Message.StartsWith(ExecutorOutputPrefix, StringComparison.Ordinal)) continue;
+                if (e.Message.IndexOf(BootstrapInstallRunMarker, StringComparison.OrdinalIgnoreCase) < 0
+                    && e.Message.IndexOf(BootstrapInstallRunMarkerAlt, StringComparison.OrdinalIgnoreCase) < 0)
+                    continue;
+
+                // First bootstrap install record of this file, offered once — accepted or not.
+                anchored = true;
+                if (CmTraceOffsetCalibrator.TryMeasureOffset(e.LocalTimestamp, deployedUtc, out var offset))
+                {
+                    current.Offset = offset;
+                    current.AnchorKind = AnchorKindBootstrapStdout;
+                    if (bootstrapPolicyId == null) bootstrapPolicyId = currentPolicyId;
+                    logger?.Info($"ImeLogEraPreScan: {fileName} bootstrap execution anchored at {offset} (stdout local={e.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fff}, policy={currentPolicyId ?? "?"})");
+                }
+                else
+                {
+                    logger?.Info($"ImeLogEraPreScan: {fileName} bootstrap stdout record rejected by the residual guard (local={e.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fff}, deployed={deployedUtc:HH:mm:ss}Z)");
+                    if (bootstrapPolicyId == null) bootstrapPolicyId = currentPolicyId;
+                }
+            }
+        }
+
+        private static void ScanServiceFiles(
+            IReadOnlyList<ScanInput> files, DateTime deployedUtc, int maxEntryBytes, CmTraceEraTable table,
+            string? bootstrapPolicyId, AgentLogger? logger)
+        {
+            if (files.Count == 0) return;
+
+            // The leading era: whatever process was writing when the scanned region begins.
+            var current = new CmTraceEra();
+            table.Add(current, isServiceEra: true);
+            var resultOffered = false;
+
+            foreach (var input in files)
+            {
+                var fileName = Path.GetFileName(input.FilePath);
+                var segment = new CmTraceEraSegment(fileName, input.StartOffset, long.MaxValue);
+                current.Segments.Add(segment);
+
+                foreach (var e in ReadEntries(input, maxEntryBytes))
+                {
+                    if (e.Message.StartsWith(ServiceStartedPrefix, StringComparison.Ordinal))
+                    {
+                        segment.EndOffset = e.Offset;
+                        var next = new CmTraceEra { StartLocal = e.HasTimestamp ? e.LocalTimestamp : (DateTime?)null };
+                        current.EndLocal = next.StartLocal;
+                        segment = new CmTraceEraSegment(fileName, e.Offset, long.MaxValue);
+                        next.Segments.Add(segment);
+                        table.Add(next, isServiceEra: true);
+                        current = next;
+                        continue;
+                    }
+
+                    if (resultOffered || bootstrapPolicyId == null || !e.HasTimestamp) continue;
+                    if (!e.Message.StartsWith("[PowerShell] User Id = ", StringComparison.Ordinal)) continue;
+                    var m = ServicePolicyResult.Match(e.Message);
+                    if (!m.Success || !string.Equals(m.Groups["id"].Value, bootstrapPolicyId, StringComparison.OrdinalIgnoreCase)) continue;
+
+                    // First result record for the bootstrap policy, offered once.
+                    resultOffered = true;
+                    if (CmTraceOffsetCalibrator.TryMeasureOffset(e.LocalTimestamp, deployedUtc, out var offset))
+                    {
+                        current.Offset = offset;
+                        current.AnchorKind = AnchorKindBootstrapPolicyResult;
+                        logger?.Info($"ImeLogEraPreScan: {fileName} service era anchored at {offset} (policy result local={e.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fff})");
+                    }
+                    else
+                    {
+                        logger?.Info($"ImeLogEraPreScan: {fileName} bootstrap policy result rejected by the residual guard (local={e.LocalTimestamp:yyyy-MM-ddTHH:mm:ss.fff}, deployed={deployedUtc:HH:mm:ss}Z)");
+                    }
+                }
+
+                // The era continues into the next (newer) file: close this file's segment at EOF.
+                try { segment.EndOffset = new FileInfo(input.FilePath).Length; } catch { segment.EndOffset = long.MaxValue; }
+            }
+
+            // The last era stays open in its last file.
+            var last = current.Segments[current.Segments.Count - 1];
+            last.EndOffset = long.MaxValue;
+        }
+
+        private sealed class ScannedEntry
+        {
+            public long Offset;
+            public bool HasTimestamp;
+            public DateTime LocalTimestamp;
+            public string Message = string.Empty;
+        }
+
+        /// <summary>
+        /// Enumerate CMTrace entries with their file offsets. Same multiline assembly as the
+        /// tracker's read loop (an AgentExecutor stdout record spans many lines; the closing tag
+        /// carries the time); oversized or over-long entries are dropped, never partially used.
+        /// </summary>
+        private static IEnumerable<ScannedEntry> ReadEntries(ScanInput input, int maxEntryBytes)
+        {
+            using (var stream = new FileStream(input.FilePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+            {
+                if (input.StartOffset > 0 && input.StartOffset < stream.Length)
+                    stream.Seek(input.StartOffset, SeekOrigin.Begin);
+                else if (input.StartOffset >= stream.Length)
+                    yield break;
+
+                var reader = new BoundedLineReader(stream, maxEntryBytes);
+                StringBuilder? buffer = null;
+                var bufferLines = 0;
+                long entryStart = input.StartOffset;
+                var skipping = false;
+
+                while (true)
+                {
+                    var line = reader.ReadLineAsync(System.Threading.CancellationToken.None).GetAwaiter().GetResult();
+                    if (line == null) yield break;
+                    if (buffer == null) entryStart = reader.LastLineStart;
+
+                    if (reader.LastLineTruncated)
+                    {
+                        buffer = null; bufferLines = 0; skipping = true;
+                        continue;
+                    }
+
+                    if (skipping)
+                    {
+                        if (line.StartsWith("<![LOG[", StringComparison.Ordinal)) skipping = false;
+                        else
+                        {
+                            if (line.Contains("]LOG]!>")) skipping = false;
+                            continue;
+                        }
+                    }
+
+                    if (buffer != null)
+                    {
+                        buffer.Append('\n').Append(line);
+                        bufferLines++;
+                        if (line.Contains("]LOG]!>"))
+                        {
+                            line = buffer.ToString();
+                            buffer = null; bufferLines = 0;
+                        }
+                        else if (bufferLines >= MaxEntryLines || buffer.Length >= maxEntryBytes)
+                        {
+                            buffer = null; bufferLines = 0; skipping = true;
+                            continue;
+                        }
+                        else continue;
+                    }
+                    else if (line.StartsWith("<![LOG[", StringComparison.Ordinal) && !line.Contains("]LOG]!>"))
+                    {
+                        buffer = new StringBuilder(line);
+                        bufferLines = 1;
+                        continue;
+                    }
+
+                    if (!CmTraceLogParser.TryParseLine(line, out var entry) || entry == null) continue;
+                    yield return new ScannedEntry
+                    {
+                        Offset = entryStart,
+                        HasTimestamp = entry.HasTimestamp && !entry.BiasMinutes.HasValue,
+                        LocalTimestamp = entry.LocalTimestamp,
+                        Message = entry.Message ?? string.Empty,
+                    };
+                }
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Handlers.cs

@@ -222,20 +222,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // PowerShell script tracking handlers
         // -----------------------------------------------------------------------
 
-        // Returns the current platform-script accumulator, or null when no platform script is active.
-        // Health-script (remediation) state is no longer tracked line-by-line — the HS-NEW-RESULT
-        // pattern delivers the full pre-detection / remediation / post-detection JSON in one shot
-        // via HandleHealthScriptResult. The platform branch keeps its line-by-line accumulator
-        // because PS-* patterns (PS-SCRIPT-CONTEXT / PS-SCRIPT-EXITCODE / PS-AGENT-OUTPUT / …) still
-        // arrive across multiple log lines.
-        private ScriptExecutionState GetCurrentPlatformScript()
-        {
-            if (!string.IsNullOrEmpty(_lastPlatformScriptPolicyId) &&
-                _pendingPlatformScripts.TryGetValue(_lastPlatformScriptPolicyId, out var state))
-                return state;
-            return null;
-        }
-
         private void HandleScriptStarted(Match match, Dictionary<string, string> parameters)
         {
             var id = match.Groups["id"]?.Value;
@@ -282,27 +268,59 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // a regex Match).
         internal void HandlePlatformScriptStarted(string id, string source = null)
         {
-            // Stale-slot hardening (session eaf3d8c4): a replayed start line from a previous
-            // enrollment whose matching result never appeared (script was mid-run when that
-            // enrollment ended) leaves a pending slot with a days-old StartedAtUtc. When the
-            // same policy genuinely re-runs now, the fresh start must begin a NEW execution —
-            // otherwise the ancient start pairs with the fresh completion and the duration
-            // lies. > 24 h mirrors the adapter's source-timestamp staleness clamp.
-            var currentStartTs = LastMatchedLogTimestamp ?? DateTime.UtcNow;
-            if (_pendingPlatformScripts.TryGetValue(id, out var pendingSlot)
-                && pendingSlot.StartedAtUtc.HasValue
-                && currentStartTs - pendingSlot.StartedAtUtc.Value > TimeSpan.FromHours(24))
+            var currentStartTs = LastMatchedLogTimestamp ?? UtcNowProvider();
+
+            // A start line older than the result this policy already emitted is the late start
+            // line of THAT run: its AgentExecutor block surfaced after the IME result — the two
+            // files are read in turn (AgentExecutor.log first, but a script's exit line and IME's
+            // result line are 8–30 ms apart), a ledger rewind recovered the block, or the poll
+            // loop stalled (session e7f3c910: the late line opened a second slot, cleared the
+            // emitted-marker and turned the exit code that followed into a fallback duplicate
+            // 15 s later). It owns the lines behind it in its file and opens nothing. Strictly
+            // older: a start line at the result's own timestamp is the next run (source lines
+            // never tie; a low-resolution clock in a test may).
+            if (_platformScriptResultEmitted.TryGetValue(id, out var emittedResultTs) && currentStartTs < emittedResultTs)
             {
-                _logger.Debug($"ImeLogTracker: discarding stale pending platform-script slot for {id} (started {pendingSlot.StartedAtUtc:o})");
-                _pendingPlatformScripts.Remove(id);
+                RecordInvocationMarker(id, isClose: false);
+                NoteInvocationActivity();
+                _logger.Debug($"ImeLogTracker: platform script start line for {id} (source: {source ?? "ime"}) predates its emitted result — late line of that run, not a new one");
+                return;
+            }
+
+            if (_pendingPlatformScripts.TryGetValue(id, out var pendingSlot))
+            {
+                if (pendingSlot.StartedAtUtc.HasValue && currentStartTs - pendingSlot.StartedAtUtc.Value > TimeSpan.FromHours(24))
+                {
+                    // Stale-slot hardening (session eaf3d8c4): a replayed start line from a previous
+                    // enrollment whose matching result never appeared (script was mid-run when that
+                    // enrollment ended) leaves a pending slot with a days-old StartedAtUtc. When the
+                    // same policy genuinely re-runs now, the fresh start must begin a NEW execution —
+                    // otherwise the ancient start pairs with the fresh completion and the duration
+                    // lies. > 24 h mirrors the adapter's source-timestamp staleness clamp.
+                    _logger.Debug($"ImeLogTracker: discarding stale pending platform-script slot for {id} (started {pendingSlot.StartedAtUtc:o})");
+                    _pendingPlatformScripts.Remove(id);
+                }
+                else if (pendingSlot.Result != null && pendingSlot.ResultObservedAtUtc.HasValue && currentStartTs >= pendingSlot.ResultObservedAtUtc.Value)
+                {
+                    // The held run is over — a start line at or after its result is the next run.
+                    // Emit what the held run has; its end block did not surface in time.
+                    EmitPlatformScriptResult(pendingSlot, "the next run of this policy started");
+                }
+                else if (!pendingSlot.StartedAtUtc.HasValue)
+                {
+                    // The slot was opened by its result while the start block was still hidden;
+                    // the recovered start line dates the run.
+                    pendingSlot.StartedAtUtc = currentStartTs;
+                    _stateDirty = true;
+                }
             }
             if (!_pendingPlatformScripts.ContainsKey(id))
             {
                 // A fresh start for this policy (no pending entry) begins a NEW execution.
                 // Clear any emitted-marker from a prior run so IME re-evaluations / retries of
                 // the same platform-script policy within one agent lifetime are not silently
-                // deduped away. Within a single run the start always precedes exit/result, so
-                // this never clears the current run's own marker.
+                // deduped away. A start line of the emitted run itself never reaches this point
+                // (the guard above), so this never clears the current run's own marker.
                 _platformScriptResultEmitted.Remove(id);
                 _pendingPlatformScripts[id] = new ScriptExecutionState
                 {
@@ -320,7 +338,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 try { OnScriptStarted?.Invoke(new ScriptStartedInfo { PolicyId = id, ScriptType = "platform" }); }
                 catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptStarted handler threw: {ex.Message}"); }
             }
-            _lastPlatformScriptPolicyId = id;
+            RecordInvocationMarker(id, isClose: false);
+            NoteInvocationActivity();
             // Started lines fire twice per script (agentexecutor + ime source) and carry no
             // outcome — the matching `platform script completed` line below carries result+exit
             // and stays on Info. Keep starts on Debug so Info reflects script outcomes only.
@@ -329,42 +348,55 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
         // Routes line-by-line script-data handlers (context / exitCode / output) to the right
         // accumulator based on the pattern's scriptType parameter. Health-script lines feed the
-        // single-slot _pendingHealthScript; platform-script lines feed _pendingPlatformScripts.
+        // single-slot _pendingHealthScript (the HS-NEW-RESULT JSON delivers the full cycle in one
+        // shot; the slot only enriches the early HS-COMPLIANCE signal). Platform-script lines feed
+        // _pendingPlatformScripts, and the slot that owns a line is decided by file position (see
+        // ImeLogTracker.Overwrite.cs), never by which script happened to start last.
         private ScriptExecutionState GetCurrentScriptForLineUpdate(Dictionary<string, string> parameters)
+            => GetCurrentScriptForLineUpdate(parameters, out _);
+
+        // ownerPolicyId names the platform script that owns the line by file position even when
+        // its pending slot is gone (the completion was already emitted); null for health-script
+        // lines and for lines no platform invocation owns.
+        private ScriptExecutionState GetCurrentScriptForLineUpdate(Dictionary<string, string> parameters, out string ownerPolicyId)
         {
             var scriptType = parameters != null && parameters.TryGetValue("scriptType", out var st) ? st : null;
-            return string.Equals(scriptType, "remediation", StringComparison.OrdinalIgnoreCase)
-                ? _pendingHealthScript
-                : GetCurrentPlatformScript();
+            if (string.Equals(scriptType, "remediation", StringComparison.OrdinalIgnoreCase))
+            {
+                ownerPolicyId = null;
+                return _pendingHealthScript;
+            }
+            return ResolvePlatformScriptForCurrentEntry(out ownerPolicyId);
         }
 
-        // Session 6b4993e5 fix — platform-script stdout/exit cross-contamination.
-        //
-        // AgentExecutor.exe hosts BOTH platform scripts (…\Policies\Scripts\<id>.ps1) and
-        // proactive-remediation scripts (…\IMECache\HealthScripts\<id>\detect.ps1), and writes
-        // their lines interleaved into the shared AgentExecutor.log. The policyId-less
-        // PS-AGENT-EXITCODE ("Powershell exit code is N") and PS-AGENT-OUTPUT ("write output
-        // done. output = …") lines are routed to whichever platform script
-        // _lastPlatformScriptPolicyId points at. A remediation invocation's start
-        // ("Adding argument remediationScript …") does NOT match PS-AGENT-SCRIPT-START, so it
-        // never moves the pointer — its exit/output then bleed into the last-started PLATFORM
-        // script's slot (observed: platform c3e0124c emitted result=Failed but with exit 0 +
-        // stdout "[Compliant] No Classic Teams found" — the Teams remediation's output).
-        //
-        // Each AgentExecutor process logs "ExecutorLog AgentExecutor gets invoked" first, so a
-        // new banner means the previous invocation's line-capture context is over. Clearing the
-        // pointer here scopes line-capture to a single invocation: the immediately following
-        // "Adding argument powershell …\Policies\Scripts\<id>.ps1" (PS-AGENT-SCRIPT-START)
-        // re-establishes it for a platform invocation, while a remediation invocation leaves it
-        // null so its exit/output are dropped (the remediation's authoritative data still
-        // arrives via HS-NEW-RESULT). The platform script's final result is unaffected — it is
-        // keyed by policyId via PS-SCRIPT-RESULT, not by this pointer.
-        private void HandleAgentExecutorInvocationBoundary()
+        // AgentExecutor.exe hosts platform scripts (…\Policies\Scripts\<id>.ps1) as well as
+        // detection, requirement and proactive-remediation scripts, and its policyId-less
+        // PS-AGENT-EXITCODE / PS-AGENT-OUTPUT lines belong to whichever invocation owns that
+        // file position. The banner closes the previous invocation; the argument line that
+        // follows opens the next one — as a platform script when PS-AGENT-SCRIPT-START matched
+        // it, otherwise as an invocation whose exit/output are not captured (a remediation's
+        // authoritative data arrives via HS-NEW-RESULT; session 6b4993e5 saw its output bleed
+        // into a platform slot). "Agent executor completed" closes the invocation again.
+        private void HandleAgentExecutorInvocation()
         {
-            if (_lastPlatformScriptPolicyId == null) return;
-            _logger.Debug(
-                $"ImeLogTracker: AgentExecutor invocation boundary — clearing platform-script line-capture pointer (was {_lastPlatformScriptPolicyId}).");
-            _lastPlatformScriptPolicyId = null;
+            RecordInvocationMarker(null, isClose: true);
+            NoteInvocationActivity();
+        }
+
+        private void HandleAgentInvocationArgument(string kind)
+        {
+            RecordInvocationMarker(null, isClose: false);
+            NoteInvocationActivity();
+            if (!string.IsNullOrEmpty(kind) && !string.Equals(kind, "powershell", StringComparison.OrdinalIgnoreCase))
+                _logger.Debug($"ImeLogTracker: AgentExecutor invocation of kind '{kind}' — exit/output lines not captured as a platform script");
+        }
+
+        private void HandleAgentExecutorCompleted()
+        {
+            RecordInvocationMarker(null, isClose: true);
+            // The end block was written at the executor's own stream position — if that lay
+            // behind the bookmark, the ledger check on the next pass finds it.
+            RequestOverwriteCheck();
         }
 
         private void HandleScriptContext(Match match, Dictionary<string, string> parameters)
@@ -372,6 +404,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             var context = match.Groups["context"]?.Value;
             if (string.IsNullOrEmpty(context)) return;
 
+            NoteInvocationActivity();
             var runContext = string.Equals(context, "machine", StringComparison.OrdinalIgnoreCase) ? "System" : "User";
             var script = GetCurrentScriptForLineUpdate(parameters);
             if (script != null)
@@ -386,18 +419,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             var exitCodeStr = match.Groups["exitCode"]?.Value;
             if (string.IsNullOrEmpty(exitCodeStr) || !int.TryParse(exitCodeStr, out var exitCode)) return;
 
-            var script = GetCurrentScriptForLineUpdate(parameters);
+            var script = GetCurrentScriptForLineUpdate(parameters, out var ownerPolicyId);
             if (script != null)
-            {
-                script.ExitCode = exitCode;
-                // Stamp when we learned the script's exit code so the deadline-based fallback
-                // (FlushStalePlatformScriptResults) can fire if IME never logs its authoritative
-                // PS-SCRIPT-RESULT line in time. Prefer the source CMTrace timestamp (already
-                // UTC-normalized by the parser) so replayed log content is dated correctly.
-                if (string.Equals(script.ScriptType, "platform", StringComparison.OrdinalIgnoreCase))
-                    script.ExitObservedAtUtc = LastMatchedLogTimestamp ?? DateTime.UtcNow;
-                _logger.Debug($"ImeLogTracker: script exit code {exitCode} for {script.PolicyId}");
-            }
+                ApplyExitCode(script, exitCode, LastMatchedLogTimestamp ?? UtcNowProvider());
+            else if (ownerPolicyId != null)
+                _logger.Debug($"ImeLogTracker: exit code {exitCode} belongs to platform script {ownerPolicyId}, whose completion was already emitted — dropped");
+            // An exit code means the executor just wrote its end block and IME is about to
+            // write the result — both land at a stale stream position when another process
+            // appended meanwhile. Check the ledgers on the next pass.
+            RequestOverwriteCheck();
+        }
+
+        private void ApplyExitCode(ScriptExecutionState script, int exitCode, DateTime observedAtUtc)
+        {
+            script.ExitCode = exitCode;
+            // Stamp when we learned the script's exit code so the deadline-based fallback
+            // (FlushPendingPlatformScriptResults) can fire if IME never logs its authoritative
+            // PS-SCRIPT-RESULT line in time. Prefer the source CMTrace timestamp (already
+            // UTC-normalized by the parser) so replayed log content is dated correctly.
+            if (string.Equals(script.ScriptType, "platform", StringComparison.OrdinalIgnoreCase))
+                script.ExitObservedAtUtc = observedAtUtc;
+            _logger.Debug($"ImeLogTracker: script exit code {exitCode} for {script.PolicyId}");
         }
 
         private void HandleScriptOutput(Match match, Dictionary<string, string> parameters)
@@ -446,22 +488,36 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
             if (string.IsNullOrEmpty(id)) return;
 
-            // Dedup: the deadline-based fallback (FlushStalePlatformScriptResults) may already have
+            CompletePlatformScriptFromImeResult(id, result, LastMatchedLogTimestamp, LastMatchedPatternId);
+        }
+
+        /// <summary>
+        /// The authoritative IME <c>PS-SCRIPT-RESULT</c> line of a platform script. Emits at once
+        /// when the executor end block (exit code, output) has been read already — the normal
+        /// order of the two files — and otherwise holds the completion: the end block reaches the
+        /// tracker after the result whenever a concurrent writer overwrote it (the check this
+        /// result triggers recovers it one pass later), when the AgentExecutor.log read of a pass
+        /// simply preceded the exit line by a few milliseconds, or when the poll loop stalled.
+        /// Emitting immediately lost the exit code in all three cases and, once the late start
+        /// line reopened the slot, produced a fallback duplicate (session e7f3c910).
+        /// <see cref="FlushPendingPlatformScriptResults"/> emits the held completion.
+        /// </summary>
+        internal void CompletePlatformScriptFromImeResult(string policyId, string result, DateTime? resultLineTimestampUtc, string patternId)
+        {
+            // Dedup: the deadline-based fallback (FlushPendingPlatformScriptResults) may already have
             // emitted this script from its AgentExecutor exit code because IME's authoritative
             // PS-SCRIPT-RESULT line arrived late. The fallback carries the same exit code + stdout,
             // so re-emitting here would duplicate the timeline entry and inflate counts. Drop the
             // now-redundant pending entry and skip.
-            if (_platformScriptResultEmitted.Contains(id))
+            if (_platformScriptResultEmitted.ContainsKey(policyId))
             {
-                _logger.Debug($"ImeLogTracker: platform script {id} PS-SCRIPT-RESULT arrived after fallback emit — skipping duplicate");
-                _pendingPlatformScripts.Remove(id);
-                if (string.Equals(_lastPlatformScriptPolicyId, id, StringComparison.OrdinalIgnoreCase))
-                    _lastPlatformScriptPolicyId = null;
+                _logger.Debug($"ImeLogTracker: platform script {policyId} PS-SCRIPT-RESULT arrived after fallback emit — skipping duplicate");
+                _pendingPlatformScripts.Remove(policyId);
                 return;
             }
 
             // Merge with pending AgentExecutor data if available
-            if (_pendingPlatformScripts.TryGetValue(id, out var script))
+            if (_pendingPlatformScripts.TryGetValue(policyId, out var script))
             {
                 // Stale-result guard: on an intra-lifetime re-run of the same policy, run 1's
                 // late PS-SCRIPT-RESULT can arrive after run 2's start line already created a
@@ -471,10 +527,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 // line in the source log, so a result older than the pending slot's start
                 // belongs to a previous run — drop it and keep the live slot intact.
                 if (script.StartedAtUtc.HasValue
-                    && LastMatchedLogTimestamp.HasValue
-                    && LastMatchedLogTimestamp.Value < script.StartedAtUtc.Value)
+                    && resultLineTimestampUtc.HasValue
+                    && resultLineTimestampUtc.Value < script.StartedAtUtc.Value)
                 {
-                    _logger.Debug($"ImeLogTracker: platform script {id} result predates the current run's start — stale result from a previous run, skipping");
+                    _logger.Debug($"ImeLogTracker: platform script {policyId} result predates the current run's start — stale result from a previous run, skipping");
                     return;
                 }
             }
@@ -482,70 +538,111 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 script = new ScriptExecutionState
                 {
-                    PolicyId = id,
+                    PolicyId = policyId,
                     ScriptType = "platform"
                 };
+                _pendingPlatformScripts[policyId] = script;
             }
 
             script.Result = result;
             script.ResultSource = "ime_policy_result";
-
-            _logger.Info($"ImeLogTracker: platform script completed: {id}, result={result}, exit={script.ExitCode}");
-
-            EmitScriptEvent(script);
-            _platformScriptResultEmitted.Add(id);
-            _pendingPlatformScripts.Remove(id);
+            script.ResultObservedAtUtc = resultLineTimestampUtc ?? UtcNowProvider();
+            script.ResultPatternId = patternId;
+            _stateDirty = true;
+
+            if (script.ExitCode.HasValue)
+            {
+                EmitPlatformScriptResult(script);
+            }
+            else
+            {
+                script.ResultHeldSinceUtc = UtcNowProvider();
+                _logger.Debug($"ImeLogTracker: platform script {policyId} result={result} seen before its executor end block — holding the completion up to {PlatformScriptEndBlockGrace.TotalSeconds:F0}s for the exit code");
+            }
+            // The result block is IME's first write after the script wait — the executor's end
+            // block in the other file may have landed behind the bookmark at the same time.
+            RequestOverwriteCheck();
+        }
+
+        /// <summary>
+        /// The one emit path for platform-script completions (IME result, held result, exit-code
+        /// fallback): event, emitted-marker with the run's source timestamp, slot closed.
+        /// </summary>
+        private void EmitPlatformScriptResult(ScriptExecutionState script, string note = null)
+        {
+            _logger.Info($"ImeLogTracker: platform script completed: {script.PolicyId}, result={script.Result}, exit={script.ExitCode}{(note != null ? $" ({note})" : string.Empty)}");
+            EmitScriptEvent(script);
+            _platformScriptResultEmitted[script.PolicyId] = script.ResultObservedAtUtc ?? script.ExitObservedAtUtc ?? UtcNowProvider();
+            _pendingPlatformScripts.Remove(script.PolicyId);
             _stateDirty = true;
-            if (string.Equals(_lastPlatformScriptPolicyId, id, StringComparison.OrdinalIgnoreCase))
-                _lastPlatformScriptPolicyId = null;
         }
 
         /// <summary>
         /// Grace period after a platform script's AgentExecutor exit code is observed before
-        /// <see cref="FlushStalePlatformScriptResults"/> emits a completion from that exit code.
-        /// IME logs its authoritative <c>PS-SCRIPT-RESULT</c> line within ~1 s of exit on healthy
-        /// reporting cycles, so 15 s lets the normal path win virtually always — the fallback is a
-        /// true safety net for the case where IME has not flushed its batch-send to the Microsoft
-        /// service before the (often short) Autopilot enrollment ends and the agent terminates.
+        /// <see cref="FlushPendingPlatformScriptResults"/> emits a completion from that exit code.
+        /// IME logs its authoritative <c>PS-SCRIPT-RESULT</c> line within ~1 s of exit; when it
+        /// is missing after 15 s it was hidden by a concurrent writer (the ledger check in
+        /// <c>ImeLogTracker.Overwrite.cs</c> recovers that line) or the enrollment ended before
+        /// IME wrote it — this fallback is the safety net for the remaining cases.
         /// </summary>
         private static readonly TimeSpan PlatformScriptResultGrace = TimeSpan.FromSeconds(15);
 
         /// <summary>
-        /// Policy IDs of platform scripts already emitted (via either the authoritative
-        /// PS-SCRIPT-RESULT path or the exit-code fallback). Guards against double emission when
-        /// both fire for the same script.
+        /// How long an IME result waits for the executor end block of its run before the
+        /// completion goes out without an exit code. An overwritten end block surfaces on the
+        /// pass after the result (100 ms, the result triggers the ledger check); a stalled poll
+        /// loop was measured at 2 s (session e7f3c910, VM at 100 % CPU). Well below the 15 s
+        /// exit-code fallback, and the event keeps the result line's timestamp — only its
+        /// delivery waits.
         /// </summary>
-        private readonly HashSet<string> _platformScriptResultEmitted =
-            new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        internal static readonly TimeSpan PlatformScriptEndBlockGrace = TimeSpan.FromSeconds(5);
 
         /// <summary>
-        /// Emits a <c>script_completed</c>/<c>script_failed</c> for every pending platform script
-        /// that has a known AgentExecutor exit code but whose IME <c>PS-SCRIPT-RESULT</c> line has
-        /// not arrived within <see cref="PlatformScriptResultGrace"/>. Without this, scripts that
-        /// completed shortly before the agent terminates are silently dropped (the
-        /// <c>_pendingPlatformScripts</c> buffer is neither persisted nor flushed on dispose), so a
-        /// device that ran N platform scripts could surface only the long-running one that happened
-        /// to get its IME result logged in time. Result is derived from the exit code (0 → Success,
-        /// else Failed) and tagged <c>resultSource=agentexecutor_fallback</c> so the data is honest
-        /// about its provenance.
-        /// <para>
-        /// Runs on the single-threaded polling loop (no locking needed, same as the handlers).
-        /// <paramref name="force"/> bypasses the grace check for the final pass on shutdown.
-        /// </para>
+        /// Platform scripts already emitted (via the authoritative PS-SCRIPT-RESULT path or the
+        /// exit-code fallback), keyed by policy id with the source timestamp of the emitted run
+        /// (the result line, or the exit line for a fallback emit). Guards against double emission
+        /// when both paths fire for the same script, and tells a late start line of the emitted
+        /// run from the start of the next run.
         /// </summary>
-        internal void FlushStalePlatformScriptResults(DateTime nowUtc, bool force = false)
+        private readonly Dictionary<string, DateTime> _platformScriptResultEmitted =
+            new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        /// End-of-pass emit for pending platform scripts, two cases:
+        /// <list type="bullet">
+        /// <item>A held IME result (<see cref="ScriptExecutionState.ResultHeldSinceUtc"/>) goes
+        /// out once its executor end block has been read — the block arrives within one pass, so
+        /// stdout/stderr are in by now — or after <see cref="PlatformScriptEndBlockGrace"/>.</item>
+        /// <item>A script with a known AgentExecutor exit code but no IME <c>PS-SCRIPT-RESULT</c>
+        /// line within <see cref="PlatformScriptResultGrace"/> is emitted from the exit code
+        /// (0 → Success, else Failed), tagged <c>resultSource=agentexecutor_fallback</c> so the
+        /// data is honest about its provenance. Without this, scripts that completed shortly
+        /// before the agent terminates were silently dropped.</item>
+        /// </list>
+        /// Runs on the single-threaded polling loop (no locking needed, same as the handlers).
+        /// <paramref name="force"/> bypasses both grace checks for the final pass on shutdown.
+        /// </summary>
+        internal void FlushPendingPlatformScriptResults(DateTime nowUtc, bool force = false)
         {
             if (_pendingPlatformScripts.Count == 0) return;
 
-            List<string> toRemove = null;
-            foreach (var kv in _pendingPlatformScripts)
+            var fallbackEmitted = false;
+            foreach (var script in _pendingPlatformScripts.Values.ToList())
             {
-                var script = kv.Value;
-
                 // Already emitted by the authoritative path — just drop the stale buffer entry.
-                if (_platformScriptResultEmitted.Contains(script.PolicyId))
+                if (_platformScriptResultEmitted.ContainsKey(script.PolicyId))
                 {
-                    (toRemove ??= new List<string>()).Add(kv.Key);
+                    _pendingPlatformScripts.Remove(script.PolicyId);
+                    _stateDirty = true;
+                    continue;
+                }
+
+                if (script.Result != null)
+                {
+                    if (script.ExitCode.HasValue)
+                        EmitPlatformScriptResult(script, "executor end block read after the result");
+                    else if (force || !script.ResultHeldSinceUtc.HasValue || nowUtc - script.ResultHeldSinceUtc.Value >= PlatformScriptEndBlockGrace)
+                        EmitPlatformScriptResult(script, $"no executor end block within {PlatformScriptEndBlockGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)}");
                     continue;
                 }
 
@@ -560,30 +657,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
                 script.Result = script.ExitCode.Value == 0 ? "Success" : "Failed";
                 script.ResultSource = "agentexecutor_fallback";
-
-                _logger.Info(
-                    $"ImeLogTracker: platform script {script.PolicyId} result not seen within " +
-                    $"{PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? " (shutdown flush)" : "")} — " +
-                    $"emitting from AgentExecutor exit code {script.ExitCode.Value} (fallback)");
-
-                EmitScriptEvent(script);
-                _platformScriptResultEmitted.Add(script.PolicyId);
-                (toRemove ??= new List<string>()).Add(kv.Key);
+                EmitPlatformScriptResult(script,
+                    $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)} — emitted from AgentExecutor exit code {script.ExitCode.Value} (fallback)");
+                fallbackEmitted = true;
             }
 
-            if (toRemove != null)
-            {
-                // The flush can fire on a quiet polling cycle (grace expiry with no new log
-                // lines), where nothing else marks state dirty — the emitted-markers must reach
-                // the state file before a restart or the restarted tracker re-emits (H1).
-                _stateDirty = true;
-                foreach (var key in toRemove)
-                {
-                    _pendingPlatformScripts.Remove(key);
-                    if (string.Equals(_lastPlatformScriptPolicyId, key, StringComparison.OrdinalIgnoreCase))
-                        _lastPlatformScriptPolicyId = null;
-                }
-            }
+            // The fallback is an end signal like the others: the result line it stood in for
+            // may sit overwritten behind the bookmark of the other file.
+            if (fallbackEmitted) RequestOverwriteCheck();
         }
 
         /// <summary>Test seam: inject a pending platform script as if AgentExecutor.log had reported
@@ -602,49 +683,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 Stdout = stdout,
                 StartedAtUtc = startedAtUtc,
             };
-            _lastPlatformScriptPolicyId = policyId;
+            NextTestEntry();
+            RecordInvocationMarker(policyId, isClose: false);
         }
 
-        /// <summary>Test seam: simulate the authoritative IME PS-SCRIPT-RESULT path for a platform
-        /// script (same code as <see cref="HandleScriptCompleted"/> minus regex extraction).
-        /// <paramref name="resultLineTimestampUtc"/> stands in for the CMTrace timestamp of the
-        /// PS-SCRIPT-RESULT line (production reads it via <see cref="LastMatchedLogTimestamp"/>).</summary>
+        /// <summary>Test seam: the authoritative IME PS-SCRIPT-RESULT path for a platform script
+        /// (the production handler minus regex extraction). <paramref name="resultLineTimestampUtc"/>
+        /// stands in for the CMTrace timestamp of the PS-SCRIPT-RESULT line (production reads it
+        /// via <see cref="LastMatchedLogTimestamp"/>, the fallback here).</summary>
         internal void CompletePlatformScriptFromImeResultForTesting(string policyId, string result, DateTime? resultLineTimestampUtc = null)
         {
             if (string.IsNullOrEmpty(policyId)) return;
+            CompletePlatformScriptFromImeResult(policyId, result, resultLineTimestampUtc ?? LastMatchedLogTimestamp, "PS-SCRIPT-RESULT");
+        }
 
-            if (_platformScriptResultEmitted.Contains(policyId))
-            {
-                _pendingPlatformScripts.Remove(policyId);
-                if (string.Equals(_lastPlatformScriptPolicyId, policyId, StringComparison.OrdinalIgnoreCase))
-                    _lastPlatformScriptPolicyId = null;
-                return;
-            }
-
+        /// <summary>Test seam: the AgentExecutor exit-code line of a pending platform script (the
+        /// production handler minus regex extraction and positional ownership).</summary>
+        internal void RecordPlatformScriptExitCodeForTesting(string policyId, int exitCode, DateTime observedAtUtc)
+        {
             if (_pendingPlatformScripts.TryGetValue(policyId, out var script))
-            {
-                // Mirror of HandleScriptCompleted's stale-result guard: a result older than the
-                // pending slot's start belongs to a previous run of the same policy.
-                if (script.StartedAtUtc.HasValue
-                    && resultLineTimestampUtc.HasValue
-                    && resultLineTimestampUtc.Value < script.StartedAtUtc.Value)
-                {
-                    return;
-                }
-            }
-            else
-            {
-                script = new ScriptExecutionState { PolicyId = policyId, ScriptType = "platform" };
-            }
-
-            script.Result = result;
-            script.ResultSource = "ime_policy_result";
-            EmitScriptEvent(script);
-            _platformScriptResultEmitted.Add(policyId);
-            _pendingPlatformScripts.Remove(policyId);
-            if (string.Equals(_lastPlatformScriptPolicyId, policyId, StringComparison.OrdinalIgnoreCase))
-                _lastPlatformScriptPolicyId = null;
-            _stateDirty = true;
+                ApplyExitCode(script, exitCode, observedAtUtc);
         }
 
         /// <summary>
@@ -794,6 +852,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 return;
             }
             HandleHealthScriptResultJson(json);
+            // A remediation executor just ended too — its end block may sit behind the bookmark.
+            RequestOverwriteCheck();
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -78,241 +78,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
                 try
                 {
-                    var fileInfo = new FileInfo(filePath);
-                    if (!fileInfo.Exists) continue;
-
-                    // Captured BEFORE MarkChecked below stamps this pass. Growth measured
-                    // against a previously observed state is what makes this pass's lines valid
-                    // "written now" anchors — for the per-file measurement AND per-line anchoring.
-                    var hadPreviousObservation = _positionTracker.HasSeen(filePath);
-                    var lastCheckedUtc = _positionTracker.GetLastCheckedUtc(filePath);
-                    var passNowUtc = UtcNowProvider();
-
-                    var startPos = _positionTracker.GetSafePosition(filePath, fileInfo.Length);
-
-                    // Every look counts, including "no new data" and an empty first sight: the
-                    // NEXT pass's freshness window is measured from here. Restored bookmarks
-                    // deliberately carry no LastCheckedUtc — the first pass after a restart reads
-                    // downtime backlog and must never count as fresh.
-                    _positionTracker.MarkChecked(filePath, passNowUtc);
-
-                    if (startPos >= fileInfo.Length)
-                    {
-                        // M2: guard the interpolated string so it isn't built every 100 ms tick
-                        // (per file) when Trace is off — which is the production default (Info).
-                        if (_logger.LogLevel >= AgentLogLevel.Trace)
-                            _logger.Trace($"ImeLogTracker: {Path.GetFileName(filePath)} — no new data (pos={startPos}, size={fileInfo.Length})");
-                        continue;
-                    }
-                    if (_logger.LogLevel >= AgentLogLevel.Trace)
-                        _logger.Trace($"ImeLogTracker: reading {Path.GetFileName(filePath)} from pos {startPos} (size={fileInfo.Length}, delta={fileInfo.Length - startPos})");
-
-                    _currentSourceFileName = Path.GetFileName(filePath);
-                    _currentPassLinesAreFresh = hadPreviousObservation
-                        && lastCheckedUtc > DateTime.MinValue
-                        && (passNowUtc - lastCheckedUtc) <= FreshLineMaxAge;
-
-                    // Newest bias-less line of this pass — the calibration anchor. Bias-carrying
-                    // lines are skipped: they already state the writer's offset, so they need no
-                    // measurement and must not overwrite one.
-                    CmTraceLogEntry calibrationAnchor = null;
-
-                    using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
-                    {
-                        stream.Seek(startPos, SeekOrigin.Begin);
-
-                        var reader = new BoundedLineReader(stream, MaxEntryBytes);
-                        var stats = new PassStats();
-
-                        // Buffer for multiline CMTrace entries (e.g. AgentExecutor.log
-                        // "write output done. output = ..." spans many lines)
-                        StringBuilder multiLineBuffer = null;
-                        int multiLineCount = 0;
-                        // Set after a capped entry is dropped: its remaining physical lines
-                        // are skipped instead of being matched as raw text, until the entry
-                        // closes or a new entry begins (so no real entry is lost).
-                        bool skippingDroppedEntry = false;
-                        // File offset where the entry currently being assembled/processed
-                        // begins — the bookmark to fall back to when that entry is NOT
-                        // consumed (cancellation, or a held-back unterminated tail).
-                        long entryStart = startPos;
-                        // Where the next pass resumes. EOF unless an entry is left unconsumed.
-                        long resumePos;
-
-                        while (true)
-                        {
-                            // CancellationToken.None: cancellation is honoured by the explicit
-                            // check below (exact bookmark) rather than by an exception out of
-                            // the read, which the poll loop would log as an error.
-                            var line = await reader.ReadLineAsync(CancellationToken.None);
-                            if (line == null)
-                            {
-                                // EOF. An in-flight multiline entry here is an entry the writer
-                                // has not finished — hold it back (see HoldBackTail) instead of
-                                // dropping it and raw-matching its remaining lines next pass.
-                                if (multiLineBuffer != null && HoldBackTail(filePath, entryStart, fileInfo.Length, passNowUtc))
-                                {
-                                    _heldTailCount++;
-                                    resumePos = entryStart;
-                                    break;
-                                }
-                                resumePos = reader.Position;
-                                break;
-                            }
-
-                            if (token.IsCancellationRequested)
-                            {
-                                // Exact bookmark: nothing of this line (or of the multiline
-                                // entry it belongs to) has been handled.
-                                resumePos = multiLineBuffer != null ? entryStart : reader.LastLineStart;
-                                break;
-                            }
-
-                            if (multiLineBuffer == null)
-                                entryStart = reader.LastLineStart;
-
-                            _linesRead++;
-
-                            // A physical line over the cap is never matched: its captures would be
-                            // cut and the regexes would run over attacker-sized input. The capped
-                            // prefix is enough to tell whether it opened an entry whose remaining
-                            // lines must be skipped rather than raw-matched.
-                            if (reader.LastLineTruncated)
-                            {
-                                stats.OversizedLines++;
-                                _oversizedLines++;
-                                if (multiLineBuffer != null)
-                                {
-                                    multiLineBuffer = null;
-                                    multiLineCount = 0;
-                                    skippingDroppedEntry = true;
-                                }
-                                else if (line.StartsWith("<![LOG[") && !line.Contains("]LOG]!>"))
-                                {
-                                    skippingDroppedEntry = true;
-                                }
-                                continue;
-                            }
-
-                            if (!reader.LastLineTerminated && multiLineBuffer == null
-                                && HoldBackTail(filePath, reader.LastLineStart, fileInfo.Length, passNowUtc))
-                            {
-                                // Unterminated single line at EOF: the writer is mid-line.
-                                _heldTailCount++;
-                                resumePos = reader.LastLineStart;
-                                break;
-                            }
-
-                            if (skippingDroppedEntry)
-                            {
-                                // A line opening a new entry ends the skip and is processed
-                                // itself — checked BEFORE the close-tag test, because a complete
-                                // single-line entry contains both and must not be consumed as
-                                // the dropped entry's close.
-                                if (line.StartsWith("<![LOG["))
-                                    skippingDroppedEntry = false;
-                                else
-                                {
-                                    if (line.Contains("]LOG]!>")) skippingDroppedEntry = false;
-                                    continue;
-                                }
-                            }
-
-                            // --- Multiline CMTrace buffering ---
-                            // CMTrace entries: <![LOG[message]LOG]!><time=...>
-                            // When message contains newlines, the entry spans multiple lines.
-                            // We buffer until we find the closing ]LOG]!> tag.
-                            if (multiLineBuffer != null)
-                            {
-                                // Continuing a multiline entry
-                                multiLineBuffer.Append('\n').Append(line);
-                                multiLineCount++;
-
-                                if (line.Contains("]LOG]!>"))
-                                {
-                                    // Entry complete — use the assembled line
-                                    line = multiLineBuffer.ToString();
-                                    multiLineBuffer = null;
-                                    multiLineCount = 0;
-                                }
-                                else if (multiLineCount >= MaxMultiLineBufferLines || multiLineBuffer.Length >= MaxEntryBytes)
-                                {
-                                    // Safety limit — discard to bound memory and parser work. Warning
-                                    // (not Debug) so a capped entry is visible in the client log at the
-                                    // default level: a real IME entry this large would be news.
-                                    _logger.Warning($"ImeLogTracker: discarding multiline CMTrace buffer in {Path.GetFileName(filePath)} after {multiLineCount} lines / {multiLineBuffer.Length} chars (cap {MaxMultiLineBufferLines} lines / {MaxEntryBytes} chars) — entry dropped");
-                                    multiLineBuffer = null;
-                                    multiLineCount = 0;
-                                    skippingDroppedEntry = true;
-                                    continue;
-                                }
-                                else
-                                {
-                                    // Still accumulating — read next line
-                                    continue;
-                                }
-                            }
-                            else if (line.StartsWith("<![LOG[") && !line.Contains("]LOG]!>"))
-                            {
-                                // Start of a multiline CMTrace entry
-                                multiLineBuffer = new StringBuilder(line);
-                                multiLineCount = 1;
-                                continue;
-                            }
-
-                            // --- Normal processing (single-line or completed multiline) ---
-                            CmTraceLogEntry entry;
-                            string messageToMatch;
-                            if (CmTraceLogParser.TryParseLine(line, out entry))
-                            {
-                                messageToMatch = entry.Message;
-                                if (entry.HasTimestamp && !entry.BiasMinutes.HasValue)
-                                    calibrationAnchor = entry;
-                            }
-                            else
-                            {
-                                // Non-CMTrace line - match raw
-                                messageToMatch = line;
-                                entry = null;
-                            }
-
-                            if (string.IsNullOrEmpty(messageToMatch)) continue;
-
-                            // Simulation mode delay
-                            if (SimulationMode && entry != null)
-                            {
-                                await ApplySimulationDelay(ResolveEntryUtc(entry), token);
-                            }
-
-                            MatchLine(filePath, line, messageToMatch, entry, stats);
-                        }
-
-                        ClearHeldTailIfConsumed(filePath, resumePos);
-                        _positionTracker.SetPosition(filePath, resumePos);
-                        _stateDirty = true;
-                        backlogBytes += Math.Max(0, fileInfo.Length - resumePos);
-
-                        // One line per pass and file, never per hostile line: the counters are
-                        // the operator's only trace that matching was skipped or cut short.
-                        if (stats.RegexTimeouts > 0 || stats.BudgetBreaks > 0 || stats.OversizedLines > 0)
-                        {
-                            _logger.Warning(
-                                $"ImeLogTracker: {Path.GetFileName(filePath)} pass skipped work — " +
-                                $"oversizedLines={stats.OversizedLines} (cap {MaxEntryBytes} bytes), " +
-                                $"regexTimeouts={stats.RegexTimeouts}, lineBudgetBreaks={stats.BudgetBreaks}" +
-                                (stats.FirstSkippedPatternId != null ? $", firstSkippedPattern={stats.FirstSkippedPatternId}" : string.Empty));
-                            RaiseTrackerDegradedOnce(Path.GetFileName(filePath), stats.FirstSkippedPatternId);
-                        }
-
-                        // Calibrate AFTER the pass: this pass's lines were resolved with the
-                        // offset established previously, at most one poll (100 ms) old. Buffering
-                        // the pass to calibrate first is not an option — the first pass of
-                        // AppWorkload.log can be hundreds of MB. The cost is a warm-up of one
-                        // growing pass, during which lines fall back to the reader zone and are
-                        // flagged as such.
-                        if (hadPreviousObservation && calibrationAnchor != null)
-                            CalibrateFrom(_currentSourceFileName, Path.GetFileName(filePath), calibrationAnchor);
-                    }
+                    backlogBytes += await ProcessFileAsync(filePath, token);
                 }
                 catch (FileNotFoundException) { }
                 catch (IOException ex)
@@ -328,6 +94,246 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             }
         }
 
+        /// <summary>
+        /// One pass over one file: the bytes behind the bookmark, on a multi-writer file preceded
+        /// by the overwrite check that may move the bookmark back first (see
+        /// <c>ImeLogTracker.Overwrite.cs</c>). Returns the file's remaining backlog in bytes.
+        /// </summary>
+        private async Task<long> ProcessFileAsync(string filePath, CancellationToken token)
+        {
+            var fileInfo = new FileInfo(filePath);
+            if (!fileInfo.Exists) return 0;
+
+            // Captured BEFORE MarkChecked below stamps this pass. Growth measured
+            // against a previously observed state is what makes this pass's lines valid
+            // "written now" anchors — for the per-file measurement AND per-line anchoring.
+            var hadPreviousObservation = _positionTracker.HasSeen(filePath);
+            var lastCheckedUtc = _positionTracker.GetLastCheckedUtc(filePath);
+            var passNowUtc = UtcNowProvider();
+
+            var startPos = _positionTracker.GetSafePosition(filePath, fileInfo.Length);
+
+            // Every look counts, including "no new data" and an empty first sight: the
+            // NEXT pass's freshness window is measured from here. Restored bookmarks
+            // deliberately carry no LastCheckedUtc — the first pass after a restart reads
+            // downtime backlog and must never count as fresh.
+            _positionTracker.MarkChecked(filePath, passNowUtc);
+
+            var fileName = Path.GetFileName(filePath);
+            var ledger = IsMultiWriterLogFile(fileName) ? GetLedger(fileName) : null;
+
+            // Set by a rewind: entries that still read unchanged behind the old bookmark are
+            // skipped, and nothing below the old bookmark is fresh or a calibration anchor.
+            HashSet<LedgerEntry> rewoundEntries = null;
+            long oldBookmark = -1;
+
+            if (ledger != null)
+            {
+                var rewindTo = await PrepareLedgerAsync(filePath, fileName, ledger, startPos, passNowUtc, token);
+                if (rewindTo >= 0)
+                {
+                    rewoundEntries = ApplyRewind(filePath, fileName, ledger, rewindTo, startPos);
+                    oldBookmark = startPos;
+                    startPos = rewindTo;
+                }
+            }
+
+            if (startPos >= fileInfo.Length)
+            {
+                // M2: guard the interpolated string so it isn't built every 100 ms tick
+                // (per file) when Trace is off — which is the production default (Info).
+                if (_logger.LogLevel >= AgentLogLevel.Trace)
+                    _logger.Trace($"ImeLogTracker: {fileName} — no new data (pos={startPos}, size={fileInfo.Length})");
+                return 0;
+            }
+            if (_logger.LogLevel >= AgentLogLevel.Trace)
+                _logger.Trace($"ImeLogTracker: reading {fileName} from pos {startPos} (size={fileInfo.Length}, delta={fileInfo.Length - startPos})");
+
+            _currentSourceFileName = fileName;
+            var passLinesAreFresh = hadPreviousObservation
+                && lastCheckedUtc > DateTime.MinValue
+                && (passNowUtc - lastCheckedUtc) <= FreshLineMaxAge;
+            _currentPassLinesAreFresh = passLinesAreFresh;
+
+            // Newest bias-less line of this pass — the calibration anchor. Bias-carrying
+            // lines are skipped: they already state the writer's offset, so they need no
+            // measurement and must not overwrite one.
+            CmTraceLogEntry calibrationAnchor = null;
+
+            using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+            {
+                // Guard zone: the file grew and is open anyway — re-check the entries just behind
+                // the bookmark, where a stale writer's block lands when it is short.
+                if (ledger != null && rewoundEntries == null && ledger.Entries.Count > 0)
+                {
+                    var guardFrom = ledger.OffsetOfEntryAtOrAfter(startPos - OverwriteGuardBytes);
+                    if (guardFrom >= 0 && guardFrom < startPos)
+                    {
+                        var divergence = await FindOverwriteAsync(stream, ledger, guardFrom, startPos, token);
+                        _verifiedBytes += startPos - guardFrom;
+                        if (divergence >= 0)
+                        {
+                            // The guard saw only the tail of the ledger; the block may start earlier.
+                            var earliest = await FindOverwriteAsync(stream, ledger, ledger.StartOffset, startPos, token);
+                            _verifiedBytes += startPos - ledger.StartOffset;
+                            _verifyPasses++;
+                            if (earliest >= 0) divergence = earliest;
+                            rewoundEntries = ApplyRewind(filePath, fileName, ledger, divergence, startPos);
+                            oldBookmark = startPos;
+                            startPos = divergence;
+                        }
+                    }
+                }
+
+                stream.Seek(startPos, SeekOrigin.Begin);
+
+                var reader = new BoundedLineReader(stream, MaxEntryBytes, hashLines: ledger != null);
+                var assembler = new CmTraceEntryAssembler(MaxMultiLineBufferLines, MaxEntryBytes);
+                var stats = new PassStats();
+                var firstEntry = true;
+                // Where the next pass resumes. EOF unless an entry is left unconsumed.
+                long resumePos;
+
+                while (true)
+                {
+                    // CancellationToken.None: cancellation is honoured by the explicit
+                    // check below (exact bookmark) rather than by an exception out of
+                    // the read, which the poll loop would log as an error.
+                    var line = await reader.ReadLineAsync(CancellationToken.None);
+                    if (line == null)
+                    {
+                        // EOF. An in-flight multiline entry here is an entry the writer
+                        // has not finished — hold it back (see HoldBackTail) instead of
+                        // dropping it and raw-matching its remaining lines next pass.
+                        if (assembler.HasOpenEntry && HoldBackTail(filePath, assembler.OpenEntryStart, fileInfo.Length, passNowUtc))
+                        {
+                            _heldTailCount++;
+                            resumePos = assembler.OpenEntryStart;
+                            break;
+                        }
+                        resumePos = reader.Position;
+                        break;
+                    }
+
+                    if (token.IsCancellationRequested)
+                    {
+                        // Exact bookmark: nothing of this line (or of the multiline
+                        // entry it belongs to) has been handled.
+                        resumePos = assembler.HasOpenEntry ? assembler.OpenEntryStart : reader.LastLineStart;
+                        break;
+                    }
+
+                    _linesRead++;
+
+                    if (!reader.LastLineTruncated && !reader.LastLineTerminated && !assembler.HasOpenEntry
+                        && HoldBackTail(filePath, reader.LastLineStart, fileInfo.Length, passNowUtc))
+                    {
+                        // Unterminated single line at EOF: the writer is mid-line.
+                        _heldTailCount++;
+                        resumePos = reader.LastLineStart;
+                        break;
+                    }
+
+                    AssembledEntry entry;
+                    var outcome = assembler.Feed(line, reader.LastLineStart, reader.Position, reader.LastLineTruncated, reader.LastLineHash, out entry);
+                    if (outcome == CmTraceEntryAssembler.Outcome.OversizedDropped)
+                    {
+                        // A physical line over the cap is never matched: its captures would be
+                        // cut and the regexes would run over attacker-sized input.
+                        stats.OversizedLines++;
+                        _oversizedLines++;
+                        continue;
+                    }
+                    if (outcome == CmTraceEntryAssembler.Outcome.CapDropped)
+                    {
+                        // Warning (not Debug) so a capped entry is visible in the client log at the
+                        // default level: a real IME entry this large would be news.
+                        _logger.Warning($"ImeLogTracker: discarding multiline CMTrace buffer in {fileName} after {assembler.DroppedLines} lines / {assembler.DroppedChars} chars (cap {MaxMultiLineBufferLines} lines / {MaxEntryBytes} chars) — entry dropped");
+                        continue;
+                    }
+                    if (outcome != CmTraceEntryAssembler.Outcome.Entry) continue;
+
+                    if (firstEntry)
+                    {
+                        firstEntry = false;
+                        // A fragment right at the bookmark of a multi-writer file (the previous
+                        // entry ended exactly here, this one does not open an entry) is the tail of
+                        // a block a stale writer laid over already-read bytes: verify before reading on.
+                        if (ledger != null && rewoundEntries == null && entry.Offset == ledger.EndOffset
+                            && ledger.LastFragmentOffset != entry.Offset && !entry.Text.StartsWith("<![LOG["))
+                        {
+                            ledger.VerifyRequested = true;
+                            ledger.LastFragmentOffset = entry.Offset;
+                            resumePos = entry.Offset;
+                            break;
+                        }
+                    }
+
+                    if (ledger != null) ledger.Record(entry);
+                    if (rewoundEntries != null && rewoundEntries.Contains(new LedgerEntry { Offset = entry.Offset, Hash = entry.Hash }))
+                        continue; // unchanged behind the old bookmark — processed before the rewind
+
+                    _currentPassLinesAreFresh = passLinesAreFresh && entry.Offset >= oldBookmark;
+
+                    // --- Normal processing (single-line or completed multiline) ---
+                    CmTraceLogEntry parsed;
+                    string messageToMatch;
+                    _currentEntryOffset = entry.Offset;
+                    if (CmTraceLogParser.TryParseLine(entry.Text, out parsed))
+                    {
+                        messageToMatch = parsed.Message;
+                        if (parsed.HasTimestamp && !parsed.BiasMinutes.HasValue && entry.Offset >= oldBookmark)
+                            calibrationAnchor = parsed;
+                    }
+                    else
+                    {
+                        // Non-CMTrace line - match raw
+                        messageToMatch = entry.Text;
+                        parsed = null;
+                    }
+
+                    if (string.IsNullOrEmpty(messageToMatch)) continue;
+
+                    // Simulation mode delay
+                    if (SimulationMode && parsed != null)
+                    {
+                        await ApplySimulationDelay(ResolveEntryUtc(parsed), token);
+                    }
+
+                    MatchLine(filePath, entry.Text, messageToMatch, parsed, stats);
+                }
+
+                ClearHeldTailIfConsumed(filePath, resumePos);
+                _positionTracker.SetPosition(filePath, resumePos);
+                _stateDirty = true;
+                if (ledger != null) ledger.TrimBelow(RetentionFloor(fileName, resumePos));
+
+                // One line per pass and file, never per hostile line: the counters are
+                // the operator's only trace that matching was skipped or cut short.
+                if (stats.RegexTimeouts > 0 || stats.BudgetBreaks > 0 || stats.OversizedLines > 0)
+                {
+                    _logger.Warning(
+                        $"ImeLogTracker: {fileName} pass skipped work — " +
+                        $"oversizedLines={stats.OversizedLines} (cap {MaxEntryBytes} bytes), " +
+                        $"regexTimeouts={stats.RegexTimeouts}, lineBudgetBreaks={stats.BudgetBreaks}" +
+                        (stats.FirstSkippedPatternId != null ? $", firstSkippedPattern={stats.FirstSkippedPatternId}" : string.Empty));
+                    RaiseTrackerDegradedOnce(fileName, stats.FirstSkippedPatternId);
+                }
+
+                // Calibrate AFTER the pass: this pass's lines were resolved with the
+                // offset established previously, at most one poll (100 ms) old. Buffering
+                // the pass to calibrate first is not an option — the first pass of
+                // AppWorkload.log can be hundreds of MB. The cost is a warm-up of one
+                // growing pass, during which lines fall back to the reader zone and are
+                // flagged as such.
+                if (hadPreviousObservation && calibrationAnchor != null)
+                    CalibrateFrom(_currentSourceFileName, fileName, calibrationAnchor);
+                _currentEntryOffset = -1;
+
+                return Math.Max(0, fileInfo.Length - resumePos);
+            }
+        }
+
         private sealed class PassStats
         {
             public int RegexTimeouts;
@@ -489,7 +495,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             "imeshutdown", "espphasedetected", "setcurrentapp",
             "updatestateinstalled", "updatestatedownloading", "updatestateinstalling",
             "updatestateskipped", "updatestateerror", "updatestatepostponed",
-            "captureexitcode", "capturehresult", "captureappversion",
+            "captureexitcode", "capturehresult", "captureexitcodeclass", "captureappversion",
             "captureapptypewinget", "captureapptypemsi", "captureattemptnumber",
             "capturedetectionresult", "esptrackstatus", "policiesdiscovered",
             "ignorecompletedapp", "updatename", "updatewin32appstate",
@@ -509,6 +515,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 LastMatchedSourceOffsetMinutes = null;
                 LastMatchedSourceOffsetOrigin = CmTraceOffsetOrigin.None;
                 LastMatchedMeasuredWriterOffsetMinutes = null;
+                LastMatchedEraAnchorKind = string.Empty;
             }
             else
             {
@@ -518,6 +525,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 LastMatchedSourceLocalTimestamp = entry.HasTimestamp ? entry.LocalTimestamp : (DateTime?)null;
                 LastMatchedSourceOffsetMinutes = offsetMinutes;
                 LastMatchedSourceOffsetOrigin = origin;
+                LastMatchedEraAnchorKind = origin == CmTraceOffsetOrigin.EraAnchored ? _lastEraAnchorKind : string.Empty;
 
                 // Observational: what the calibrator measured for this file, distinct from what
                 // was applied above.
@@ -555,7 +563,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             // Placed after the staleness gate so a success replayed from a previous
             // enrollment's log cannot clear a genuine current outage.
             if (!isStaleReplayLine && string.Equals(pattern.PatternId, "IME-TOKEN-SUCCESS", StringComparison.OrdinalIgnoreCase))
+            {
                 ClearPendingTokenFailure();
+                // Raw user-token observation for the Entra user-affinity detector (2026-09-04).
+                // Deliberately NOT routed through espPhaseDetected: that path deduplicates once
+                // AccountSetup is set, so a FullESP session would never report the token that
+                // followed the real-user desktop.
+                try { OnUserTokenAcquired?.Invoke(LastMatchedLogTimestamp); }
+                catch (Exception ex) { _logger?.Warning($"OnUserTokenAcquired handler threw: {ex.Message}"); }
+            }
 
             try
             {
@@ -617,6 +633,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
                     case "imetokenfailure":
                         HandleImeTokenFailure(match.Groups["errorCode"]?.Value, message);
+                        // Raw per-line observation (staleness already enforced above via
+                        // AppMutatingActions) — the affinity detector counts failures after
+                        // the real-user desktop; the grace-window Warning stays separate.
+                        try { OnTokenFailureLine?.Invoke(match.Groups["errorCode"]?.Value, LastMatchedLogTimestamp); }
+                        catch (Exception ex) { _logger?.Warning($"OnTokenFailureLine handler threw: {ex.Message}"); }
                         break;
 
                     case "imeimpersonation":
@@ -698,6 +719,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                             _packageStates.GetPackage(_packageStates.CurrentPackageId)?.UpdateHResult(hresultVal);
                         break;
 
+                    case "captureexitcodeclass":
+                        // Return-code class of the exit code captured just before (IME logs the
+                        // number, then "lpExitCode is defined as <class>"). Same current-app
+                        // addressing as captureExitCode; last value wins across a Retry loop.
+                        var exitCodeClassVal = match.Groups["exitCodeClass"]?.Value;
+                        if (!string.IsNullOrEmpty(exitCodeClassVal) && !string.IsNullOrEmpty(_packageStates.CurrentPackageId))
+                            _packageStates.GetPackage(_packageStates.CurrentPackageId)?.UpdateExitCodeClass(exitCodeClassVal);
+                        break;
+
                     case "captureappversion":
                         var appVersionVal = match.Groups["appVersion"]?.Value;
                         if (!string.IsNullOrEmpty(id) && !string.IsNullOrEmpty(appVersionVal))
@@ -802,10 +832,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         break;
 
                     case "resetplatformscriptcontext":
-                        // Session 6b4993e5 fix: a fresh AgentExecutor invocation banner
-                        // ("ExecutorLog AgentExecutor gets invoked") ends the previous
-                        // invocation's line-capture context. See HandleAgentExecutorInvocationBoundary.
-                        HandleAgentExecutorInvocationBoundary();
+                        // "ExecutorLog AgentExecutor gets invoked": a new process — the executor
+                        // lines that follow belong to its own argument line, never to the
+                        // previous invocation (session 6b4993e5).
+                        HandleAgentExecutorInvocation();
+                        break;
+
+                    case "agentinvocationargument":
+                        HandleAgentInvocationArgument(match.Groups["kind"]?.Value);
+                        break;
+
+                    case "agentexecutorcompleted":
+                        HandleAgentExecutorCompleted();
                         break;
 
                     case "healthscriptresult":
@@ -833,11 +871,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <c>_activePatterns</c> → <see cref="HandlePatternMatch"/>). Lets unit tests drive the
         /// script / app handlers deterministically without writing CMTrace files or spinning the
         /// poller. <paramref name="sourceTimestampUtc"/> populates the entry timestamp some
-        /// handlers read via <see cref="LastMatchedLogTimestamp"/>.
+        /// handlers read via <see cref="LastMatchedLogTimestamp"/>. <paramref name="sourceFileName"/>
+        /// names the log the line comes from — positional ownership is per file — and stays in
+        /// effect for later calls; omitted, the line lands in the test file.
         /// </summary>
-        internal void ProcessLogMessageForTest(string message, DateTime? sourceTimestampUtc = null)
+        internal void ProcessLogMessageForTest(string message, DateTime? sourceTimestampUtc = null, string sourceFileName = null)
         {
             if (string.IsNullOrEmpty(message)) return;
+            if (sourceFileName != null) _currentSourceFileName = sourceFileName;
+            NextTestEntry();
             // The test seam hands in an already-resolved UTC instant, so it takes the same route a
             // writer-declared bias does: TimestampUtc set, no zone left to guess.
             var entry = sourceTimestampUtc.HasValue
@@ -941,6 +983,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 }
             }
 
+            // ERA ANCHOR (2026-09-04, session a7140f98): a backlog line whose writer era was
+            // anchored by the bootstrap execution record resolves through that era's offset.
+            // Whole era or nothing — the anchor never crosses an "EMS Agent Started" boundary,
+            // and in-process sibling files (AppWorkload, AppActionProcessor) join by local
+            // time only while the service eras' local ranges are unambiguous. See
+            // ImeLogEraPreScan for why this is the one anchor a backlog line can trust.
+            _lastEraAnchorKind = string.Empty;
+            if (_currentSourceFileName != null && _currentEntryOffset >= 0)
+            {
+                TimeSpan eraOffset;
+                string anchorKind;
+                var resolved = EraTable.TryResolveByOffset(_currentSourceFileName, _currentEntryOffset, out eraOffset, out anchorKind)
+                    || (ImeLogEraPreScan.IsServiceHostedFile(_currentSourceFileName)
+                        && EraTable.TryResolveByLocalTime(entry.LocalTimestamp, out eraOffset, out anchorKind));
+                if (resolved)
+                {
+                    origin = CmTraceOffsetOrigin.EraAnchored;
+                    offsetMinutes = (int)eraOffset.TotalMinutes;
+                    _lastEraAnchorKind = anchorKind;
+                    return DateTime.SpecifyKind(entry.LocalTimestamp - eraOffset, DateTimeKind.Utc);
+                }
+            }
+
             // Fallback for everything not provably fresh: assume the reader's zone, UNIFORMLY.
             // Wrong in absolute terms whenever the writer held a different belief, but
             // self-consistent — both ends of a duration are wrong by the same amount, so derived