chore: bump internal gitlink

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/scripts/Get-StorageAuthHeaders.ps1

@@ -0,0 +1,51 @@
+<#
+.SYNOPSIS
+    Returns the request headers that authorize an Azure Storage REST call with Microsoft Entra.
+
+.DESCRIPTION
+    One place for the storage OAuth contract shared by every publisher in this repo -- the
+    agent ZIP and MSI, the customer bootstrap scripts, the version manifests and the build
+    counters. Resource id, the az invocation, the service version and the failure message
+    live here so they cannot drift between call sites.
+
+    Identity comes from whatever `az login` established: the federated GitHub OIDC principal
+    in CI (azure/login, subject repo:okieselbach/AutopilotMonitor:ref:refs/heads/main), the
+    operator's own account for the local build. No secret is read, stored or passed around.
+
+    x-ms-version is MANDATORY here, not decoration: Entra-authorized requests are rejected
+    below 2017-11-09, and Table requests without a SAS must carry the header at all. 2021-08-06
+    is old enough to be deployed in every region and new enough for everything we send.
+
+    Callers merge the result into their own headers -- `$auth + @{ ... }` yields a new
+    hashtable per request, so nothing is shared across uploads:
+
+        $auth = & "$PSScriptRoot/Get-StorageAuthHeaders.ps1"
+        Invoke-RestMethod -Uri $url -Method Put -Headers ($auth + @{ 'x-ms-blob-type' = 'BlockBlob' }) -Body $bytes
+
+    Acquire once per step and reuse: every call shells out to az (~1s) and the token is valid
+    for the lifetime of a job.
+
+.OUTPUTS
+    [hashtable] Authorization + x-ms-version.
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+# The data-plane resource, not management.azure.com -- a management token is accepted by
+# neither the blob nor the table endpoint.
+$token = az account get-access-token --resource https://storage.azure.com --query accessToken -o tsv 2>$null
+
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+    throw ('Could not acquire an Azure Storage token. In CI this means the azure/login step ' +
+           'is missing or its federated credential does not cover this ref; locally, run ' +
+           '`az login`. A token alone is not enough: the principal also needs Storage Blob ' +
+           'Data Contributor on the container it writes, and Storage Table Data Contributor ' +
+           'on the table -- a missing role shows up later as HTTP 403 AuthorizationPermissionMismatch.')
+}
+
+return @{
+    'Authorization' = "Bearer $token"
+    'x-ms-version'  = '2021-08-06'
+}

.github/scripts/Publish-BootstrapScripts.ps1

@@ -12,52 +12,78 @@
                                 lands a consistent set (ZIP + manifest + scripts).
 
     Both callers run the same code. The scripts on the download alias are the live
-    copy the WDP bootstrap MSI (Invoke-BootstrapDownload.ps1) downloads on every
-    enrolling device, so "current" is a correctness property, not cosmetics.
+    copy the stage-1 loader downloads on every enrolling device, whether it came from
+    Intune or from the bootstrap MSI, so "current" is a correctness property, not
+    cosmetics.
 
     Steps, in order:
-      1. Parse $ScriptVersion from the bootstrap source.
-      2. Render the -Dev variant by literal substitution of the two URL/manifest
+      1. Parse $ScriptVersion from the loader and the bootstrap source.
+      2. Render the -Dev variants by literal substitution of the URL/manifest
          defaults. A missing anchor is a hard failure -- a silently un-substituted
          dev script would point the dev fleet at the stable agent.
-      3. Version-bump guard: if the published bootstrap differs from the source
-         but carries the same $ScriptVersion, abort. Otherwise the docs badge,
+      3. Version-bump guard: if a published script differs from its source but
+         carries the same $ScriptVersion, abort. Otherwise the docs badge,
          version.json.bootstrapVersion and the portal's "your script is outdated"
          hint would all keep asserting a version that is no longer what ships.
-      4. Upload every script blob with Cache-Control: no-cache (they rotate in
+      4. Build the publish set (loader, bootstrap, both dev renders, the extras).
+      5. Authenticode-sign every script (see -SigningToken). Signing is the LAST
+         transformation: it covers the exact CRLF/UTF-8 bytes that get uploaded,
+         and nothing may touch them afterwards or the signature breaks.
+      6. Upload every script blob with Cache-Control: no-cache (they rotate in
          place), mirrored fail-soft to the legacy account.
-      5. Reconcile the two version oracles: version.json.bootstrapVersion
-         (read-modify-write under If-Match, so a concurrent agent release cannot
-         lose its agent fields) and AdminConfiguration.LatestBootstrapV2ScriptVersion.
-      6. Verify through the alias -- re-download each blob and compare SHA-256.
+      7. Reconcile the version oracles: version.json.bootstrapVersion and
+         .loaderVersion (read-modify-write under If-Match, so a concurrent agent
+         release cannot lose its agent fields) and
+         AdminConfiguration.LatestBootstrapV2ScriptVersion.
+      8. Verify through the alias -- re-download each blob and compare SHA-256.
 
-.PARAMETER SasToken
-    Container SAS for the eu storage account with write permission. Leading '?' tolerated.
+    Comparisons against a published script always strip its signature block first
+    (Get-ComparableText). A signature carries a timestamp, so signed bytes differ on
+    every run; without stripping, the bump guard and the drift check would report a
+    change for every unchanged script.
 
 .PARAMETER LegacySasToken
     Container SAS for the legacy account. Optional -- a mirror failure warns, never fails.
-
-.PARAMETER TableSasToken
-    Table SAS for AdminConfiguration. Optional -- omitted or 'XXX' skips the oracle update.
+    The legacy account lives in a different tenant, so the ambient Entra identity cannot
+    reach it; this is the only credential the publisher still takes.
 
 .PARAMETER RepoRoot
     Repository root. Defaults to the parent of .github/scripts.
 
 .PARAMETER DryRun
-    Run every check and render, upload nothing.
+    Run every check and render, upload nothing. A dry run signs when a token is supplied
+    and skips signing when it is not: the PR gate runs this without any Azure login.
+
+.PARAMETER SigningToken
+    Azure Key Vault access token for AzureSignTool. MANDATORY for a real publish -- an
+    unsigned customer script is not something this repo publishes. Together with
+    -KeyVaultUrl and -CertificateName.
+
+.PARAMETER ExpectedPublisher
+    Optional -like pattern the signer subject must match after signing. Pins the publisher
+    instead of accepting any trusted signature; the loader on the device pins the same way.
+
+.PARAMETER SignedOutputDir
+    Optional directory that receives a copy of every published file exactly as uploaded.
+    Used by CI to offer the signed scripts as a build artifact for local inspection.
 
 .EXAMPLE
     ./Publish-BootstrapScripts.ps1 -DryRun
 
 .EXAMPLE
-    ./Publish-BootstrapScripts.ps1 -SasToken $env:SAS -TableSasToken $env:TABLE_SAS
+    ./Publish-BootstrapScripts.ps1 -LegacySasToken $env:LEGACY_SAS -SigningToken $env:AKV_TOKEN `
+        -KeyVaultUrl $env:KV_URL -CertificateName $env:CERT
 #>
 [CmdletBinding()]
 param(
-    [string]$SasToken,
     [string]$LegacySasToken,
-    [string]$TableSasToken,
     [string]$RepoRoot,
+    [string]$SigningToken,
+    [string]$KeyVaultUrl,
+    [string]$CertificateName,
+    [string]$TimestampUrl = 'http://timestamp.acs.microsoft.com',
+    [string]$ExpectedPublisher,
+    [string]$SignedOutputDir,
     [switch]$DryRun
 )
 
@@ -66,9 +92,6 @@ $ErrorActionPreference = 'Stop'
 if (-not $RepoRoot) {
     $RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).Path
 }
-if (-not $DryRun -and [string]::IsNullOrWhiteSpace($SasToken)) {
-    throw 'SasToken is required unless -DryRun is used.'
-}
 
 $ContainerUrl       = 'https://autopilotmonitoreu.blob.core.windows.net/agent'
 $LegacyContainerUrl = 'https://autopilotmonitor.blob.core.windows.net/agent'
@@ -78,8 +101,23 @@ $TableUrl           = "https://autopilotmonitoreu.table.core.windows.net/AdminCo
 $BootstrapSource   = Join-Path $RepoRoot 'scripts/Bootstrap/Install-AutopilotMonitor.ps1'
 $BootstrapBlob     = 'Install-AutopilotMonitor.ps1'
 $DevBlob           = 'Install-AutopilotMonitor-Dev.ps1'
+# Stage 1. Assigned in Intune once, and embedded in the bootstrap MSI; it downloads the
+# bootstrap above on every device and verifies its publisher before running it.
+$LoaderSource      = Join-Path $RepoRoot 'scripts/Bootstrap/Start-AutopilotMonitor.ps1'
+$LoaderBlob        = 'Start-AutopilotMonitor.ps1'
+$LoaderDevBlob     = 'Start-AutopilotMonitor-Dev.ps1'
 $ScriptContentType = 'text/plain; charset=utf-8'
 
+$SigningEnabled = -not [string]::IsNullOrWhiteSpace($SigningToken)
+if (-not $DryRun -and -not $SigningEnabled) {
+    throw ('Publishing requires -SigningToken (plus -KeyVaultUrl and -CertificateName): the ' +
+           'loader on every device verifies the publisher of what it downloads, so an unsigned ' +
+           'script would be rejected in the field. Only -DryRun may run without signing.')
+}
+if ($SigningEnabled -and ([string]::IsNullOrWhiteSpace($KeyVaultUrl) -or [string]::IsNullOrWhiteSpace($CertificateName))) {
+    throw '-SigningToken needs -KeyVaultUrl and -CertificateName.'
+}
+
 function Get-HttpStatus {
     param($ErrorRecord)
     if ($ErrorRecord.Exception.PSObject.Properties['Response'] -and $ErrorRecord.Exception.Response) {
@@ -125,6 +163,132 @@ function Get-PublishBytes {
     return ,(New-Object System.Text.UTF8Encoding $false).GetBytes($normalised)
 }
 
+# A PowerShell signature is appended as a comment block at the end of the file, so the
+# published bytes are "source + signature". Everything that compares a published script to
+# its source has to cut that block off first -- the signature carries a timestamp and is
+# therefore different on every publish, while the script above it is unchanged.
+function Remove-SignatureBlock {
+    param([string]$Text)
+    $marker = '# SIG # Begin signature block'
+    $index = $Text.IndexOf($marker)
+    if ($index -lt 0) { return $Text }
+    return $Text.Substring(0, $index)
+}
+
+# Comparison form: no signature, LF, no trailing blank lines. Used for "is the published
+# copy still this source" -- never for what gets uploaded.
+function Get-ComparableText {
+    param([string]$Text)
+    return (Remove-SignatureBlock $Text).Replace("`r`n", "`n").TrimEnd("`n")
+}
+
+# Signs the publish set in place: each item's bytes are written to a work directory, signed
+# there, verified, and read back as the bytes that will be uploaded. Signing has to be the
+# last transformation -- the signature covers exactly these bytes, so nothing may normalise
+# or re-encode them afterwards.
+function Set-PublishSetSignature {
+    param([object[]]$Items, [string]$WorkDir)
+
+    if (-not (Get-Command azuresigntool -ErrorAction SilentlyContinue)) {
+        throw "azuresigntool is not on PATH. Install it with: dotnet tool install --global AzureSignTool --version 7.0.1"
+    }
+
+    New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
+
+    $paths = @()
+    foreach ($item in $Items) {
+        $path = Join-Path $WorkDir $item.BlobName
+        [System.IO.File]::WriteAllBytes($path, [byte[]]$item.Bytes)
+        $paths += $path
+    }
+
+    Write-Host "Signing $($paths.Count) script(s) with certificate '$CertificateName'..."
+    & azuresigntool.exe sign --verbose `
+        --azure-key-vault-url $KeyVaultUrl `
+        --azure-key-vault-accesstoken $SigningToken `
+        --azure-key-vault-certificate $CertificateName `
+        --timestamp-rfc3161 $TimestampUrl `
+        --file-digest sha256 `
+        --description 'Autopilot Monitor bootstrap' `
+        --description-url 'https://www.autopilotmonitor.com' `
+        $paths
+
+    # Native tool: PowerShell does not throw on a non-zero exit, and an unnoticed signing
+    # failure would publish unsigned scripts that every loader in the field then rejects.
+    if ($LASTEXITCODE -ne 0) {
+        throw "azuresigntool failed with exit code $LASTEXITCODE -- nothing was uploaded."
+    }
+
+    foreach ($item in $Items) {
+        $path = Join-Path $WorkDir $item.BlobName
+        $sig = Get-AuthenticodeSignature -FilePath $path
+        if ($sig.Status -ne 'Valid') {
+            throw "Signature on $($item.BlobName) is '$($sig.Status)', expected 'Valid'."
+        }
+        # Without a timestamp the signature dies with the certificate, and these scripts sit
+        # on customer devices far longer than a certificate lifetime.
+        if (-not $sig.TimeStamperCertificate) {
+            throw "Signature on $($item.BlobName) carries no timestamp."
+        }
+        if ($ExpectedPublisher -and $sig.SignerCertificate.Subject -notlike $ExpectedPublisher) {
+            throw "$($item.BlobName) was signed by '$($sig.SignerCertificate.Subject)', expected '$ExpectedPublisher'."
+        }
+        # Plain assignment, NO comma operator: the ',' elsewhere in this file exists because
+        # PowerShell unrolls an array RETURNED from a function, which is not what a property
+        # assignment does -- here it would wrap the byte[] in an Object[] of length 1 and the
+        # upload would fail converting it back.
+        $signedBytes = [System.IO.File]::ReadAllBytes($path)
+        if ($signedBytes.Length -le $item.Bytes.Length) {
+            throw ("Signed $($item.BlobName) is $($signedBytes.Length) bytes but the unsigned form " +
+                   "was $($item.Bytes.Length) -- a signature only ever adds bytes, so this is a " +
+                   'read-back bug, not a signing result.')
+        }
+        $item.Bytes = $signedBytes
+        Write-Host "  signed $($item.BlobName) ($($signedBytes.Length) bytes, signer $($sig.SignerCertificate.Subject.Split(',')[0]))"
+    }
+}
+
+# Aborts when a published script changed behaviour without a version bump. Consumers act on
+# the version (docs badge, version.json, the portal's outdated-script hint), so an unchanged
+# version has to mean unchanged behaviour.
+function Assert-VersionBump {
+    param(
+        [string]$BlobName,
+        [string]$SourceContent,
+        [string]$SourceOrigin,
+        [string]$SourceVersion
+    )
+
+    $publishedBytes = Get-PublishedBytes "$AliasUrl/$BlobName"
+    if ($null -eq $publishedBytes) {
+        Write-Host "No published $BlobName yet -- version-bump guard skipped (first publish)"
+        return
+    }
+
+    $publishedText = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
+    if ((Get-ComparableText $publishedText) -eq (Get-ComparableText $SourceContent)) {
+        Write-Host "Published $BlobName is already this source (signature block aside)"
+        return
+    }
+
+    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BlobName" -Optional
+
+    if ($null -eq $publishedVersion) {
+        Write-Host "::warning::The published $BlobName is not a readable script (no ScriptVersion found). Republishing over it."
+    } elseif ($publishedVersion -ne $SourceVersion) {
+        Write-Host "Version bump: $publishedVersion -> $SourceVersion ($BlobName)"
+    } elseif ((Get-CodeFingerprint -Text (Remove-SignatureBlock $publishedText) -Origin "$AliasUrl/$BlobName") -eq
+              (Get-CodeFingerprint -Text $SourceContent -Origin $SourceOrigin)) {
+        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
+        Write-Host "::warning::$BlobName changed in comments or formatting only; publishing under the unchanged version $SourceVersion."
+    } else {
+        throw ("Version-bump guard: $BlobName changed behaviour but ScriptVersion is still $SourceVersion. " +
+               "Bump it in $SourceOrigin -- the docs badge, version.json and the " +
+               'portal outdated-script hint all read that value, and customers decide from it whether ' +
+               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
+    }
+}
+
 function Get-BootstrapScriptVersion {
     param([string]$Content, [string]$Origin, [switch]$Optional)
     if ($Content -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"') { return $Matches[1] }
@@ -152,12 +316,16 @@ function Get-CodeFingerprint {
     return (($tokens | Where-Object { $ignored -notcontains $_.Kind.ToString() } | ForEach-Object { $_.Text }) -join "`n")
 }
 
-# ------------------------------------------------------------------ 1. source
+# ------------------------------------------------------------------ 1. sources
 $sourceContent = Get-Content $BootstrapSource -Raw
 $sourceBytes   = Get-PublishBytes $sourceContent
 $scriptVersion = Get-BootstrapScriptVersion -Content $sourceContent -Origin $BootstrapSource
 Write-Host "Bootstrap script version: $scriptVersion"
 
+$loaderContent = Get-Content $LoaderSource -Raw
+$loaderVersion = Get-BootstrapScriptVersion -Content $loaderContent -Origin $LoaderSource
+Write-Host "Loader script version: $loaderVersion"
+
 # ------------------------------------------------------------------ 2. dev render
 $stableUrlLiteral = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip"'
 $devUrlLiteral    = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent-dev.zip"'
@@ -170,33 +338,21 @@ if ($sourceContent.IndexOf($stableUrlLiteral) -lt 0 -or $sourceContent.IndexOf($
 $devContent = $sourceContent.Replace($stableUrlLiteral, $devUrlLiteral).Replace($stableManLiteral, $devManLiteral)
 Write-Host "Rendered $DevBlob (dev agent URL + version-dev.json)"
 
-# ------------------------------------------------------------------ 3. bump guard
-$publishedBytes = Get-PublishedBytes "$AliasUrl/$BootstrapBlob"
-if ($null -eq $publishedBytes) {
-    Write-Host 'No published bootstrap yet -- version-bump guard skipped (first publish)'
-} elseif ((Get-Sha256 $publishedBytes) -eq (Get-Sha256 $sourceBytes)) {
-    Write-Host 'Published bootstrap is already byte-identical to the source'
-} else {
-    $publishedText    = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
-    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BootstrapBlob" -Optional
+# The dev loader must fetch the dev bootstrap, or a dev device would run the stable chain.
+$stableLoaderLiteral = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1"'
+$devLoaderLiteral    = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor-Dev.ps1"'
 
-    if ($null -eq $publishedVersion) {
-        Write-Host "::warning::The published $BootstrapBlob is not a readable bootstrap script (no ScriptVersion found). Republishing over it."
-    } elseif ($publishedVersion -ne $scriptVersion) {
-        Write-Host "Version bump: $publishedVersion -> $scriptVersion"
-    } elseif ((Get-CodeFingerprint -Text $publishedText -Origin "$AliasUrl/$BootstrapBlob") -eq
-              (Get-CodeFingerprint -Text $sourceContent -Origin $BootstrapSource)) {
-        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
-        Write-Host "::warning::$BootstrapBlob changed in comments or formatting only; publishing under the unchanged version $scriptVersion."
-    } else {
-        throw ("Version-bump guard: $BootstrapBlob changed behaviour but ScriptVersion is still $scriptVersion. " +
-               "Bump it in $BootstrapSource -- the docs badge, version.json.bootstrapVersion and the " +
-               'portal outdated-script hint all read that value, and customers decide from it whether ' +
-               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
-    }
+if ($loaderContent.IndexOf($stableLoaderLiteral) -lt 0) {
+    throw "Loader dev-render: anchor literal missing in $LoaderSource"
 }
+$devLoaderContent = $loaderContent.Replace($stableLoaderLiteral, $devLoaderLiteral)
+Write-Host "Rendered $LoaderDevBlob (points at $DevBlob)"
 
-# ------------------------------------------------------------------ 4. upload
+# ------------------------------------------------------------------ 3. bump guards
+Assert-VersionBump -BlobName $BootstrapBlob -SourceContent $sourceContent -SourceOrigin $BootstrapSource -SourceVersion $scriptVersion
+Assert-VersionBump -BlobName $LoaderBlob    -SourceContent $loaderContent -SourceOrigin $LoaderSource    -SourceVersion $loaderVersion
+
+# ------------------------------------------------------------------ 4. publish set
 # Sources beyond the bootstrap pair, read straight from the repo.
 $extraSources = @(
     @{ Path = 'scripts/Bootstrap/Test-ShouldBootstrapAgent.ps1';       BlobName = 'Test-ShouldBootstrapAgent.ps1' }
@@ -206,20 +362,38 @@ $extraSources = @(
 # Uninstall-AutopilotMonitor.ps1 is deliberately NOT published: nothing links it, and
 # an unauthenticated uninstall script on the public download host is not a feature.
 
+# Text is the unsigned publish form and stays the reference for every comparison against a
+# published copy; Bytes is what goes on the wire and carries the signature after step 4.
 $publishSet = [System.Collections.Generic.List[object]]::new()
-$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Bytes = $sourceBytes })
-$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Bytes = (Get-PublishBytes $devContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $LoaderBlob;    Text = $loaderContent;    Bytes = (Get-PublishBytes $loaderContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $LoaderDevBlob; Text = $devLoaderContent; Bytes = (Get-PublishBytes $devLoaderContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Text = $sourceContent;    Bytes = $sourceBytes })
+$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Text = $devContent;       Bytes = (Get-PublishBytes $devContent) })
 foreach ($extra in $extraSources) {
     $extraPath = Join-Path $RepoRoot $extra.Path
     if (-not (Test-Path $extraPath)) {
         throw "Publish source missing: $extraPath"
     }
-    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Bytes = (Get-PublishBytes (Get-Content $extraPath -Raw)) })
+    $extraText = Get-Content $extraPath -Raw
+    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Text = $extraText; Bytes = (Get-PublishBytes $extraText) })
+}
+
+# ------------------------------------------------------------------ 5. sign
+# After this point the bytes are final. Normalising, re-encoding or rewriting a line ending
+# would invalidate the signature, and the device-side loader would refuse the script.
+if ($SigningEnabled) {
+    Set-PublishSetSignature -Items $publishSet -WorkDir (Join-Path ([System.IO.Path]::GetTempPath()) "apm-publish-$PID")
+} else {
+    Write-Host '::warning::No signing token supplied -- dry run continues with unsigned scripts.'
 }
 
 $legacySas = if ($LegacySasToken) { $LegacySasToken.TrimStart('?') } else { '' }
-$writeSas  = if ($SasToken) { $SasToken.TrimStart('?') } else { '' }
 
+# Acquired lazily: a dry run must stay runnable without any Azure login -- the PR gate
+# (bootstrap-script-gates.yml) executes this script with -DryRun and never logs in.
+$authHeaders = if ($DryRun) { $null } else { & (Join-Path $PSScriptRoot 'Get-StorageAuthHeaders.ps1') }
+
+# ------------------------------------------------------------------ 6. upload
 foreach ($item in $publishSet) {
     # Explicit type, not a convenience: an Object[] body is uploaded as space-separated
     # decimals rather than raw bytes, and every hash check still passes because [byte[]]
@@ -227,11 +401,21 @@ foreach ($item in $publishSet) {
     [byte[]]$bytes = $item.Bytes
     $item | Add-Member -NotePropertyName Sha256 -NotePropertyValue (Get-Sha256 $bytes) -Force
 
+    # Exactly the bytes that go on the wire, for the CI artifact. Written in a dry run too:
+    # that is the run an operator uses to inspect a signed script before it is published.
+    if ($SignedOutputDir) {
+        New-Item -ItemType Directory -Force -Path $SignedOutputDir | Out-Null
+        [System.IO.File]::WriteAllBytes((Join-Path $SignedOutputDir $item.BlobName), $bytes)
+    }
+
     if ($DryRun) {
-        # Doubles as a drift check: says per blob whether the alias already serves this source.
+        # Doubles as a drift check: says per blob whether the alias already serves this
+        # source. Compared as text without the signature block -- signed bytes differ on
+        # every run, so a byte comparison would report drift for every unchanged script.
         $served = Get-PublishedBytes "$AliasUrl/$($item.BlobName)"
         $state = if ($null -eq $served) { 'MISSING on the alias' }
-                 elseif ((Get-Sha256 $served) -eq $item.Sha256) { 'already current' }
+                 elseif ((Get-ComparableText ([System.Text.Encoding]::UTF8.GetString($served))) -eq
+                         (Get-ComparableText $item.Text)) { 'already current' }
                  else { 'STALE on the alias' }
         Write-Host "  [dry-run] $($item.BlobName) ($($bytes.Length) bytes, sha256 $($item.Sha256)) -- $state"
         continue
@@ -241,8 +425,18 @@ foreach ($item in $publishSet) {
     # with Front Door. Route caching is disabled there, but a stale script paired with a
     # fresh manifest would fail the bootstrap SHA check -- this keeps that class of bug
     # impossible even if caching is ever re-enabled.
-    $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = $ScriptContentType; 'x-ms-blob-cache-control' = 'no-cache' }
-    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)?$writeSas" -Method Put -Headers $headers -Body $bytes | Out-Null
+    #
+    # Content-Disposition: without it a text/plain blob opens as a web page in every
+    # browser, and the documented "download the script" step silently becomes "copy this
+    # text". The header makes the link a download everywhere, and command-line clients
+    # (the loader, the MSI, curl) ignore it.
+    $headers = @{
+        'x-ms-blob-type'                = 'BlockBlob'
+        'Content-Type'                  = $ScriptContentType
+        'x-ms-blob-cache-control'       = 'no-cache'
+        'x-ms-blob-content-disposition' = ('attachment; filename="{0}"' -f $item.BlobName)
+    }
+    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)" -Method Put -Headers ($authHeaders + $headers) -Body $bytes | Out-Null
 
     # Read straight back from the blob (authoritative, no CDN in the way) before touching the
     # mirror or the next file. The alias verification at the end would catch a bad body too,
@@ -266,7 +460,7 @@ foreach ($item in $publishSet) {
     }
 }
 
-# ------------------------------------------------------------------ 5. version oracles
+# ------------------------------------------------------------------ 7. version oracles
 # version.json is the agent manifest; only bootstrapVersion belongs to us. Read from the
 # blob (not the alias) for an authoritative ETag, write back under If-Match so a concurrent
 # agent release cannot lose its version/sha256 fields.
@@ -278,11 +472,15 @@ if (-not $DryRun) {
         } else { [string]$manifestResp.Content }
         $manifest = $manifestRaw | ConvertFrom-Json
 
-        if ($manifest.bootstrapVersion -eq $scriptVersion) {
-            Write-Host "version.json already reports bootstrapVersion $scriptVersion"
+        if ($manifest.bootstrapVersion -eq $scriptVersion -and $manifest.loaderVersion -eq $loaderVersion) {
+            Write-Host "version.json already reports bootstrapVersion $scriptVersion and loaderVersion $loaderVersion"
         } else {
             $etag = '"' + ([string]($manifestResp.Headers['ETag'] | Select-Object -First 1)).Trim('"') + '"'
             $manifest | Add-Member -NotePropertyName 'bootstrapVersion' -NotePropertyValue $scriptVersion -Force
+            # Additive: no consumer reads loaderVersion yet. It exists so support can tell
+            # which stage-1 file a device was assigned -- stage 2 is always current by
+            # construction, so its version says nothing about the customer's Intune copy.
+            $manifest | Add-Member -NotePropertyName 'loaderVersion' -NotePropertyValue $loaderVersion -Force
             $body = [System.Text.Encoding]::UTF8.GetBytes(($manifest | ConvertTo-Json -Compress))
             $manifestHeaders = @{
                 'x-ms-blob-type'          = 'BlockBlob'
@@ -290,8 +488,8 @@ if (-not $DryRun) {
                 'x-ms-blob-cache-control' = 'no-cache'
                 'If-Match'                = $etag
             }
-            Invoke-RestMethod -Uri "$ContainerUrl/version.json?$writeSas" -Method Put -Headers $manifestHeaders -Body $body | Out-Null
-            Write-Host "version.json bootstrapVersion -> $scriptVersion (agent fields untouched)"
+            Invoke-RestMethod -Uri "$ContainerUrl/version.json" -Method Put -Headers ($authHeaders + $manifestHeaders) -Body $body | Out-Null
+            Write-Host "version.json bootstrapVersion -> $scriptVersion, loaderVersion -> $loaderVersion (agent fields untouched)"
 
             if ($legacySas) {
                 try {
@@ -310,11 +508,8 @@ if (-not $DryRun) {
     }
 }
 
-$tableSas = if ($TableSasToken) { $TableSasToken.TrimStart('?') } else { '' }
 if ($DryRun) {
     Write-Host "  [dry-run] would set AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
-} elseif ([string]::IsNullOrEmpty($tableSas) -or $tableSas -eq 'XXX') {
-    Write-Host 'SKIPPED: AdminConfiguration update -- set AZURE_TABLE_ADMIN_SAS_TOKEN to enable the portal version oracle'
 } else {
     $tableHeaders = @{
         'Content-Type' = 'application/json'
@@ -322,11 +517,11 @@ if ($DryRun) {
         'If-Match'     = '*'
     }
     $tableBody = @{ LatestBootstrapV2ScriptVersion = $scriptVersion } | ConvertTo-Json
-    Invoke-RestMethod -Uri "$TableUrl`?$tableSas" -Method Merge -Headers $tableHeaders -Body $tableBody | Out-Null
+    Invoke-RestMethod -Uri $TableUrl -Method Merge -Headers ($authHeaders + $tableHeaders) -Body $tableBody | Out-Null
     Write-Host "AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
 }
 
-# ------------------------------------------------------------------ 6. verify via alias
+# ------------------------------------------------------------------ 8. verify via alias
 if (-not $DryRun) {
     $pending = [System.Collections.ArrayList]::new()
     $publishSet | ForEach-Object { [void]$pending.Add($_) }
@@ -358,7 +553,8 @@ if ($env:GITHUB_STEP_SUMMARY) {
     $summary = @(
         "### Bootstrap scripts: $mode",
         '',
-        "Bootstrap script version: **$scriptVersion**",
+        "Loader script version: **$loaderVersion** | Bootstrap script version: **$scriptVersion**",
+        "Signed: **$(if ($SigningEnabled) { "yes, certificate '$CertificateName'" } else { 'NO (unsigned dry run)' })**",
         ''
     ) + ($publishSet | ForEach-Object { "- $($_.BlobName) -- sha256 $($_.Sha256)" })
     ($summary -join [Environment]::NewLine) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8

.github/scripts/Request-BuildNumber.ps1

@@ -12,7 +12,8 @@
     A failed build burns a number, which is harmless -- uniqueness matters,
     density does not.
 
-    The blob is public-read; only the write needs the container SAS.
+    The blob is public-read; only the write needs authorization, and that comes from the
+    ambient Entra identity (see Get-StorageAuthHeaders.ps1) -- no secret is passed in.
 
     Why a counter and not the published version manifest: manifests are written
     on publish, not on build (the agent writes version.json only for stable
@@ -20,10 +21,7 @@
     overwrite each other's versioned artifact.
 
 .PARAMETER CounterUrl
-    Full URL of the counter blob, without SAS.
-
-.PARAMETER SasToken
-    Container SAS with create+write permission. A leading '?' is tolerated.
+    Full URL of the counter blob.
 
 .PARAMETER Override
     Explicit build number instead of counter+1. If it is not greater than the
@@ -37,20 +35,19 @@
     [int] the reserved build number. Progress goes to the host, not the pipeline.
 
 .EXAMPLE
-    $n = ./Request-BuildNumber.ps1 -CounterUrl $url -SasToken $sas
+    $n = ./Request-BuildNumber.ps1 -CounterUrl $url
 #>
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)][string]$CounterUrl,
-    [Parameter(Mandatory = $true)][string]$SasToken,
     [int]$Override = 0,
     [int]$MaxAttempts = 5
 )
 
 $ErrorActionPreference = 'Stop'
 
-# Tolerate both secret formats ("sp=cw&..." and "?sp=cw&...").
-$writeUrl = $CounterUrl + '?' + $SasToken.TrimStart('?')
+# The write is Entra-authorized; the read below stays anonymous (public container).
+$authHeaders = & (Join-Path $PSScriptRoot 'Get-StorageAuthHeaders.ps1')
 
 function Get-HttpStatus {
     param($ErrorRecord)
@@ -85,8 +82,8 @@ for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
     $target = if ($Override -gt 0) { $Override } else { $counter.Value + 1 }
 
     try {
-        $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'If-Match' = $counter.ETag }
-        Invoke-RestMethod -Uri $writeUrl -Method Put -Headers $headers -Body "$target" -ContentType 'text/plain' | Out-Null
+        $headers = $authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'If-Match' = $counter.ETag }
+        Invoke-RestMethod -Uri $CounterUrl -Method Put -Headers $headers -Body "$target" -ContentType 'text/plain' | Out-Null
         Write-Host "  Reserved build number $target (CAS write ok, attempt $attempt)"
         return $target
     } catch {

.github/workflows/build-agent.yml

@@ -57,6 +57,13 @@ env:
   VERSIONED_ZIP: AutopilotMonitor-Agent-v2.zip
   STABLE_ZIP: AutopilotMonitor-Agent.zip
   STABLE_MANIFEST: version.json
+  # Authenticode via Azure Key Vault; identity and vault come from repository variables.
+  # CODE_SIGN_EXPECTED_SUBJECT is optional and pins the publisher in the verify step.
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
   build:
@@ -67,12 +74,64 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      # Every released build is signed; a missing variable stops the run before a build
+      # number is burnt.
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Every released build must be Authenticode-signed."
+            }
+          }
+          Write-Host "Code-signing configuration present (certificate '$env:CODE_SIGN_CERTIFICATE_NAME')"
+
+      # Logs in FIRST and only to fetch the Key Vault token: azure/login sets the default az
+      # account, so the storage login below has to be the last one. Both federated credentials
+      # are bound to the ref, so this job must never be given an `environment:` -- that would
+      # change the OIDC subject claim and break both logins.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # Every storage write below (counter blob, agent ZIP, manifests, AdminConfiguration)
+      # is authorized by this federated identity -- no SAS secret. One login covers the whole
+      # job: the federated credential is bound to the ref, and a release run takes ~2 minutes,
+      # well inside the token lifetime. Only the legacy mirror still needs a SAS: that account
+      # lives in the pre-migration tenant, where this principal has no identity.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
       # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
       - name: Setup .NET
         uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 
+      # Version pinned; roll-forward because the tool targets an older runtime than the SDK above.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
       # Build numbers come from the shared counter blob -- one counter and one
       # implementation for CI and the local build (.github/scripts/Request-BuildNumber.ps1).
       # Reserve-before-build with ETag-CAS: concurrent builds can never mint the same
@@ -85,7 +144,6 @@ jobs:
         # build_number could otherwise break out of the quotes and run arbitrary code.
         env:
           BUILD_NUMBER_OVERRIDE: ${{ inputs.build_number }}
-          AGENT_SAS_TOKEN: ${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}
         run: |
           $override = 0
           if ($env:BUILD_NUMBER_OVERRIDE -ne '') {
@@ -96,7 +154,7 @@ jobs:
           }
 
           $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v$($env:LINE_MAJOR).txt"
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken $env:AGENT_SAS_TOKEN -Override $override
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -Override $override
 
           $csproj = Get-Content $env:CSPROJ_PATH -Raw
           if ($csproj -match '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -129,6 +187,47 @@ jobs:
       - name: Run Agent unit tests
         run: dotnet test ${{ env.TEST_PROJECT }} --configuration Release --no-restore --verbosity quiet
 
+      # Authenticode over everything we author; third-party assemblies keep their own signature.
+      #
+      # THE POSITION IS LOAD-BEARING: signing rewrites the PE file, so it must run before the
+      # ZIP and every SHA-256 in the next step -- those hashes are the bootstrap's integrity
+      # oracle, and hashes taken before signing match no downloaded file.
+      #
+      # $LASTEXITCODE is checked explicitly: PowerShell does not throw on a native non-zero exit.
+      - name: Sign agent binaries (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $targets = @()
+          $targets += Get-ChildItem -Path "$env:AGENT_OUTPUT/*" -Include 'AutopilotMonitor.*.exe', 'AutopilotMonitor.*.dll' -File
+          $targets += Get-ChildItem -Path "$env:DIALOG_OUTPUT/AutopilotMonitor.SummaryDialog.exe" -File
+
+          if (-not ($targets | Where-Object Name -eq 'AutopilotMonitor.Agent.exe')) {
+            throw "AutopilotMonitor.Agent.exe not found in $env:AGENT_OUTPUT -- nothing to sign."
+          }
+          if (-not ($targets | Where-Object Name -eq 'AutopilotMonitor.SummaryDialog.exe')) {
+            throw "AutopilotMonitor.SummaryDialog.exe not found in $env:DIALOG_OUTPUT -- nothing to sign."
+          }
+
+          $targets | ForEach-Object { Write-Host "Signing $($_.Name)" }
+
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description "Autopilot Monitor Agent" `
+            --description-url "https://www.autopilotmonitor.com" `
+            ($targets | ForEach-Object { $_.FullName })
+
+          if ($LASTEXITCODE -ne 0) {
+            throw "azuresigntool failed with exit code $LASTEXITCODE -- aborting before anything is published."
+          }
+
       - name: Create release artifact
         id: artifact
         shell: pwsh
@@ -219,12 +318,57 @@ jobs:
           "sha256=$sha256Hash" >> $env:GITHUB_OUTPUT
           "exe_sha256=$exeSha256Hash" >> $env:GITHUB_OUTPUT
 
+      # Verified against the STAGING copy -- the exact bytes that ship. The invariant is "every
+      # AutopilotMonitor PE in the ZIP is signed", so a project added later cannot ride along
+      # unsigned. A missing timestamp fails too: without it the signature dies with the cert.
+      - name: Verify Authenticode signatures
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $files = Get-ChildItem -Path "staging/agent/*" -Include 'AutopilotMonitor.*.exe', 'AutopilotMonitor.*.dll' -File
+          if ($files.Count -lt 2) {
+            throw "Expected signed binaries in staging/agent, found $($files.Count)."
+          }
+
+          $failed = $false
+          $thumbprints = @{}
+          foreach ($file in $files) {
+            $sig = Get-AuthenticodeSignature -FilePath $file.FullName
+            if ($sig.Status -ne 'Valid') {
+              Write-Host "::error file=$($file.Name)::Signature status is '$($sig.Status)' -- expected 'Valid'."
+              $failed = $true
+              continue
+            }
+            if (-not $sig.TimeStamperCertificate) {
+              Write-Host "::error file=$($file.Name)::Signature carries no RFC-3161 timestamp -- it would expire with the certificate."
+              $failed = $true
+              continue
+            }
+            if (-not [string]::IsNullOrWhiteSpace($env:CODE_SIGN_EXPECTED_SUBJECT) -and
+                $sig.SignerCertificate.Subject -notlike $env:CODE_SIGN_EXPECTED_SUBJECT) {
+              Write-Host "::error file=$($file.Name)::Signed by '$($sig.SignerCertificate.Subject)', expected '$env:CODE_SIGN_EXPECTED_SUBJECT'."
+              $failed = $true
+              continue
+            }
+            $thumbprints[$sig.SignerCertificate.Thumbprint] = $true
+            Write-Host "$($file.Name): Valid, timestamped $($sig.TimeStamperCertificate.Subject.Split(',')[0]), signer $($sig.SignerCertificate.Subject)"
+          }
+
+          if ($thumbprints.Count -gt 1) {
+            Write-Host "::error::Staged binaries carry $($thumbprints.Count) different signing certificates -- expected exactly one."
+            $failed = $true
+          }
+          if ($failed) {
+            throw "Signature verification failed. Nothing was published."
+          }
+          Write-Host "All $($files.Count) binaries signed with certificate $($thumbprints.Keys -join ', ')"
+
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
           # Legacy mirror (transition until customers moved to the download.-alias):
           # blobs are ALSO pushed to the old account so the bootstrap URL baked into
           # customers' Intune scripts keeps serving current bits. Fail-soft -- a
@@ -234,7 +378,6 @@ jobs:
 
           function Send-Blob {
             param([string]$Local, [string]$BlobName, [string]$ContentType)
-            $url = "$containerUrl/$BlobName`?$sasToken"
             $bytes = [System.IO.File]::ReadAllBytes($Local)
             # no-cache on EVERY blob: they all rotate in place (even the per-line ZIP is
             # overwritten each build), and the download alias fronts them with Front Door.
@@ -248,7 +391,7 @@ jobs:
               $md5.Dispose()
             }
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1MB, 2)) MB)..."
-            Invoke-RestMethod -Uri $url -Method Put -Headers $headers -Body $bytes
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName" -Method Put -Headers ($authHeaders + $headers) -Body $bytes
             Write-Host "  uploaded $BlobName"
             if (-not [string]::IsNullOrEmpty($legacySasToken)) {
               try {
@@ -274,47 +417,57 @@ jobs:
             # to main, so a release lands a set that is consistent with what is already live
             # (dev render, version-bump guard, bootstrapVersion oracles, alias verification).
             # Runs AFTER version.json so its bootstrapVersion read sees this build's manifest.
+            # Signed with the same identity: the device-side loader verifies the publisher
+            # of what it downloads, and the publisher refuses to upload unsigned scripts.
             ./.github/scripts/Publish-BootstrapScripts.ps1 `
-              -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
               -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
-              -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}'
+              -SigningToken $env:CODE_SIGN_AKV_ACCESS_TOKEN `
+              -KeyVaultUrl $env:CODE_SIGN_KEY_VAULT_URL `
+              -CertificateName $env:CODE_SIGN_CERTIFICATE_NAME `
+              -TimestampUrl $env:CODE_SIGN_TIMESTAMP_URL `
+              -ExpectedPublisher $env:CODE_SIGN_EXPECTED_SUBJECT
           }
 
           # Update AdminConfiguration LatestAgentV2* -- ONLY on stable cutover. The hash-oracle
           # must never point at a build that is not actually in the stable namespace.
           # LatestBootstrapV2ScriptVersion is NOT set here: it belongs to the script publisher
           # above, which also owns it on script-only pushes. One writer per field.
-          $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}".TrimStart('?')
           if ('${{ inputs.publish_as_stable }}' -ne 'true') {
             Write-Host "SKIPPED: AdminConfiguration update (versioned-only run -- stable namespace unchanged)"
-          } elseif ([string]::IsNullOrEmpty($tableSasToken) -or $tableSasToken -eq "XXX") {
-            Write-Host "SKIPPED: Table SAS token not configured -- set AZURE_TABLE_ADMIN_SAS_TOKEN secret to enable backend hash-oracle"
           } else {
             $sha256 = "${{ steps.artifact.outputs.sha256 }}"
             $exeSha256 = "${{ steps.artifact.outputs.exe_sha256 }}"
             $agentVersion = "${{ steps.version.outputs.version }}"
-            $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')?$tableSasToken"
+            $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')"
             $tableBody = @{
               LatestAgentV2Version    = $agentVersion
               LatestAgentV2Sha256     = $sha256
               LatestAgentV2ExeSha256  = $exeSha256
             }
-            Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers @{
+            Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers ($authHeaders + @{
               "Content-Type" = "application/json"
               "Accept"       = "application/json;odata=nometadata"
               "If-Match"     = "*"
-            } -Body ($tableBody | ConvertTo-Json)
+            }) -Body ($tableBody | ConvertTo-Json)
             Write-Host "AdminConfiguration updated: V2 version=$agentVersion, sha256=$sha256, exeSha256=$exeSha256"
           }
 
-      # Sigstore keyless provenance: binds the ZIP digest to this workflow run (repo, ref,
-      # commit, workflow file) in a public transparency log. The digest covers the identical
+      # Sigstore keyless provenance: binds the artifact digests to this workflow run (repo, ref,
+      # commit, workflow file) in a public transparency log. The digests cover the identical
       # bytes uploaded to blob (versioned AND stable), so one attestation covers all copies.
-      # Verify: gh attestation verify <zip> --repo okieselbach/AutopilotMonitor
-      - name: Attest build provenance (ZIP)
+      # Complements Authenticode rather than replacing it: the signature says who published a
+      # binary, the attestation which build produced these exact bytes. Both EXEs are subjects
+      # of their own so an extracted binary can be verified without the ZIP.
+      # Verify: gh attestation verify <file> --repo okieselbach/AutopilotMonitor
+      # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
+      - name: Attest build provenance
+        if: inputs.upload_blob || inputs.create_release
         uses: actions/attest-build-provenance@v4
         with:
-          subject-path: ${{ steps.artifact.outputs.versioned_zip_release }}
+          subject-path: |
+            ${{ steps.artifact.outputs.versioned_zip_release }}
+            staging/agent/AutopilotMonitor.Agent.exe
+            staging/agent/AutopilotMonitor.SummaryDialog.exe
 
       - name: Upload build artifact
         uses: actions/upload-artifact@v7
@@ -356,7 +509,7 @@ jobs:
             - **Published as stable:** ${{ inputs.publish_as_stable }}
 
             ### Provenance
-            This ZIP carries a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
+            The executables are Authenticode-signed and timestamped. The ZIP and both executables carry a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
             ```
             gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/AutopilotMonitor
             ```

.github/workflows/build-msi.yml

@@ -1,11 +1,11 @@
 name: Build & Publish Bootstrap MSI
 
 # Thin MDM LOB delivery vehicle for WDP (Autopilot v2) — see
-# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI carries no bootstrap
-# logic (only the runner script that downloads the CURRENT server-hosted
-# Install-AutopilotMonitor.ps1), so it is rebuilt rarely: only when the runner script
-# or the WiX package changes. Version lives in Package.wxs — bump it there before
-# dispatching so Intune LOB update detection sees a new ProductVersion.
+# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI is packaging only: it
+# carries the SAME stage-1 loader that is assigned directly in Intune, so it is rebuilt
+# rarely — only when that loader or the WiX package changes. Version lives in Package.wxs
+# — bump it there before dispatching so Intune LOB update detection sees a new
+# ProductVersion.
 
 on:
   workflow_dispatch:
@@ -23,8 +23,15 @@ permissions:
 
 env:
   MSI_PROJECT_DIR: src/Agent/AutopilotMonitor.BootstrapMsi
-  RUNNER_SCRIPT: src/Agent/AutopilotMonitor.BootstrapMsi/Invoke-BootstrapDownload.ps1
+  RUNNER_SCRIPT: scripts/Bootstrap/Start-AutopilotMonitor.ps1
   STABLE_MSI: AutopilotMonitor-Bootstrap.msi
+  # Authenticode via Azure Key Vault; identity and vault come from repository variables.
+  # CODE_SIGN_EXPECTED_SUBJECT is optional and pins the publisher in the verify steps.
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
   build:
@@ -35,8 +42,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
-      # The runner executes as SYSTEM on every enrolling device — a parse error or
+      # The loader executes as SYSTEM on every enrolling device — a parse error or
       # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
+      # bootstrap-script-gates.yml runs the same checks plus Pester on pushes; this job
+      # stands on its own because it can be dispatched at any time.
       - name: Validate runner script (parse + ASCII-only)
         shell: pwsh
         run: |
@@ -62,9 +71,75 @@ jobs:
           Write-Host "MSI version (from Package.wxs): $version"
           "version=$version" >> $env:GITHUB_OUTPUT
 
+      # Every published MSI is signed; a missing variable stops the run before the build.
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Every published MSI must be Authenticode-signed."
+            }
+          }
+
+      # Logs in FIRST and only to fetch the Key Vault token: azure/login sets the default az
+      # account, so the storage login below has to be the last one. Both federated credentials
+      # are bound to the ref, so this job must never be given an `environment:` -- that would
+      # change the OIDC subject claim and break both logins.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # The blob upload below is authorized by this federated identity, not by a SAS.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
       - name: Install WiX toolset
         run: dotnet tool install --global wix --version "5.*"
 
+      # Version pinned; roll-forward because the tool targets an older runtime than the SDK.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
+      # BEFORE the build: wix embeds the file as it finds it, so a loader signed afterwards
+      # would leave the copy inside the MSI unsigned. Devices under an AllSigned policy need
+      # the embedded loader to carry a signature of its own.
+      - name: Sign bootstrap loader (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description 'Autopilot Monitor bootstrap runner' `
+            --description-url 'https://www.autopilotmonitor.com' `
+            $env:RUNNER_SCRIPT
+          if ($LASTEXITCODE -ne 0) { throw "azuresigntool failed with exit code $LASTEXITCODE" }
+
       - name: Build MSI
         shell: pwsh
         run: |
@@ -75,16 +150,46 @@ jobs:
           wix build Package.wxs -arch x64 -o $out
           Pop-Location
           if (-not (Test-Path $env:STABLE_MSI)) { Write-Error "wix build produced no MSI"; exit 1 }
-          $sha256 = (Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant()
           Write-Host "Built $env:STABLE_MSI ($([math]::Round((Get-Item $env:STABLE_MSI).Length / 1KB)) KB)"
-          Write-Host "SHA-256: $sha256"
+
+      # Signing rewrites the MSI, so it runs before the hash and the upload. A missing
+      # timestamp fails the run: without it the signature dies with the certificate.
+      - name: Sign MSI (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description 'Autopilot Monitor Bootstrap' `
+            --description-url 'https://www.autopilotmonitor.com' `
+            $env:STABLE_MSI
+          if ($LASTEXITCODE -ne 0) { throw "azuresigntool failed with exit code $LASTEXITCODE" }
+
+          # The MSI and the loader it carries -- verified here, before anything is published.
+          foreach ($file in @($env:STABLE_MSI, $env:RUNNER_SCRIPT)) {
+            $sig = Get-AuthenticodeSignature -FilePath $file
+            if ($sig.Status -ne 'Valid') { throw "Signature on $file is '$($sig.Status)', expected 'Valid'." }
+            if (-not $sig.TimeStamperCertificate) { throw "Signature on $file carries no timestamp." }
+            if ($env:CODE_SIGN_EXPECTED_SUBJECT -and $sig.SignerCertificate.Subject -notlike $env:CODE_SIGN_EXPECTED_SUBJECT) {
+              throw "$file was signed by '$($sig.SignerCertificate.Subject)', expected '$env:CODE_SIGN_EXPECTED_SUBJECT'."
+            }
+            Write-Host "$file : Valid, timestamped, signer $($sig.SignerCertificate.Subject.Split(',')[0])"
+          }
+
+          Write-Host "SHA-256: $((Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant())"
 
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
           $version = "${{ steps.version.outputs.version }}"
 
           # Same Send-Blob contract as build-agent.yml: no-cache on every blob because the
@@ -102,7 +207,7 @@ jobs:
             $headers["Content-MD5"] = [Convert]::ToBase64String($md5.ComputeHash($bytes))
             $md5.Dispose()
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1KB)) KB)..."
-            Invoke-RestMethod -Uri "$containerUrl/$BlobName`?$sasToken" -Method Put -Headers $headers -Body $bytes
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName" -Method Put -Headers ($authHeaders + $headers) -Body $bytes
             Write-Host "  uploaded $BlobName"
           }
 
@@ -125,9 +230,11 @@ jobs:
           }
           Write-Host "Alias verified: https://download.autopilotmonitor.com/agent/$env:STABLE_MSI ($remoteSize bytes)"
 
-      # Sigstore keyless provenance, same as the agent ZIP. Verify:
+      # Sigstore keyless provenance, same as the agent ZIP; covers the signed bytes. Skipped
+      # on runs that publish nothing -- no log entry for bytes nobody receives. Verify:
       # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (MSI)
+        if: inputs.upload_blob
         uses: actions/attest-build-provenance@v4
         with:
           subject-path: ${{ env.STABLE_MSI }}

.github/workflows/deploy-backend.yml

@@ -41,7 +41,7 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/backend.txt" -SasToken '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/backend.txt"
 
           $csproj = Get-Content ${{ env.CSPROJ_PATH }} -Raw
           if ($csproj -notmatch '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -115,9 +115,9 @@ jobs:
             runId       = '${{ github.run_id }}'
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/backend.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/backend.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/backend.json"
           Write-Host $manifest

.github/workflows/deploy-mcp.yml

@@ -59,7 +59,7 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/mcp.txt" -SasToken '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/mcp.txt"
 
           $pkgVersion = (Get-Content ${{ env.PACKAGE_JSON }} -Raw | ConvertFrom-Json).version
           $prefix = ($pkgVersion -split '\.')[0..1] -join '.'
@@ -144,9 +144,9 @@ jobs:
             docsCommit  = '${{ steps.docs.outputs.sha }}'.Substring(0, 7)
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/mcp.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/mcp.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/mcp.json"
           Write-Host $manifest

.github/workflows/deploy-web.yml

@@ -40,6 +40,32 @@ jobs:
           lfs: false
           fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
 
+      # Only the version manifest at the very end needs Azure; logging in here rather than
+      # next to that step keeps a credential problem from surfacing after a live deploy.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # The customer docs repo is the single source of the "What's new" panel: the prebuild
+      # step (scripts/whats-new/build-whats-new.js) turns changelog/*.md into
+      # public/whats-new.json and dates every bullet via git blame — hence the full history.
+      # Public repo, no token. Editing the docs does NOT update the live panel until this
+      # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
+      # records which docs commit is live.
+      - name: Check out documentation bundle
+        uses: actions/checkout@v7
+        with:
+          repository: autopilotmonitor/autopilotmonitor-docs
+          path: whats-new-docs
+          fetch-depth: 0
+
+      - name: Resolve docs commit
+        id: docs
+        run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - uses: actions/setup-node@v7
         with:
           node-version: '22'
@@ -51,7 +77,7 @@ jobs:
         run: npm ci
 
       # next.config output:'export' -- `next build` writes the static site to out/
-      # (prebuild: sync-error-codes, generate-lastmod, generate-version).
+      # (prebuild: sync-error-codes, generate-lastmod, generate-version, whats-new).
       - name: Build
         working-directory: ${{ env.WEB_DIR }}
         env:
@@ -68,9 +94,12 @@ jobs:
           # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
           # the verify step below polls the deployed file for exactly this commit.
           GITHUB_SHA: ${{ github.sha }}
+          # Docs checkout for public/whats-new.json; the prebuild fails in CI without it.
+          WHATS_NEW_DOCS_DIR: ${{ github.workspace }}/whats-new-docs
         run: |
           npm run build
           test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }
+          test -f out/whats-new.json || { echo "out/whats-new.json missing - whats-new prebuild did not run"; exit 1; }
 
       # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
       - name: Package export
@@ -136,7 +165,8 @@ jobs:
           throw "Portal did not serve commit $expectedCommit within 5 minutes -- deployment not verified, version manifest NOT published"
 
       # Cross-component deploy record, written last and only on a verified deploy --
-      # same contract as versions/backend.json and versions/mcp.json.
+      # same contract as versions/backend.json and versions/mcp.json. docsCommit says which
+      # docs revision the live What's new panel was generated from (as for the MCP corpus).
       - name: Publish version manifest
         shell: pwsh
         run: |
@@ -145,11 +175,12 @@ jobs:
             commit      = '${{ github.sha }}'.Substring(0, 7)
             deployedUtc = [DateTime]::UtcNow.ToString('o')
             runId       = '${{ github.run_id }}'
+            docsCommit  = '${{ steps.docs.outputs.sha }}'.Substring(0, 7)
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/web.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/web.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/web.json"
           Write-Host $manifest

.github/workflows/publish-scripts.yml

@@ -26,6 +26,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write   # OIDC federated login for the storage writes (secret-less)
 
 # Shared with build-agent.yml: a script publish and an agent release both touch
 # version.json, and the bootstrapVersion read-modify-write must not interleave with the
@@ -34,6 +35,16 @@ concurrency:
   group: agent-blob-publish
   cancel-in-progress: false
 
+# Authenticode for the customer scripts. Same identity and same repository variables as
+# build-agent.yml -- the loader on every device pins this publisher, so the two must not
+# drift apart.
+env:
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
+
 jobs:
   gates:
     uses: ./.github/workflows/bootstrap-script-gates.yml
@@ -45,12 +56,79 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Published customer scripts must be signed."
+            }
+          }
+
+      # First, and only to fetch the Key Vault token: azure/login sets the default az
+      # account and the storage login below has to be the one that stays. See D-223 --
+      # both federated credentials are bound to the ref, so this job must never carry a
+      # GitHub `environment:`.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # Authorizes the eu blob writes and the AdminConfiguration merge. The gates job above
+      # runs the same publisher with -DryRun and deliberately without a login -- a dry run
+      # must never need Azure credentials.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # Version pinned so a new or compromised NuGet release cannot flow into signing
+      # unreviewed; roll-forward because the tool targets an older runtime than the SDK
+      # preinstalled on the runner.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
       - name: Publish bootstrap + customer scripts
         shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
         run: |
           $dryRun = '${{ inputs.dry_run }}' -eq 'true'
           ./.github/scripts/Publish-BootstrapScripts.ps1 `
-            -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
             -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
-            -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}' `
+            -SigningToken $env:CODE_SIGN_AKV_ACCESS_TOKEN `
+            -KeyVaultUrl $env:CODE_SIGN_KEY_VAULT_URL `
+            -CertificateName $env:CODE_SIGN_CERTIFICATE_NAME `
+            -TimestampUrl $env:CODE_SIGN_TIMESTAMP_URL `
+            -ExpectedPublisher $env:CODE_SIGN_EXPECTED_SUBJECT `
+            -SignedOutputDir "$env:RUNNER_TEMP/signed-scripts" `
             -DryRun:$dryRun
+
+      # The exact bytes that were (or, on a dry run, would have been) uploaded. A dry-run
+      # dispatch is therefore the way to inspect a signed script locally before it reaches
+      # a single customer. Kept on failure too: a failed alias verification is precisely
+      # when someone wants to look at the file.
+      - name: Upload signed scripts
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: signed-scripts
+          path: ${{ runner.temp }}/signed-scripts
+          if-no-files-found: ignore

.gitignore

@@ -145,6 +145,10 @@ internal/docs/~$Introduction-AutopilotMonitor.pptx
 # changes each run) and served at /version.json from the static export.
 src/Web/autopilot-monitor-web/public/version.json
 
+# What's new payload: generated by scripts/whats-new/build-whats-new.js from the docs
+# checkout on every build and served at /whats-new.json from the static export.
+src/Web/autopilot-monitor-web/public/whats-new.json
+
 
 # Local IME installer scratch (MSI + extracted payload per version, for grepping
 # in binaries). Operator-only, never committed.

rules/schema/gather-rule.schema.json

@@ -114,6 +114,11 @@
           "description": "Emit behavior: \"always\" (default — emit on every collection) or \"on_change\" (poll on the trigger cadence but emit only when the collected result changes; the first in-scope result always emits).",
           "enum": ["always", "on_change"]
         },
+        "enrichErrorCodes": {
+          "type": "boolean",
+          "description": "Opt-in: let the backend explain error-code fields in this rule's output (exitCode, errorCode, hresult, ...) with the Windows/MSI/Intune error-code catalog, attaching the same *Info siblings built-in events get. Default false because gather-rule codes usually come from third-party logs or commands (HP Image Assistant, Dell Command Update, custom scripts) with their own exit-code numbering, where the catalog meaning would be wrong. Enable only when the parsed source really uses Windows codes (e.g. an msiexec or IME log).",
+          "default": false
+        },
         "outputEventType": {
           "type": "string",
           "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."

scripts/Bootstrap/Start-AutopilotMonitor.Tests.ps1

@@ -0,0 +1,147 @@
+# Pester tests (Pester 5+) for the stage-1 loader Start-AutopilotMonitor.ps1.
+#
+# The script under test is dot-sourced; its entry guard prevents the loader from
+# executing, so loading it here is side-effect free. Network and signature checks
+# are mocked -- what is verified is the DECISION: what does the loader accept, what
+# does it refuse, and how often does it retry.
+#
+# Run under Windows PowerShell 5.1 to match the IME runtime:
+#   powershell.exe -NoProfile -Command "& { $c = New-PesterConfiguration; $c.Run.Path = 'scripts\Bootstrap'; $c.Output.Verbosity = 'Detailed'; Invoke-Pester -Configuration $c }"
+#
+# This file MUST remain pure ASCII (PS 5.1 reads BOM-less files as ANSI).
+
+BeforeAll {
+    . (Join-Path $PSScriptRoot 'Start-AutopilotMonitor.ps1')
+
+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+}
+
+Describe 'Test-BootstrapSignature' {
+    BeforeEach {
+        Mock Write-Log { }
+    }
+
+    It 'accepts a valid signature from the expected publisher' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeTrue
+    }
+
+    # An EV subject is a line of street address and registration numbers; the log gets the CN.
+    It 'logs the signer CN, not the whole subject' {
+        Mock Get-AuthenticodeSignature {
+            New-FakeSignature -Status 'Valid' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, L=Offenbach am Main, C=DE, SERIALNUMBER=HRB 12381'
+        }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeTrue
+        Should -Invoke Write-Log -ParameterFilter { $Message -eq 'Signature status: Valid. Signer: glueckkanja AG' }
+    }
+
+    It 'refuses an unsigned script' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses a tampered script (hash mismatch)' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    # The whole point of the pinned publisher: a validly signed script from someone else
+    # is exactly what an attacker with any code-signing certificate can produce.
+    It 'refuses a valid signature from a different publisher' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses when the signature check itself fails' {
+        Mock Get-AuthenticodeSignature { throw 'file not found' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+}
+
+Describe 'Get-VerifiedBootstrapScript' {
+    BeforeEach {
+        Mock Write-Log { }
+        Mock Start-Sleep { }
+        Mock Invoke-WebRequest { }
+    }
+
+    It 'returns after the first attempt when the download verifies' {
+        Mock Test-BootstrapSignature { $true }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 1 -Exactly
+    }
+
+    It 'gives up after three attempts when verification keeps failing' {
+        Mock Test-BootstrapSignature { $false }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeFalse
+        Should -Invoke Invoke-WebRequest -Times 3 -Exactly
+    }
+
+    # A truncated or proxy-mangled body fails verification, so the retry has to cover the
+    # download AND the check, not just the transport.
+    It 'retries a failed verification and accepts a later attempt' {
+        $script:calls = 0
+        Mock Test-BootstrapSignature { $script:calls++; return ($script:calls -ge 2) }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 2 -Exactly
+    }
+
+    It 'retries a transport failure' {
+        $script:downloads = 0
+        Mock Invoke-WebRequest { $script:downloads++; if ($script:downloads -eq 1) { throw 'connection reset' } }
+        Mock Test-BootstrapSignature { $true }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 2 -Exactly
+    }
+
+    It 'never executes anything when no attempt verifies' {
+        Mock Test-BootstrapSignature { $false }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeFalse
+    }
+}
+
+Describe 'publish contract' {
+    BeforeAll {
+        $script:loaderText = Get-Content (Join-Path $PSScriptRoot 'Start-AutopilotMonitor.ps1') -Raw
+    }
+
+    # Publish-BootstrapScripts.ps1 renders the -Dev loader by substituting this exact
+    # literal and fails the publish when it is gone. Catching that here means the PR fails
+    # instead of the publish.
+    It 'carries the dev-render anchor the publisher substitutes' {
+        $anchor = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1"'
+        $script:loaderText.Contains($anchor) | Should -BeTrue
+    }
+
+    # The publisher parses this to write version.json.loaderVersion and to run the
+    # version-bump guard.
+    It 'declares a parsable ScriptVersion' {
+        $script:loaderText -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"' | Should -BeTrue
+    }
+
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $script:loaderText -match '\$ExpectedPublisher\s*=\s*"\*O=' | Should -BeTrue
+    }
+
+    # The bootstrap MSI installs this same file and runs it with -LogFileName so the delivery
+    # channel stays visible in a diagnostics package. Renaming the parameter on either side
+    # would leave the MSI channel silently logging under the wrong name.
+    It 'keeps the -LogFileName contract the bootstrap MSI relies on' {
+        $script:loaderText -match '\[string\]\$LogFileName' | Should -BeTrue
+
+        $wxs = Get-Content (Join-Path $PSScriptRoot '..\..\src\Agent\AutopilotMonitor.BootstrapMsi\Package.wxs') -Raw
+        $wxs.Contains('[INSTALLFOLDER]Start-AutopilotMonitor.ps1') | Should -BeTrue
+        $wxs.Contains('-LogFileName bootstrap-msi.log') | Should -BeTrue
+    }
+}

scripts/Bootstrap/Start-AutopilotMonitor.ps1

@@ -0,0 +1,216 @@
+<#
+.SYNOPSIS
+    Stage 1 of the Autopilot Monitor bootstrap: fetches the current installer and runs it.
+
+.DESCRIPTION
+    This is the file an administrator assigns in Intune, and the same file the bootstrap MSI
+    installs and runs -- one implementation for both delivery channels; the MSI is only the
+    packaging. It carries no enrollment logic at all: it downloads the published
+    Install-AutopilotMonitor.ps1, proves that it was signed by Autopilot Monitor, and runs it
+    in this process.
+
+    Why two stages: the installer holds every guard, relax rule and download path, and those
+    change. Whoever assigns the installer directly has to replace their Intune copy each
+    time; whoever assigns this loader never does, because the part that changes lives on the
+    server. Assigning the installer directly stays supported and unchanged.
+
+    This file is deliberately boring. It is the one piece that cannot be fixed remotely, so
+    it does the least it can: download, verify, invoke, log.
+
+    Verification is by Authenticode publisher, not by hash. A hash oracle would have to be
+    fetched from the same host as the script itself, so it could not survive a compromise of
+    that host, while the expected publisher below travels with this file. It pins the
+    certificate SUBJECT and not a thumbprint, so a certificate renewal does not brick a
+    loader that is already deployed on devices.
+
+    Fail-soft: the loader always exits 0 and never throws into the caller. A device that
+    cannot reach the download endpoint is a device without monitoring, never a failed
+    enrollment step. Verification failures are the same: nothing runs, and the reason is in
+    the log. Refusing to execute unverified code as SYSTEM is the point of this file.
+
+    This file MUST remain pure ASCII (PS 5.1 reads BOM-less files as ANSI).
+
+.PARAMETER BootstrapUrl
+    Installer URL. Defaults to the published stable installer; the -Dev variant of this
+    loader is rendered from that default at publish time.
+
+.PARAMETER LogFileName
+    Log file inside the agent log directory. The MSI channel passes bootstrap-msi.log so the
+    delivery channel stays visible in a diagnostics package; the diag tooling keys on these
+    names, so do not rename them.
+
+.PARAMETER BootstrapArguments
+    Everything else is passed through to the installer unchanged, so any parameter the
+    installer accepts can be set here without this file knowing about it.
+
+.EXAMPLE
+    .\Start-AutopilotMonitor.ps1
+
+.EXAMPLE
+    .\Start-AutopilotMonitor.ps1 -MaxBootstrapWindowHours 24
+
+.NOTES
+    Author  : Oliver Kieselbach (autopilotmonitor.com)
+    Runtime : Windows PowerShell 5.1, SYSTEM context, during Autopilot enrollment
+
+.CHANGELOG
+    2026-09-08  v1.2  Log the signer CN instead of the full EV subject; the full subject is
+                      logged only when the publisher is why a script was rejected.
+    2026-09-08  v1.1  Also used by the bootstrap MSI, which replaced its own copy of this
+                      logic; -LogFileName keeps the channel visible in diagnostics.
+    2026-09-08  v1.0  Initial version: two-stage bootstrap, publisher-pinned verification.
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string]$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1",
+
+    [Parameter(Mandatory = $false)]
+    [ValidatePattern('^[A-Za-z0-9._-]+$')]
+    [string]$LogFileName = "bootstrap-loader.log",
+
+    [Parameter(Mandatory = $false, ValueFromRemainingArguments = $true)]
+    [string[]]$BootstrapArguments
+)
+
+# Script version (bump on meaningful changes; see .CHANGELOG above)
+$ScriptVersion = "1.2"
+
+# The publisher every downloaded stage-2 script must carry. A -like pattern on the subject,
+# NOT a thumbprint: certificates are renewed, deployed loaders are not.
+$ExpectedPublisher = "*O=glueckkanja AG*"
+
+$LoaderBasePath = "$env:ProgramData\AutopilotMonitor"
+$LoaderLogPath  = "$LoaderBasePath\Logs"
+$LogFile        = "$LoaderLogPath\$LogFileName"
+$BootstrapPath  = "$LoaderBasePath\Install-AutopilotMonitor.ps1"
+
+$DownloadAttempts = 3
+$RetryDelaySeconds = 10
+
+# Write-Host as well as the file: the Intune script output is what an administrator sees in
+# the portal, the file is what a support case reads.
+function Write-Log {
+    param([string]$Message)
+    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
+    $logMessage = "[$timestamp] $Message"
+    Write-Host $logMessage
+    Add-Content -Path $LogFile -Value $logMessage -ErrorAction SilentlyContinue
+}
+
+# True only when the file is signed, the signature validates against the machine's trust
+# chain, and the signer is us. Any error is a false -- an unreadable signature is an
+# unverified script.
+function Test-BootstrapSignature {
+    param([string]$Path)
+
+    try {
+        $sig = Get-AuthenticodeSignature -FilePath $Path -ErrorAction Stop
+    }
+    catch {
+        Write-Log "Signature check failed to run: $($_.Exception.Message)"
+        return $false
+    }
+
+    if ($null -eq $sig) {
+        Write-Log "Signature check returned nothing."
+        return $false
+    }
+
+    # The full subject of an EV certificate is a line of street address and registration
+    # numbers. The CN answers the only question the log has to answer; the full subject is
+    # logged when it is the reason for a rejection.
+    $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { "<unsigned>" }
+    $signer = if ($subject -match 'CN=([^,]+)') { $Matches[1] } else { $subject }
+    Write-Log "Signature status: $($sig.Status). Signer: $signer"
+
+    if ($sig.Status -ne 'Valid') {
+        Write-Log "REJECTED: expected signature status 'Valid'."
+        return $false
+    }
+    if ($subject -notlike $ExpectedPublisher) {
+        Write-Log "REJECTED: signer does not match the expected publisher. Full subject: $subject"
+        return $false
+    }
+
+    Write-Log "Signature accepted (thumbprint $($sig.SignerCertificate.Thumbprint))."
+    return $true
+}
+
+# Downloads the installer and returns $true once a downloaded copy passes verification.
+# Verification lives inside the retry loop on purpose: a truncated or proxy-mangled body
+# fails the signature check, and that is worth another attempt.
+function Get-VerifiedBootstrapScript {
+    param([string]$Url, [string]$Destination)
+
+    for ($attempt = 1; $attempt -le $DownloadAttempts; $attempt++) {
+        try {
+            Write-Log "Download attempt $attempt/$DownloadAttempts from $Url"
+            Invoke-WebRequest -Uri $Url -OutFile $Destination -UseBasicParsing -TimeoutSec 60 -ErrorAction Stop
+
+            if (Test-BootstrapSignature -Path $Destination) {
+                return $true
+            }
+        }
+        catch {
+            Write-Log "Download attempt $attempt failed: $($_.Exception.Message)"
+        }
+
+        if ($attempt -lt $DownloadAttempts) {
+            Start-Sleep -Seconds $RetryDelaySeconds
+        }
+    }
+
+    return $false
+}
+
+# Main flow. Only invoked when the script is run directly (see entry guard at the bottom),
+# so the Pester suite can dot-source this file without bootstrapping anything.
+function Start-BootstrapLoader {
+    New-Item -ItemType Directory -Force -Path $LoaderLogPath -ErrorAction SilentlyContinue | Out-Null
+
+    Write-Log "=== Autopilot Monitor bootstrap loader v$ScriptVersion started (user=$env:USERNAME, pid=$PID) ==="
+
+    # PS 5.1 on an OOBE device still defaults to TLS 1.0 for this process.
+    try {
+        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+    }
+    catch {
+        Write-Log "INFO: could not raise the TLS protocol: $($_.Exception.Message)"
+    }
+
+    if (-not (Get-VerifiedBootstrapScript -Url $BootstrapUrl -Destination $BootstrapPath)) {
+        Write-Log "No verified installer available after $DownloadAttempts attempt(s). Nothing was executed."
+        return
+    }
+
+    Write-Log "Executing $BootstrapPath"
+
+    # Same process, so the execution policy this loader runs under applies to stage 2 as
+    # well and no second policy decision can strand the installer. Splatting an array of
+    # remaining arguments keeps this file free of any knowledge about the installer's
+    # parameters.
+    $arguments = @()
+    if ($BootstrapArguments) { $arguments = $BootstrapArguments }
+
+    try {
+        & $BootstrapPath @arguments
+        Write-Log "Installer finished (exit code $LASTEXITCODE)."
+    }
+    catch {
+        Write-Log "Installer threw: $($_.Exception.Message)"
+    }
+}
+
+# Entry guard: dot-sourcing (Pester) loads the functions without running the loader.
+if ($MyInvocation.InvocationName -ne '.') {
+    try {
+        Start-BootstrapLoader
+    }
+    catch {
+        # Nothing above should throw; if it does, it must not become a failed Intune script.
+        Write-Log "Loader failed: $($_.Exception.Message)"
+    }
+    exit 0
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorEnrichErrorCodesTests.cs

@@ -0,0 +1,111 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// <see cref="GatherRule.EnrichErrorCodes"/> is an opt-in the backend honours at response time:
+    /// the agent stamps <c>enrichErrorCodes: true</c> into the event data of a rule that set it and
+    /// nothing at all otherwise (the default payload stays as it was).
+    /// </summary>
+    [Collection("SerialThreading")] // startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorEnrichErrorCodesTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_7e3a1f4b-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorEnrichErrorCodesTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private EnrollmentEvent SingleEvent()
+        {
+            lock (_eventsGate) return Assert.Single(_events);
+        }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                lock (_eventsGate) if (_events.Count >= count) return true;
+                Thread.Sleep(25);
+            }
+            lock (_eventsGate) return _events.Count >= count;
+        }
+
+        private static GatherRule StartupRule(bool enrichErrorCodes) => new GatherRule
+        {
+            RuleId = "GATHER-EEC-001",
+            Title = "enrich test",
+            CollectorType = "registry",
+            Target = AbsentPath,
+            Trigger = "startup",
+            OutputEventType = "gather_test",
+            Enabled = true,
+            EnrichErrorCodes = enrichErrorCodes,
+        };
+
+        [Fact]
+        public void StampRuleMarkers_AddsMarkerOnlyWhenOptedIn()
+        {
+            var optedIn = new Dictionary<string, object> { ["exitCode"] = "1603" };
+            GatherRuleExecutor.StampRuleMarkers(StartupRule(enrichErrorCodes: true), optedIn);
+            Assert.Equal(true, optedIn[Constants.GatherRuleDataKeys.EnrichErrorCodes]);
+
+            var defaultRule = new Dictionary<string, object> { ["exitCode"] = "1603" };
+            GatherRuleExecutor.StampRuleMarkers(StartupRule(enrichErrorCodes: false), defaultRule);
+            Assert.False(defaultRule.ContainsKey(Constants.GatherRuleDataKeys.EnrichErrorCodes));
+            Assert.Single(defaultRule);
+        }
+
+        [Fact]
+        public void ExecuteRule_StampsMarker_WhenRuleOptsIn()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule(enrichErrorCodes: true) });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            var evt = SingleEvent();
+            Assert.Equal(GatherRuleExecutor.SourceName, evt.Source);
+            Assert.Equal(true, evt.Data[Constants.GatherRuleDataKeys.EnrichErrorCodes]);
+        }
+
+        [Fact]
+        public void ExecuteRule_LeavesPayloadUnchanged_ByDefault()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule(enrichErrorCodes: false) });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            Assert.False(SingleEvent().Data.ContainsKey(Constants.GatherRuleDataKeys.EnrichErrorCodes));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -223,7 +223,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             return true;
         }
 
-        private const int MaxScriptOutputLength = 2048;
+        // Script stdout kept per event. Measured over 1,486 script outputs in the fleet
+        // (2026-08-25..09-08): median 39, p90 644, max 1,501 chars -- the maximum being our own
+        // one-stage bootstrap, and nothing ever hit the previous 2,048 cap. The two-stage
+        // bootstrap then added a ~460-char loader preamble to that maximum and started
+        // truncating the one output an operator actually reads. 8,192 leaves room for the
+        // realistic worst case (download retries plus relax logging, ~2,700) and stays 4x below
+        // the 32K-char Table Storage property limit that bounds the event downstream. Growth
+        // driver is the number of log lines the bootstrap chain writes, so re-measure before
+        // adding a chatty step rather than raising this again.
+        private const int MaxScriptOutputLength = 8192;
         private const int MaxMultiLineBufferLines = 100;
         // Size cap for ONE entry — a single physical line (enforced by BoundedLineReader before
         // the line is materialized) and an assembled multiline entry alike. Any process able to

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/Collectors/LogParserCollector.cs

@@ -278,6 +278,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors
                                 data["logFile"] = Path.GetFileName(filePath);
                                 data["ruleId"] = rule.RuleId;
                                 data["ruleTitle"] = rule.Title;
+                                GatherRuleExecutor.StampRuleMarkers(rule, data);
 
                                 var eventType = !string.IsNullOrEmpty(rule.OutputEventType)
                                     ? rule.OutputEventType
@@ -347,6 +348,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors
                                 data["logFile"] = Path.GetFileName(filePath);
                                 data["ruleId"] = rule.RuleId;
                                 data["ruleTitle"] = rule.Title;
+                                GatherRuleExecutor.StampRuleMarkers(rule, data);
 
                                 var eventType = !string.IsNullOrEmpty(rule.OutputEventType)
                                     ? rule.OutputEventType

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs

@@ -26,7 +26,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         /// emits (executor, context guard events, collectors). The timeline feed uses it to keep
         /// gather output from re-triggering on_event rules.
         /// </summary>
-        public const string SourceName = "GatherRuleExecutor";
+        public const string SourceName = Constants.EventSources.GatherRuleExecutor;
 
         /// <summary>
         /// Upper bound on on_event executions per rule and session. on_event has no natural
@@ -496,6 +496,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                     result["ruleId"] = rule.RuleId;
                     result["ruleTitle"] = rule.Title;
+                    StampRuleMarkers(rule, result);
 
                     var eventType = !string.IsNullOrEmpty(rule.OutputEventType) ? rule.OutputEventType : Constants.EventTypes.GatherResult;
 
@@ -537,6 +538,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
         // ===== Phase scope (ActivePhases / ActiveFromPhase) =====
 
+        /// <summary>
+        /// Injects the per-rule opt-in markers the backend reads at response time. Called after
+        /// the on_change hash is taken (the markers are rule config, not collected data) by the
+        /// executor and by collectors that emit directly (logparser).
+        /// </summary>
+        internal static void StampRuleMarkers(GatherRule rule, Dictionary<string, object> data)
+        {
+            if (rule.EnrichErrorCodes)
+                data[Constants.GatherRuleDataKeys.EnrichErrorCodes] = true;
+        }
+
         private static bool HasPhaseScope(GatherRule rule)
         {
             return (rule.ActivePhases != null && rule.ActivePhases.Count > 0)

src/Agent/AutopilotMonitor.BootstrapMsi/Invoke-BootstrapDownload.ps1

@@ -1,55 +0,0 @@
-# Invoke-BootstrapDownload.ps1 - thin runner embedded in the Bootstrap MSI.
-#
-# The MSI is only a delivery vehicle (MDM LOB channel installs earlier than the IME
-# script/app batches during Autopilot Device Preparation). This runner downloads the
-# CURRENT Install-AutopilotMonitor.ps1 from the download endpoint and executes it, so
-# every piece of real bootstrap logic (guards, relax rules, agent download) stays
-# server-updatable without re-shipping the MSI.
-#
-# Fail-soft by design: the runner always exits 0 so a transient network failure never
-# marks the LOB install as failed; diagnostics go to bootstrap-msi.log.
-# ASCII only - no special characters in this file.
-
-$ErrorActionPreference = 'Stop'
-$baseDir = Join-Path $env:ProgramData 'AutopilotMonitor'
-$logDir  = Join-Path $baseDir 'Logs'
-New-Item -ItemType Directory -Force -Path $logDir | Out-Null
-$log = Join-Path $logDir 'bootstrap-msi.log'
-
-function Write-Log([string]$message) {
-    Add-Content -Path $log -Value ("[{0}] {1}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $message)
-}
-
-try {
-    Write-Log "MSI bootstrap runner started (user=$env:USERNAME, pid=$PID)."
-
-    if (Test-Path 'HKLM:\SOFTWARE\AutopilotMonitor\Deployed') {
-        Write-Log 'Deployed marker present - skipping, another channel already installed the agent.'
-        exit 0
-    }
-
-    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-    $url  = 'https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1'
-    $dest = Join-Path $baseDir 'Install-AutopilotMonitor.ps1'
-
-    for ($attempt = 1; $attempt -le 3; $attempt++) {
-        try {
-            Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $dest
-            break
-        } catch {
-            Write-Log "Download attempt $attempt failed: $_"
-            if ($attempt -eq 3) { throw }
-            Start-Sleep -Seconds 10
-        }
-    }
-
-    Write-Log "Bootstrap script downloaded to $dest - executing."
-    # PS 5.1 file redirection (*>>) writes UTF-16LE, which garbles a log otherwise
-    # written via Add-Content (ANSI). Route through Add-Content for one encoding.
-    & $dest *>&1 | ForEach-Object { $_.ToString() } | Add-Content -Path $log
-    Write-Log "Bootstrap script finished (exit code $LASTEXITCODE)."
-    exit 0
-} catch {
-    Write-Log ("MSI bootstrap runner failed: " + ($_ | Out-String))
-    exit 0
-}

src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs

@@ -4,16 +4,19 @@
   LOB MSIs are installed by the OMA-DM stack (EnterpriseDesktopAppManagement CSP) during
   the first MDM sync, i.e. BEFORE/parallel to the Device Preparation SLDM app batch -
   earlier than any IME-delivered script (Batch 2) or Win32 app can run. The MSI itself
-  carries no bootstrap logic: it installs one runner script and executes it once. The
-  runner downloads the CURRENT server-hosted Install-AutopilotMonitor.ps1, keeping all
-  real logic updatable without re-shipping the MSI.
+  carries no bootstrap logic and no downloader of its own: it installs the SAME stage-1
+  loader that is assigned directly in Intune (scripts/Bootstrap/Start-AutopilotMonitor.ps1)
+  and runs it once. The loader downloads the current server-hosted
+  Install-AutopilotMonitor.ps1 and verifies its publisher before executing it, so all real
+  logic stays updatable without re-shipping the MSI, and both delivery channels share one
+  implementation.
 
   Build: wix build Package.wxs -arch x64 -o bin\AutopilotMonitor-Bootstrap.msi
 -->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Package Name="Autopilot Monitor Bootstrap"
            Manufacturer="Autopilot Monitor"
-           Version="1.0.2"
+           Version="1.1.0"
            UpgradeCode="1fbe5515-d346-445c-b8b8-14ee79f97522"
            Scope="perMachine"
            Compressed="yes">
@@ -28,8 +31,13 @@
     </StandardDirectory>
 
     <ComponentGroup Id="MainComponents" Directory="INSTALLFOLDER">
-      <Component Id="RunnerScript" Guid="8c8e8962-719f-458b-b291-dd99d3f1dc30">
-        <File Id="RunnerPs1" Source="Invoke-BootstrapDownload.ps1" KeyPath="yes" />
+      <!-- Source is relative to the build working directory (the project dir), not to this
+           file. New component GUID because the key path changed. -->
+      <Component Id="RunnerScript" Guid="A972F561-01B5-400A-8C2A-47D12BA97DCA">
+        <File Id="RunnerPs1"
+              Source="..\..\..\scripts\Bootstrap\Start-AutopilotMonitor.ps1"
+              Name="Start-AutopilotMonitor.ps1"
+              KeyPath="yes" />
       </Component>
     </ComponentGroup>
 
@@ -38,11 +46,12 @@
     </Feature>
 
     <!-- Deferred + no-impersonate: runs as SYSTEM after files land. Return=ignore keeps
-         the LOB install green even if the runner hits a transient error (the runner is
-         additionally fail-soft itself); diagnostics live in bootstrap-msi.log. -->
+         the LOB install green even if the loader hits a transient error (the loader is
+         additionally fail-soft itself). -LogFileName keeps this channel distinguishable in
+         a diagnostics package; the diag tooling keys on that name. -->
     <CustomAction Id="RunBootstrap"
                   Directory="INSTALLFOLDER"
-                  ExeCommand="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -ExecutionPolicy Bypass -File &quot;[INSTALLFOLDER]Invoke-BootstrapDownload.ps1&quot;"
+                  ExeCommand="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -ExecutionPolicy Bypass -File &quot;[INSTALLFOLDER]Start-AutopilotMonitor.ps1&quot; -LogFileName bootstrap-msi.log"
                   Execute="deferred"
                   Impersonate="no"
                   Return="ignore" />

src/Backend/AutopilotMonitor.Functions.Tests/AgentConfigResolverTests.cs

@@ -0,0 +1,189 @@
+using System;
+using System.Collections.Generic;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the derivation shared by the agent channel (GET agent/config) and the Global-Admin
+/// report route (GET config/{tenantId}/effective-agent-config): every rule the Tenant Config
+/// Report used to re-implement in the web now has exactly one implementation, and these
+/// facts are its contract.
+/// </summary>
+public class AgentConfigResolverTests
+{
+    private const string TenantId = "11111111-2222-3333-4444-555555555555";
+    private static readonly DateTime Now = new(2026, 9, 6, 12, 0, 0, DateTimeKind.Utc);
+
+    private static TenantConfiguration Tenant(Action<TenantConfiguration>? mutate = null)
+    {
+        var c = new TenantConfiguration { TenantId = TenantId, DomainName = "contoso.example", UpdatedBy = "ga@operator.example" };
+        mutate?.Invoke(c);
+        return c;
+    }
+
+    private static AdminConfiguration Admin(Action<AdminConfiguration>? mutate = null)
+    {
+        var a = new AdminConfiguration();
+        mutate?.Invoke(a);
+        return a;
+    }
+
+    private static AgentConfigResponse Build(TenantConfiguration tenant, AdminConfiguration? admin = null, int agentMajor = AgentConfigResolver.CurrentAgentMajor)
+        => AgentConfigResolver.Build(tenant, admin ?? Admin(), new List<GatherRule>(), new List<ImeLogPattern>(), agentMajor, Now).Response;
+
+    [Fact]
+    public void Fresh_tenant_gets_the_agent_defaults()
+    {
+        var r = Build(Tenant());
+
+        Assert.Equal(AgentConfigResolver.ConfigVersion, r.ConfigVersion);
+        Assert.Equal(AutopilotMonitor.Shared.Constants.DefaultUploadIntervalSeconds, r.UploadIntervalSeconds);
+        Assert.Equal(10, r.UploadIntervalSeconds); // the report showed 30 for a month — pinned
+        Assert.True(r.SelfDestructOnComplete);
+        Assert.False(r.KeepLogFile);
+        Assert.True(r.EnableGeoLocation);
+        Assert.Equal(5, r.MaxAuthFailures);
+        Assert.Equal(0, r.AuthFailureTimeoutMinutes);
+        Assert.Equal("Info", r.LogLevel);
+        Assert.Equal(10, r.RebootDelaySeconds);
+        Assert.Equal(60, r.EnrollmentSummaryTimeoutSeconds);
+        Assert.Equal(120, r.EnrollmentSummaryLaunchRetrySeconds);
+        Assert.Equal(100, r.MaxBatchSize);
+        Assert.Equal("time.windows.com", r.NtpServer);
+        Assert.Equal("Off", r.DiagnosticsUploadMode);
+        Assert.False(r.DiagnosticsUploadEnabled);
+        Assert.False(r.UnrestrictedMode);
+        Assert.False(r.DeviceBlocked);
+        Assert.False(r.DeviceKillSignal);
+        Assert.Null(r.UnblockAt);
+        Assert.Null(r.MigrateToApiBaseUrl);
+
+        Assert.Equal(360, r.Collectors.AgentMaxLifetimeMinutes);
+        Assert.Equal(15, r.Collectors.CollectorIdleTimeoutMinutes);
+        Assert.Equal(10, r.Collectors.DesktopDetectorNoCandidateTimeoutMinutes);
+        Assert.Equal(new[] { 100, 1005, 1010 }, r.Collectors.ModernDeploymentHarmlessEventIds);
+
+        Assert.True(r.Analyzers.EnableLocalAdminAnalyzer);
+        Assert.Empty(r.Analyzers.LocalAdminAllowedAccounts);
+        Assert.False(r.Analyzers.EnableSoftwareInventoryAnalyzer);
+        Assert.True(r.Analyzers.EnableIntegrityBypassAnalyzer);
+        Assert.False(r.Analyzers.EnableRealmJoinWatcher);
+        Assert.False(r.Analyzers.KeepAwakeDuringUserEsp);
+        Assert.True(r.Analyzers.EnableConsoleBypassDetection);
+    }
+
+    [Theory]
+    [InlineData(null, "CustomerSas", "Off", false)]
+    [InlineData(null, "Hosted", "Off", true)]        // hosted destination needs no SAS
+    [InlineData("https://acct.blob.core.windows.net/c?sv=1", "CustomerSas", "Off", true)] // SAS enables regardless of mode
+    public void Diagnostics_upload_enabled_follows_sas_or_hosted_not_the_mode(string? sas, string destination, string mode, bool expected)
+    {
+        var r = Build(Tenant(t =>
+        {
+            t.DiagnosticsBlobSasUrl = sas!;
+            t.DiagnosticsUploadDestination = destination;
+            t.DiagnosticsUploadMode = mode;
+        }));
+        Assert.Equal(expected, r.DiagnosticsUploadEnabled);
+    }
+
+    [Theory]
+    [InlineData("free", true, true, false)]  // Community: entitlement missing
+    [InlineData("pro", false, true, false)]  // GA gate off
+    [InlineData("pro", true, false, false)]  // tenant toggle off
+    [InlineData("pro", true, true, true)]
+    public void Unrestricted_mode_needs_entitlement_and_gate_and_toggle(string planTier, bool gaGate, bool toggle, bool expected)
+    {
+        var r = Build(Tenant(t =>
+        {
+            t.PlanTier = planTier;
+            t.UnrestrictedModeEnabled = gaGate;
+            t.UnrestrictedMode = toggle;
+        }));
+        Assert.Equal(expected, r.UnrestrictedMode);
+    }
+
+    [Fact]
+    public void Operator_knobs_come_from_the_admin_configuration()
+    {
+        var admin = Admin(a =>
+        {
+            a.CollectorIdleTimeoutMinutes = 25;
+            a.DesktopDetectorNoCandidateTimeoutMinutes = 7;
+            a.AllowAgentDowngrade = true;
+            a.ModernDeploymentHarmlessEventIdsJson = "[100, 42]";
+            a.LatestAgentV2Sha256 = "zip-v2";
+            a.LatestAgentV2ExeSha256 = "exe-v2";
+        });
+
+        var r = Build(Tenant(), admin);
+
+        Assert.Equal(25, r.Collectors.CollectorIdleTimeoutMinutes);
+        Assert.Equal(7, r.Collectors.DesktopDetectorNoCandidateTimeoutMinutes);
+        Assert.True(r.AllowAgentDowngrade);
+        Assert.Equal(new[] { 100, 42 }, r.Collectors.ModernDeploymentHarmlessEventIds);
+        Assert.Equal("zip-v2", r.LatestAgentSha256);
+        Assert.Equal("exe-v2", r.LatestAgentExeSha256);
+    }
+
+    [Fact]
+    public void Legacy_major_gets_empty_hashes_the_current_major_gets_v2()
+    {
+        var admin = Admin(a => { a.LatestAgentV2Sha256 = "zip-v2"; a.LatestAgentV2ExeSha256 = "exe-v2"; });
+
+        var legacy = Build(Tenant(), admin, agentMajor: 1);
+        Assert.Equal(string.Empty, legacy.LatestAgentSha256);
+
+        var current = Build(Tenant(), admin, agentMajor: AgentConfigResolver.CurrentAgentMajor);
+        Assert.Equal("zip-v2", current.LatestAgentSha256);
+    }
+
+    [Fact]
+    public void Tenant_overrides_win_over_defaults()
+    {
+        var r = Build(Tenant(t =>
+        {
+            t.MaxBatchSize = 25;
+            t.LogLevel = "Debug";
+            t.NtpServer = "";
+            t.LocalAdminAllowedAccountsJson = "[\"Admin\",\"Helpdesk\"]";
+            t.AgentMaxLifetimeMinutes = 120;
+            t.EnableConsoleBypassDetection = false;
+        }));
+
+        Assert.Equal(25, r.MaxBatchSize);
+        Assert.Equal("Debug", r.LogLevel);
+        Assert.Equal("time.windows.com", r.NtpServer); // empty string falls back like null
+        Assert.Equal(new[] { "Admin", "Helpdesk" }, r.Analyzers.LocalAdminAllowedAccounts);
+        Assert.Equal(120, r.Collectors.AgentMaxLifetimeMinutes);
+        Assert.False(r.Analyzers.EnableConsoleBypassDetection);
+    }
+
+    [Fact]
+    public void Migration_target_is_served_when_valid_and_reported_when_rejected()
+    {
+        const string Us = "https://autopilotmonitor-api-us.azurewebsites.net";
+        var served = AgentConfigResolver.Build(Tenant(), Admin(a => a.AgentMigrateApiBaseUrl = Us),
+            new List<GatherRule>(), new List<ImeLogPattern>(), AgentConfigResolver.CurrentAgentMajor, Now);
+        Assert.Equal(Us, served.Response.MigrateToApiBaseUrl);
+        Assert.Null(served.RejectedMigrateCandidate);
+
+        var rejected = AgentConfigResolver.Build(Tenant(), Admin(a => a.AgentMigrateApiBaseUrl = "https://evil.example"),
+            new List<GatherRule>(), new List<ImeLogPattern>(), AgentConfigResolver.CurrentAgentMajor, Now);
+        Assert.Null(rejected.Response.MigrateToApiBaseUrl);
+        Assert.Equal("https://evil.example", rejected.RejectedMigrateCandidate);
+    }
+
+    [Fact]
+    public void Catalogs_pass_through_unchanged()
+    {
+        var rules = new List<GatherRule> { new() { RuleId = "GATHER-TEST-001" } };
+        var patterns = new List<ImeLogPattern> { new() { PatternId = "IME-TEST-001" } };
+        var r = AgentConfigResolver.Build(Tenant(), Admin(), rules, patterns, AgentConfigResolver.CurrentAgentMajor, Now).Response;
+        Assert.Same(rules, r.GatherRules);
+        Assert.Same(patterns, r.ImeLogPatterns);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AgentEndpointMigrationTests.cs

@@ -1,4 +1,4 @@
-using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Services;
 using Xunit;
@@ -8,7 +8,7 @@ namespace AutopilotMonitor.Functions.Tests;
 /// <summary>
 /// Pins the endpoint-migration serving contract: the shared allowlist rules
 /// (<see cref="AgentEndpointMigrationRules"/>, used verbatim by the agent too) and the
-/// backend-side per-tenant resolution (<see cref="GetAgentConfigFunction.ResolveMigrateTarget"/> —
+/// backend-side per-tenant resolution (<see cref="AgentConfigResolver.ResolveMigrateTarget"/> —
 /// tenant override wins, empty override pins, invalid values are never served).
 /// </summary>
 public class AgentEndpointMigrationTests
@@ -75,7 +75,7 @@ public class AgentEndpointMigrationTests
     {
         var config = new AdminConfiguration();
 
-        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out var rejected));
         Assert.Null(rejected);
     }
 
@@ -84,8 +84,8 @@ public class AgentEndpointMigrationTests
     {
         var config = new AdminConfiguration { AgentMigrateApiBaseUrl = UsUrl };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantB, out _));
     }
 
     [Fact]
@@ -97,8 +97,8 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = $"{{\"{TenantA}\": \"{EuUrl}\"}}"
         };
 
-        Assert.Equal(EuUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+        Assert.Equal(EuUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantB, out _));
     }
 
     [Fact]
@@ -110,9 +110,9 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = $"{{\"{TenantA}\": \"\"}}"
         };
 
-        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out var rejected));
         Assert.Null(rejected); // pinned, not rejected
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantB, out _));
     }
 
     [Fact]
@@ -123,7 +123,7 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = $"{{\"{TenantA.ToUpperInvariant()}\": \"{UsUrl}\"}}"
         };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
     }
 
     [Fact]
@@ -131,7 +131,7 @@ public class AgentEndpointMigrationTests
     {
         var config = new AdminConfiguration { AgentMigrateApiBaseUrl = "https://attacker.example.com" };
 
-        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out var rejected));
         Assert.Equal("https://attacker.example.com", rejected);
     }
 
@@ -144,7 +144,7 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = "{not json"
         };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
     }
 
     [Fact]
@@ -155,6 +155,6 @@ public class AgentEndpointMigrationTests
             AgentMigrateApiBaseUrl = "https://AutopilotMonitor-API-US.azurewebsites.net/"
         };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
     }
 }

src/Backend/AutopilotMonitor.Functions.Tests/AuthFunctionTests.cs

@@ -55,6 +55,76 @@ public class AuthFunctionTests
         Assert.True((bool)body.hasMcpAccess);
     }
 
+    [Fact]
+    public void HappyPath_SurfacesWhatsNewSeenMarks()
+    {
+        var platformSeen = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+        var agentSeen = new DateTime(2026, 9, 8, 10, 5, 0, DateTimeKind.Utc);
+
+        var result = AuthFunction.BuildAuthResult(
+            DefaultConfig(), isGlobalAdmin: false, isGlobalReader: false, isPreviewApproved: true,
+            memberRole: AdminRole(), mcpCheck: McpAllowed(),
+            hasTenantAdmins: true,
+            TenantId, Upn, DisplayName, ObjectId,
+            whatsNewSeenPlatformUtc: platformSeen,
+            whatsNewSeenAgentUtc: agentSeen);
+
+        Assert.True(result.IsSuccess);
+        var body = ToDynamic(result.Body);
+        Assert.Equal(platformSeen, (DateTime)body.whatsNewSeenPlatformUtc);
+        Assert.Equal(agentSeen, (DateTime)body.whatsNewSeenAgentUtc);
+    }
+
+    [Theory]
+    [InlineData("platform", "platform")]
+    [InlineData("Platform", "platform")]
+    [InlineData("agent", "agent")]
+    public void TryNormalizeWhatsNewSeen_AcceptsKnownChannels(string input, string expected)
+    {
+        var seen = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+
+        var ok = AuthFunction.TryNormalizeWhatsNewSeen(
+            new WhatsNewSeenRequest { Channel = input, SeenUtc = seen },
+            seen.AddMinutes(1),
+            out var channel,
+            out var seenUtc,
+            out var error);
+
+        Assert.True(ok, error);
+        Assert.Equal(expected, channel);
+        Assert.Equal(seen, seenUtc);
+    }
+
+    [Fact]
+    public void TryNormalizeWhatsNewSeen_RejectsUnknownChannel()
+    {
+        var ok = AuthFunction.TryNormalizeWhatsNewSeen(
+            new WhatsNewSeenRequest { Channel = "other", SeenUtc = DateTime.UtcNow },
+            DateTime.UtcNow,
+            out _,
+            out _,
+            out var error);
+
+        Assert.False(ok);
+        Assert.Equal("channel must be 'platform' or 'agent'", error);
+    }
+
+    [Fact]
+    public void TryNormalizeWhatsNewSeen_ClampsFarFutureTimestamp()
+    {
+        var now = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+
+        var ok = AuthFunction.TryNormalizeWhatsNewSeen(
+            new WhatsNewSeenRequest { Channel = "agent", SeenUtc = now.AddMinutes(6) },
+            now,
+            out _,
+            out var seenUtc,
+            out var error);
+
+        Assert.True(ok, error);
+        Assert.Equal(now, seenUtc);
+    }
+
     [Fact]
     public void HappyPath_OperatorUser_ReturnsCorrectRole()
     {

src/Backend/AutopilotMonitor.Functions.Tests/CrossTenantAccessTests.cs

@@ -182,6 +182,7 @@ public class CrossTenantAccessTests
 
     [Theory]
     [InlineData("PATCH", "/api/config/{0}/plan")]
+    [InlineData("GET", "/api/config/{0}/effective-agent-config")]
     [InlineData("POST", "/api/preview/whitelist/{0}")]
     [InlineData("DELETE", "/api/preview/whitelist/{0}")]
     [InlineData("POST", "/api/preview/send-welcome-email/{0}")]

src/Backend/AutopilotMonitor.Functions.Tests/EndpointNormalizerTests.cs

@@ -0,0 +1,57 @@
+using AutopilotMonitor.Functions.Helpers;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+public class EndpointNormalizerTests
+{
+    [Fact]
+    public void Normalize_StripsApiPrefixReplacesGuidsAndKeyChars()
+    {
+        var normalized = EndpointNormalizer.Normalize("/api/Sessions/0f8fad5b-d9cb-469f-a165-70867728950e/events?x=1");
+        Assert.Equal("sessions_{id}_events_x=1", normalized);
+    }
+
+    [Fact]
+    public void ToolNameKey_RealToolName_PassesThroughUnchanged()
+    {
+        // Existing UserUsageLog rows are keyed by "<tool>:<endpoint>"; a real tool name must keep its key.
+        Assert.Equal("get_session_events", EndpointNormalizer.ToolNameKey("get_session_events"));
+    }
+
+    [Fact]
+    public void ToolNameKey_NullOrEmpty_ReturnsEmpty()
+    {
+        Assert.Equal(string.Empty, EndpointNormalizer.ToolNameKey(null));
+        Assert.Equal(string.Empty, EndpointNormalizer.ToolNameKey(string.Empty));
+    }
+
+    [Fact]
+    public void ToolNameKey_WithCrlfAndControlChars_StripsThem()
+    {
+        // The log-forging vector: a header that tries to inject a fake log line through the row key.
+        var forged = $"get_metrics\r\n[McpQuota] FAKE{(char)0}{(char)27}{(char)0x2028}x";
+        var key = EndpointNormalizer.ToolNameKey(forged);
+        Assert.Equal("get_metrics[McpQuota] FAKEx", key);
+    }
+
+    [Fact]
+    public void ToolNameKey_WithTableKeyIllegalChars_ReplacesThem()
+    {
+        // '/', '\', '#', '?' are rejected by Table Storage in keys — a header carrying them would make
+        // every usage increment fail with 400, so they are replaced the same way the path is.
+        Assert.Equal("a_b_c_d_e", EndpointNormalizer.ToolNameKey("a/b\\c#d?e"));
+    }
+
+    [Fact]
+    public void ToolNameKey_LongerThanCap_IsTruncated()
+    {
+        var key = EndpointNormalizer.ToolNameKey(new string('t', EndpointNormalizer.MaxToolNameLength + 10));
+        Assert.Equal(EndpointNormalizer.MaxToolNameLength, key.Length);
+    }
+
+    [Fact]
+    public void ToolNameKey_OnlyControlChars_ReturnsEmpty()
+    {
+        Assert.Equal(string.Empty, EndpointNormalizer.ToolNameKey("\r\n  "));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/FleetHealthPayloadTests.cs

@@ -147,11 +147,11 @@ public class FleetHealthPayloadTests
         var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 30);
 
         Assert.Equal(6, payload.ModelHealth.Count);
-        Assert.Equal("Contoso Model7", payload.ModelHealth[0].Model);
+        Assert.Equal("Contoso Model7", payload.ModelHealth[0].Label);
         Assert.Equal(7, payload.ModelHealth[0].Total);
         Assert.Equal(7, payload.ModelHealth[0].Succeeded);
         // The smallest (volume 1) is dropped by the top-6 cut.
-        Assert.DoesNotContain(payload.ModelHealth, m => m.Model == "Contoso Model1");
+        Assert.DoesNotContain(payload.ModelHealth, m => m.Label == "Contoso Model1");
     }
 
     [Fact]
@@ -182,7 +182,47 @@ public class FleetHealthPayloadTests
             new List<SessionSummary> { S(SessionStatus.Succeeded, manufacturer: "", model: "") },
             days: 7);
 
-        Assert.Equal("Unknown", Assert.Single(payload.ModelHealth).Model);
+        var m = Assert.Single(payload.ModelHealth);
+        Assert.Equal("Unknown", m.Label);
+        Assert.Equal("", m.Manufacturer);
+        Assert.Equal("", m.Model);
+    }
+
+    [Fact]
+    public void ModelBuckets_CarryManufacturerAndModelSeparately_OnAllThreeLists()
+    {
+        // The dashboard deep link addresses the two session fields as two qualified search
+        // terms; a client must never have to split the label again.
+        var sessions = new List<SessionSummary>
+        {
+            S(SessionStatus.Succeeded, durationSeconds: 600, manufacturer: " Contoso ", model: "EliteBook 840"),
+            S(SessionStatus.Failed, manufacturer: "Contoso", model: "EliteBook 840"),
+        };
+
+        var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 7);
+
+        var health = Assert.Single(payload.ModelHealth);
+        Assert.Equal(("Contoso", "EliteBook 840", "Contoso EliteBook 840"), (health.Manufacturer, health.Model, health.Label));
+        Assert.Equal(2, health.Total);
+        var slow = Assert.Single(payload.SlowestModels);
+        Assert.Equal(("Contoso", "EliteBook 840", "Contoso EliteBook 840"), (slow.Manufacturer, slow.Model, slow.Label));
+        var failing = Assert.Single(payload.TopFailingModels);
+        Assert.Equal(("Contoso", "EliteBook 840", "Contoso EliteBook 840"), (failing.Manufacturer, failing.Model, failing.Label));
+    }
+
+    [Fact]
+    public void ModelBuckets_GroupOnThePair_NotOnTheLabel()
+    {
+        var sessions = new List<SessionSummary>
+        {
+            S(SessionStatus.Succeeded, manufacturer: "Contoso", model: "A B"),
+            S(SessionStatus.Succeeded, manufacturer: "Contoso A", model: "B"),
+        };
+
+        var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 7);
+
+        Assert.Equal(2, payload.ModelHealth.Count);
+        Assert.All(payload.ModelHealth, m => Assert.Equal("Contoso A B", m.Label));
     }
 
     [Fact]
@@ -199,10 +239,10 @@ public class FleetHealthPayloadTests
         var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 30);
 
         Assert.Equal(2, payload.SlowestModels.Count);
-        Assert.Equal("Contoso Slow", payload.SlowestModels[0].Model);
+        Assert.Equal("Contoso Slow", payload.SlowestModels[0].Label);
         Assert.Equal(30, payload.SlowestModels[0].AvgMinutes);
         Assert.Equal(1, payload.SlowestModels[0].Count);
-        Assert.Equal("Contoso Fast", payload.SlowestModels[1].Model);
+        Assert.Equal("Contoso Fast", payload.SlowestModels[1].Label);
         Assert.Equal(10, payload.SlowestModels[1].AvgMinutes);
     }
 
@@ -227,13 +267,13 @@ public class FleetHealthPayloadTests
         var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 30);
 
         Assert.Equal(2, payload.TopFailingModels.Count);
-        Assert.Equal("Contoso B", payload.TopFailingModels[0].Model);
+        Assert.Equal("Contoso B", payload.TopFailingModels[0].Label);
         Assert.Equal(2, payload.TopFailingModels[0].Failed);
         Assert.Equal(100, payload.TopFailingModels[0].FailureRate);
-        Assert.Equal("Contoso A", payload.TopFailingModels[1].Model);
+        Assert.Equal("Contoso A", payload.TopFailingModels[1].Label);
         Assert.Equal(4, payload.TopFailingModels[1].Total);
         Assert.Equal(50, payload.TopFailingModels[1].FailureRate);
-        Assert.DoesNotContain(payload.TopFailingModels, m => m.Model == "Contoso C");
+        Assert.DoesNotContain(payload.TopFailingModels, m => m.Label == "Contoso C");
     }
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/GatherRuleScopeFieldsTests.cs

@@ -129,6 +129,29 @@ public class GatherRuleScopeFieldsTests
         Assert.Null(mapped.ActivePhases);
         Assert.Null(mapped.ActiveFromPhase);
         Assert.Null(mapped.EmitMode);
+        Assert.False(mapped.EnrichErrorCodes);
+    }
+
+    [Fact]
+    public async Task Roundtrip_EnrichErrorCodes_SurvivesStoreAndMap()
+    {
+        var (service, lastUpserted) = BuildStorageHarness();
+        var rule = new GatherRule
+        {
+            RuleId = "GATHER-ENRICH-001",
+            Title = "MSI log parser",
+            CollectorType = "logparser",
+            Target = "C:\\Windows\\Temp\\msi.log",
+            Trigger = "interval",
+            IntervalSeconds = 60,
+            OutputEventType = "gather_msi",
+            EnrichErrorCodes = true,
+        };
+
+        Assert.True(await service.StoreGatherRuleAsync(rule, "global"));
+        var mapped = service.MapToGatherRule(lastUpserted()!);
+
+        Assert.True(mapped.EnrichErrorCodes);
     }
 
     // ── ContentEquivalent ──────────────────────────────────────────────────
@@ -175,6 +198,10 @@ public class GatherRuleScopeFieldsTests
         var emit = BaseRule();
         emit.EmitMode = "on_change";
         Assert.False(GatherRuleService.ContentEquivalent(baseline, emit));
+
+        var enrich = BaseRule();
+        enrich.EnrichErrorCodes = true;
+        Assert.False(GatherRuleService.ContentEquivalent(baseline, enrich));
     }
 
     [Fact]

src/Backend/AutopilotMonitor.Functions.Tests/GatherRuleUpdatePartialMergeTests.cs

@@ -37,6 +37,7 @@ public class GatherRuleUpdatePartialMergeTests
         CreatedAt = new DateTime(2026, 1, 15, 12, 0, 0, DateTimeKind.Utc),
         ActiveFromPhase = "AccountSetup",
         EmitMode = "on_change",
+        EnrichErrorCodes = true,
     };
 
     private static (GatherRuleService service, Mock<IRuleRepository> repo, List<GatherRule> stored) BuildService(
@@ -77,6 +78,7 @@ public class GatherRuleUpdatePartialMergeTests
         Assert.Equal("Version", written.Parameters["valueName"]);
         Assert.Equal("AccountSetup", written.ActiveFromPhase);
         Assert.Equal("on_change", written.EmitMode);
+        Assert.True(written.EnrichErrorCodes);
         Assert.Equal(existing.CreatedAt, written.CreatedAt);
         Assert.Equal("Alice Admin", written.Author);
     }

src/Backend/AutopilotMonitor.Functions.Tests/GetAgentConfigFunctionTests.cs

@@ -1,10 +1,10 @@
-using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Tests for <see cref="GetAgentConfigFunction.ParseAgentMajor"/> — the pure decision logic that picks
+/// Tests for <see cref="AgentConfigResolver.ParseAgentMajor"/> — the pure decision logic that picks
 /// the per-line hash-oracle field set based on the X-Agent-Version header value.
 /// </summary>
 public class GetAgentConfigFunctionTests
@@ -29,7 +29,7 @@ public class GetAgentConfigFunctionTests
     [InlineData("vNEXT", 1)]
     public void ParseAgentMajor_ExtractsMajor(string? agentVersion, int expectedMajor)
     {
-        var actual = GetAgentConfigFunction.ParseAgentMajor(agentVersion);
+        var actual = AgentConfigResolver.ParseAgentMajor(agentVersion);
         Assert.Equal(expectedMajor, actual);
     }
 
@@ -49,7 +49,7 @@ public class GetAgentConfigFunctionTests
             P(@"C:\Windows\SetupDiag\*.log", "tenant"),
         };
 
-        var merged = GetAgentConfigFunction.MergeDiagnosticsLogPaths(global, tenant);
+        var merged = AgentConfigResolver.MergeDiagnosticsLogPaths(global, tenant);
 
         Assert.Equal(new[]
         {
@@ -63,7 +63,7 @@ public class GetAgentConfigFunctionTests
     [Fact]
     public void MergeDiagnosticsLogPaths_DropsBlankEntries()
     {
-        var merged = GetAgentConfigFunction.MergeDiagnosticsLogPaths(
+        var merged = AgentConfigResolver.MergeDiagnosticsLogPaths(
             new[] { P(""), P("   "), P(@"C:\Install\Log\*.log") },
             new DiagnosticsLogPath[] { null!, P(@"C:\Install\Log\*.log") });
 
@@ -90,7 +90,7 @@ public class GetAgentConfigFunctionTests
     public void ResolveDiagnosticsUploadEnabled_GatesOnSasOrHosted(
         string? diagnosticsBlobSasUrl, string? destination, bool expected)
     {
-        var actual = GetAgentConfigFunction.ResolveDiagnosticsUploadEnabled(diagnosticsBlobSasUrl, destination);
+        var actual = AgentConfigResolver.ResolveDiagnosticsUploadEnabled(diagnosticsBlobSasUrl, destination);
         Assert.Equal(expected, actual);
     }
 }

src/Backend/AutopilotMonitor.Functions.Tests/HealthCheckServiceMcpServerTests.cs

@@ -77,17 +77,62 @@ public class HealthCheckServiceMcpServerTests
     }
 
     [Fact]
-    public async Task Check_TimeoutOrConnectionFailure_ReportsWarningForColdStart()
+    public async Task Check_Timeout_ReportsWarmingSoTheCallerCanRePoll()
     {
         var svc = BuildServiceWithFactory(
             new ThrowingHttpClientFactory(new TaskCanceledException("timeout")));
 
         var check = await svc.CheckMcpServerAsync();
 
-        // Failure to wake the scaled-to-zero container within the budget is a warning,
-        // not a hard outage (a re-check may still succeed once it finishes warming).
+        // A scaled-to-zero container that did not answer inside the budget is "warming",
+        // NOT a fault: the caller re-checks and the activation we triggered keeps running.
+        Assert.Equal("warming", check.Status);
+        // The default budget is pinned here because it is set nowhere else in the repo —
+        // the code default IS the live production value.
+        Assert.Contains("3s", check.Message);
+    }
+
+    [Fact]
+    public async Task Check_Timeout_HonoursConfiguredBudget()
+    {
+        var svc = BuildServiceWithFactory(
+            new ThrowingHttpClientFactory(new TaskCanceledException("timeout")),
+            extraConfig: new Dictionary<string, string?> { ["McpServerHealthTimeoutSeconds"] = "7" });
+
+        var check = await svc.CheckMcpServerAsync();
+
+        Assert.Equal("warming", check.Status);
+        Assert.Contains("7s", check.Message);
+    }
+
+    [Fact]
+    public async Task Check_ConnectionFailure_ReportsWarningNotWarmingAndKeepsTheHostOut()
+    {
+        var svc = BuildServiceWithFactory(
+            new ThrowingHttpClientFactory(new System.Net.Http.HttpRequestException("no such host mcp.example.test")));
+
+        var check = await svc.CheckMcpServerAsync();
+
+        // Reaching the network and failing to connect is a real warning — distinct from
+        // the expected cold-start path, so it must not be softened to "warming".
         Assert.Equal("warning", check.Status);
-        Assert.Contains("could not be reached", check.Message);
+        Assert.DoesNotContain("http", check.Message, System.StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("mcp.example.test", check.Message);
+    }
+
+    [Theory]
+    [InlineData(12, false)]
+    [InlineData(750, false)]
+    [InlineData(751, true)]
+    [InlineData(2400, true)]
+    public void McpReachableMessage_marksOnlyAnswersAboveTheWarmThresholdAsColdStart(long elapsedMs, bool expectColdStart)
+    {
+        var message = HealthCheckService.McpReachableMessage(elapsedMs);
+
+        // Both arms keep the word "reachable" — the healthy-path assertions rely on it.
+        Assert.Contains("reachable", message);
+        Assert.Contains($"{elapsedMs}ms", message);
+        Assert.Equal(expectColdStart, message.Contains("cold start"));
     }
 
     /// <summary>
@@ -101,13 +146,21 @@ public class HealthCheckServiceMcpServerTests
         return BuildServiceWithFactory(new StubHttpClientFactory(handler));
     }
 
-    private static HealthCheckService BuildServiceWithFactory(System.Net.Http.IHttpClientFactory factory)
+    private static HealthCheckService BuildServiceWithFactory(
+        System.Net.Http.IHttpClientFactory factory,
+        Dictionary<string, string?>? extraConfig = null)
     {
+        var settings = new Dictionary<string, string?>
+        {
+            ["McpServerUrl"] = "https://mcp.example.test",
+        };
+        if (extraConfig != null)
+        {
+            foreach (var kv in extraConfig) settings[kv.Key] = kv.Value;
+        }
+
         var config = new ConfigurationBuilder()
-            .AddInMemoryCollection(new Dictionary<string, string?>
-            {
-                ["McpServerUrl"] = "https://mcp.example.test",
-            })
+            .AddInMemoryCollection(settings)
             .Build();
 
         return new HealthCheckService(

src/Backend/AutopilotMonitor.Functions.Tests/InfrastructureWireParityTests.cs

@@ -28,6 +28,8 @@ public class InfrastructureWireParityTests
         var displayName = "Admin User";
         var objectId = "0b6f7a37-1111-4d61-9c93-0aa111111111";
         var managedTenantIds = new[] { "7b7b46b3-40c3-4f2f-9a1b-6d9f1a2b3c4e" };
+        var platformSeen = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+        var agentSeen = new DateTime(2026, 9, 8, 10, 5, 0, DateTimeKind.Utc);
 
         AssertParity(
             new
@@ -46,7 +48,9 @@ public class InfrastructureWireParityTests
                 hasMcpAccess = true,
                 homedApp = "primary",
                 bootstrapTokenEnabled = true,
-                unrestrictedModeEnabled = false
+                unrestrictedModeEnabled = false,
+                whatsNewSeenPlatformUtc = platformSeen,
+                whatsNewSeenAgentUtc = agentSeen
             },
             new AuthMeResponse
             {
@@ -64,7 +68,9 @@ public class InfrastructureWireParityTests
                 HasMcpAccess = true,
                 HomedApp = "primary",
                 BootstrapTokenEnabled = true,
-                UnrestrictedModeEnabled = false
+                UnrestrictedModeEnabled = false,
+                WhatsNewSeenPlatformUtc = platformSeen,
+                WhatsNewSeenAgentUtc = agentSeen
             });
     }
 
@@ -78,6 +84,8 @@ public class InfrastructureWireParityTests
         var displayName = "Reader User";
         var objectId = "0b6f7a37-2222-4d61-9c93-0aa222222222";
         string? role = null;
+        DateTime? whatsNewSeenPlatformUtc = null;
+        DateTime? whatsNewSeenAgentUtc = null;
 
         AssertParity(
             new
@@ -96,7 +104,9 @@ public class InfrastructureWireParityTests
                 hasMcpAccess = true,
                 homedApp = "legacy",
                 bootstrapTokenEnabled = false,
-                unrestrictedModeEnabled = false
+                unrestrictedModeEnabled = false,
+                whatsNewSeenPlatformUtc,
+                whatsNewSeenAgentUtc
             },
             new AuthMeResponse
             {
@@ -114,7 +124,9 @@ public class InfrastructureWireParityTests
                 HasMcpAccess = true,
                 HomedApp = "legacy",
                 BootstrapTokenEnabled = false,
-                UnrestrictedModeEnabled = false
+                UnrestrictedModeEnabled = false,
+                WhatsNewSeenPlatformUtc = null,
+                WhatsNewSeenAgentUtc = null
             });
     }
 

src/Backend/AutopilotMonitor.Functions.Tests/QueryParamGuardTests.cs

@@ -9,7 +9,8 @@ namespace AutopilotMonitor.Functions.Tests;
 /// is a new private parser copy — the state the 2026-09-04 API audit found six times over for
 /// <c>days</c> alone, each with its own default, cap and out-of-range rule. The baseline lists
 /// the sites that parse something other than a query parameter (a header, a stored cell, a
-/// version string); it only shrinks.
+/// version string); it only shrinks. The X-Agent-Version major parse moved to
+/// <c>Services/AgentConfigResolver.cs</c> (outside the scanned roots) with D-216.
 /// </summary>
 public class QueryParamGuardTests
 {
@@ -19,7 +20,6 @@ public class QueryParamGuardTests
     /// <summary>Non-query parses, reviewed: file → why it is allowed.</summary>
     private static readonly IReadOnlyDictionary<string, string> Baseline = new Dictionary<string, string>(StringComparer.Ordinal)
     {
-        ["Functions/Config/GetAgentConfigFunction.cs"] = "major of the X-Agent-Version header",
         ["Functions/Ingest/IngestTelemetryFunction.cs"] = "X-Send-Time-Utc header (RoundtripKind, deliberately not a query instant)",
         ["Functions/Raw/QueryRawEventsFunction.cs"] = "Severity / Sequence cells of raw table rows",
         ["Functions/Diagnostics/GetDiagnosticsUploadUrlFunction.cs"] = "se= expiry inside the tenant's stored SAS URL",

src/Backend/AutopilotMonitor.Functions.Tests/RevokeEnforcementTests.cs

@@ -77,7 +77,7 @@ public class RevokeEnforcementTests
     }
 
     private static (TenantGroupManagementFunction Fn, Mock<IAdminRepository> Repo,
-        Mock<IMaintenanceRepository> Audit, FakeSignalRNotificationService SignalR) BuildGroupFn()
+        Mock<IMaintenanceRepository> Audit, FakeSignalRNotificationService SignalR) BuildGroupFn(ProConferralService? proConferral = null)
     {
         var repo = new Mock<IAdminRepository>();
         // Loose-mock defaults return a null Task — every repo read the flows touch needs a concrete setup.
@@ -90,10 +90,17 @@ public class RevokeEnforcementTests
         var signalR = new FakeSignalRNotificationService();
         var fn = new TenantGroupManagementFunction(
             NullLogger<TenantGroupManagementFunction>.Instance, BuildService(repo), Resolver(), audit.Object, signalR, BuildSlots(repo),
-            TestProConferral.Inert());
+            proConferral ?? TestProConferral.Inert());
         return (fn, repo, audit, signalR);
     }
 
+    /// <summary>A recording conferral double (CallBase off, touches no storage): the group flows only need to prove WHAT they hand it.</summary>
+    private static Mock<ProConferralService> RecordingProConferral() =>
+        new(Mock.Of<IAdminRepository>(),
+            new TenantConfigurationService(Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, new MemoryCache(new MemoryCacheOptions())),
+            ManagedTenantProIndex.None,
+            NullLogger<ProConferralService>.Instance) { CallBase = false };
+
     // --- ChargeHomeTenantQuota flip: audited under every tenant, no-op on an unchanged value ---
 
     [Fact]
@@ -362,4 +369,53 @@ public class RevokeEnforcementTests
             TenantA, "DELETE", "DelegatedGroupAccess", "*", "ga@vendor.example",
             It.IsAny<Dictionary<string, string>?>()), Times.Once);
     }
+
+    // --- Group delete ends conferred Pro: every member of an OWNED group gets its grace anchor ---
+
+    private const string OwnerTenant = "33333333-3333-3333-3333-333333333333";
+
+    [Fact]
+    public async Task DeleteGroupCore_OwnedGroup_RecordsLossForEveryMember_EvenWithoutAssignees()
+    {
+        var proConferral = RecordingProConferral();
+        var (fn, repo, audit, _) = BuildGroupFn(proConferral.Object);
+        var ownedGroupId = Constants.TenantGroupIds.ForHomeTenant(OwnerTenant);
+        repo.Setup(r => r.GetTenantGroupAsync(ownedGroupId)).ReturnsAsync(new TenantGroup
+        {
+            GroupId = ownedGroupId,
+            Name = "Customers of owner",
+            OwnerTenantId = OwnerTenant,
+            TenantIds = new List<string> { TenantA, TenantB, OwnerTenant },
+            AssigneeCount = 0,
+        });
+        repo.Setup(r => r.DeleteTenantGroupAsync(ownedGroupId)).ReturnsAsync(true);
+
+        await fn.DeleteGroupCoreAsync(ownedGroupId, "ga@vendor.example");
+
+        // The anchor does not depend on assignees (no assignee ⇒ no access audit, but Pro still ends);
+        // the owner itself is never a managed tenant of its own group.
+        proConferral.Verify(p => p.RecordLossAsync(TenantA, OwnerTenant, "group-deleted"), Times.Once);
+        proConferral.Verify(p => p.RecordLossAsync(TenantB, OwnerTenant, "group-deleted"), Times.Once);
+        proConferral.Verify(p => p.RecordLossAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Exactly(2));
+        VerifyNoAudit(audit);
+    }
+
+    [Fact]
+    public async Task DeleteGroupCore_OperatorGroup_RecordsNoLoss()
+    {
+        var proConferral = RecordingProConferral();
+        var (fn, repo, _, _) = BuildGroupFn(proConferral.Object);
+        repo.Setup(r => r.GetTenantGroupAsync(GroupId)).ReturnsAsync(new TenantGroup
+        {
+            GroupId = GroupId,
+            Name = "MSP Customers",
+            TenantIds = new List<string> { TenantA },
+            AssigneeCount = 0,
+        });
+        repo.Setup(r => r.DeleteTenantGroupAsync(GroupId)).ReturnsAsync(true);
+
+        await fn.DeleteGroupCoreAsync(GroupId, "ga@vendor.example");
+
+        proConferral.Verify(p => p.RecordLossAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/Services/ErrorCodeEnricherTests.cs

@@ -160,6 +160,88 @@ public sealed class ErrorCodeEnricherTests
         Assert.Single(nested);
     }
 
+    [Fact]
+    public void EnrichEvent_skips_gather_rule_events_by_default()
+    {
+        // A logparser gather rule on HP Image Assistant.log captured `exitcode` — HPiA has its own
+        // exit-code table, so the MSI/Win32 catalog meaning ("ERROR_SUCCESS") must not be attached
+        // unless the rule opted in (no enrichErrorCodes marker here).
+        var evt = new EnrollmentEvent
+        {
+            EventType = "HPiA-UpdateStatus",
+            Source = "GatherRuleExecutor",
+            Message = "Gather: HP Updater Log Analyze",
+            Data = new()
+            {
+                { "exitcode", "0" },
+                { "errorCode", "0x80070005" },
+                { "enforcementState", "1000" },
+                { "ruleId", "hpia-log-collect" },
+            },
+        };
+
+        ErrorCodeEnricher.EnrichEvent(evt);
+
+        Assert.DoesNotContain(evt.Data.Keys, k => k.EndsWith("Info"));
+        Assert.Equal(4, evt.Data.Count);
+    }
+
+    [Fact]
+    public void EnrichEvent_matches_gather_rule_source_case_insensitively()
+    {
+        var evt = EventWithData(new() { { "exitCode", "1603" } });
+        evt.Source = "gatherruleexecutor";
+
+        ErrorCodeEnricher.EnrichEvent(evt);
+
+        Assert.False(evt.Data.ContainsKey("exitCodeInfo"));
+    }
+
+    [Theory]
+    [InlineData(true)]        // in-process CLR bool
+    [InlineData("true")]      // string form after DataJson roundtrip
+    [InlineData("True")]
+    public void EnrichEvent_enriches_gather_rule_events_that_opted_in(object marker)
+    {
+        // A rule that parses an msiexec log set enrichErrorCodes; the agent stamped the marker.
+        var evt = EventWithData(new()
+        {
+            { "exitCode", "1603" },
+            { "ruleId", "msi-log" },
+            { "enrichErrorCodes", marker },
+        });
+        evt.Source = "GatherRuleExecutor";
+
+        ErrorCodeEnricher.EnrichEvent(evt);
+
+        Assert.Equal("ERROR_INSTALL_FAILURE", Info(evt, "exitCodeInfo")["symbol"]);
+    }
+
+    [Theory]
+    [InlineData(false)]
+    [InlineData("false")]
+    [InlineData("")]
+    public void EnrichEvent_ignores_gather_rule_marker_that_is_not_true(object marker)
+    {
+        var evt = EventWithData(new() { { "exitCode", "1603" }, { "enrichErrorCodes", marker } });
+        evt.Source = "GatherRuleExecutor";
+
+        ErrorCodeEnricher.EnrichEvent(evt);
+
+        Assert.False(evt.Data.ContainsKey("exitCodeInfo"));
+    }
+
+    [Fact]
+    public void EnrichEvent_marker_on_non_gather_event_changes_nothing()
+    {
+        // Built-in events are always enriched; the marker is only consulted for gather events.
+        var evt = EventWithData(new() { { "exitCode", "1603" }, { "enrichErrorCodes", false } });
+
+        ErrorCodeEnricher.EnrichEvent(evt);
+
+        Assert.True(evt.Data.ContainsKey("exitCodeInfo"));
+    }
+
     [Fact]
     public void EnrichEvent_handles_null_data_dictionary()
     {

src/Backend/AutopilotMonitor.Functions.Tests/SessionFreeTextSearchTests.cs

@@ -1,4 +1,9 @@
 using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.Json;
+using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
@@ -7,13 +12,16 @@ using Xunit;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Fragilitätsaudit P6.2: server-side free-text search (<c>q=</c>) for the dashboard search
-/// box, replacing the client's unbounded loadAll() sweep. The predicate must mirror the web
-/// dashboard's client-side searchable field set (minus derived-only tokens) — see the doc on
-/// <c>TableStorageService.MatchesFreeText</c>.
+/// Server-side free-text search (<c>q=</c>) for the dashboard search box. The predicate is the
+/// search grammar of <see cref="SessionSearchQuery"/> over the web dashboard's client-side
+/// searchable field set (minus derived-only tokens). Parity with the web parser is pinned by
+/// the shared case file <c>src/Web/autopilot-monitor-web/utils/session-search-syntax.cases.json</c>,
+/// which vitest runs against <c>app/dashboard/utils/sessionSearchQuery.ts</c>.
 /// </summary>
 public class SessionFreeTextSearchTests
 {
+    private const string CasesRepoPath = "src/Web/autopilot-monitor-web/utils/session-search-syntax.cases.json";
+
     private static SessionSummary Sample() => new()
     {
         SessionId = "22222222-2222-2222-2222-222222222222",
@@ -66,6 +74,79 @@ public class SessionFreeTextSearchTests
         Assert.True(TableStorageService.MatchesFreeText(Sample(), string.Empty));
     }
 
+    // ---- Parity with the web parser (shared case file) ----
+
+    public static IEnumerable<object[]> SharedCases()
+    {
+        var doc = LoadCases();
+        foreach (var c in doc.RootElement.GetProperty("cases").EnumerateArray())
+        {
+            // `extra` cases exercise client-derived tokens the server never sees.
+            if (c.TryGetProperty("extra", out _)) continue;
+            yield return new object[]
+            {
+                c.GetProperty("query").GetString()!,
+                c.GetProperty("expected").GetBoolean(),
+                c.GetProperty("note").GetString()!,
+            };
+        }
+    }
+
+    [Theory]
+    [MemberData(nameof(SharedCases))]
+    public void SharedCase_MatchesLikeTheWebParser(string query, bool expected, string note)
+    {
+        var session = SessionFromCaseFile();
+        Assert.True(expected == SessionSearchQuery.Parse(query).Matches(session), $"{query} — {note}");
+    }
+
+    [Fact]
+    public void SharedCaseFile_SampleSession_IsTheOneTheTestsUse()
+    {
+        // The case file's session drives both sides; the local Sample() mirrors it so the
+        // InlineData theories above and the shared cases talk about the same rows.
+        var fromFile = SessionFromCaseFile();
+        var local = Sample();
+        foreach (var field in SessionSearchQuery.Fields)
+            Assert.Equal(field.Value(local), field.Value(fromFile));
+    }
+
+    [Fact]
+    public void SharedCaseFile_CoversEveryQualifier_AndEveryFieldHasAValue()
+    {
+        var doc = LoadCases();
+        var queries = string.Join("\n", doc.RootElement.GetProperty("cases").EnumerateArray()
+            .Select(c => c.GetProperty("query").GetString()!.ToLowerInvariant()));
+        var session = SessionFromCaseFile();
+        foreach (var field in SessionSearchQuery.Fields)
+        {
+            Assert.True(queries.Contains(field.Key + "=") || queries.Contains(field.Key + ":"),
+                $"no shared case uses {field.Key}=");
+            Assert.False(string.IsNullOrEmpty(field.Value(session)), $"sample carries no {field.Key}");
+        }
+        Assert.Equal(SessionSearchQuery.Fields.Count, SessionSearchQuery.Fields.Select(f => f.Key).Distinct().Count());
+    }
+
+    [Fact]
+    public void Parse_ResolvesKnownQualifiers_AndKeepsUnknownOnesLiteral()
+    {
+        var q = SessionSearchQuery.Parse("Model=Surface -status:failed 14:30 foo=bar");
+        Assert.Equal(new[]
+        {
+            new SessionSearchQuery.Term("Surface", "model"),
+            new SessionSearchQuery.Term("14:30", null),
+            new SessionSearchQuery.Term("foo=bar", null),
+        }, q.Include);
+        Assert.Equal(new[] { new SessionSearchQuery.Term("failed", "status") }, q.Exclude);
+    }
+
+    [Fact]
+    public void Parse_LoneMinusOrBareQualifier_IsEmpty()
+    {
+        Assert.True(SessionSearchQuery.Parse(" - model= ").IsEmpty);
+        Assert.True(SessionSearchQuery.Parse(null).IsEmpty);
+    }
+
     [Fact]
     public void Fingerprint_BindsQ_SoContinuationCannotCrossQueries()
     {
@@ -81,4 +162,45 @@ public class SessionFreeTextSearchTests
         Assert.NotEqual(fp1, fp2);
         Assert.NotEqual(fp1, fp3);
     }
+
+    private static JsonDocument LoadCases()
+    {
+        var path = Path.Combine(FindRepoRoot(), CasesRepoPath.Replace('/', Path.DirectorySeparatorChar));
+        return JsonDocument.Parse(File.ReadAllText(path));
+    }
+
+    private static SessionSummary SessionFromCaseFile()
+    {
+        var s = LoadCases().RootElement.GetProperty("session");
+        string F(string name) => s.GetProperty(name).GetString()!;
+        return new SessionSummary
+        {
+            DeviceName = F("deviceName"),
+            SerialNumber = F("serialNumber"),
+            Manufacturer = F("manufacturer"),
+            Model = F("model"),
+            Status = Enum.Parse<SessionStatus>(F("status")),
+            SessionId = F("sessionId"),
+            GeoCountry = F("geoCountry"),
+            GeoRegion = F("geoRegion"),
+            GeoCity = F("geoCity"),
+            AgentVersion = F("agentVersion"),
+            OsName = F("osName"),
+            OsBuild = F("osBuild"),
+            OsDisplayVersion = F("osDisplayVersion"),
+            OsEdition = F("osEdition"),
+            OsLanguage = F("osLanguage"),
+        };
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null && !File.Exists(Path.Combine(dir.FullName, "AutopilotMonitor.sln")))
+        {
+            dir = dir.Parent;
+        }
+        Assert.NotNull(dir);
+        return dir!.FullName;
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/Shared/ErrorCodeCatalogTests.cs

@@ -9,7 +9,7 @@ using Xunit;
 namespace AutopilotMonitor.Functions.Tests.Shared;
 
 /// <summary>
-/// Pins the schemaVersion-2 catalog contract (generated by scripts/error-codes/generate.mjs):
+/// Pins the schemaVersion-2 catalog contract (generated by tools/error-codes/generate.mjs):
 /// key/source/category vocabulary, the HRESULT_FROM_WIN32 derivation, the symbol and
 /// enforcement-state indexes, and the handful of entries product code and rules rely on.
 /// </summary>

src/Backend/AutopilotMonitor.Functions.Tests/SharedManifestParityTests.cs

@@ -60,13 +60,26 @@ public sealed class SharedManifestParityTests
             // v2: adds the "types" section (full wire-type graph) and drops v1's
             // "sessionSummary" (it had no TS consumer; SessionSummary now rides in "types").
             ["schemaVersion"] = 2,
+            // "defaults" = the value of every wire field on a freshly constructed instance (the C#
+            // initializer): the web's "custom" highlight compares stored values against these
+            // instead of a hand-copied map. Nested objects appear as null — they have their own section.
             ["adminConfiguration"] = new Dictionary<string, object?>
             {
                 ["fields"] = WireFieldNames(typeof(AdminConfiguration)),
+                ["defaults"] = WireDefaults(typeof(AdminConfiguration)),
             },
             ["tenantConfiguration"] = new Dictionary<string, object?>
             {
                 ["fields"] = WireFieldNames(typeof(TenantConfiguration)),
+                ["defaults"] = WireDefaults(typeof(TenantConfiguration)),
+            },
+            // What an agent receives (GET agent/config) at its class defaults — the runtime column of
+            // the Tenant Config Report highlights every effective value that differs from these.
+            ["agentConfig"] = new Dictionary<string, object?>
+            {
+                ["responseDefaults"] = WireDefaults(typeof(AgentConfigResponse)),
+                ["collectorDefaults"] = WireDefaults(typeof(CollectorConfiguration)),
+                ["analyzerDefaults"] = WireDefaults(typeof(AnalyzerConfiguration)),
             },
             // Enum member order is load-bearing (append-only ordinals) — declaration order kept.
             ["sessionStatuses"] = Enum.GetNames(typeof(SessionStatus)),
@@ -116,6 +129,29 @@ public sealed class SharedManifestParityTests
     private static string[] WireFieldNames(Type type)
         => WireProperties(type).Select(p => JsonNamingPolicy.CamelCase.ConvertName(p.Name)).ToArray();
 
+    /// <summary>
+    /// Wire name → initializer value of a fresh instance. Scalars, strings, enums (by name),
+    /// DateTime (round-trip) and arrays/lists of those travel as-is; a nested object is null.
+    /// </summary>
+    private static Dictionary<string, object?> WireDefaults(Type type)
+    {
+        var instance = Activator.CreateInstance(type)!;
+        return WireProperties(type).ToDictionary(
+            p => JsonNamingPolicy.CamelCase.ConvertName(p.Name),
+            p => DefaultValue(p.GetValue(instance)));
+    }
+
+    private static object? DefaultValue(object? value) => value switch
+    {
+        null => null,
+        string s => s,
+        bool or int or long or double or float or decimal => value,
+        Enum e => e.ToString(),
+        DateTime d => d.ToString("O"),
+        System.Collections.IEnumerable list => list.Cast<object?>().Select(DefaultValue).ToArray(),
+        _ => null,
+    };
+
     private static IEnumerable<PropertyInfo> WireProperties(Type type)
         => type.GetProperties(BindingFlags.Public | BindingFlags.Instance)
             .Where(p => p.GetMethod != null && p.GetIndexParameters().Length == 0);

src/Backend/AutopilotMonitor.Functions.Tests/TableUserUsageRepositoryCasTests.cs

@@ -0,0 +1,152 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Azure;
+using Azure.Data.Tables;
+using AutopilotMonitor.Functions.DataAccess.TableStorage;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The two MCP usage counters go through <see cref="TableCasRetry"/> with a retry budget sized for
+/// parallel tool calls of one user (2026-09-06: the previous three-attempt loop without backoff lost
+/// 3 of 6 concurrent increments). These tests pin the budget, the merge-patch shape and the
+/// create-with-AddEntity path against a mocked table surface.
+/// </summary>
+public class TableUserUsageRepositoryCasTests
+{
+    private sealed class TableHarness
+    {
+        public Mock<TableClient> Table { get; } = new();
+        public List<TableEntity> Added { get; } = new();
+        public List<(TableEntity Entity, ETag ETag, TableUpdateMode Mode)> Updates { get; } = new();
+        public Func<Response<TableEntity>> Read { get; set; } = () => throw new RequestFailedException(404, "not found");
+        public Queue<Func<Response>> UpdateBehaviors { get; } = new();
+
+        public TableHarness()
+        {
+            Table.Setup(t => t.GetEntityAsync<TableEntity>(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<IEnumerable<string>>(), It.IsAny<CancellationToken>()))
+                .Returns(() => Task.FromResult(Read()));
+            Table.Setup(t => t.AddEntityAsync(It.IsAny<TableEntity>(), It.IsAny<CancellationToken>()))
+                .Returns<TableEntity, CancellationToken>((e, _) =>
+                {
+                    Added.Add(e);
+                    return Task.FromResult(Mock.Of<Response>());
+                });
+            Table.Setup(t => t.UpdateEntityAsync(It.IsAny<TableEntity>(), It.IsAny<ETag>(), It.IsAny<TableUpdateMode>(), It.IsAny<CancellationToken>()))
+                .Returns<TableEntity, ETag, TableUpdateMode, CancellationToken>((e, tag, mode, _) =>
+                {
+                    Updates.Add((e, tag, mode));
+                    return Task.FromResult(UpdateBehaviors.Count > 0 ? UpdateBehaviors.Dequeue()() : Mock.Of<Response>());
+                });
+        }
+
+        public static Response<TableEntity> Row(string pk, string rk, long count, string etag)
+        {
+            var e = new TableEntity(pk, rk) { ["RequestCount"] = count };
+            e.ETag = new ETag(etag);
+            return Response.FromValue(e, Mock.Of<Response>());
+        }
+
+        public static Func<Response> Conflict => () => throw new RequestFailedException(412, "precondition failed");
+    }
+
+    private sealed class Harness
+    {
+        public TableHarness Users { get; } = new();
+        public TableHarness Tenants { get; } = new();
+        public TableUserUsageRepository Repo { get; }
+
+        public Harness()
+        {
+            var service = new Mock<TableServiceClient>();
+            service.Setup(s => s.GetTableClient(Constants.TableNames.UserUsageLog)).Returns(Users.Table.Object);
+            service.Setup(s => s.GetTableClient(Constants.TableNames.McpTenantUsage)).Returns(Tenants.Table.Object);
+            var storage = new TableStorageService(service.Object, NullLogger<TableStorageService>.Instance);
+            Repo = new TableUserUsageRepository(storage, NullLogger<TableUserUsageRepository>.Instance);
+        }
+    }
+
+    [Fact]
+    public void Retry_budget_is_sized_for_parallel_tool_calls()
+    {
+        Assert.Equal(8, TableUserUsageRepository.UsageCounterRetries);
+        Assert.True(TableUserUsageRepository.UsageCounterRetries > TableCasRetry.DefaultRetries);
+    }
+
+    [Fact]
+    public async Task Four_consecutive_etag_conflicts_still_land_the_user_increment()
+    {
+        var h = new Harness();
+        h.Users.Read = () => TableHarness.Row("oid-1", "20260906_get_session_events:sessions_{id}_events", 5, "e1");
+        for (var i = 0; i < 4; i++)
+            h.Users.UpdateBehaviors.Enqueue(TableHarness.Conflict);
+
+        await h.Repo.IncrementUsageAsync("oid-1", "user@example.test", "tid-home", "get_session_events:sessions_{id}_events");
+
+        // The old loop gave up after three attempts; four conflicts plus the landing write = five updates.
+        Assert.Equal(5, h.Users.Updates.Count);
+        var (entity, etag, mode) = h.Users.Updates.Last();
+        Assert.Equal(6L, entity.GetInt64("RequestCount"));
+        Assert.Equal(new ETag("e1"), etag);
+        Assert.Equal(TableUpdateMode.Merge, mode);
+        Assert.Empty(h.Users.Added);
+    }
+
+    [Fact]
+    public async Task Missing_user_row_is_created_with_add_and_full_attribution()
+    {
+        var h = new Harness();
+
+        await h.Repo.IncrementUsageAsync("oid-1", "user@example.test", "tid-home", "get_metrics:metrics");
+
+        var row = Assert.Single(h.Users.Added);
+        Assert.Equal("oid-1", row.PartitionKey);
+        Assert.EndsWith("_get_metrics:metrics", row.RowKey);
+        Assert.Equal(1L, row.GetInt64("RequestCount"));
+        Assert.Equal("user@example.test", row.GetString("UserPrincipalName"));
+        Assert.Equal("tid-home", row.GetString("TenantId"));
+        Assert.Equal("get_metrics:metrics", row.GetString("Endpoint"));
+        Assert.Empty(h.Users.Updates);
+    }
+
+    [Fact]
+    public async Task Tenant_increment_merges_only_the_counter_and_attribution_columns()
+    {
+        var h = new Harness();
+        h.Tenants.Read = () => TableHarness.Row("tid-customer", "20260906_oid-1", 41, "t1");
+
+        await h.Repo.IncrementTenantUsageAsync("tid-customer", "oid-1", "msp@example.test", "tid-home");
+
+        var (entity, etag, mode) = Assert.Single(h.Tenants.Updates);
+        Assert.Equal(TableUpdateMode.Merge, mode);
+        Assert.Equal(new ETag("t1"), etag);
+        Assert.Equal(42L, entity.GetInt64("RequestCount"));
+        Assert.Equal("msp@example.test", entity.GetString("UserPrincipalName"));
+        Assert.Equal("tid-home", entity.GetString("HomeTenantId"));
+        Assert.NotNull(entity["LastRequestAt"]);
+        // A merge patch never re-sends the identity columns of the row.
+        Assert.False(entity.ContainsKey("Date"));
+        Assert.False(entity.ContainsKey("UserId"));
+    }
+
+    [Fact]
+    public async Task Tenant_increment_is_skipped_without_a_tenant_or_user()
+    {
+        var h = new Harness();
+
+        await h.Repo.IncrementTenantUsageAsync("", "oid-1", null, null);
+        await h.Repo.IncrementTenantUsageAsync("tid-customer", " ", null, null);
+
+        Assert.Empty(h.Tenants.Updates);
+        Assert.Empty(h.Tenants.Added);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/UserWhatsNewSeenStorageTests.cs

@@ -0,0 +1,126 @@
+using Azure;
+using Azure.Data.Tables;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+public class UserWhatsNewSeenStorageTests
+{
+    private const string TenantId = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+    private const string Upn = "user@contoso.com";
+
+    [Fact]
+    public async Task GetUserWhatsNewSeen_MissingRow_ReturnsNullMarks()
+    {
+        var h = new Harness();
+        h.Table.Setup(t => t.GetEntityAsync<TableEntity>(
+                TenantId,
+                TableStorageService.PresenceRowKey(Upn),
+                It.Is<IEnumerable<string>>(s => s.SequenceEqual(new[] { "WhatsNewSeenPlatformUtc", "WhatsNewSeenAgentUtc" })),
+                It.IsAny<CancellationToken>()))
+            .ThrowsAsync(new RequestFailedException(404, "Not found"));
+
+        var seen = await h.Sut.GetUserWhatsNewSeenAsync(TenantId, Upn);
+
+        Assert.Null(seen.PlatformUtc);
+        Assert.Null(seen.AgentUtc);
+    }
+
+    [Fact]
+    public async Task MarkUserWhatsNewSeen_OlderThanExisting_DoesNotWrite()
+    {
+        var existing = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+        var h = new Harness();
+        h.SetupRead(new TableEntity(TenantId, TableStorageService.PresenceRowKey(Upn))
+        {
+            ["WhatsNewSeenPlatformUtc"] = existing
+        });
+
+        await h.Sut.MarkUserWhatsNewSeenAsync(TenantId, Upn, "platform", existing.AddMinutes(-1));
+
+        Assert.Empty(h.Upserts);
+    }
+
+    [Fact]
+    public async Task MarkUserWhatsNewSeen_NewerValue_MergeUpsertsOnlySelectedChannelAndUpn()
+    {
+        var existing = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+        var newer = existing.AddMinutes(1);
+        var h = new Harness();
+        h.SetupRead(new TableEntity(TenantId, TableStorageService.PresenceRowKey(Upn))
+        {
+            ["WhatsNewSeenAgentUtc"] = existing
+        });
+
+        await h.Sut.MarkUserWhatsNewSeenAsync(TenantId, Upn, "agent", newer);
+
+        var (entity, mode) = Assert.Single(h.Upserts);
+        Assert.Equal(TableUpdateMode.Merge, mode);
+        Assert.Equal(Upn, entity.GetString("Upn"));
+        Assert.Equal(newer, entity.GetDateTime("WhatsNewSeenAgentUtc"));
+        Assert.False(entity.ContainsKey("LastSeen"));
+        Assert.False(entity.ContainsKey("UserRole"));
+        Assert.False(entity.ContainsKey("WhatsNewSeenPlatformUtc"));
+    }
+
+    [Fact]
+    public async Task MarkUserWhatsNewSeen_MissingRow_MergeCreatesRowWithUpn()
+    {
+        var seen = new DateTime(2026, 9, 8, 10, 0, 0, DateTimeKind.Utc);
+        var h = new Harness();
+        h.Table.Setup(t => t.GetEntityAsync<TableEntity>(
+                TenantId,
+                TableStorageService.PresenceRowKey(Upn),
+                It.IsAny<IEnumerable<string>>(),
+                It.IsAny<CancellationToken>()))
+            .ThrowsAsync(new RequestFailedException(404, "Not found"));
+
+        await h.Sut.MarkUserWhatsNewSeenAsync(TenantId, Upn, "platform", seen);
+
+        var (entity, mode) = Assert.Single(h.Upserts);
+        Assert.Equal(TableUpdateMode.Merge, mode);
+        Assert.Equal(TenantId, entity.PartitionKey);
+        Assert.Equal(TableStorageService.PresenceRowKey(Upn), entity.RowKey);
+        Assert.Equal(Upn, entity.GetString("Upn"));
+        Assert.Equal(seen, entity.GetDateTime("WhatsNewSeenPlatformUtc"));
+        Assert.False(entity.ContainsKey("LastSeen"));
+        Assert.False(entity.ContainsKey("UserRole"));
+    }
+
+    private sealed class Harness
+    {
+        public Mock<TableClient> Table { get; } = new();
+        public TableStorageService Sut { get; }
+        public List<(TableEntity Entity, TableUpdateMode Mode)> Upserts { get; } = new();
+
+        public Harness()
+        {
+            Table.Setup(t => t.UpsertEntityAsync(
+                    It.IsAny<TableEntity>(),
+                    It.IsAny<TableUpdateMode>(),
+                    It.IsAny<CancellationToken>()))
+                .Returns<TableEntity, TableUpdateMode, CancellationToken>((e, mode, _) =>
+                {
+                    Upserts.Add((e, mode));
+                    return Task.FromResult(Mock.Of<Response>());
+                });
+
+            var serviceClient = new Mock<TableServiceClient>();
+            serviceClient.Setup(c => c.GetTableClient(Constants.TableNames.UserPresence)).Returns(Table.Object);
+            Sut = new TableStorageService(serviceClient.Object, NullLogger<TableStorageService>.Instance);
+        }
+
+        public void SetupRead(TableEntity entity)
+        {
+            Table.Setup(t => t.GetEntityAsync<TableEntity>(
+                    entity.PartitionKey,
+                    entity.RowKey,
+                    It.IsAny<IEnumerable<string>>(),
+                    It.IsAny<CancellationToken>()))
+                .ReturnsAsync(Response.FromValue(entity, Mock.Of<Response>()));
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/VulnerabilitySummaryAggregatorTests.cs

@@ -88,6 +88,24 @@ public class VulnerabilitySummaryAggregatorTests
         Assert.Equal(4, r.DistinctCves);
     }
 
+    [Fact]
+    public void BuildsPriorityBreakdownFromTheMergedBand_legacyRowsCountInNone()
+    {
+        var act = Row("CVE-A", "s1", "Critical", 9.8, kev: true); act.Priority = "act";
+        var attendHigh = Row("CVE-B", "s1", "Medium", 5.0); attendHigh.Priority = "attend";
+        var attendLow = Row("CVE-B", "s2", "Medium", 5.0); attendLow.Priority = "track";   // merged band = attend
+        var track = Row("CVE-C", "s2", "Low", 2.0); track.Priority = "TRACK";              // case-insensitive
+        var legacy = Row("CVE-D", "s3", "High", 7.5);                                       // empty priority
+
+        var r = VulnerabilitySummaryAggregator.Aggregate(new[] { act, attendHigh, attendLow, track, legacy }, false, 20, 30, false, Now);
+
+        Assert.Equal(1, r.PriorityBreakdown.Act);
+        Assert.Equal(1, r.PriorityBreakdown.Attend);
+        Assert.Equal(1, r.PriorityBreakdown.Track);
+        Assert.Equal(4, r.DistinctCves);
+        Assert.Equal(r.KevCves, r.PriorityBreakdown.Act);
+    }
+
     [Fact]
     public void RanksTopCvesByAffectedSessionsThenScore_andRespectsTopN()
     {

src/Backend/AutopilotMonitor.Functions.Tests/VulnerabilityWireParityTests.cs

@@ -663,6 +663,7 @@ public class VulnerabilityWireParityTests
     public void CveExposureSummary_wire_shape_is_unchanged_by_the_IApiResponse_marker()
     {
         var breakdown = new SeverityBreakdown { Critical = 1, High = 2, Medium = 0, Low = 0 };
+        var priorities = new PriorityBreakdown { Act = 1, Attend = 1, Track = 1 };
         var topCves = new List<TopCve>
         {
             new TopCve
@@ -687,6 +688,7 @@ public class VulnerabilityWireParityTests
                 distinctCves = 3,
                 kevCves = 1,
                 severityBreakdown = breakdown,
+                priorityBreakdown = priorities,
                 topCves,
                 truncated = false,
             },
@@ -698,6 +700,7 @@ public class VulnerabilityWireParityTests
                 DistinctCves = 3,
                 KevCves = 1,
                 SeverityBreakdown = breakdown,
+                PriorityBreakdown = priorities,
                 TopCves = topCves,
                 Truncated = false,
             });
@@ -707,6 +710,7 @@ public class VulnerabilityWireParityTests
     public void CveExposureSummary_omits_totalAffectedTenants_on_a_tenant_scoped_read()
     {
         var breakdown = new SeverityBreakdown { Critical = 0, High = 0, Medium = 0, Low = 0 };
+        var priorities = new PriorityBreakdown { Act = 0, Attend = 0, Track = 0 };
         var topCves = new List<TopCve>();
 
         AssertParity(
@@ -718,6 +722,7 @@ public class VulnerabilityWireParityTests
                 distinctCves = 0,
                 kevCves = 0,
                 severityBreakdown = breakdown,
+                priorityBreakdown = priorities,
                 topCves,
                 truncated = true,
             },
@@ -729,6 +734,7 @@ public class VulnerabilityWireParityTests
                 DistinctCves = 0,
                 KevCves = 0,
                 SeverityBreakdown = breakdown,
+                PriorityBreakdown = priorities,
                 TopCves = topCves,
                 Truncated = true,
             });

src/Backend/AutopilotMonitor.Functions.Tests/WhatsNewNotificationServiceTests.cs

@@ -0,0 +1,453 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Functions.Services.Notifications;
+using AutopilotMonitor.Functions.Services.WhatsNew;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Models.Notifications;
+using AutopilotMonitor.Shared.Models.WhatsNew;
+using Microsoft.ApplicationInsights;
+using Microsoft.ApplicationInsights.Extensibility;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// What's new → channel digest: feed parsing, watermark semantics (baseline on first run, diff by
+/// entry key, claim-then-send with ETag CAS), per-channel opt-in routing, and the digest shape.
+/// </summary>
+public class WhatsNewNotificationServiceTests
+{
+    // ── Fakes ─────────────────────────────────────────────────────────────
+
+    private sealed class InMemoryStateRepository : IWhatsNewNotificationStateRepository
+    {
+        private WhatsNewNotificationState? _row;
+        private long _version = 0;
+        public int ConflictsToInject { get; set; }
+        public int Writes { get; private set; }
+
+        public WhatsNewNotificationState? Current => _row;
+
+        public void Seed(params string[] knownKeys)
+        {
+            _row = new WhatsNewNotificationState { KnownEntryKeys = new HashSet<string>(knownKeys, StringComparer.Ordinal) };
+            _version++;
+        }
+
+        public Task<(WhatsNewNotificationState? State, string? ETag)> GetWithETagAsync()
+            => Task.FromResult(_row == null ? ((WhatsNewNotificationState?)null, (string?)null) : (Clone(_row), _version.ToString()));
+
+        public Task<bool> TryUpsertAsync(WhatsNewNotificationState state, string? ifMatchETag)
+        {
+            if (ConflictsToInject > 0)
+            {
+                ConflictsToInject--;
+                _version++;
+                return Task.FromResult(false);
+            }
+            if (ifMatchETag is null && _row != null) return Task.FromResult(false);
+            if (ifMatchETag is not null && ifMatchETag != _version.ToString()) return Task.FromResult(false);
+
+            _row = Clone(state);
+            _version++;
+            Writes++;
+            return Task.FromResult(true);
+        }
+
+        private static WhatsNewNotificationState Clone(WhatsNewNotificationState s) => new()
+        {
+            KnownEntryKeys = new HashSet<string>(s.KnownEntryKeys, StringComparer.Ordinal),
+            LastDocsCommit = s.LastDocsCommit,
+            LastRunUtc = s.LastRunUtc,
+            LastNotifiedUtc = s.LastNotifiedUtc,
+            LastNotifiedEntryCount = s.LastNotifiedEntryCount,
+        };
+    }
+
+    private sealed class Harness
+    {
+        public InMemoryStateRepository StateRepo { get; } = new();
+        public Mock<IWhatsNewFeedClient> Feed { get; } = new();
+        public Mock<IConfigRepository> ConfigRepo { get; } = new();
+        public Mock<NotificationChannelDispatcher> Dispatcher { get; }
+        public List<(List<NotificationChannel> Channels, NotificationAlert Alert)> Sent { get; } = new();
+        public WhatsNewNotificationService Service { get; }
+        public DateTime Now { get; } = new(2026, 9, 8, 12, 0, 0, DateTimeKind.Utc);
+
+        public Harness()
+        {
+            var webhook = new WebhookNotificationService(new HttpClient(), NullLogger<WebhookNotificationService>.Instance);
+            var telegram = new TelegramNotificationService(new HttpClient(), Mock.Of<IConfigRepository>(), NullLogger<TelegramNotificationService>.Instance);
+            Dispatcher = new Mock<NotificationChannelDispatcher>(webhook, telegram);
+            Dispatcher
+                .Setup(d => d.SendToChannelsAsync(It.IsAny<IEnumerable<NotificationChannel>>(), It.IsAny<NotificationAlert>()))
+                .Returns<IEnumerable<NotificationChannel>, NotificationAlert>((channels, alert) =>
+                {
+                    Sent.Add((channels.ToList(), alert));
+                    return Task.CompletedTask;
+                });
+
+            ConfigRepo.Setup(r => r.GetAllTenantConfigurationsAsync()).ReturnsAsync(new List<TenantConfiguration>());
+
+            Service = new WhatsNewNotificationService(
+                Feed.Object,
+                StateRepo,
+                ConfigRepo.Object,
+                Dispatcher.Object,
+                new TelemetryClient(new TelemetryConfiguration()),
+                NullLogger<WhatsNewNotificationService>.Instance,
+                () => Now);
+        }
+
+        public void SetFeed(WhatsNewFeed? feed)
+            => Feed.Setup(f => f.GetAsync(It.IsAny<CancellationToken>())).ReturnsAsync(feed);
+
+        public void SetTenants(params TenantConfiguration[] tenants)
+            => ConfigRepo.Setup(r => r.GetAllTenantConfigurationsAsync()).ReturnsAsync(tenants.ToList());
+    }
+
+    private static WhatsNewFeedEntry Entry(string channel, string id, string? title = null, string body = "Body text.", int daysAgo = 0)
+        => new()
+        {
+            Channel = channel,
+            Id = id,
+            AddedUtc = new DateTime(2026, 9, 8, 0, 0, 0, DateTimeKind.Utc).AddDays(-daysAgo),
+            Period = "September 2026",
+            Title = title,
+            Body = body,
+            Link = null,
+        };
+
+    private static WhatsNewFeed Feed(params WhatsNewFeedEntry[] entries) => new()
+    {
+        DocsCommit = "abc1234",
+        Entries = entries,
+        DocsUrls = new Dictionary<string, string>
+        {
+            [WhatsNewFeed.PlatformChannel] = Constants.DocsBaseUrl + "/changelog/platform-changelog",
+            [WhatsNewFeed.AgentChannel] = Constants.DocsBaseUrl + "/changelog/agent-changelog",
+        },
+    };
+
+    private static TenantConfiguration Tenant(string id, params NotificationChannel[] channels) => new()
+    {
+        TenantId = id,
+        NotificationChannelsJson = NotificationChannel.SerializeList(channels),
+    };
+
+    private static NotificationChannel Channel(string id, bool whatsNew, bool enabled = true, string url = "https://hooks.example/x")
+        => new() { Id = id, Name = id, ProviderType = 20, Url = url, Enabled = enabled, NotifyOnWhatsNew = whatsNew, NotifyOnSuccess = true };
+
+    // ── Feed parsing ──────────────────────────────────────────────────────
+
+    [Fact]
+    public void Parse_ValidPayload_YieldsEntriesForBothChannels()
+    {
+        const string json = """
+        {
+          "schemaVersion": 1,
+          "generatedUtc": "2026-09-08T10:00:00.000Z",
+          "docsCommit": "deadbee",
+          "channels": {
+            "platform": { "docsUrl": "https://docs.autopilotmonitor.com/changelog/platform-changelog", "entries": [
+              { "id": "0a1b2c3d", "addedUtc": "2026-09-07T09:00:00.000Z", "period": "September 2026", "title": "**Bold lead**", "body": "Body with [link](https://docs.autopilotmonitor.com/x).", "link": "https://docs.autopilotmonitor.com/x" }
+            ] },
+            "agent": { "docsUrl": "https://docs.autopilotmonitor.com/changelog/agent-changelog", "entries": [
+              { "id": "ffffffff", "addedUtc": "2026-09-01T09:00:00.000Z", "period": "September 2026", "title": null, "body": "Agent bullet.", "link": null }
+            ] }
+          }
+        }
+        """;
+
+        var feed = WhatsNewFeed.Parse(json);
+
+        Assert.NotNull(feed);
+        Assert.Equal("deadbee", feed!.DocsCommit);
+        Assert.Equal(2, feed.Entries.Count);
+        Assert.Equal("platform:0a1b2c3d", feed.Entries[0].Key);
+        Assert.Equal("agent:ffffffff", feed.Entries[1].Key);
+        Assert.Equal(new DateTime(2026, 9, 7, 9, 0, 0, DateTimeKind.Utc), feed.Entries[0].AddedUtc);
+        Assert.Equal("https://docs.autopilotmonitor.com/changelog/agent-changelog", feed.DocsUrls[WhatsNewFeed.AgentChannel]);
+    }
+
+    [Fact]
+    public void Parse_OffShape_YieldsNull()
+    {
+        Assert.Null(WhatsNewFeed.Parse(null));
+        Assert.Null(WhatsNewFeed.Parse(""));
+        Assert.Null(WhatsNewFeed.Parse("not json"));
+        Assert.Null(WhatsNewFeed.Parse("""{"schemaVersion":2,"channels":{"platform":{"entries":[]},"agent":{"entries":[]}}}"""));
+        // Missing channel
+        Assert.Null(WhatsNewFeed.Parse("""{"schemaVersion":1,"channels":{"platform":{"entries":[]}}}"""));
+        // Entry without id
+        Assert.Null(WhatsNewFeed.Parse("""{"schemaVersion":1,"channels":{"platform":{"entries":[{"addedUtc":"2026-09-07T09:00:00Z","body":"x"}]},"agent":{"entries":[]}}}"""));
+    }
+
+    // ── Run semantics ─────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Run_FeedUnavailable_DoesNotTouchStateOrSend()
+    {
+        var h = new Harness();
+        h.SetFeed(null);
+        h.StateRepo.Seed("platform:old");
+
+        var result = await h.Service.RunAsync();
+
+        Assert.True(result.FeedUnavailable);
+        Assert.Equal(0, h.StateRepo.Writes);
+        Assert.Empty(h.Sent);
+    }
+
+    [Fact]
+    public async Task Run_FirstRun_BaselinesWithoutSending()
+    {
+        var h = new Harness();
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("agent", "b")));
+        h.SetTenants(Tenant("t1", Channel("c1", whatsNew: true)));
+
+        var result = await h.Service.RunAsync();
+
+        Assert.True(result.Baselined);
+        Assert.Empty(h.Sent);
+        Assert.NotNull(h.StateRepo.Current);
+        Assert.Equal(new[] { "agent:b", "platform:a" }, h.StateRepo.Current!.KnownEntryKeys.OrderBy(k => k));
+        Assert.Equal("abc1234", h.StateRepo.Current.LastDocsCommit);
+        Assert.Null(h.StateRepo.Current.LastNotifiedUtc);
+    }
+
+    [Fact]
+    public async Task Run_EmptyKnownSet_IsTreatedAsBaseline()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed(); // row exists, no keys
+        h.SetFeed(Feed(Entry("platform", "a")));
+        h.SetTenants(Tenant("t1", Channel("c1", whatsNew: true)));
+
+        var result = await h.Service.RunAsync();
+
+        Assert.True(result.Baselined);
+        Assert.Empty(h.Sent);
+    }
+
+    [Fact]
+    public async Task Run_NothingNew_NoSendAndNoWriteWhenUnchanged()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a", "agent:b");
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("agent", "b")));
+        h.SetTenants(Tenant("t1", Channel("c1", whatsNew: true)));
+
+        var result = await h.Service.RunAsync();
+
+        Assert.Equal(0, result.NewEntries);
+        Assert.Empty(h.Sent);
+        Assert.Equal(0, h.StateRepo.Writes);
+    }
+
+    [Fact]
+    public async Task Run_EntriesRolledOut_UpdatesWatermarkWithoutSending()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a", "platform:old");
+        h.SetFeed(Feed(Entry("platform", "a")));
+
+        var result = await h.Service.RunAsync();
+
+        Assert.Equal(0, result.NewEntries);
+        Assert.Empty(h.Sent);
+        Assert.Equal(1, h.StateRepo.Writes);
+        Assert.Equal(new[] { "platform:a" }, h.StateRepo.Current!.KnownEntryKeys.ToArray());
+    }
+
+    [Fact]
+    public async Task Run_NewEntries_SendsOneDigestPerTenantToOptedInChannelsOnly()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a");
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("platform", "b", title: "**New** thing"), Entry("agent", "c")));
+        h.SetTenants(
+            Tenant("opted-in", Channel("yes", whatsNew: true), Channel("no", whatsNew: false), Channel("disabled", whatsNew: true, enabled: false)),
+            Tenant("not-opted-in", Channel("no", whatsNew: false)),
+            Tenant("no-channels"));
+
+        var result = await h.Service.RunAsync();
+
+        Assert.Equal(2, result.NewEntries);
+        Assert.Equal(1, result.TenantsNotified);
+        Assert.Equal(1, result.ChannelsNotified);
+
+        var (channels, alert) = Assert.Single(h.Sent);
+        Assert.Equal("yes", Assert.Single(channels).Id);
+        Assert.Equal("whats_new", alert.EventType);
+        Assert.Equal(2, alert.Sections.Count);
+        Assert.Contains("2 new updates", alert.Summary);
+        Assert.Contains("1 platform, 1 agent", alert.Summary);
+
+        // Watermark advanced to the full live set and marked as notified.
+        var state = h.StateRepo.Current!;
+        Assert.Equal(new[] { "agent:c", "platform:a", "platform:b" }, state.KnownEntryKeys.OrderBy(k => k));
+        Assert.Equal(h.Now, state.LastNotifiedUtc);
+        Assert.Equal(2, state.LastNotifiedEntryCount);
+    }
+
+    [Fact]
+    public async Task Run_SkipsDisabledTenants()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a");
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("platform", "b")));
+        var disabled = Tenant("off", Channel("yes", whatsNew: true));
+        disabled.Disabled = true;
+        h.SetTenants(disabled);
+
+        var result = await h.Service.RunAsync();
+
+        Assert.Equal(1, result.NewEntries);
+        Assert.Empty(h.Sent);
+    }
+
+    [Fact]
+    public async Task Run_LostRace_DoesNotSend()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a");
+        h.StateRepo.ConflictsToInject = 1;
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("platform", "b")));
+        h.SetTenants(Tenant("t1", Channel("c1", whatsNew: true)));
+
+        var result = await h.Service.RunAsync();
+
+        Assert.True(result.LostRace);
+        Assert.Empty(h.Sent);
+        h.ConfigRepo.Verify(r => r.GetAllTenantConfigurationsAsync(), Times.Never);
+    }
+
+    [Fact]
+    public async Task Run_SecondRunAfterAnnouncement_IsQuiet()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a");
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("platform", "b")));
+        h.SetTenants(Tenant("t1", Channel("c1", whatsNew: true)));
+
+        await h.Service.RunAsync();
+        var second = await h.Service.RunAsync();
+
+        Assert.Equal(0, second.NewEntries);
+        Assert.Single(h.Sent);
+    }
+
+    [Fact]
+    public async Task Run_LegacySingleWebhookTenant_NeverReceivesWhatsNew()
+    {
+        var h = new Harness();
+        h.StateRepo.Seed("platform:a");
+        h.SetFeed(Feed(Entry("platform", "a"), Entry("platform", "b")));
+        h.SetTenants(new TenantConfiguration
+        {
+            TenantId = "legacy",
+            WebhookUrl = "https://hooks.example/legacy",
+            WebhookProviderType = 2,
+            WebhookNotifyOnSuccess = true,
+        });
+
+        var result = await h.Service.RunAsync();
+
+        Assert.Equal(1, result.NewEntries);
+        Assert.Empty(h.Sent);
+    }
+
+    // ── Digest shape ──────────────────────────────────────────────────────
+
+    [Fact]
+    public void BuildWhatsNewAlert_NewestFirst_PlainText_Actions()
+    {
+        var entries = new List<WhatsNewFeedEntry>
+        {
+            Entry("agent", "old", body: "Older agent `fix` here.", daysAgo: 5),
+            Entry("platform", "new", title: "**Rules editor** revamp", body: "Read the [guide](https://docs.autopilotmonitor.com/g) for _details_."),
+        };
+        var docs = new Dictionary<string, string>
+        {
+            [WhatsNewFeed.PlatformChannel] = Constants.DocsBaseUrl + "/changelog/platform-changelog",
+            [WhatsNewFeed.AgentChannel] = Constants.DocsBaseUrl + "/changelog/agent-changelog",
+        };
+
+        var alert = NotificationAlertBuilder.BuildWhatsNewAlert(entries, docs, WhatsNewNotificationService.PortalWhatsNewUrl("platform"));
+
+        Assert.Equal(2, alert.Sections.Count);
+        Assert.StartsWith("Platform \u00b7 Sep 8, 2026 \u2014 Rules editor revamp", alert.Sections[0].Title);
+        Assert.Equal("Read the guide for details.", alert.Sections[0].Text);
+        Assert.StartsWith("Agent \u00b7 Sep 3, 2026", alert.Sections[1].Title);
+        Assert.Equal("Older agent fix here.", alert.Sections[1].Text);
+
+        Assert.Equal(2, alert.Actions.Count);
+        Assert.Equal(Constants.PortalBaseUrl + "/dashboard?whats-new=platform", alert.Actions[0].Url);
+        // Tie (1 platform, 1 agent) → platform changelog.
+        Assert.Equal(Constants.DocsBaseUrl + "/changelog/platform-changelog", alert.Actions[1].Url);
+    }
+
+    [Fact]
+    public void BuildWhatsNewAlert_CapsSectionsAndFoldsRemainder()
+    {
+        var entries = Enumerable.Range(0, NotificationAlertBuilder.WhatsNewMaxSections + 3)
+            .Select(i => Entry("agent", $"id{i}", body: $"Bullet {i}", daysAgo: i))
+            .ToList();
+
+        var alert = NotificationAlertBuilder.BuildWhatsNewAlert(entries, null, WhatsNewNotificationService.PortalWhatsNewUrl("agent"));
+
+        Assert.Equal(NotificationAlertBuilder.WhatsNewMaxSections + 1, alert.Sections.Count);
+        Assert.Contains("+ 3 more updates", alert.Sections[^1].Text);
+        Assert.Single(alert.Actions); // no docs URLs → only the portal button
+        Assert.Contains($"{entries.Count} new updates", alert.Summary);
+    }
+
+    [Fact]
+    public void BuildWhatsNewAlert_TelegramText_CarriesSectionsAndLinks()
+    {
+        var alert = NotificationAlertBuilder.BuildWhatsNewAlert(
+            new List<WhatsNewFeedEntry> { Entry("platform", "p", title: "**Lead**", body: "Body.") },
+            null,
+            WhatsNewNotificationService.PortalWhatsNewUrl("platform"));
+
+        var text = TelegramNotificationService.RenderAlertText(alert);
+
+        Assert.Contains("What's new in Autopilot Monitor", text);
+        Assert.Contains("Platform \u00b7 Sep 8, 2026 \u2014 Lead", text);
+        Assert.Contains("Body.", text);
+        Assert.Contains("Open What's new: " + Constants.PortalBaseUrl + "/dashboard?whats-new=platform", text);
+    }
+
+    [Theory]
+    [InlineData("**Bold** text", "Bold text")]
+    [InlineData("See [the docs](https://docs.autopilotmonitor.com/x) now", "See the docs now")]
+    [InlineData("Run `agent.exe --verbose`", "Run agent.exe --verbose")]
+    [InlineData("_emphasis_ and *more*", "emphasis and more")]
+    [InlineData("snake_case_name stays", "snake_case_name stays")]
+    [InlineData("  spaced   out  ", "spaced out")]
+    [InlineData(null, "")]
+    public void StripInlineMarkdown_Flattens(string? input, string expected)
+        => Assert.Equal(expected, NotificationAlertBuilder.StripInlineMarkdown(input));
+
+    // ── Channel model ─────────────────────────────────────────────────────
+
+    [Fact]
+    public void NotifyOnWhatsNew_RoundTripsThroughJson_AndDefaultsOff()
+    {
+        var json = NotificationChannel.SerializeList(new[] { Channel("c", whatsNew: true) });
+        Assert.Contains("\"notifyOnWhatsNew\":true", json);
+        Assert.True(NotificationChannel.ParseList(json).Single().NotifyOnWhatsNew);
+
+        var legacyShape = "[{\"id\":\"x\",\"name\":\"x\",\"providerType\":20,\"url\":\"https://hooks.example/x\",\"enabled\":true}]";
+        Assert.False(NotificationChannel.ParseList(legacyShape).Single().NotifyOnWhatsNew);
+    }
+}

src/Backend/AutopilotMonitor.Functions/DataAccess/DataAccessServiceExtensions.cs

@@ -36,6 +36,8 @@ namespace AutopilotMonitor.Functions.DataAccess
             services.AddSingleton<INotificationRepository, TableNotificationRepository>();
             services.AddSingleton<ITenantNotificationRepository, TableTenantNotificationRepository>();
             services.AddSingleton<ISlaTenantStatusRepository, TableSlaTenantStatusRepository>();
+            // What's new notifier watermark (single platform row in the AdminConfiguration table).
+            services.AddSingleton<IWhatsNewNotificationStateRepository, TableWhatsNewNotificationStateRepository>();
             services.AddSingleton<IHardwareRejectionNotificationTracker, TableHardwareRejectionNotificationTracker>();
             services.AddSingleton<IDeviceSecurityRepository, TableDeviceSecurityRepository>();
             services.AddSingleton<IUserUsageRepository, TableUserUsageRepository>();

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableMetricsRepository.cs

@@ -92,6 +92,12 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
         public Task RecordUserPresenceAsync(string tenantId, string upn, string userRole)
             => _storage.RecordUserPresenceAsync(tenantId, upn, userRole);
 
+        public Task<UserWhatsNewSeen> GetUserWhatsNewSeenAsync(string tenantId, string upn)
+            => _storage.GetUserWhatsNewSeenAsync(tenantId, upn);
+
+        public Task MarkUserWhatsNewSeenAsync(string tenantId, string upn, string channel, DateTime seenUtc)
+            => _storage.MarkUserWhatsNewSeenAsync(tenantId, upn, channel, seenUtc);
+
         public Task<List<UserPresenceEntry>> GetActivePresenceAsync(TimeSpan window)
             => _storage.GetActivePresenceAsync(window);
 

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableUserUsageRepository.cs

@@ -34,57 +34,46 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
             _tenantTableClient = storage.GetTableClient(Constants.TableNames.McpTenantUsage);
         }
 
-        public async Task IncrementUsageAsync(string userId, string userPrincipalName, string tenantId, string endpoint)
+        /// <summary>
+        /// CAS attempts for the two usage counters — deliberately above
+        /// <see cref="TableCasRetry.DefaultRetries"/>. MCP clients fan tool calls out in parallel, so
+        /// six requests of one user hit the same (user, day, endpoint) row in the same instant; with
+        /// the helper's jittered backoff one writer lands per round, and eight rounds absorb a burst
+        /// of that size without dropping an increment (2026-09-06: three attempts without backoff lost
+        /// 3 of 6). The increment runs off the request path, so the extra latency is invisible.
+        /// </summary>
+        internal const int UsageCounterRetries = 8;
+
+        private static long ReadCount(TableEntity entity)
+            => entity.TryGetValue("RequestCount", out var c) ? Convert.ToInt64(c) : 0L;
+
+        public Task IncrementUsageAsync(string userId, string userPrincipalName, string tenantId, string endpoint)
         {
             var date = DateTime.UtcNow.ToString("yyyyMMdd");
             var rowKey = $"{date}_{endpoint}";
 
-            const int maxRetries = 3;
-            for (var attempt = 0; attempt < maxRetries; attempt++)
-            {
-                try
+            return TableCasRetry.MutateAsync(
+                _tableClient, userId, rowKey,
+                patch: read => new TableEntity(userId, rowKey)
                 {
-                    var result = await _tableClient.GetEntityAsync<TableEntity>(userId, rowKey);
-                    var entity = result.Value;
-                    var count = entity.TryGetValue("RequestCount", out var c) ? Convert.ToInt64(c) : 0L;
-                    entity["RequestCount"] = count + 1;
-                    entity["LastRequestAt"] = DateTimeOffset.UtcNow;
-                    await _tableClient.UpdateEntityAsync(entity, entity.ETag);
-                    return;
-                }
-                catch (RequestFailedException ex) when (ex.Status == 404)
+                    ["RequestCount"] = ReadCount(read) + 1,
+                    ["LastRequestAt"] = DateTimeOffset.UtcNow,
+                },
+                createMissing: () => new TableEntity(userId, rowKey)
                 {
-                    var entity = new TableEntity(userId, rowKey)
-                    {
-                        ["Date"] = date,
-                        ["Endpoint"] = endpoint,
-                        ["UserId"] = userId,
-                        ["UserPrincipalName"] = userPrincipalName,
-                        ["TenantId"] = tenantId,
-                        ["RequestCount"] = 1L,
-                        ["LastRequestAt"] = DateTimeOffset.UtcNow,
-                    };
-                    try
-                    {
-                        await _tableClient.AddEntityAsync(entity);
-                        return;
-                    }
-                    catch (RequestFailedException addEx) when (addEx.Status == 409)
-                    {
-                        _metrics?.CasConflict("IncrementUserUsage", Constants.TableNames.UserUsageLog, CasOutcome.Retried);
-                        continue;
-                    }
-                }
-                catch (RequestFailedException ex) when (ex.Status == 412)
-                {
-                    _metrics?.CasConflict("IncrementUserUsage", Constants.TableNames.UserUsageLog, CasOutcome.Retried);
-                    continue;
-                }
-            }
-
-            _metrics?.CasConflict("IncrementUserUsage", Constants.TableNames.UserUsageLog, CasOutcome.Exhausted);
-            _logger.LogWarning("Failed to increment user usage after {MaxRetries} retries: user={UserId}, endpoint={Endpoint}",
-                maxRetries, LogSanitizer.Clean(userId), LogSanitizer.Clean(endpoint));
+                    ["Date"] = date,
+                    ["Endpoint"] = endpoint,
+                    ["UserId"] = userId,
+                    ["UserPrincipalName"] = userPrincipalName,
+                    ["TenantId"] = tenantId,
+                    ["RequestCount"] = 1L,
+                    ["LastRequestAt"] = DateTimeOffset.UtcNow,
+                },
+                operation: "IncrementUserUsage",
+                tableName: Constants.TableNames.UserUsageLog,
+                metrics: _metrics,
+                logger: _logger,
+                retries: UsageCounterRetries);
         }
 
         public async Task<List<UserUsageRecord>> GetUsageByUserAsync(string userId, string? dateFrom = null, string? dateTo = null)
@@ -215,65 +204,45 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
 
         // ---- McpTenantUsage (organization-wide quota counters) ----
 
-        public async Task IncrementTenantUsageAsync(string tenantId, string userId, string? userPrincipalName, string? homeTenantId)
+        public Task IncrementTenantUsageAsync(string tenantId, string userId, string? userPrincipalName, string? homeTenantId)
         {
             if (string.IsNullOrWhiteSpace(tenantId) || string.IsNullOrWhiteSpace(userId))
-                return;
+                return Task.CompletedTask;
 
             var date = DateTime.UtcNow.ToString("yyyyMMdd");
             var rowKey = $"{date}_{userId}";
 
-            const int maxRetries = 3;
-            for (var attempt = 0; attempt < maxRetries; attempt++)
-            {
-                try
+            return TableCasRetry.MutateAsync(
+                _tenantTableClient, tenantId, rowKey,
+                patch: read =>
                 {
-                    var result = await _tenantTableClient.GetEntityAsync<TableEntity>(tenantId, rowKey);
-                    var entity = result.Value;
-                    var count = entity.TryGetValue("RequestCount", out var c) ? Convert.ToInt64(c) : 0L;
-                    entity["RequestCount"] = count + 1;
-                    entity["LastRequestAt"] = DateTimeOffset.UtcNow;
-                    // Attribution columns (added 2026-09): the UPN as last seen, and the caller's home tenant
-                    // when this row was charged by a delegated (MSP) read. Refreshed on every increment so a
-                    // row created before the columns existed heals on its next hit.
-                    if (!string.IsNullOrEmpty(userPrincipalName))
-                        entity["UserPrincipalName"] = userPrincipalName;
-                    entity["HomeTenantId"] = homeTenantId ?? string.Empty;
-                    await _tenantTableClient.UpdateEntityAsync(entity, entity.ETag);
-                    return;
-                }
-                catch (RequestFailedException ex) when (ex.Status == 404)
-                {
-                    var entity = new TableEntity(tenantId, rowKey)
+                    var patch = new TableEntity(tenantId, rowKey)
                     {
-                        ["Date"] = date,
-                        ["UserId"] = userId,
-                        ["UserPrincipalName"] = userPrincipalName ?? string.Empty,
-                        ["HomeTenantId"] = homeTenantId ?? string.Empty,
-                        ["RequestCount"] = 1L,
+                        ["RequestCount"] = ReadCount(read) + 1,
                         ["LastRequestAt"] = DateTimeOffset.UtcNow,
+                        // Attribution columns (added 2026-09): the UPN as last seen, and the caller's home
+                        // tenant when this row was charged by a delegated (MSP) read. Refreshed on every
+                        // increment so a row created before the columns existed heals on its next hit.
+                        ["HomeTenantId"] = homeTenantId ?? string.Empty,
                     };
-                    try
-                    {
-                        await _tenantTableClient.AddEntityAsync(entity);
-                        return;
-                    }
-                    catch (RequestFailedException addEx) when (addEx.Status == 409)
-                    {
-                        _metrics?.CasConflict("IncrementTenantUsage", Constants.TableNames.McpTenantUsage, CasOutcome.Retried);
-                        continue;
-                    }
-                }
-                catch (RequestFailedException ex) when (ex.Status == 412)
+                    if (!string.IsNullOrEmpty(userPrincipalName))
+                        patch["UserPrincipalName"] = userPrincipalName;
+                    return patch;
+                },
+                createMissing: () => new TableEntity(tenantId, rowKey)
                 {
-                    _metrics?.CasConflict("IncrementTenantUsage", Constants.TableNames.McpTenantUsage, CasOutcome.Retried);
-                    continue;
-                }
-            }
-
-            _metrics?.CasConflict("IncrementTenantUsage", Constants.TableNames.McpTenantUsage, CasOutcome.Exhausted);
-            _logger.LogWarning("Failed to increment tenant usage after {MaxRetries} retries: tenant={TenantId}, user={UserId}",
-                maxRetries, LogSanitizer.Clean(tenantId), LogSanitizer.Clean(userId));
+                    ["Date"] = date,
+                    ["UserId"] = userId,
+                    ["UserPrincipalName"] = userPrincipalName ?? string.Empty,
+                    ["HomeTenantId"] = homeTenantId ?? string.Empty,
+                    ["RequestCount"] = 1L,
+                    ["LastRequestAt"] = DateTimeOffset.UtcNow,
+                },
+                operation: "IncrementTenantUsage",
+                tableName: Constants.TableNames.McpTenantUsage,
+                metrics: _metrics,
+                logger: _logger,
+                retries: UsageCounterRetries);
         }
 
         public async Task<List<TenantUsageRecord>> GetTenantUsageAsync(string tenantId, string? dateFrom = null, string? dateTo = null)

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableWhatsNewNotificationStateRepository.cs

@@ -0,0 +1,148 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models.WhatsNew;
+using Azure;
+using Azure.Data.Tables;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.DataAccess.TableStorage
+{
+    /// <summary>
+    /// Table Storage implementation of <see cref="IWhatsNewNotificationStateRepository"/>.
+    /// Lives as a side row in the AdminConfiguration table (PartitionKey
+    /// <see cref="PartitionKey"/>, RowKey <see cref="RowKey"/>) — platform-scoped state next to the
+    /// table-schema sentinel, so no new table is needed. Deliberately NOT a field on the
+    /// AdminConfiguration row itself: that row is round-tripped wholesale by the Global Admin
+    /// settings UI, and a stale save there would roll the watermark back and re-announce entries.
+    /// </summary>
+    public class TableWhatsNewNotificationStateRepository : IWhatsNewNotificationStateRepository
+    {
+        internal const string PartitionKey = "WhatsNewNotifications";
+        internal const string RowKey = "state";
+
+        private const string KnownEntryKeysProperty = "KnownEntryKeysJson";
+        private const string LastDocsCommitProperty = "LastDocsCommit";
+        private const string LastRunUtcProperty = "LastRunUtc";
+        private const string LastNotifiedUtcProperty = "LastNotifiedUtc";
+        private const string LastNotifiedEntryCountProperty = "LastNotifiedEntryCount";
+
+        private readonly TableClient _table;
+        private readonly ILogger<TableWhatsNewNotificationStateRepository> _logger;
+
+        public TableWhatsNewNotificationStateRepository(
+            TableStorageService storage,
+            ILogger<TableWhatsNewNotificationStateRepository> logger)
+        {
+            _logger = logger;
+            _table = storage.GetTableClient(Constants.TableNames.AdminConfiguration);
+        }
+
+        public async Task<(WhatsNewNotificationState? State, string? ETag)> GetWithETagAsync()
+        {
+            try
+            {
+                var response = await _table.GetEntityIfExistsAsync<TableEntity>(PartitionKey, RowKey);
+                if (!response.HasValue)
+                    return (null, null);
+
+                var entity = response.Value!;
+                return (MapFromEntity(entity), entity.ETag.ToString());
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to load What's new notification state");
+                throw;
+            }
+        }
+
+        public async Task<bool> TryUpsertAsync(WhatsNewNotificationState state, string? ifMatchETag)
+        {
+            if (state == null)
+                return false;
+
+            try
+            {
+                var entity = MapToEntity(state);
+
+                if (ifMatchETag is null)
+                {
+                    await _table.AddEntityAsync(entity);
+                    return true;
+                }
+
+                await _table.UpdateEntityAsync(entity, new ETag(ifMatchETag), TableUpdateMode.Replace);
+                return true;
+            }
+            catch (RequestFailedException ex) when (ex.Status == 409 || ex.Status == 412)
+            {
+                // 409 EntityAlreadyExists (AddEntity) or 412 PreconditionFailed (ETag mismatch):
+                // a parallel run committed first — the caller must not send.
+                return false;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed conditional upsert of What's new notification state");
+                return false;
+            }
+        }
+
+        private static TableEntity MapToEntity(WhatsNewNotificationState state)
+        {
+            var entity = new TableEntity(PartitionKey, RowKey)
+            {
+                [KnownEntryKeysProperty] = JsonSerializer.Serialize(state.KnownEntryKeys),
+                [LastNotifiedEntryCountProperty] = state.LastNotifiedEntryCount,
+            };
+
+            if (!string.IsNullOrEmpty(state.LastDocsCommit))
+                entity[LastDocsCommitProperty] = state.LastDocsCommit;
+            if (state.LastRunUtc.HasValue)
+                entity[LastRunUtcProperty] = DateTime.SpecifyKind(state.LastRunUtc.Value, DateTimeKind.Utc);
+            if (state.LastNotifiedUtc.HasValue)
+                entity[LastNotifiedUtcProperty] = DateTime.SpecifyKind(state.LastNotifiedUtc.Value, DateTimeKind.Utc);
+
+            return entity;
+        }
+
+        private WhatsNewNotificationState MapFromEntity(TableEntity entity)
+        {
+            var known = new HashSet<string>(StringComparer.Ordinal);
+            var json = entity.GetString(KnownEntryKeysProperty);
+            if (!string.IsNullOrWhiteSpace(json))
+            {
+                try
+                {
+                    var parsed = JsonSerializer.Deserialize<List<string>>(json!);
+                    if (parsed != null)
+                    {
+                        foreach (var key in parsed)
+                        {
+                            if (!string.IsNullOrWhiteSpace(key))
+                                known.Add(key);
+                        }
+                    }
+                }
+                catch (JsonException ex)
+                {
+                    // Treated as an empty watermark: the service then re-baselines silently
+                    // (empty known set + existing row = "first run" semantics), never re-announces.
+                    _logger.LogWarning(ex, "What's new notification state has malformed KnownEntryKeysJson — re-baselining");
+                }
+            }
+
+            return new WhatsNewNotificationState
+            {
+                KnownEntryKeys = known,
+                LastDocsCommit = entity.GetString(LastDocsCommitProperty),
+                LastRunUtc = entity.GetDateTime(LastRunUtcProperty),
+                LastNotifiedUtc = entity.GetDateTime(LastNotifiedUtcProperty),
+                LastNotifiedEntryCount = entity.GetInt32(LastNotifiedEntryCountProperty) ?? 0,
+            };
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Admin/TenantGroupManagementFunction.cs

@@ -180,17 +180,32 @@ public class TenantGroupManagementFunction
     /// BEFORE the delete removes them, so the bulk access removal is audited under each affected
     /// tenant and EVERY (former) assignee's live streams are cut — group authorization is join-time
     /// only, so without the kick they keep receiving the managed tenants' telemetry until their
-    /// connection drops.
+    /// connection drops. Deleting an OWNED group also ends conferred Pro for every member at once,
+    /// so each member's retention grace anchor is stamped (the projection leaves no trace by itself).
     /// </summary>
     internal async Task DeleteGroupCoreAsync(string groupId, string? currentUpn)
     {
         var group = await _delegatedAdminService.GetGroupAsync(groupId);
         var assignees = await _delegatedAdminService.GetGroupAssigneesAsync(groupId);
+        var owner = string.IsNullOrWhiteSpace(group?.OwnerTenantId) ? null : group!.OwnerTenantId;
         await _delegatedAdminService.DeleteGroupAsync(groupId);
 
         foreach (var assignee in assignees)
             await _signalRService.DisconnectUserAsync(assignee.Upn);
 
+        // The portal hides Delete for owned groups, but the route accepts any group id — without the
+        // anchor a member that raised its retention under Pro (MSP) would be clamped to the Community
+        // cap at the next sweep instead of getting the grace period.
+        if (owner != null)
+        {
+            foreach (var member in group!.TenantIds)
+            {
+                if (string.Equals(member, owner, StringComparison.OrdinalIgnoreCase))
+                    continue;
+                await _proConferral.RecordLossAsync(member, owner, "group-deleted");
+            }
+        }
+
         if (group != null && group.AssigneeCount > 0)
         {
             await AuditPerTenantAsync(group.TenantIds, "DELETE", "*", currentUpn,

src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs

@@ -20,8 +20,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
         private readonly ILogger<GetAgentConfigFunction> _logger;
         private readonly TenantConfigurationService _configService;
         private readonly AdminConfigurationService _adminConfigService;
-        private readonly GatherRuleService _gatherRuleService;
-        private readonly ImeLogPatternService _imeLogPatternService;
+        private readonly AgentConfigResolver _resolver;
         private readonly RateLimitService _rateLimitService;
         private readonly AutopilotDeviceValidator _autopilotDeviceValidator;
         private readonly CorporateIdentifierValidator _corporateIdentifierValidator;
@@ -35,8 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
             ILogger<GetAgentConfigFunction> logger,
             TenantConfigurationService configService,
             AdminConfigurationService adminConfigService,
-            GatherRuleService gatherRuleService,
-            ImeLogPatternService imeLogPatternService,
+            AgentConfigResolver resolver,
             RateLimitService rateLimitService,
             AutopilotDeviceValidator autopilotDeviceValidator,
             CorporateIdentifierValidator corporateIdentifierValidator,
@@ -49,8 +47,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
             _logger = logger;
             _configService = configService;
             _adminConfigService = adminConfigService;
-            _gatherRuleService = gatherRuleService;
-            _imeLogPatternService = imeLogPatternService;
+            _resolver = resolver;
             _rateLimitService = rateLimitService;
             _autopilotDeviceValidator = autopilotDeviceValidator;
             _corporateIdentifierValidator = corporateIdentifierValidator;
@@ -105,108 +102,8 @@ namespace AutopilotMonitor.Functions.Functions.Config
         }
 
         /// <summary>
-        /// Parses the major-version from an X-Agent-Version header value.
-        /// Accepts SemVer-ish strings like "2.0.114" or "2.0.114+abc123".
-        /// Missing/unparsable → returns 1 (backward-compat: very old agents may omit the
-        /// header). The V1 line is retired, so major 1 resolves to empty hashes via
-        /// GetAgentLine's default arm — legacy stragglers just skip their integrity check.
-        /// Deliberately NOT defaulting to 2: that would hand V2 hashes to V1 binaries and
-        /// could trigger the runtime_hash_mismatch force-update path against the wrong line.
-        /// </summary>
-        internal static int ParseAgentMajor(string? agentVersion)
-        {
-            if (string.IsNullOrWhiteSpace(agentVersion))
-                return 1;
-
-            var dot = agentVersion.IndexOf('.');
-            var majorStr = dot > 0 ? agentVersion.Substring(0, dot) : agentVersion;
-            return int.TryParse(majorStr, out var major) ? major : 1;
-        }
-
-        /// <summary>
-        /// Decides whether the agent should perform diagnostics uploads at all.
-        /// The CustomerSas destination is gated on a per-tenant SAS URL being present, but the
-        /// Hosted destination has no such URL (the platform owns the storage) — so gating purely
-        /// on the SAS URL silently disabled uploads for every Hosted-destination tenant. Enable
-        /// when either a customer SAS is configured OR the destination is Hosted.
-        /// </summary>
-        internal static bool ResolveDiagnosticsUploadEnabled(string? diagnosticsBlobSasUrl, string? destination)
-        {
-            return !string.IsNullOrEmpty(diagnosticsBlobSasUrl)
-                || string.Equals(destination, "Hosted", StringComparison.OrdinalIgnoreCase);
-        }
-
-        /// <summary>
-        /// Global ∪ tenant diagnostics paths: global first, order preserved, blank paths dropped,
-        /// duplicates (trimmed, case-insensitive) collapsed onto the first occurrence. The agent
-        /// keys ZIP entries on the path, so a path present in both lists would otherwise produce
-        /// duplicate entry names inside the archive.
-        /// </summary>
-        internal static List<DiagnosticsLogPath> MergeDiagnosticsLogPaths(
-            IEnumerable<DiagnosticsLogPath> global,
-            IEnumerable<DiagnosticsLogPath> tenant)
-        {
-            return global.Concat(tenant)
-                .Where(p => !string.IsNullOrWhiteSpace(p?.Path))
-                .GroupBy(p => p.Path.Trim(), StringComparer.OrdinalIgnoreCase)
-                .Select(g => g.First())
-                .ToList();
-        }
-
-        /// <summary>
-        /// Returns the (ZipSha256, ExeSha256) pair appropriate for the calling agent.
-        /// Reads the X-Agent-Version header, parses the major, and dispatches to the
-        /// corresponding per-line field set on <see cref="AdminConfiguration"/> via
-        /// <see cref="AdminConfiguration.GetAgentLine(int)"/>. Future V3 = no change here;
-        /// add a switch arm in GetAgentLine and a field set on AdminConfiguration.
-        /// </summary>
-        internal static (string ZipSha256, string ExeSha256) SelectAgentHashesForClient(
-            HttpRequestData req,
-            AutopilotMonitor.Shared.Models.AdminConfiguration adminConfig)
-        {
-            var agentVersion = req.Headers.Contains("X-Agent-Version")
-                ? req.Headers.GetValues("X-Agent-Version").FirstOrDefault()
-                : null;
-
-            var line = adminConfig.GetAgentLine(ParseAgentMajor(agentVersion));
-            return (line.ZipSha256, line.ExeSha256);
-        }
-
-        /// <summary>
-        /// Resolves the endpoint-migration target for a tenant: per-tenant override wins over
-        /// the global value; an override entry with an empty value pins the tenant (no
-        /// migration even while the global target is set — staged rollout). The winning value
-        /// is validated against <see cref="AutopilotMonitor.Shared.Services.AgentEndpointMigrationRules"/>;
-        /// invalid values resolve to null (fail-safe: better to strand an agent on the old
-        /// backend than to serve a broken or non-allowlisted URL).
-        /// </summary>
-        internal static string? ResolveMigrateTarget(
-            AutopilotMonitor.Shared.Models.AdminConfiguration adminConfig,
-            string tenantId,
-            out string? rejectedCandidate)
-        {
-            rejectedCandidate = null;
-            string? candidate = adminConfig.AgentMigrateApiBaseUrl;
-
-            var overrides = adminConfig.GetAgentMigrateTenantOverrides();
-            if (!string.IsNullOrEmpty(tenantId) && overrides.TryGetValue(tenantId, out var tenantTarget))
-                candidate = tenantTarget; // empty string = pinned, handled below
-
-            if (string.IsNullOrWhiteSpace(candidate))
-                return null;
-
-            if (AutopilotMonitor.Shared.Services.AgentEndpointMigrationRules
-                .TryNormalizeTarget(candidate, out var normalized))
-            {
-                return normalized;
-            }
-
-            rejectedCandidate = candidate;
-            return null;
-        }
-
-        /// <summary>
-        /// Core config logic: fetch tenant + admin config, gather rules, IME patterns.
+        /// Core config logic: kill verdict for this device, then the shared derivation
+        /// (<see cref="AgentConfigResolver"/>) with the device verdict applied on top.
         /// Called by both the cert-auth Run() method and the bootstrap wrapper.
         /// <paramref name="intuneDeviceId"/> is the certificate identity from the cert Subject CN
         /// (cert-auth callers); the bootstrap wrapper has none and leaves it null.
@@ -236,114 +133,30 @@ namespace AutopilotMonitor.Functions.Functions.Config
                 intuneDeviceId: intuneDeviceId);
             DeviceIdentityBinding.Stamp(req, killVerdict.IdentityBinding);
 
-            // Get tenant configuration
-            var tenantConfig = await _configService.GetConfigurationAsync(tenantId);
+            // Select the per-line hash oracle from the X-Agent-Version header (parametric per major).
+            var resolution = await _resolver.ResolveAsync(tenantId, AgentConfigResolver.ParseAgentMajor(agentVersionHeader));
+            var response = resolution.Response;
 
-            // Get global admin config for platform-wide policy settings
-            var adminConfig = await _adminConfigService.GetConfigurationAsync();
-
-            // Build collector configuration from tenant settings + global policy
-            var collectors = new CollectorConfiguration
-            {
-                EnablePerformanceCollector = tenantConfig.EnablePerformanceCollector,
-                PerformanceIntervalSeconds = tenantConfig.PerformanceCollectorIntervalSeconds,
-                CollectorIdleTimeoutMinutes = adminConfig.CollectorIdleTimeoutMinutes,
-                DesktopDetectorNoCandidateTimeoutMinutes = adminConfig.DesktopDetectorNoCandidateTimeoutMinutes,
-                HelloWaitTimeoutSeconds = tenantConfig.HelloWaitTimeoutSeconds,
-                AgentMaxLifetimeMinutes = tenantConfig.AgentMaxLifetimeMinutes ?? 360,
-                ModernDeploymentHarmlessEventIds = adminConfig.GetModernDeploymentHarmlessEventIds().ToArray()
-            };
-
-            // Active gather rules + active IME log patterns for this tenant. Independent reads,
-            // both served from per-instance catalog caches — fetch them concurrently.
-            var gatherRulesTask = _gatherRuleService.GetActiveRulesForTenantAsync(tenantId);
-            var imeLogPatternsTask = _imeLogPatternService.GetActivePatternsForTenantAsync(tenantId);
-            await Task.WhenAll(gatherRulesTask, imeLogPatternsTask);
-            var gatherRules = await gatherRulesTask;
-            var imeLogPatterns = await imeLogPatternsTask;
-
-            // Merge global + tenant-specific diagnostics log paths (the built-in sections are
-            // compiled into the agent — DiagnosticsBuiltInSections — and never travel here)
-            var diagLogPaths = MergeDiagnosticsLogPaths(
-                adminConfig.GetDiagnosticsGlobalLogPaths(), tenantConfig.GetDiagnosticsLogPaths());
-
-            // Select per-line hash oracle from the X-Agent-Version header (parametric per major).
-            // The wire response keeps generic field names (LatestAgentSha256 / LatestAgentExeSha256)
-            // so agent code is unchanged across all major lines.
-            var (latestAgentSha256, latestAgentExeSha256) = SelectAgentHashesForClient(req, adminConfig);
-
-            // Endpoint migration on the control channel: serve the (validated) re-home target
-            // so agents still bound to this backend's compiled-in URL move themselves to the
-            // new deployment at their next start. LogWarning (not Information) because worker
-            // logs below Warning never reach App Insights — this line is the delivery evidence
-            // during a migration window.
-            var migrateTarget = ResolveMigrateTarget(adminConfig, tenantId, out var rejectedMigrateCandidate);
-            if (migrateTarget != null)
+            // LogWarning (not Information) because worker logs below Warning never reach App
+            // Insights — this line is the delivery evidence during a migration window.
+            if (response.MigrateToApiBaseUrl != null)
             {
                 _logger.LogWarning(
                     "AgentMigrateServed: tenant={TenantId} serial={Serial} agentVersion={AgentVersion} target={Target}",
-                    tenantId, serialNumberHeader, agentVersionHeader, migrateTarget);
+                    tenantId, serialNumberHeader, agentVersionHeader, response.MigrateToApiBaseUrl);
             }
-            else if (rejectedMigrateCandidate != null)
+            else if (resolution.RejectedMigrateCandidate != null)
             {
                 _logger.LogWarning(
                     "AgentMigrateRejected: configured migration target failed validation and is NOT served. tenant={TenantId} candidate={Candidate}",
-                    tenantId, rejectedMigrateCandidate);
+                    tenantId, resolution.RejectedMigrateCandidate);
             }
 
-            var response = await req.OkAsync(new AgentConfigResponse
-            {
-                ConfigVersion = 40, // EnableDoGroupIdAutoSet (Delivery Optimization group ID from network fingerprint)
-                UploadIntervalSeconds = Shared.Constants.DefaultUploadIntervalSeconds,
-                SelfDestructOnComplete = tenantConfig.SelfDestructOnComplete ?? true,
-                KeepLogFile = tenantConfig.KeepLogFile ?? false,
-                EnableGeoLocation = tenantConfig.EnableGeoLocation ?? true,
-                EnableImeMatchLog = tenantConfig.EnableImeMatchLog ?? false,
-                EnableGatherRuleDebugLog = tenantConfig.EnableGatherRuleDebugLog ?? false,
-                EnableEspContinueAnywayObservation = tenantConfig.EnableEspContinueAnywayObservation ?? false,
-                MaxAuthFailures = tenantConfig.MaxAuthFailures ?? 5,
-                AuthFailureTimeoutMinutes = tenantConfig.AuthFailureTimeoutMinutes ?? 0,
-                LogLevel = tenantConfig.LogLevel ?? "Info",
-                RebootOnComplete = tenantConfig.RebootOnComplete ?? false,
-                RebootDelaySeconds = tenantConfig.RebootDelaySeconds ?? 10,
-                ShowEnrollmentSummary = tenantConfig.ShowEnrollmentSummary ?? false,
-                EnrollmentSummaryTimeoutSeconds = tenantConfig.EnrollmentSummaryTimeoutSeconds ?? 60,
-                EnrollmentSummaryBrandingImageUrl = tenantConfig.EnrollmentSummaryBrandingImageUrl,
-                EnrollmentSummaryLaunchRetrySeconds = tenantConfig.EnrollmentSummaryLaunchRetrySeconds ?? 120,
-                MaxBatchSize = tenantConfig.MaxBatchSize ?? 100,
-                DiagnosticsUploadEnabled = ResolveDiagnosticsUploadEnabled(
-                    tenantConfig.DiagnosticsBlobSasUrl, tenantConfig.DiagnosticsUploadDestination),
-                DiagnosticsUploadMode = tenantConfig.DiagnosticsUploadMode ?? "Off",
-                DiagnosticsLogPaths = diagLogPaths,
-                Collectors = collectors,
-                Analyzers = new AnalyzerConfiguration
-                {
-                    EnableLocalAdminAnalyzer = tenantConfig.EnableLocalAdminAnalyzer ?? true,
-                    LocalAdminAllowedAccounts = tenantConfig.GetLocalAdminAllowedAccounts(),
-                    EnableSoftwareInventoryAnalyzer = tenantConfig.EnableSoftwareInventoryAnalyzer ?? false,
-                    EnableIntegrityBypassAnalyzer = tenantConfig.EnableIntegrityBypassAnalyzer ?? true,
-                    EnableRealmJoinWatcher = tenantConfig.EnableRealmJoinWatcher ?? false,
-                    KeepAwakeDuringUserEsp = tenantConfig.KeepAwakeDuringUserEsp ?? false,
-                    EnableConsoleBypassDetection = tenantConfig.EnableConsoleBypassDetection ?? true
-                },
-                LatestAgentSha256 = latestAgentSha256,
-                LatestAgentExeSha256 = latestAgentExeSha256,
-                AllowAgentDowngrade = adminConfig.AllowAgentDowngrade,
-                NtpServer = string.IsNullOrEmpty(tenantConfig.NtpServer) ? "time.windows.com" : tenantConfig.NtpServer,
-                EnableTimezoneAutoSet = tenantConfig.EnableTimezoneAutoSet ?? false,
-                EnableDoGroupIdAutoSet = tenantConfig.EnableDoGroupIdAutoSet ?? false,
-                SendTraceEvents = tenantConfig.SendTraceEvents,
-                UnrestrictedMode = TenantEntitlementService.IsUnrestrictedModeActive(tenantConfig, DateTime.UtcNow),
-                GatherRules = gatherRules,
-                ImeLogPatterns = imeLogPatterns,
-                WhiteGloveSealingPatternIds = adminConfig.GetWhiteGloveSealingPatternIds(),
-                DeviceBlocked = killVerdict.IsBlocked,
-                DeviceKillSignal = killVerdict.IsKill,
-                UnblockAt = killVerdict.UnblockAt,
-                MigrateToApiBaseUrl = migrateTarget,
-            });
+            response.DeviceBlocked = killVerdict.IsBlocked;
+            response.DeviceKillSignal = killVerdict.IsKill;
+            response.UnblockAt = killVerdict.UnblockAt;
 
-            return response;
+            return await req.OkAsync(response);
         }
     }
 }

src/Backend/AutopilotMonitor.Functions/Functions/Config/GetEffectiveAgentConfigFunction.cs

@@ -0,0 +1,58 @@
+using System;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Config
+{
+    /// <summary>
+    /// Global-Admin view of what an agent of the tenant receives from GET agent/config right
+    /// now: the same <see cref="AgentConfigResolver"/> derivation the agent channel uses, minus
+    /// the per-device kill verdict (no device here). Drives the runtime column of the Tenant
+    /// Config Report, so the report cannot drift from the backend rules. Read-only, no
+    /// side effects, no ops event.
+    /// </summary>
+    public class GetEffectiveAgentConfigFunction
+    {
+        private readonly ILogger<GetEffectiveAgentConfigFunction> _logger;
+        private readonly AgentConfigResolver _resolver;
+
+        public GetEffectiveAgentConfigFunction(
+            ILogger<GetEffectiveAgentConfigFunction> logger,
+            AgentConfigResolver resolver)
+        {
+            _logger = logger;
+            _resolver = resolver;
+        }
+
+        [Function("GetEffectiveAgentConfig")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "config/{tenantId}/effective-agent-config")] HttpRequestData req,
+            string tenantId)
+        {
+            try
+            {
+                // GlobalAdminOnly + RouteParam scoping enforced by PolicyEnforcementMiddleware.
+                var requestCtx = req.GetRequestContext();
+
+                // Optional ?agentVersion= selects the hash-oracle line like the agent's
+                // X-Agent-Version header would; absent → the current (V2) line, never the
+                // legacy fallback an absent header means on the agent channel.
+                var agentVersion = System.Web.HttpUtility.ParseQueryString(req.Url.Query)["agentVersion"];
+                var agentMajor = string.IsNullOrWhiteSpace(agentVersion)
+                    ? AgentConfigResolver.CurrentAgentMajor
+                    : AgentConfigResolver.ParseAgentMajor(agentVersion);
+
+                var resolution = await _resolver.ResolveAsync(requestCtx.TargetTenantId, agentMajor);
+                return await req.OkAsync(resolution.Response);
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "GetEffectiveAgentConfig");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/AuthFunction.cs

@@ -100,7 +100,8 @@ public class AuthFunction
 
         // --- Parallel data fetch: all independent queries run concurrently ---
         // Fail-fast: if any fetch throws, AggregateException propagates → Azure Functions returns 500.
-        // This is intentional — all 6 queries are required for the auth decision.
+        // This is intentional — the auth-decision queries are required; the What's-new marker read
+        // is fail-soft inside the repository because it is only a UX convenience.
         // Non-creating read: do NOT auto-persist a default config row just because someone authenticated.
         // A delegated-only external MSP login must not phantom-onboard its home tenant (see the side-effect
         // gate below). A genuine first-user still gets their config created by HandleNewTenantDomainAsync.
@@ -116,9 +117,10 @@ public class AuthFunction
         // middleware does (the table-vs-claim reconciliation happens inside the shared role resolver).
         var mcpCheckTask = _mcpUserService.IsAllowedAsync(upn, tenantId, objectId, principal.GetAppRoles());
         var existingAdminsTask = _tenantAdminsService.GetTenantAdminsAsync(tenantId);
+        var whatsNewSeenTask = _metricsRepo.GetUserWhatsNewSeenAsync(tenantId, upn);
 
         await Task.WhenAll(tenantConfigTask, globalRoleTask, delegatedScopeTask, isApprovedTask,
-                           membershipTask, mcpCheckTask, existingAdminsTask);
+                           membershipTask, mcpCheckTask, existingAdminsTask, whatsNewSeenTask);
 
         var (tenantConfig, _) = tenantConfigTask.Result;
         var globalRole = globalRoleTask.Result;
@@ -131,6 +133,7 @@ public class AuthFunction
         var (tableState, tableRole) = membershipTask.Result;
         var mcpCheck = mcpCheckTask.Result;
         var existingAdmins = existingAdminsTask.Result;
+        var whatsNewSeen = whatsNewSeenTask.Result;
 
         // Reconcile the TenantAdmins table state with any Entra app-role claim. An enabled row
         // wins; a disabled row is an explicit deny (claim ignored); only a missing row falls back
@@ -164,7 +167,9 @@ public class AuthFunction
             memberRole, mcpCheck, existingAdmins.Count > 0,
             tenantId, upn, displayName ?? string.Empty, objectId ?? string.Empty,
             delegatedTenantIds,
-            homedApp: _appRegistry.ResolveForTenant(tenantConfig).IsLegacy ? "legacy" : "primary");
+            homedApp: _appRegistry.ResolveForTenant(tenantConfig).IsLegacy ? "legacy" : "primary",
+            whatsNewSeenPlatformUtc: whatsNewSeen.PlatformUtc,
+            whatsNewSeenAgentUtc: whatsNewSeen.AgentUtc);
 
         if (!decision.IsSuccess)
         {
@@ -193,6 +198,35 @@ public class AuthFunction
         return response;
     }
 
+    /// <summary>
+    /// PUT /api/auth/me/whats-new-seen
+    /// Marks the caller's What's-new channel as seen.
+    /// </summary>
+    [Function("MarkWhatsNewSeen")]
+    [Authorize]
+    public async Task<HttpResponseData> MarkWhatsNewSeen(
+        [HttpTrigger(AuthorizationLevel.Anonymous, "put", Route = "auth/me/whats-new-seen")] HttpRequestData req,
+        FunctionContext context)
+    {
+        var principal = context.GetUser();
+        if (principal == null)
+            return req.CreateResponse(HttpStatusCode.Unauthorized);
+
+        var tenantId = principal.GetTenantId();
+        var upn = principal.GetUserPrincipalName();
+        if (string.IsNullOrEmpty(tenantId) || string.IsNullOrEmpty(upn))
+            return await req.BadRequestAsync("Missing required claims");
+
+        var read = await req.ReadAsync<WhatsNewSeenRequest>();
+        if (read.Error != null) return read.Error;
+
+        if (!TryNormalizeWhatsNewSeen(read.Value, DateTime.UtcNow, out var channel, out var seenUtc, out var error))
+            return await req.BadRequestAsync(error);
+
+        await _metricsRepo.MarkUserWhatsNewSeenAsync(tenantId, upn, channel, seenUtc);
+        return req.CreateResponse(HttpStatusCode.NoContent);
+    }
+
     /// <summary>
     /// GET /api/auth/is-global-admin
     /// Checks if the current user is a Global Admin
@@ -515,7 +549,9 @@ public class AuthFunction
         bool hasTenantAdmins,
         string tenantId, string upn, string displayName, string objectId,
         IReadOnlyCollection<string>? delegatedTenantIds = null,
-        string homedApp = "primary")
+        string homedApp = "primary",
+        DateTime? whatsNewSeenPlatformUtc = null,
+        DateTime? whatsNewSeenAgentUtc = null)
     {
         // A delegated ("MSP") admin manages a subset of OTHER tenants. They are explicitly authorized, so —
         // like a Global Admin / Reader — they bypass the private-preview gate even when their own home tenant
@@ -603,10 +639,61 @@ public class AuthFunction
             BootstrapTokenEnabled = TenantEntitlementService.IsBootstrapEnabled(tenantConfig, DateTime.UtcNow),
             UnrestrictedModeEnabled =
                 FeatureEntitlementCatalog.Get(TenantEntitlementService.Resolve(tenantConfig, DateTime.UtcNow)).UnrestrictedModeAvailable
-                && tenantConfig.UnrestrictedModeEnabled
+                && tenantConfig.UnrestrictedModeEnabled,
+            WhatsNewSeenPlatformUtc = whatsNewSeenPlatformUtc,
+            WhatsNewSeenAgentUtc = whatsNewSeenAgentUtc
         }, needsAutoAdmin);
     }
 
+    internal static bool TryNormalizeWhatsNewSeen(
+        WhatsNewSeenRequest? body,
+        DateTime nowUtc,
+        out string channel,
+        out DateTime seenUtc,
+        out string error)
+    {
+        channel = string.Empty;
+        seenUtc = default;
+        error = string.Empty;
+
+        if (body == null)
+        {
+            error = "Request body is required";
+            return false;
+        }
+
+        channel = (body.Channel ?? string.Empty).Trim().ToLowerInvariant();
+        if (channel is not ("platform" or "agent"))
+        {
+            error = "channel must be 'platform' or 'agent'";
+            return false;
+        }
+
+        if (body.SeenUtc == default)
+        {
+            error = "seenUtc is required";
+            return false;
+        }
+
+        nowUtc = NormalizeUtc(nowUtc);
+        seenUtc = NormalizeUtc(body.SeenUtc);
+        if (seenUtc > nowUtc.AddMinutes(5))
+        {
+            // Client clocks can run ahead; clamp rather than reject so the marker remains harmless.
+            seenUtc = nowUtc;
+        }
+
+        return true;
+    }
+
+    private static DateTime NormalizeUtc(DateTime value)
+        => value.Kind switch
+        {
+            DateTimeKind.Utc => value,
+            DateTimeKind.Local => value.ToUniversalTime(),
+            _ => DateTime.SpecifyKind(value, DateTimeKind.Utc)
+        };
+
     /// <summary>
     /// Extracts domain name from UPN (e.g., user@contoso.com -> contoso.com)
     /// </summary>

src/Backend/AutopilotMonitor.Functions/Functions/Vulnerability/VulnerabilitySummaryAggregator.cs

@@ -100,6 +100,13 @@ namespace AutopilotMonitor.Functions.Functions.Vulnerability
                 Low = groups.Count(c => c.SeverityRank == 1),
             };
 
+            var priorities = new PriorityBreakdown
+            {
+                Act = groups.Count(c => CvePriority.Rank(c.Priority) == CvePriority.Rank(CvePriority.Act)),
+                Attend = groups.Count(c => CvePriority.Rank(c.Priority) == CvePriority.Rank(CvePriority.Attend)),
+                Track = groups.Count(c => CvePriority.Rank(c.Priority) == CvePriority.Rank(CvePriority.Track)),
+            };
+
             var totalAffectedSessions = inWindow.Select(r => r.SessionId)
                 .Where(s => !string.IsNullOrEmpty(s))
                 .Distinct(StringComparer.OrdinalIgnoreCase).Count();
@@ -118,6 +125,7 @@ namespace AutopilotMonitor.Functions.Functions.Vulnerability
                 DistinctCves = groups.Count,
                 KevCves = groups.Count(c => c.IsKev),
                 SeverityBreakdown = breakdown,
+                PriorityBreakdown = priorities,
                 TopCves = topCves,
                 Truncated = truncated,
             };

src/Backend/AutopilotMonitor.Functions/Functions/WhatsNew/WhatsNewNotificationFunction.cs

@@ -0,0 +1,35 @@
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services.WhatsNew;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.WhatsNew
+{
+    /// <summary>
+    /// Hourly timer: diffs the portal's live <c>/whats-new.json</c> against the platform watermark
+    /// and sends one digest of the newly published entries to every tenant channel that opted in
+    /// (<c>NotificationChannel.NotifyOnWhatsNew</c>). Hourly — not on deploy — because the payload
+    /// only changes with a web deploy and a delay of up to an hour is fine for product news.
+    /// Offset to :20 so it does not collide with the :00 maintenance/SLA timers or the :30 sweep.
+    /// </summary>
+    public class WhatsNewNotificationFunction
+    {
+        private readonly WhatsNewNotificationService _service;
+        private readonly ILogger<WhatsNewNotificationFunction> _logger;
+
+        public WhatsNewNotificationFunction(
+            WhatsNewNotificationService service,
+            ILogger<WhatsNewNotificationFunction> logger)
+        {
+            _service = service;
+            _logger = logger;
+        }
+
+        [Function("WhatsNewNotification")]
+        public async Task Run([TimerTrigger("0 20 * * * *")] object timer)
+        {
+            _logger.LogInformation("What's new notification timer fired at {Time}", System.DateTime.UtcNow);
+            await _service.RunAsync();
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Helpers/EndpointNormalizer.cs

@@ -12,6 +12,16 @@ public static class EndpointNormalizer
         @"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
         RegexOptions.Compiled);
 
+    // Same classes LogSanitizer strips: C0/C1 control characters (Table Storage rejects them in
+    // keys) plus the Unicode line/paragraph separators a log viewer breaks a line on.
+    private static readonly Regex ControlChars = new(@"[\p{Cc}\p{Zl}\p{Zp}]", RegexOptions.Compiled);
+
+    /// <summary>
+    /// Cap for the caller-supplied tool-name prefix of a usage row key. Real MCP tool names are
+    /// well under this; the cap only bounds what an arbitrary header can push into a key.
+    /// </summary>
+    public const int MaxToolNameLength = 64;
+
     public static string Normalize(string path)
     {
         // Strip /api/ prefix
@@ -22,9 +32,32 @@ public static class EndpointNormalizer
         // Replace GUIDs with {id}
         normalized = GuidPattern.Replace(normalized, "{id}");
 
-        // Replace characters that are illegal in Azure Table Storage keys (/, \, #, ?)
-        normalized = normalized.Replace('/', '_').Replace('\\', '_').Replace('#', '_').Replace('?', '_');
-
-        return normalized.ToLowerInvariant();
+        return ReplaceIllegalKeyChars(normalized).ToLowerInvariant();
     }
+
+    /// <summary>
+    /// Makes the <c>X-MCP-Tool-Name</c> header value safe to use as the prefix of a usage row key.
+    /// The header is caller-supplied (the MCP server sets it to the real tool name, but any
+    /// authenticated MCP-source caller can send it), and the key ends up in the CAS-conflict warning
+    /// of the usage counter: control characters and line separators are removed, the characters Table
+    /// Storage rejects in keys are replaced, and the length is capped. A real tool name
+    /// (<c>get_session_events</c>) passes through unchanged, so existing usage rows keep their keys.
+    /// Returns an empty string when nothing key-safe remains; callers then skip the prefix.
+    /// </summary>
+    public static string ToolNameKey(string? toolName)
+    {
+        if (string.IsNullOrEmpty(toolName))
+            return string.Empty;
+
+        // Explicit CR/LF removal first — the log-injection barrier the CodeQL taint model
+        // recognizes; the regex pass then drops any remaining control character or separator.
+        var cleaned = toolName.Replace("\r", string.Empty).Replace("\n", string.Empty);
+        cleaned = ControlChars.Replace(cleaned, string.Empty);
+        cleaned = ReplaceIllegalKeyChars(cleaned).Trim();
+        return cleaned.Length <= MaxToolNameLength ? cleaned : cleaned[..MaxToolNameLength];
+    }
+
+    /// <summary>Replaces the characters Azure Table Storage rejects in keys (/, \, #, ?).</summary>
+    private static string ReplaceIllegalKeyChars(string value)
+        => value.Replace('/', '_').Replace('\\', '_').Replace('#', '_').Replace('?', '_');
 }

src/Backend/AutopilotMonitor.Functions/Helpers/MetricsMath.cs

@@ -287,13 +287,13 @@ public static class MetricsMath
 
     private static List<FleetModelHealth> BuildFleetModelHealth(IReadOnlyList<SessionSummary> sessions)
     {
-        var models = new Dictionary<string, FleetModelHealth>();
+        var models = new Dictionary<ModelBucket, FleetModelHealth>();
         foreach (var s in sessions)
         {
             var key = FleetModelKey(s);
             if (!models.TryGetValue(key, out var m))
             {
-                m = new FleetModelHealth { Model = key };
+                m = new FleetModelHealth { Manufacturer = key.Manufacturer, Model = key.Model, Label = key.Label };
                 models[key] = m;
             }
             m.Total++;
@@ -308,7 +308,7 @@ public static class MetricsMath
 
     private static List<FleetSlowModel> BuildFleetSlowestModels(IReadOnlyList<SessionSummary> sessions)
     {
-        var acc = new Dictionary<string, (long TotalDuration, int Count)>();
+        var acc = new Dictionary<ModelBucket, (long TotalDuration, int Count)>();
         foreach (var s in sessions)
         {
             if (s.Status != SessionStatus.Succeeded) continue;
@@ -320,7 +320,9 @@ public static class MetricsMath
         return acc
             .Select(kv => new FleetSlowModel
             {
-                Model = kv.Key,
+                Manufacturer = kv.Key.Manufacturer,
+                Model = kv.Key.Model,
+                Label = kv.Key.Label,
                 AvgMinutes = (int)Math.Round((double)kv.Value.TotalDuration / kv.Value.Count / 60.0, MidpointRounding.AwayFromZero),
                 Count = kv.Value.Count,
             })
@@ -331,7 +333,7 @@ public static class MetricsMath
 
     private static List<FleetFailingModel> BuildFleetTopFailingModels(IReadOnlyList<SessionSummary> sessions)
     {
-        var acc = new Dictionary<string, (int Failed, int Succeeded, int Total)>();
+        var acc = new Dictionary<ModelBucket, (int Failed, int Succeeded, int Total)>();
         foreach (var s in sessions)
         {
             var key = FleetModelKey(s);
@@ -347,7 +349,9 @@ public static class MetricsMath
             .Where(kv => kv.Value.Failed > 0)
             .Select(kv => new FleetFailingModel
             {
-                Model = kv.Key,
+                Manufacturer = kv.Key.Manufacturer,
+                Model = kv.Key.Model,
+                Label = kv.Key.Label,
                 Failed = kv.Value.Failed,
                 Total = kv.Value.Total,
                 FailureRate = (int)Math.Round(
@@ -358,13 +362,26 @@ public static class MetricsMath
             .ToList();
     }
 
-    /// <summary>"{Manufacturer} {Model}" trimmed, or "Unknown" when both are blank.</summary>
-    private static string FleetModelKey(SessionSummary s)
+    /// <summary>
+    /// Grouping key of the model buckets: the two session fields as stored (trimmed) plus the
+    /// display label "{Manufacturer} {Model}", or "Unknown" when both are blank. Grouping on the
+    /// pair keeps ("Contoso", "A B") and ("Contoso A", "B") apart even though their labels collide.
+    /// </summary>
+    private readonly record struct ModelBucket(string Manufacturer, string Model)
     {
-        var key = $"{s.Manufacturer} {s.Model}".Trim();
-        return string.IsNullOrEmpty(key) ? "Unknown" : key;
+        public string Label
+        {
+            get
+            {
+                var label = $"{Manufacturer} {Model}".Trim();
+                return string.IsNullOrEmpty(label) ? "Unknown" : label;
+            }
+        }
     }
 
+    private static ModelBucket FleetModelKey(SessionSummary s)
+        => new((s.Manufacturer ?? string.Empty).Trim(), (s.Model ?? string.Empty).Trim());
+
     /// <summary>Share of total bytes (0-100, one decimal) not pulled from the CDN. 0 when no bytes.</summary>
     private static double OffloadPercent(long offloaded, long total)
         => total > 0 ? Math.Round((double)offloaded / total * 100, 1) : 0;

src/Backend/AutopilotMonitor.Functions/Helpers/SessionSearchQuery.cs

@@ -0,0 +1,165 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Helpers;
+
+/// <summary>
+/// The dashboard search-box grammar, parsed once per request for the server-side sweep
+/// (<c>q=</c> on <c>/api/search/sessions</c> and the global twin). Mirrors the web's
+/// <c>app/dashboard/utils/sessionSearchQuery.ts</c> exactly — both run
+/// <c>utils/session-search-syntax.cases.json</c>, because a term that matches on one side
+/// and not the other is a ghost result (found by the server, filtered out by the client, or
+/// never fetched at all).
+/// <para>
+/// Grammar: whitespace-separated terms are AND-ed; a leading minus excludes; double quotes
+/// protect a phrase; <c>key=value</c> / <c>key:value</c> restricts a term to one field when
+/// <c>key</c> is in <see cref="Fields"/> (case-insensitive), otherwise the token stays a
+/// literal term (<c>14:30</c>). A qualifier is recognised only when the separator precedes any
+/// quote in the token. Every term is a case-insensitive substring match; free terms may hit
+/// any field in <see cref="Fields"/>. There is no escape character.
+/// </para>
+/// </summary>
+public sealed class SessionSearchQuery
+{
+    /// <summary>Qualifier → field reader, in the web's suggestion order. Exactly the set the client searches.</summary>
+    public static readonly IReadOnlyList<KeyValuePair<string, Func<SessionSummary, string?>>> Fields =
+        new List<KeyValuePair<string, Func<SessionSummary, string?>>>
+        {
+            new("device", s => s.DeviceName),
+            new("serial", s => s.SerialNumber),
+            new("model", s => s.Model),
+            new("manufacturer", s => s.Manufacturer),
+            new("status", s => s.Status.ToString()),
+            new("session", s => s.SessionId),
+            new("country", s => s.GeoCountry),
+            new("region", s => s.GeoRegion),
+            new("city", s => s.GeoCity),
+            new("agent", s => s.AgentVersion),
+            new("os", s => s.OsName),
+            new("build", s => s.OsBuild),
+            new("osversion", s => s.OsDisplayVersion),
+            new("edition", s => s.OsEdition),
+            new("language", s => s.OsLanguage),
+        };
+
+    private static readonly Dictionary<string, Func<SessionSummary, string?>> ReaderByQualifier =
+        Fields.ToDictionary(kv => kv.Key, kv => kv.Value, StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>One search term; <see cref="Field"/> is the qualifier (lowercase) or null for a free term.</summary>
+    public readonly record struct Term(string Text, string? Field);
+
+    public IReadOnlyList<Term> Include { get; }
+    public IReadOnlyList<Term> Exclude { get; }
+
+    /// <summary>True when the query carries no filter at all (matches every session).</summary>
+    public bool IsEmpty => Include.Count == 0 && Exclude.Count == 0;
+
+    private SessionSearchQuery(List<Term> include, List<Term> exclude)
+    {
+        Include = include;
+        Exclude = exclude;
+    }
+
+    public static SessionSearchQuery Parse(string? query)
+    {
+        var include = new List<Term>();
+        var exclude = new List<Term>();
+        foreach (var token in Tokenize(query ?? string.Empty))
+        {
+            Term term;
+            if (token.Qualifier != null && ReaderByQualifier.ContainsKey(token.Qualifier))
+                term = new Term(token.Text.ToString(), token.Qualifier.ToLowerInvariant());
+            else
+                term = new Term(token.LiteralText, null);
+            var target = token.Negated ? exclude : include;
+            if (!target.Contains(term)) target.Add(term);
+        }
+        return new SessionSearchQuery(include, exclude);
+    }
+
+    public bool Matches(SessionSummary session)
+    {
+        if (IsEmpty) return true;
+        foreach (var t in Include)
+            if (!TermMatches(t, session)) return false;
+        foreach (var t in Exclude)
+            if (TermMatches(t, session)) return false;
+        return true;
+    }
+
+    private static bool TermMatches(Term term, SessionSummary session)
+    {
+        if (term.Field != null)
+            return ContainsIgnoreCase(ReaderByQualifier[term.Field](session), term.Text);
+        foreach (var field in Fields)
+            if (ContainsIgnoreCase(field.Value(session), term.Text)) return true;
+        return false;
+    }
+
+    private static bool ContainsIgnoreCase(string? haystack, string needle)
+        => !string.IsNullOrEmpty(haystack)
+           && haystack!.IndexOf(needle, StringComparison.OrdinalIgnoreCase) >= 0;
+
+    private sealed class Token
+    {
+        public StringBuilder Text { get; } = new();
+        public bool Negated { get; init; }
+        public string? Qualifier { get; set; }
+        public char Separator { get; set; }
+        public bool SawQuote { get; set; }
+        public string LiteralText => Qualifier == null ? Text.ToString() : $"{Qualifier}{Separator}{Text}";
+    }
+
+    // Character-for-character the web tokenizer (lib/searchQueryTokens.ts).
+    private static List<Token> Tokenize(string query)
+    {
+        var tokens = new List<Token>();
+        Token? current = null;
+        var inQuotes = false;
+
+        void Flush()
+        {
+            if (current != null && current.Text.Length > 0) tokens.Add(current);
+            current = null;
+        }
+
+        foreach (var ch in query)
+        {
+            if (!inQuotes && char.IsWhiteSpace(ch))
+            {
+                Flush();
+                continue;
+            }
+            if (ch == '"')
+            {
+                current ??= new Token();
+                current.SawQuote = true;
+                inQuotes = !inQuotes;
+                continue;
+            }
+            if (current == null)
+            {
+                if (ch == '-')
+                {
+                    current = new Token { Negated = true };
+                    continue;
+                }
+                current = new Token();
+            }
+            if ((ch == '=' || ch == ':') && !inQuotes && !current.SawQuote
+                && current.Qualifier == null && current.Text.Length > 0)
+            {
+                current.Qualifier = current.Text.ToString();
+                current.Separator = ch;
+                current.Text.Clear();
+                continue;
+            }
+            current.Text.Append(ch);
+        }
+        Flush();
+        return tokens;
+    }
+}

src/Backend/AutopilotMonitor.Functions/Middleware/McpQuotaEnforcementMiddleware.cs

@@ -354,8 +354,9 @@ public class McpQuotaEnforcementMiddleware : IFunctionsWorkerMiddleware
     private void TrackUsage(HttpContext httpContext, string oid, string? upn, string homeTenantId, IReadOnlyCollection<string> chargeTenantIds)
     {
         var normalizedEndpoint = EndpointNormalizer.Normalize(httpContext.Request.Path.Value ?? string.Empty);
-        var mcpToolName = httpContext.Request.Headers["X-MCP-Tool-Name"].FirstOrDefault();
-        if (!string.IsNullOrEmpty(mcpToolName))
+        // Key-safe copy of the header: the value becomes part of the UserUsageLog row key.
+        var mcpToolName = EndpointNormalizer.ToolNameKey(httpContext.Request.Headers["X-MCP-Tool-Name"].FirstOrDefault());
+        if (mcpToolName.Length > 0)
             normalizedEndpoint = $"{mcpToolName}:{normalizedEndpoint}";
 
         var repo = _userUsageRepo;

src/Backend/AutopilotMonitor.Functions/Program.cs

@@ -310,6 +310,8 @@ builder.Services.AddSingleton<BlockedDeviceService>();
 builder.Services.AddSingleton<HardwareRejectionThrottleService>();
 builder.Services.AddSingleton<BlockedVersionService>();
 builder.Services.AddSingleton<KillSwitchEvaluator>();
+// Shared agent-config derivation for the agent channel and the GA effective-config route.
+builder.Services.AddSingleton<AgentConfigResolver>();
 builder.Services.AddSingleton<BlobStorageService>();
 builder.Services.AddSingleton<AutopilotMonitor.Functions.Services.Diagnostics.HostedDiagnosticsBlobService>();
 builder.Services.AddSingleton<AutopilotMonitor.Functions.Services.Diagnostics.DiagnosticsBlobStreamer>();
@@ -466,6 +468,13 @@ builder.Services.AddHttpClient<TelegramNotificationService>()
 // Channel-level send API — routes each NotificationChannel to its transport (webhook renderer
 // vs. the platform Telegram bot). Transient: both transports are typed HttpClients.
 builder.Services.AddTransient<AutopilotMonitor.Functions.Services.Notifications.NotificationChannelDispatcher>();
+// What's new → channel digest (hourly timer). The feed client is a typed HttpClient reading the
+// portal's static whats-new.json; the service is transient because the dispatcher it wraps is.
+builder.Services.AddHttpClient<AutopilotMonitor.Functions.Services.WhatsNew.IWhatsNewFeedClient,
+    AutopilotMonitor.Functions.Services.WhatsNew.WhatsNewFeedClient>()
+    .ConfigureHttpClient(client => client.Timeout = TimeSpan.FromSeconds(15))
+    .AddPolicyHandler((sp, _) => sp.GetRequiredService<ResiliencePolicies>().ExternalDataApi);
+builder.Services.AddTransient<AutopilotMonitor.Functions.Services.WhatsNew.WhatsNewNotificationService>();
 // Durable channel notifications from the agent hot paths (ingest terminal alerts, hardware
 // rejection): the producer enqueues channel ids + alert, Functions/Queue/NotificationDispatchQueueFunction
 // re-resolves the channels from the tenant config and sends. Handler is transient because the

src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs

@@ -209,6 +209,7 @@ public static class EndpointAccessPolicyCatalog
 
         // ── AuthenticatedUser ───────────────────────────────────────────
         new("GET",    "auth/me",                   EndpointPolicy.AuthenticatedUser),
+        new("PUT",    "auth/me/whats-new-seen",    EndpointPolicy.AuthenticatedUser),
         new("GET",    "auth/is-global-admin",      EndpointPolicy.AuthenticatedUser),
         new("POST",   "realtime/negotiate",        EndpointPolicy.AuthenticatedUser),
         // Group join/leave is AuthenticatedUserWithRole — NOT MemberRead — on purpose. The real,
@@ -458,6 +459,8 @@ public static class EndpointAccessPolicyCatalog
         // config writes remain a future policy decision.
         new("PATCH",  "config/{tenantId}/fields",  EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam),
         new("GET",    "config/{tenantId}/backups", EndpointPolicy.GlobalAdminOnly, TenantScoping.RouteParam),
+        // Operator view of the AgentConfigResponse an agent of the tenant receives (Tenant Config Report).
+        new("GET",    "config/{tenantId}/effective-agent-config", EndpointPolicy.GlobalAdminOnly, TenantScoping.RouteParam),
         new("POST",   "config/{tenantId}/revert",  EndpointPolicy.GlobalAdminOnly, TenantScoping.RouteParam),
         // Field schema for the write surface above: tenant-independent reflection over the model
         // + deny-lists (no tenant data), but GA-only to match the surface it describes. Literal

src/Backend/AutopilotMonitor.Functions/Services/AgentConfigResolver.cs

@@ -0,0 +1,252 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Services
+{
+    /// <summary>
+    /// Outcome of <see cref="AgentConfigResolver.Build"/>: the response an agent of the tenant
+    /// receives, plus the migration candidate that failed validation (null when none) so the
+    /// agent channel can log it as delivery evidence.
+    /// </summary>
+    public sealed class AgentConfigResolution
+    {
+        public AgentConfigResponse Response { get; }
+        public string? RejectedMigrateCandidate { get; }
+
+        public AgentConfigResolution(AgentConfigResponse response, string? rejectedMigrateCandidate)
+        {
+            Response = response;
+            RejectedMigrateCandidate = rejectedMigrateCandidate;
+        }
+    }
+
+    /// <summary>
+    /// The one place that derives an <see cref="AgentConfigResponse"/> from a tenant's stored
+    /// configuration, the global admin configuration and the tenant's active rule catalogs.
+    /// Serves two callers with the same result: the cert-authenticated agent channel
+    /// (GetAgentConfigFunction, which adds the per-device kill verdict on top) and the
+    /// Global-Admin report route (GetEffectiveAgentConfigFunction), so the operator sees
+    /// exactly what an agent would receive. Every default applied here IS the agent-side
+    /// default; the class initializers of <see cref="AgentConfigResponse"/> are the source
+    /// of the "custom" highlight in the web report via the shared manifest.
+    /// </summary>
+    public class AgentConfigResolver
+    {
+        /// <summary>Bumped when the wire shape gains a field the agent must understand.</summary>
+        public const int ConfigVersion = 40; // EnableDoGroupIdAutoSet (Delivery Optimization group ID from network fingerprint)
+
+        /// <summary>
+        /// The agent line whose hash oracle is served when no X-Agent-Version is available
+        /// (operator report). V2 is the only wired line — see AdminConfiguration.GetAgentLine.
+        /// </summary>
+        public const int CurrentAgentMajor = 2;
+
+        private readonly TenantConfigurationService _configService;
+        private readonly AdminConfigurationService _adminConfigService;
+        private readonly GatherRuleService _gatherRuleService;
+        private readonly ImeLogPatternService _imeLogPatternService;
+
+        public AgentConfigResolver(
+            TenantConfigurationService configService,
+            AdminConfigurationService adminConfigService,
+            GatherRuleService gatherRuleService,
+            ImeLogPatternService imeLogPatternService)
+        {
+            _configService = configService;
+            _adminConfigService = adminConfigService;
+            _gatherRuleService = gatherRuleService;
+            _imeLogPatternService = imeLogPatternService;
+        }
+
+        /// <summary>
+        /// Loads the four inputs and builds the response. Rule and pattern reads are independent
+        /// and served from per-instance catalog caches — fetched concurrently.
+        /// </summary>
+        public async Task<AgentConfigResolution> ResolveAsync(string tenantId, int agentMajor)
+        {
+            var tenantConfig = await _configService.GetConfigurationAsync(tenantId);
+            var adminConfig = await _adminConfigService.GetConfigurationAsync();
+
+            var gatherRulesTask = _gatherRuleService.GetActiveRulesForTenantAsync(tenantId);
+            var imeLogPatternsTask = _imeLogPatternService.GetActivePatternsForTenantAsync(tenantId);
+            await Task.WhenAll(gatherRulesTask, imeLogPatternsTask);
+
+            return Build(tenantConfig, adminConfig, await gatherRulesTask, await imeLogPatternsTask, agentMajor, DateTime.UtcNow);
+        }
+
+        /// <summary>
+        /// Pure derivation: tenant config + admin config + catalogs → response. Device-specific
+        /// fields (DeviceBlocked, DeviceKillSignal, UnblockAt) stay at their defaults; the agent
+        /// channel sets them from its kill verdict.
+        /// </summary>
+        public static AgentConfigResolution Build(
+            TenantConfiguration tenantConfig,
+            AdminConfiguration adminConfig,
+            List<GatherRule> gatherRules,
+            List<ImeLogPattern> imeLogPatterns,
+            int agentMajor,
+            DateTime nowUtc)
+        {
+            // Collector configuration from tenant settings + global policy
+            var collectors = new CollectorConfiguration
+            {
+                EnablePerformanceCollector = tenantConfig.EnablePerformanceCollector,
+                PerformanceIntervalSeconds = tenantConfig.PerformanceCollectorIntervalSeconds,
+                CollectorIdleTimeoutMinutes = adminConfig.CollectorIdleTimeoutMinutes,
+                DesktopDetectorNoCandidateTimeoutMinutes = adminConfig.DesktopDetectorNoCandidateTimeoutMinutes,
+                HelloWaitTimeoutSeconds = tenantConfig.HelloWaitTimeoutSeconds,
+                AgentMaxLifetimeMinutes = tenantConfig.AgentMaxLifetimeMinutes ?? 360,
+                ModernDeploymentHarmlessEventIds = adminConfig.GetModernDeploymentHarmlessEventIds().ToArray()
+            };
+
+            // Merge global + tenant-specific diagnostics log paths (the built-in sections are
+            // compiled into the agent — DiagnosticsBuiltInSections — and never travel here)
+            var diagLogPaths = MergeDiagnosticsLogPaths(
+                adminConfig.GetDiagnosticsGlobalLogPaths(), tenantConfig.GetDiagnosticsLogPaths());
+
+            // Per-line hash oracle (parametric per major). The wire response keeps generic field
+            // names (LatestAgentSha256 / LatestAgentExeSha256) so agent code is unchanged across lines.
+            var line = adminConfig.GetAgentLine(agentMajor);
+
+            // Endpoint migration on the control channel: the (validated) re-home target, so agents
+            // still bound to this backend's compiled-in URL move themselves at their next start.
+            var migrateTarget = ResolveMigrateTarget(adminConfig, tenantConfig.TenantId, out var rejectedMigrateCandidate);
+
+            var response = new AgentConfigResponse
+            {
+                ConfigVersion = ConfigVersion,
+                UploadIntervalSeconds = Shared.Constants.DefaultUploadIntervalSeconds,
+                SelfDestructOnComplete = tenantConfig.SelfDestructOnComplete ?? true,
+                KeepLogFile = tenantConfig.KeepLogFile ?? false,
+                EnableGeoLocation = tenantConfig.EnableGeoLocation ?? true,
+                EnableImeMatchLog = tenantConfig.EnableImeMatchLog ?? false,
+                EnableGatherRuleDebugLog = tenantConfig.EnableGatherRuleDebugLog ?? false,
+                EnableEspContinueAnywayObservation = tenantConfig.EnableEspContinueAnywayObservation ?? false,
+                MaxAuthFailures = tenantConfig.MaxAuthFailures ?? 5,
+                AuthFailureTimeoutMinutes = tenantConfig.AuthFailureTimeoutMinutes ?? 0,
+                LogLevel = tenantConfig.LogLevel ?? "Info",
+                RebootOnComplete = tenantConfig.RebootOnComplete ?? false,
+                RebootDelaySeconds = tenantConfig.RebootDelaySeconds ?? 10,
+                ShowEnrollmentSummary = tenantConfig.ShowEnrollmentSummary ?? false,
+                EnrollmentSummaryTimeoutSeconds = tenantConfig.EnrollmentSummaryTimeoutSeconds ?? 60,
+                EnrollmentSummaryBrandingImageUrl = tenantConfig.EnrollmentSummaryBrandingImageUrl,
+                EnrollmentSummaryLaunchRetrySeconds = tenantConfig.EnrollmentSummaryLaunchRetrySeconds ?? 120,
+                MaxBatchSize = tenantConfig.MaxBatchSize ?? 100,
+                DiagnosticsUploadEnabled = ResolveDiagnosticsUploadEnabled(
+                    tenantConfig.DiagnosticsBlobSasUrl, tenantConfig.DiagnosticsUploadDestination),
+                DiagnosticsUploadMode = tenantConfig.DiagnosticsUploadMode ?? "Off",
+                DiagnosticsLogPaths = diagLogPaths,
+                Collectors = collectors,
+                Analyzers = new AnalyzerConfiguration
+                {
+                    EnableLocalAdminAnalyzer = tenantConfig.EnableLocalAdminAnalyzer ?? true,
+                    LocalAdminAllowedAccounts = tenantConfig.GetLocalAdminAllowedAccounts(),
+                    EnableSoftwareInventoryAnalyzer = tenantConfig.EnableSoftwareInventoryAnalyzer ?? false,
+                    EnableIntegrityBypassAnalyzer = tenantConfig.EnableIntegrityBypassAnalyzer ?? true,
+                    EnableRealmJoinWatcher = tenantConfig.EnableRealmJoinWatcher ?? false,
+                    KeepAwakeDuringUserEsp = tenantConfig.KeepAwakeDuringUserEsp ?? false,
+                    EnableConsoleBypassDetection = tenantConfig.EnableConsoleBypassDetection ?? true
+                },
+                LatestAgentSha256 = line.ZipSha256,
+                LatestAgentExeSha256 = line.ExeSha256,
+                AllowAgentDowngrade = adminConfig.AllowAgentDowngrade,
+                NtpServer = string.IsNullOrEmpty(tenantConfig.NtpServer) ? "time.windows.com" : tenantConfig.NtpServer,
+                EnableTimezoneAutoSet = tenantConfig.EnableTimezoneAutoSet ?? false,
+                EnableDoGroupIdAutoSet = tenantConfig.EnableDoGroupIdAutoSet ?? false,
+                SendTraceEvents = tenantConfig.SendTraceEvents,
+                UnrestrictedMode = TenantEntitlementService.IsUnrestrictedModeActive(tenantConfig, nowUtc),
+                GatherRules = gatherRules,
+                ImeLogPatterns = imeLogPatterns,
+                WhiteGloveSealingPatternIds = adminConfig.GetWhiteGloveSealingPatternIds(),
+                MigrateToApiBaseUrl = migrateTarget,
+            };
+
+            return new AgentConfigResolution(response, rejectedMigrateCandidate);
+        }
+
+        /// <summary>
+        /// Parses the major-version from an X-Agent-Version header value.
+        /// Accepts SemVer-ish strings like "2.0.114" or "2.0.114+abc123".
+        /// Missing/unparsable → returns 1 (backward-compat: very old agents may omit the
+        /// header). The V1 line is retired, so major 1 resolves to empty hashes via
+        /// GetAgentLine's default arm — legacy stragglers just skip their integrity check.
+        /// Deliberately NOT defaulting to 2: that would hand V2 hashes to V1 binaries and
+        /// could trigger the runtime_hash_mismatch force-update path against the wrong line.
+        /// </summary>
+        internal static int ParseAgentMajor(string? agentVersion)
+        {
+            if (string.IsNullOrWhiteSpace(agentVersion))
+                return 1;
+
+            var dot = agentVersion.IndexOf('.');
+            var majorStr = dot > 0 ? agentVersion.Substring(0, dot) : agentVersion;
+            return int.TryParse(majorStr, out var major) ? major : 1;
+        }
+
+        /// <summary>
+        /// Decides whether the agent should perform diagnostics uploads at all.
+        /// The CustomerSas destination is gated on a per-tenant SAS URL being present, but the
+        /// Hosted destination has no such URL (the platform owns the storage) — so gating purely
+        /// on the SAS URL silently disabled uploads for every Hosted-destination tenant. Enable
+        /// when either a customer SAS is configured OR the destination is Hosted.
+        /// </summary>
+        internal static bool ResolveDiagnosticsUploadEnabled(string? diagnosticsBlobSasUrl, string? destination)
+        {
+            return !string.IsNullOrEmpty(diagnosticsBlobSasUrl)
+                || string.Equals(destination, "Hosted", StringComparison.OrdinalIgnoreCase);
+        }
+
+        /// <summary>
+        /// Global ∪ tenant diagnostics paths: global first, order preserved, blank paths dropped,
+        /// duplicates (trimmed, case-insensitive) collapsed onto the first occurrence. The agent
+        /// keys ZIP entries on the path, so a path present in both lists would otherwise produce
+        /// duplicate entry names inside the archive.
+        /// </summary>
+        internal static List<DiagnosticsLogPath> MergeDiagnosticsLogPaths(
+            IEnumerable<DiagnosticsLogPath> global,
+            IEnumerable<DiagnosticsLogPath> tenant)
+        {
+            return global.Concat(tenant)
+                .Where(p => !string.IsNullOrWhiteSpace(p?.Path))
+                .GroupBy(p => p.Path.Trim(), StringComparer.OrdinalIgnoreCase)
+                .Select(g => g.First())
+                .ToList();
+        }
+
+        /// <summary>
+        /// Resolves the endpoint-migration target for a tenant: per-tenant override wins over
+        /// the global value; an override entry with an empty value pins the tenant (no
+        /// migration even while the global target is set — staged rollout). The winning value
+        /// is validated against <see cref="AutopilotMonitor.Shared.Services.AgentEndpointMigrationRules"/>;
+        /// invalid values resolve to null (fail-safe: better to strand an agent on the old
+        /// backend than to serve a broken or non-allowlisted URL).
+        /// </summary>
+        internal static string? ResolveMigrateTarget(
+            AdminConfiguration adminConfig,
+            string tenantId,
+            out string? rejectedCandidate)
+        {
+            rejectedCandidate = null;
+
+            string? candidate = adminConfig.AgentMigrateApiBaseUrl;
+            var overrides = adminConfig.GetAgentMigrateTenantOverrides();
+            if (!string.IsNullOrEmpty(tenantId) && overrides.TryGetValue(tenantId, out var tenantTarget))
+                candidate = tenantTarget; // empty string = pinned, handled below
+
+            if (string.IsNullOrWhiteSpace(candidate))
+                return null;
+
+            if (AutopilotMonitor.Shared.Services.AgentEndpointMigrationRules
+                .TryNormalizeTarget(candidate, out var normalized))
+            {
+                return normalized;
+            }
+
+            rejectedCandidate = candidate;
+            return null;
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Services/DiagnosticsUploadConfigChange.cs

@@ -1,5 +1,4 @@
 using System;
-using AutopilotMonitor.Functions.Functions.Config;
 using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Functions.Services
@@ -33,7 +32,7 @@ namespace AutopilotMonitor.Functions.Services
         {
             if (config == null) return false;
             return !string.Equals(config.DiagnosticsUploadMode ?? "Off", "Off", StringComparison.OrdinalIgnoreCase)
-                && GetAgentConfigFunction.ResolveDiagnosticsUploadEnabled(
+                && AgentConfigResolver.ResolveDiagnosticsUploadEnabled(
                     config.DiagnosticsBlobSasUrl, config.DiagnosticsUploadDestination);
         }
 

src/Backend/AutopilotMonitor.Functions/Services/ErrorCodeEnricher.cs

@@ -1,6 +1,7 @@
 #nullable enable
 using System;
 using System.Collections.Generic;
+using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Services;
 
@@ -18,9 +19,23 @@ namespace AutopilotMonitor.Functions.Services
     /// Idempotent: when a sibling info key is already present the entry is skipped.
     /// Read-only on the storage layer — never writes back to the table.
     /// </para>
+    /// <para>
+    /// Events emitted by the gather-rule pipeline (<see cref="GatherRuleSource"/>) are only
+    /// enriched when the rule opted in via <see cref="GatherRule.EnrichErrorCodes"/> — the agent
+    /// then stamps <c>enrichErrorCodes: true</c> into the data. Without it, their payload keys are
+    /// author-chosen and the codes come from arbitrary third-party logs or commands (HP Image
+    /// Assistant, Dell Command Update, custom scripts …) with their own exit-code numbering;
+    /// resolving those against the Windows/MSI/Intune catalog would attach a confident but
+    /// wrong meaning.
+    /// </para>
     /// </summary>
     public static class ErrorCodeEnricher
     {
+        /// <summary>
+        /// <see cref="EnrollmentEvent.Source"/> stamped by the agent on every gather-rule event.
+        /// </summary>
+        internal const string GatherRuleSource = Constants.EventSources.GatherRuleExecutor;
+
         /// <summary>
         /// Keys (lower-cased) whose value the enricher looks up. Match is case-insensitive.
         /// Each is paired with the sibling info-key written next to it in <c>Data</c>.
@@ -42,6 +57,7 @@ namespace AutopilotMonitor.Functions.Services
         public static void EnrichEvent(EnrollmentEvent evt)
         {
             if (evt?.Data == null || evt.Data.Count == 0) return;
+            if (IsGatherRuleEvent(evt) && !HasEnrichOptIn(evt.Data)) return;
 
             foreach (var pair in _codeKeyPairs)
             {
@@ -87,6 +103,21 @@ namespace AutopilotMonitor.Functions.Services
             foreach (var e in events) EnrichEvent(e);
         }
 
+        private static bool IsGatherRuleEvent(EnrollmentEvent evt) =>
+            string.Equals(evt.Source, GatherRuleSource, StringComparison.OrdinalIgnoreCase);
+
+        /// <summary>
+        /// The agent-stamped opt-in marker. Data may hold a CLR bool (in-process) or a
+        /// deserialized JSON token / string (from DataJson), so the check goes via ToString.
+        /// </summary>
+        private static bool HasEnrichOptIn(Dictionary<string, object> data)
+        {
+            if (!TryFindKey(data, Constants.GatherRuleDataKeys.EnrichErrorCodes, out var key)) return false;
+            var raw = data[key];
+            if (raw is bool b) return b;
+            return string.Equals(raw?.ToString(), "true", StringComparison.OrdinalIgnoreCase);
+        }
+
         private static bool TryFindKey(Dictionary<string, object> data, string lowerKey, out string actualKey)
         {
             foreach (var k in data.Keys)

src/Backend/AutopilotMonitor.Functions/Services/GatherRuleService.cs

@@ -505,7 +505,8 @@ namespace AutopilotMonitor.Functions.Services
                 && a.TriggerPhase == b.TriggerPhase
                 && ActivePhasesEquivalent(a.ActivePhases, b.ActivePhases)
                 && a.ActiveFromPhase == b.ActiveFromPhase
-                && a.EmitMode == b.EmitMode;
+                && a.EmitMode == b.EmitMode
+                && a.EnrichErrorCodes == b.EnrichErrorCodes;
         }
 
         /// <summary>

src/Backend/AutopilotMonitor.Functions/Services/HealthCheckService.cs

@@ -49,10 +49,12 @@ public class HealthCheckService
         };
 
         // NOTE: CheckMcpServerAsync is deliberately NOT part of this batch. The MCP
-        // Container App scales to zero on idle, so a probe may need to wake it and can
-        // take many seconds. Bundling it here would block the entire dashboard on that
-        // one slow check. It is exposed via its own endpoint (GET health/mcp) that the
-        // frontend fetches independently and folds into the card grid incrementally.
+        // Container App scales to zero on idle; a cold probe answers "warming" after a
+        // short budget and the caller re-polls until the replica is up. That re-poll loop
+        // must stay off the blocking batch, and "warming" must never reach this aggregate
+        // — a scale-from-zero is expected behaviour, not a degraded platform. It is
+        // exposed via its own endpoint (GET health/mcp) that the frontend fetches
+        // independently and folds into the card grid incrementally.
         var checks = await Task.WhenAll(
             CheckStorageBackendAsync(includeEndpointUrls),
             CheckProcessingBackendAsync(includeEndpointUrls),
@@ -244,13 +246,32 @@ public class HealthCheckService
     /// only included in the details when <paramref name="includeEndpointUrl"/> is set —
     /// callers must only enable it for Global Admins.
     /// <para>
-    /// The Container App runs with minReplicas=0 and scales to zero on idle. Azure Container
-    /// Apps holds an inbound request while it activates a cold replica, so this probe doubles
-    /// as the wake signal — a generous timeout (<c>McpServerHealthTimeoutSeconds</c>, default
-    /// 30s) gives the cold start time to complete and report healthy. Only when the server
-    /// cannot be woken within that budget is it a warning; a reachable-but-erroring server
-    /// (non-2xx) is unhealthy. This is exposed via its own <c>health/mcp</c> endpoint, never
-    /// the blocking all-checks batch, so the dashboard never waits on the wake.
+    /// The Container App runs with minReplicas=0 and scales to zero on idle, and a cold start
+    /// is dominated by Container Apps activation, not by us: measured at 24.5s and 31.5s to
+    /// first byte, of which ~98% is KEDA scheduling plus the image mount and ~500ms is the
+    /// application (see <c>internal/docs/mcp/docs-corpus.md</c>, "Cold start"). No UI wait
+    /// covers that, so this probe deliberately does not try to sit it out — an earlier design
+    /// waited 30s as a "wake signal" and still timed out in 50 of 83 observed calls, i.e. it
+    /// bought a long wall in front of the same answer.
+    /// </para>
+    /// <para>
+    /// The probe therefore has two jobs: answer fast and honestly within
+    /// <c>McpServerHealthTimeoutSeconds</c> (default 3s — chosen to sit in the widest observed
+    /// latency gap, 2347ms..3930ms, so jitter cannot flip the verdict), and leave the wake
+    /// running. The inbound request has already reached the Container Apps activator by the
+    /// time we give up, so aborting our side does not undo the scale-from-zero it triggered;
+    /// the caller re-checks and a later probe finds the replica warm.
+    /// </para>
+    /// <para>
+    /// Status vocabulary: <c>healthy</c> = answered 2xx; <c>warming</c> = did not answer inside
+    /// the budget, a cold start is in progress and the caller should re-check (must NOT be
+    /// rated into any aggregate — it is expected, not a fault); <c>warning</c> = reachable but
+    /// the connection failed; <c>unhealthy</c> = answered non-2xx. Exposed via its own
+    /// <c>health/mcp</c> endpoint, never the blocking all-checks batch.
+    /// </para>
+    /// <para>
+    /// <c>McpServerHealthTimeoutSeconds</c> is set nowhere in the repo, infra or workflows, so
+    /// the default below IS the live production value — changing it changes production.
     /// </para>
     /// </summary>
     internal async Task<HealthCheck> CheckMcpServerAsync(bool includeEndpointUrl = false)
@@ -268,11 +289,9 @@ public class HealthCheckService
         {
             check.Details = new Dictionary<string, object> { ["Server URL"] = baseUrl };
         }
-        var timeoutSeconds = ParsePositiveInt("McpServerHealthTimeoutSeconds", 30);
-
-        // A cold start that takes longer than this is treated as a successful wake rather
-        // than an instant-warm hit, so the message can say so.
-        const long WarmHitThresholdMs = 2500;
+        // 3s: warm answers were measured at 4..148ms over 14 days, so this is ~20x the warm
+        // maximum, while a cold start needs 20-30s and is unreachable for any UI wait.
+        var timeoutSeconds = ParsePositiveInt("McpServerHealthTimeoutSeconds", 3);
 
         try
         {
@@ -293,24 +312,34 @@ public class HealthCheckService
             var version = await TryReadMcpVersionAsync(response);
 
             check.Status = "healthy";
-            check.Message = sw.ElapsedMilliseconds > WarmHitThresholdMs
-                ? $"MCP server woke from idle and is reachable ({sw.ElapsedMilliseconds}ms)"
-                : $"MCP server reachable ({sw.ElapsedMilliseconds}ms)";
+            check.Message = McpReachableMessage(sw.ElapsedMilliseconds);
             if (!string.IsNullOrWhiteSpace(version))
             {
                 check.Details ??= new Dictionary<string, object>();
                 check.Details["Version"] = version;
             }
         }
-        catch (Exception ex) when (ex is TaskCanceledException or OperationCanceledException or HttpRequestException)
+        catch (Exception ex) when (ex is TaskCanceledException or OperationCanceledException)
         {
-            // Timeout or connection failure after the full wake budget. The probe held the
-            // request long enough for a cold replica to activate, so a failure here means the
-            // server could not be woken — surface as a warning (not a hard outage: the next
-            // re-check may still succeed once it finishes warming).
+            // Our own timeout: no external cancellation token reaches this path, so a
+            // cancellation here is always the budget above expiring. The scale-from-zero we
+            // triggered keeps running after we give up, so this is a re-check prompt, not a
+            // fault — and with minReplicas=0 it is the expected path for an idle server,
+            // which is why it logs at Information and must not colour any aggregate.
+            check.Status = "warming";
+            // Short on purpose: the portal card renders its own one-line warming text and
+            // ignores this message, so it only has to be honest for a direct API caller.
+            check.Message = $"MCP server is starting (no answer within {timeoutSeconds}s; it scales to zero when idle)";
+            _logger.LogInformation(ex, "MCP server health probe found a cold server (no answer within {TimeoutSeconds}s); activation continues in the background", timeoutSeconds);
+        }
+        catch (HttpRequestException ex)
+        {
+            // Reached the network but could not connect — distinct from the cold-start path
+            // above and genuinely worth a warning. ex.Message can carry the host name, so it
+            // stays out of the user-visible text (same rule as the non-2xx branch).
             check.Status = "warning";
-            check.Message = $"MCP server could not be reached within {timeoutSeconds}s — it may still be warming up. Re-check in a moment.";
-            _logger.LogWarning(ex, "MCP server health probe did not respond within {TimeoutSeconds}s (wake attempt failed)", timeoutSeconds);
+            check.Message = "MCP server unreachable (connection failed)";
+            _logger.LogWarning(ex, "MCP server health probe could not connect");
         }
         catch (Exception ex)
         {
@@ -322,6 +351,24 @@ public class HealthCheckService
         return check;
     }
 
+    /// <summary>
+    /// An answer slower than this came from a replica that had just started, not from a warm
+    /// one, so the message can say so. 750ms is ~5x the warm maximum measured over 14 days
+    /// (4..148ms) and deliberately generous: those measurements come from a near-idle,
+    /// single-user system, and warm latency will rise under concurrency. It stays well below
+    /// the next observed cluster (2289ms), so the distinction remains sharp.
+    /// </summary>
+    private const long WarmHitThresholdMs = 750;
+
+    /// <summary>
+    /// Wording for a reachable MCP server. Extracted so the threshold can be pinned by a test
+    /// without a real delay. Both arms keep the word "reachable".
+    /// </summary>
+    internal static string McpReachableMessage(long elapsedMs) =>
+        elapsedMs > WarmHitThresholdMs
+            ? $"MCP server reachable after a cold start ({elapsedMs}ms)"
+            : $"MCP server reachable ({elapsedMs}ms)";
+
     /// <summary>
     /// Best-effort parse of the MCP <c>/health</c> JSON body for its <c>version</c> field.
     /// A missing or malformed body is non-fatal — the probe already proved reachability.

src/Backend/AutopilotMonitor.Functions/Services/Notifications/NotificationAlertBuilder.cs

@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Linq;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Models.Notifications;
+using AutopilotMonitor.Shared.Models.WhatsNew;
 
 namespace AutopilotMonitor.Functions.Services.Notifications
 {
@@ -465,5 +466,106 @@ namespace AutopilotMonitor.Functions.Services.Notifications
             var result = string.Join(" ", Array.FindAll(parts, p => p != null));
             return string.IsNullOrEmpty(result) ? "\u2013" : result;
         }
+
+        // ── What's new digest ─────────────────────────────────────────────────
+
+        /// <summary>Entries rendered in full; the rest is folded into a "+N more" line.</summary>
+        public const int WhatsNewMaxSections = 6;
+        private const int WhatsNewMaxBodyLength = 280;
+
+        /// <summary>
+        /// Builds the "What's new" digest sent to channels with <c>NotifyOnWhatsNew</c>: one
+        /// message per batch of newly published changelog entries (newest first), one section per
+        /// entry. Entry text is inline markdown authored for the docs; renderers disagree on
+        /// markdown dialects (Adaptive Card vs. Slack mrkdwn vs. Discord), so it is flattened to
+        /// plain text here and the links live in the action buttons instead.
+        /// </summary>
+        public static NotificationAlert BuildWhatsNewAlert(
+            IReadOnlyList<WhatsNewFeedEntry> newEntries,
+            IReadOnlyDictionary<string, string>? docsUrls,
+            string portalWhatsNewUrl)
+        {
+            if (newEntries == null) throw new ArgumentNullException(nameof(newEntries));
+            if (newEntries.Count == 0) throw new ArgumentException("At least one entry is required.", nameof(newEntries));
+
+            var ordered = newEntries.OrderByDescending(e => e.AddedUtc).ToList();
+            var platformCount = ordered.Count(e => e.Channel == WhatsNewFeed.PlatformChannel);
+            var agentCount = ordered.Count - platformCount;
+
+            var alert = new NotificationAlert
+            {
+                EventType = "whats_new",
+                Title = "\ud83c\udd95 What's new in Autopilot Monitor",
+                Summary = BuildWhatsNewSummary(ordered.Count, platformCount, agentCount),
+                Severity = NotificationSeverity.Info,
+                ThemeColor = "0078D4",
+            };
+
+            foreach (var entry in ordered.Take(WhatsNewMaxSections))
+            {
+                var channelLabel = entry.Channel == WhatsNewFeed.AgentChannel ? "Agent" : "Platform";
+                var heading = $"{channelLabel} \u00b7 {entry.AddedUtc:MMM d, yyyy}";
+                var title = StripInlineMarkdown(entry.Title);
+                if (!string.IsNullOrEmpty(title))
+                    heading += $" \u2014 {title}";
+
+                alert.Sections.Add(new NotificationSection
+                {
+                    Title = heading,
+                    Text = Truncate(StripInlineMarkdown(entry.Body), WhatsNewMaxBodyLength),
+                });
+            }
+
+            var remaining = ordered.Count - WhatsNewMaxSections;
+            if (remaining > 0)
+            {
+                alert.Sections.Add(new NotificationSection
+                {
+                    Title = string.Empty,
+                    Text = $"+ {remaining} more update{(remaining == 1 ? "" : "s")} \u2014 see the full changelog.",
+                });
+            }
+
+            alert.Actions.Add(new NotificationAction { Type = "openUrl", Title = "Open What's new", Url = portalWhatsNewUrl });
+
+            // Changelog button for the channel with the most new entries (platform on a tie).
+            var primaryChannel = agentCount > platformCount ? WhatsNewFeed.AgentChannel : WhatsNewFeed.PlatformChannel;
+            if (docsUrls != null && docsUrls.TryGetValue(primaryChannel, out var docsUrl) && !string.IsNullOrWhiteSpace(docsUrl))
+                alert.Actions.Add(new NotificationAction { Type = "openUrl", Title = "Full changelog", Url = docsUrl });
+
+            return alert;
+        }
+
+        private static string BuildWhatsNewSummary(int total, int platformCount, int agentCount)
+        {
+            var parts = new List<string>(2);
+            if (platformCount > 0) parts.Add($"{platformCount} platform");
+            if (agentCount > 0) parts.Add($"{agentCount} agent");
+            var breakdown = parts.Count == 2 ? $" ({string.Join(", ", parts)})" : string.Empty;
+            return $"{total} new update{(total == 1 ? "" : "s")}{breakdown} just went live in the portal.";
+        }
+
+        /// <summary>
+        /// Flattens the docs' inline markdown: <c>[label](url)</c> → label, <c>**x**</c>/<c>__x__</c> → x,
+        /// <c>`x`</c> → x, <c>*x*</c>/<c>_x_</c> → x. Null-safe; whitespace is collapsed.
+        /// </summary>
+        internal static string StripInlineMarkdown(string? markdown)
+        {
+            if (string.IsNullOrWhiteSpace(markdown))
+                return string.Empty;
+
+            var text = markdown!;
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"\[([^\]]+)\]\([^)]*\)", "$1");
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"\*\*(.+?)\*\*", "$1");
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"__(.+?)__", "$1");
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"`([^`]*)`", "$1");
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"(?<![\w*])\*(?!\s)(.+?)(?<!\s)\*(?![\w*])", "$1");
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"(?<![\w_])_(?!\s)(.+?)(?<!\s)_(?![\w_])", "$1");
+            text = System.Text.RegularExpressions.Regex.Replace(text, @"\s+", " ");
+            return text.Trim();
+        }
+
+        private static string Truncate(string text, int maxLength)
+            => text.Length <= maxLength ? text : text[..(maxLength - 1)].TrimEnd() + "\u2026";
     }
 }

src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.AgentApi.cs

@@ -594,7 +594,8 @@ namespace AutopilotMonitor.Functions.Services
             // Free-text queries backfill whole Azure pages until pageSize matches accumulated
             // (bounded rounds); non-q queries keep the single-page contract ("consume until
             // absent" — a page may contain fewer than pageSize items after client filters).
-            var maxRounds = string.IsNullOrEmpty(filter.Q) ? 1 : FreeTextBackfillMaxRounds;
+            var query = SessionSearchQuery.Parse(filter.Q);
+            var maxRounds = query.IsEmpty ? 1 : FreeTextBackfillMaxRounds;
 
             var sessions = new List<SessionSummary>(pageSize);
             var token = continuation;
@@ -610,7 +611,7 @@ namespace AutopilotMonitor.Functions.Services
                 foreach (var entity in entities)
                 {
                     var session = MapIndexEntityToSessionSummary(entity);
-                    if (!MatchesScanClientFilters(session, filter)) continue;
+                    if (!MatchesScanClientFilters(session, filter, query)) continue;
                     sessions.Add(session);
                 }
 
@@ -645,11 +646,12 @@ namespace AutopilotMonitor.Functions.Services
                 pageSize: pageSize,
                 continuation: continuation);
 
+            var query = SessionSearchQuery.Parse(filter.Q);
             var rows = new List<IReadOnlyDictionary<string, object?>>(entities.Count);
             foreach (var entity in entities)
             {
                 var session = MapIndexEntityToSessionSummary(entity);
-                if (!MatchesScanClientFilters(session, filter)) continue;
+                if (!MatchesScanClientFilters(session, filter, query)) continue;
                 rows.Add(RawEntityProjection.ToDictionary(entity));
             }
 
@@ -782,40 +784,20 @@ namespace AutopilotMonitor.Functions.Services
         }
 
         /// <summary>
-        /// Free-text predicate for the dashboard search box (<c>q=</c>). Case-insensitive
-        /// substring over EXACTLY the fields the web dashboard's client-side filter searches
-        /// (useDashboardFilters.searchableText, minus its derived-only tokens: localized date
-        /// string, "N min" duration, "blocked"). Keep the two lists in sync — a field matched
-        /// only server-side would be filtered back out by the client and read as a ghost result.
+        /// Free-text predicate for the dashboard search box (<c>q=</c>): the search grammar
+        /// (<see cref="SessionSearchQuery"/> — AND-ed terms, exclusions, phrases, field
+        /// qualifiers) over EXACTLY the fields the web dashboard's client-side filter searches
+        /// (minus its derived-only tokens: localized date string, "N min" duration, "blocked").
+        /// The two sides share a case file — a field matched only server-side would be filtered
+        /// back out by the client and read as a ghost result. Parses per call; the page paths
+        /// parse once and use <see cref="MatchesScanClientFilters(SessionSummary, SessionSearchFilter, SessionSearchQuery)"/>.
         /// </summary>
         internal static bool MatchesFreeText(SessionSummary session, string? q)
+            => SessionSearchQuery.Parse(q).Matches(session);
+
+        private static bool MatchesScanClientFilters(SessionSummary session, SessionSearchFilter filter, SessionSearchQuery query)
         {
-            if (string.IsNullOrEmpty(q)) return true;
-
-            return ContainsIgnoreCase(session.DeviceName, q)
-                || ContainsIgnoreCase(session.SerialNumber, q)
-                || ContainsIgnoreCase(session.Manufacturer, q)
-                || ContainsIgnoreCase(session.Model, q)
-                || ContainsIgnoreCase(session.Status.ToString(), q)
-                || ContainsIgnoreCase(session.SessionId, q)
-                || ContainsIgnoreCase(session.GeoCountry, q)
-                || ContainsIgnoreCase(session.GeoRegion, q)
-                || ContainsIgnoreCase(session.GeoCity, q)
-                || ContainsIgnoreCase(session.AgentVersion, q)
-                || ContainsIgnoreCase(session.OsName, q)
-                || ContainsIgnoreCase(session.OsBuild, q)
-                || ContainsIgnoreCase(session.OsDisplayVersion, q)
-                || ContainsIgnoreCase(session.OsEdition, q)
-                || ContainsIgnoreCase(session.OsLanguage, q);
-        }
-
-        private static bool ContainsIgnoreCase(string? haystack, string needle)
-            => !string.IsNullOrEmpty(haystack)
-               && haystack!.IndexOf(needle, StringComparison.OrdinalIgnoreCase) >= 0;
-
-        private static bool MatchesScanClientFilters(SessionSummary session, SessionSearchFilter filter)
-        {
-            if (!MatchesFreeText(session, filter.Q)) return false;
+            if (!query.Matches(session)) return false;
             if (!string.IsNullOrEmpty(filter.SerialNumber) &&
                 !string.Equals(session.SerialNumber, filter.SerialNumber, StringComparison.OrdinalIgnoreCase))
                 return false;
@@ -1074,6 +1056,7 @@ namespace AutopilotMonitor.Functions.Services
 
         private List<SessionSummary> ApplyBasicFilters(List<SessionSummary> sessions, SessionSearchFilter filter)
         {
+            var query = SessionSearchQuery.Parse(filter.Q);
             return sessions.Where(s =>
             {
                 if (!string.IsNullOrEmpty(filter.Status) && s.Status.ToString() != filter.Status) return false;
@@ -1106,7 +1089,7 @@ namespace AutopilotMonitor.Functions.Services
                 // query can't return non-matching sessions.
                 if (!MatchesRebootCountBounds(s, filter)) return false;
                 if (!MatchesConnectionType(s, filter)) return false;
-                if (!MatchesFreeText(s, filter.Q)) return false;
+                if (!query.Matches(s)) return false;
                 return true;
             }).ToList();
         }

src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Metrics.cs

@@ -1091,7 +1091,7 @@ namespace AutopilotMonitor.Functions.Services
 
         /// <summary>
         /// Upserts a single presence row (PK=tenantId, RK=hash(UPN)) stamped with LastSeen=now.
-        /// One row per user — overwritten on every call, so the table never grows past the distinct-user count.
+        /// One row per user, so the table never grows past the distinct-user count.
         /// </summary>
         public async Task RecordUserPresenceAsync(string tenantId, string upn, string userRole)
         {
@@ -1105,7 +1105,11 @@ namespace AutopilotMonitor.Functions.Services
                     ["LastSeen"] = DateTime.UtcNow
                 };
 
-                await tableClient.UpsertEntityAsync(entity, TableUpdateMode.Replace);
+                // Merge preserves the What's-new seen marks carried on the same row
+                // (WhatsNewSeenPlatformUtc / WhatsNewSeenAgentUtc); a Replace upsert every
+                // ≥60s would wipe them. Upn/UserRole/LastSeen are always set here, so Merge
+                // is semantically identical for presence.
+                await tableClient.UpsertEntityAsync(entity, TableUpdateMode.Merge);
             }
             catch (Exception ex)
             {
@@ -1114,6 +1118,89 @@ namespace AutopilotMonitor.Functions.Services
             }
         }
 
+        public async Task<UserWhatsNewSeen> GetUserWhatsNewSeenAsync(string tenantId, string upn)
+        {
+            try
+            {
+                var tableClient = _tableServiceClient.GetTableClient(Constants.TableNames.UserPresence);
+                var entity = (await tableClient.GetEntityAsync<TableEntity>(
+                    tenantId,
+                    PresenceRowKey(upn),
+                    select: new[] { WhatsNewSeenPlatformColumn, WhatsNewSeenAgentColumn })).Value;
+
+                return new UserWhatsNewSeen(
+                    entity.GetDateTime(WhatsNewSeenPlatformColumn),
+                    entity.GetDateTime(WhatsNewSeenAgentColumn));
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                return new UserWhatsNewSeen();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to read What's-new seen marks for {Upn} in tenant {TenantId}", upn, tenantId);
+                return new UserWhatsNewSeen();
+            }
+        }
+
+        public async Task MarkUserWhatsNewSeenAsync(string tenantId, string upn, string channel, DateTime seenUtc)
+        {
+            var column = channel.ToLowerInvariant() switch
+            {
+                "platform" => WhatsNewSeenPlatformColumn,
+                "agent" => WhatsNewSeenAgentColumn,
+                _ => throw new ArgumentException("Unknown What's-new channel.", nameof(channel))
+            };
+
+            seenUtc = NormalizeTableUtc(seenUtc);
+
+            try
+            {
+                var tableClient = _tableServiceClient.GetTableClient(Constants.TableNames.UserPresence);
+                var rowKey = PresenceRowKey(upn);
+                DateTime? existing = null;
+
+                try
+                {
+                    var entity = (await tableClient.GetEntityAsync<TableEntity>(
+                        tenantId,
+                        rowKey,
+                        select: new[] { column })).Value;
+                    existing = entity.GetDateTime(column);
+                }
+                catch (RequestFailedException ex) when (ex.Status == 404)
+                {
+                    // Missing presence is fine: this endpoint may be the first thing that writes the row.
+                }
+
+                if (existing.HasValue && NormalizeTableUtc(existing.Value) >= seenUtc)
+                    return;
+
+                var patch = new TableEntity(tenantId, rowKey)
+                {
+                    ["Upn"] = upn ?? string.Empty,
+                    [column] = seenUtc
+                };
+
+                await tableClient.UpsertEntityAsync(patch, TableUpdateMode.Merge);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to mark What's-new {Channel} as seen for {Upn} in tenant {TenantId}", channel, upn, tenantId);
+            }
+        }
+
+        private const string WhatsNewSeenPlatformColumn = "WhatsNewSeenPlatformUtc";
+        private const string WhatsNewSeenAgentColumn = "WhatsNewSeenAgentUtc";
+
+        private static DateTime NormalizeTableUtc(DateTime value)
+            => value.Kind switch
+            {
+                DateTimeKind.Utc => value,
+                DateTimeKind.Local => value.ToUniversalTime(),
+                _ => DateTime.SpecifyKind(value, DateTimeKind.Utc)
+            };
+
         /// <summary>
         /// Returns all users whose LastSeen is within the given window (cross-tenant), newest first.
         /// Intentionally NOT wrapped in a swallow-and-return-empty try/catch: a storage failure must

src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Rules.cs

@@ -233,6 +233,7 @@ namespace AutopilotMonitor.Functions.Services
                     ["ActivePhasesJson"] = JsonConvert.SerializeObject(rule.ActivePhases ?? new List<string>()),
                     ["ActiveFromPhase"] = rule.ActiveFromPhase ?? string.Empty,
                     ["EmitMode"] = rule.EmitMode ?? string.Empty,
+                    ["EnrichErrorCodes"] = rule.EnrichErrorCodes,
                     ["OutputEventType"] = rule.OutputEventType ?? string.Empty,
                     ["OutputSeverity"] = rule.OutputSeverity ?? "Info",
                     ["TagsJson"] = JsonConvert.SerializeObject(rule.Tags ?? new string[0]),
@@ -343,6 +344,8 @@ namespace AutopilotMonitor.Functions.Services
                 ActivePhases = MapActivePhases(entity.GetString("ActivePhasesJson")),
                 ActiveFromPhase = string.IsNullOrEmpty(entity.GetString("ActiveFromPhase")) ? null : entity.GetString("ActiveFromPhase"),
                 EmitMode = string.IsNullOrEmpty(entity.GetString("EmitMode")) ? null : entity.GetString("EmitMode"),
+                // Absent column (pre-existing rows) → false: the opt-in never turns itself on.
+                EnrichErrorCodes = entity.GetBoolean("EnrichErrorCodes") ?? false,
                 OutputEventType = entity.GetString("OutputEventType") ?? string.Empty,
                 OutputSeverity = entity.GetString("OutputSeverity") ?? "Info",
                 Tags = DeserializeJsonArray(entity.GetString("TagsJson")),

src/Backend/AutopilotMonitor.Functions/Services/TelegramNotificationService.cs

@@ -281,7 +281,8 @@ namespace AutopilotMonitor.Functions.Services
         /// <summary>
         /// Flattens an alert into the plain-text form Telegram accepts. Telegram has no card
         /// format, so facts become "Name: Value" lines — that is also what carries an ops event's
-        /// structured payload into the message.
+        /// structured payload into the message. Sections (rule explanations, What's new entries)
+        /// follow as title + text blocks, and openUrl actions as trailing "Title: url" lines.
         /// </summary>
         internal static string RenderAlertText(NotificationAlert alert)
         {
@@ -300,6 +301,25 @@ namespace AutopilotMonitor.Functions.Services
             foreach (var fact in alert.Facts)
                 sb.AppendLine($"{fact.Name}: {fact.Value}");
 
+            foreach (var section in alert.Sections)
+            {
+                if (string.IsNullOrEmpty(section.Title) && string.IsNullOrEmpty(section.Text))
+                    continue;
+                sb.AppendLine();
+                if (!string.IsNullOrEmpty(section.Title))
+                    sb.AppendLine(section.Title);
+                if (!string.IsNullOrEmpty(section.Text))
+                    sb.AppendLine(section.Text);
+            }
+
+            var links = alert.Actions.Where(a => a.Type == "openUrl" && !string.IsNullOrEmpty(a.Url)).ToList();
+            if (links.Count > 0)
+            {
+                sb.AppendLine();
+                foreach (var action in links)
+                    sb.AppendLine($"{action.Title}: {action.Url}");
+            }
+
             return sb.ToString().TrimEnd();
         }
 

src/Backend/AutopilotMonitor.Functions/Services/WhatsNew/WhatsNewFeedClient.cs

@@ -0,0 +1,63 @@
+using System;
+using System.Net.Http;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models.WhatsNew;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Services.WhatsNew
+{
+    /// <summary>Reads the live What's new payload the portal serves.</summary>
+    public interface IWhatsNewFeedClient
+    {
+        /// <summary>The parsed payload, or null when it could not be fetched or is off-shape.</summary>
+        Task<WhatsNewFeed?> GetAsync(CancellationToken ct = default);
+    }
+
+    /// <summary>
+    /// Fetches <c>{PortalBaseUrl}/whats-new.json</c> — the static file the web deploy generates from
+    /// the docs changelogs. Reading the portal's own copy (rather than the docs repo) keeps the
+    /// notifier in lockstep with what the panel shows: an entry is announced when it becomes visible
+    /// to users, not when it is committed to the docs.
+    /// </summary>
+    public sealed class WhatsNewFeedClient : IWhatsNewFeedClient
+    {
+        public const string FeedUrl = Constants.PortalBaseUrl + "/whats-new.json";
+
+        private readonly HttpClient _httpClient;
+        private readonly ILogger<WhatsNewFeedClient> _logger;
+
+        public WhatsNewFeedClient(HttpClient httpClient, ILogger<WhatsNewFeedClient> logger)
+        {
+            _httpClient = httpClient;
+            _logger = logger;
+        }
+
+        public async Task<WhatsNewFeed?> GetAsync(CancellationToken ct = default)
+        {
+            try
+            {
+                using var request = new HttpRequestMessage(HttpMethod.Get, FeedUrl);
+                request.Headers.CacheControl = new System.Net.Http.Headers.CacheControlHeaderValue { NoCache = true };
+                using var response = await _httpClient.SendAsync(request, ct);
+                if (!response.IsSuccessStatusCode)
+                {
+                    _logger.LogWarning("What's new feed returned HTTP {Status}", (int)response.StatusCode);
+                    return null;
+                }
+
+                var json = await response.Content.ReadAsStringAsync(ct);
+                var feed = WhatsNewFeed.Parse(json);
+                if (feed == null)
+                    _logger.LogWarning("What's new feed at {Url} has an unexpected shape — skipping", FeedUrl);
+                return feed;
+            }
+            catch (Exception ex) when (ex is HttpRequestException || ex is TaskCanceledException)
+            {
+                _logger.LogWarning(ex, "Failed to fetch What's new feed from {Url}", FeedUrl);
+                return null;
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Services/WhatsNew/WhatsNewNotificationService.cs

@@ -0,0 +1,193 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services.Notifications;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models.Notifications;
+using AutopilotMonitor.Shared.Models.WhatsNew;
+using Microsoft.ApplicationInsights;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Services.WhatsNew
+{
+    /// <summary>
+    /// Announces newly published What's new entries to every tenant channel that opted in
+    /// (<see cref="NotificationChannel.NotifyOnWhatsNew"/>).
+    /// <para>
+    /// "New" means: present in the live <c>/whats-new.json</c> but absent from the platform-wide
+    /// watermark (<see cref="WhatsNewNotificationState.KnownEntryKeys"/>) — i.e. the entry became
+    /// visible in the portal since the last run. Diffing on ids rather than dates matters because
+    /// the payload is regenerated only on web deploys: a bullet's docs commit date can be days
+    /// older than the moment it actually appears. All new entries of a run go out as ONE digest
+    /// per channel, so a release that adds five bullets is one message, not five.
+    /// </para>
+    /// <para>
+    /// Ordering is claim-then-send: the watermark is advanced with an ETag compare-and-swap
+    /// BEFORE any channel is contacted. A lost race means another run owns this batch and this
+    /// one exits without sending; a crash after the claim loses the batch rather than
+    /// double-announcing it (at-most-once, like every other channel notification here).
+    /// The very first run — no state row, or an empty known set — only baselines and never
+    /// announces: a fresh deployment must not blast the entire changelog at every tenant.
+    /// </para>
+    /// </summary>
+    public class WhatsNewNotificationService
+    {
+        /// <summary>Portal deep link that opens the panel on load (WhatsNewPanelHost reads <c>?whats-new=</c>).</summary>
+        internal static string PortalWhatsNewUrl(string channel)
+            => $"{Constants.PortalBaseUrl}/dashboard?whats-new={Uri.EscapeDataString(channel)}";
+
+        private readonly IWhatsNewFeedClient _feedClient;
+        private readonly IWhatsNewNotificationStateRepository _stateRepo;
+        private readonly IConfigRepository _configRepo;
+        private readonly NotificationChannelDispatcher _channelDispatcher;
+        private readonly TelemetryClient _telemetryClient;
+        private readonly ILogger<WhatsNewNotificationService> _logger;
+        private readonly Func<DateTime> _nowProvider;
+
+        public WhatsNewNotificationService(
+            IWhatsNewFeedClient feedClient,
+            IWhatsNewNotificationStateRepository stateRepo,
+            IConfigRepository configRepo,
+            NotificationChannelDispatcher channelDispatcher,
+            TelemetryClient telemetryClient,
+            ILogger<WhatsNewNotificationService> logger,
+            Func<DateTime>? nowProvider = null)
+        {
+            _feedClient = feedClient;
+            _stateRepo = stateRepo;
+            _configRepo = configRepo;
+            _channelDispatcher = channelDispatcher;
+            _telemetryClient = telemetryClient;
+            _logger = logger;
+            _nowProvider = nowProvider ?? (() => DateTime.UtcNow);
+        }
+
+        public sealed class RunResult
+        {
+            public bool FeedUnavailable { get; init; }
+            public bool Baselined { get; init; }
+            public bool LostRace { get; init; }
+            public int NewEntries { get; init; }
+            public int TenantsNotified { get; init; }
+            public int ChannelsNotified { get; init; }
+        }
+
+        /// <summary>Timer entry point. Never throws for expected conditions (feed down, nothing new, lost race).</summary>
+        public async Task<RunResult> RunAsync(CancellationToken ct = default)
+        {
+            var sw = Stopwatch.StartNew();
+
+            var feed = await _feedClient.GetAsync(ct);
+            if (feed == null)
+            {
+                _logger.LogWarning("What's new notifier: feed unavailable — skipping run");
+                return new RunResult { FeedUnavailable = true };
+            }
+
+            var (state, etag) = await _stateRepo.GetWithETagAsync();
+            var now = _nowProvider();
+            var currentKeys = new HashSet<string>(feed.Entries.Select(e => e.Key), StringComparer.Ordinal);
+
+            var next = new WhatsNewNotificationState
+            {
+                KnownEntryKeys = currentKeys,
+                LastDocsCommit = feed.DocsCommit,
+                LastRunUtc = now,
+                LastNotifiedUtc = state?.LastNotifiedUtc,
+                LastNotifiedEntryCount = state?.LastNotifiedEntryCount ?? 0,
+            };
+
+            // First run (or a wiped/malformed watermark): record what is live, announce nothing.
+            if (state == null || state.KnownEntryKeys.Count == 0)
+            {
+                var stored = await _stateRepo.TryUpsertAsync(next, etag);
+                _logger.LogInformation("What's new notifier: baselined {Count} entries (docs @ {Commit}), stored={Stored}",
+                    currentKeys.Count, feed.DocsCommit ?? "unknown", stored);
+                return new RunResult { Baselined = true };
+            }
+
+            var newEntries = feed.Entries.Where(e => !state.KnownEntryKeys.Contains(e.Key)).ToList();
+            if (newEntries.Count == 0)
+            {
+                // Only touch storage when the payload actually changed (entries rolled out of the window).
+                if (!currentKeys.SetEquals(state.KnownEntryKeys))
+                    await _stateRepo.TryUpsertAsync(next, etag);
+                _logger.LogDebug("What's new notifier: nothing new ({Count} entries live)", currentKeys.Count);
+                return new RunResult();
+            }
+
+            next.LastNotifiedUtc = now;
+            next.LastNotifiedEntryCount = newEntries.Count;
+
+            if (!await _stateRepo.TryUpsertAsync(next, etag))
+            {
+                _logger.LogInformation("What's new notifier: watermark changed underneath this run — another run owns the batch");
+                return new RunResult { LostRace = true, NewEntries = newEntries.Count };
+            }
+
+            var (tenantsNotified, channelsNotified) = await DispatchAsync(feed, newEntries, ct);
+
+            _logger.LogInformation(
+                "What's new notifier: announced {New} new entries to {Channels} channels across {Tenants} tenants in {ElapsedMs}ms",
+                newEntries.Count, channelsNotified, tenantsNotified, sw.ElapsedMilliseconds);
+
+            _telemetryClient.TrackEvent("WhatsNewNotificationSent", new Dictionary<string, string>
+            {
+                { "NewEntries", newEntries.Count.ToString() },
+                { "PlatformEntries", newEntries.Count(e => e.Channel == WhatsNewFeed.PlatformChannel).ToString() },
+                { "AgentEntries", newEntries.Count(e => e.Channel == WhatsNewFeed.AgentChannel).ToString() },
+                { "Tenants", tenantsNotified.ToString() },
+                { "Channels", channelsNotified.ToString() },
+                { "DocsCommit", feed.DocsCommit ?? "unknown" },
+            });
+
+            return new RunResult
+            {
+                NewEntries = newEntries.Count,
+                TenantsNotified = tenantsNotified,
+                ChannelsNotified = channelsNotified,
+            };
+        }
+
+        private async Task<(int Tenants, int Channels)> DispatchAsync(
+            WhatsNewFeed feed, List<WhatsNewFeedEntry> newEntries, CancellationToken ct)
+        {
+            var platformCount = newEntries.Count(e => e.Channel == WhatsNewFeed.PlatformChannel);
+            var primaryChannel = newEntries.Count - platformCount > platformCount
+                ? WhatsNewFeed.AgentChannel
+                : WhatsNewFeed.PlatformChannel;
+            var alert = NotificationAlertBuilder.BuildWhatsNewAlert(newEntries, feed.DocsUrls, PortalWhatsNewUrl(primaryChannel));
+
+            var configs = await _configRepo.GetAllTenantConfigurationsAsync();
+            int tenants = 0, channels = 0;
+
+            foreach (var config in configs)
+            {
+                if (ct.IsCancellationRequested) break;
+                if (config.IsCurrentlyDisabled()) continue;
+
+                var targets = config.GetNotificationChannels()
+                    .Where(c => c.Enabled && c.NotifyOnWhatsNew && !string.IsNullOrEmpty(c.Url))
+                    .ToList();
+                if (targets.Count == 0) continue;
+
+                try
+                {
+                    await _channelDispatcher.SendToChannelsAsync(targets, alert);
+                    tenants++;
+                    channels += targets.Count;
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "What's new notifier: dispatch failed for tenant {TenantId}", config.TenantId);
+                }
+            }
+
+            return (tenants, channels);
+        }
+    }
+}

src/McpServer/autopilot-monitor-mcp/src/__tests__/mcp-http.test.ts

@@ -83,7 +83,14 @@ describe('2026-07-28 (modern) client', () => {
     try {
       expect(client.getInstructions()).toContain('as a Global Admin you additionally have tenant-configuration write tools');
       expect(client.getInstructions()).toContain('omit tenantId for cross-tenant queries');
-      expect(client.getServerVersion()).toEqual({ name: 'Autopilot-Monitor', version: '0.0.0-test' });
+      // Hosts (VS Code) render description/websiteUrl in their server list —
+      // without them the server shows up as "No description provided".
+      expect(client.getServerVersion()).toEqual({
+        name: 'Autopilot-Monitor',
+        version: '0.0.0-test',
+        description: expect.stringContaining('troubleshooting for Windows Autopilot enrollments'),
+        websiteUrl: 'https://www.autopilotmonitor.com',
+      });
     } finally {
       await client.close();
     }

src/McpServer/autopilot-monitor-mcp/src/__tests__/tools-lookup-error-code.test.ts

@@ -145,4 +145,24 @@ describe('keyEventErrorCode (get_session_summary)', () => {
   it('surfaces an unknown code without text', () => {
     expect(keyEventErrorCode({ errorCode: '0xDEADBEEF' })).toEqual({ errorCode: '0xDEADBEEF' });
   });
+
+  it('never explains gather-rule codes by default — they live in the vendor\'s own numbering (HPiA, DCU, …)', () => {
+    // exitCode 1603 is a well-known MSI code, but from a gather rule it means whatever the parsed
+    // log says; neither the local catalog nor a stale backend sibling may attach text.
+    expect(keyEventErrorCode({ exitCode: '1603' }, 'GatherRuleExecutor')).toEqual({ errorCode: '1603' });
+    expect(keyEventErrorCode({
+      exitCode: '1603',
+      exitCodeInfo: { description: 'A fatal error occurred during installation', symbol: 'ERROR_INSTALL_FAILURE' },
+    }, 'gatherruleexecutor')).toEqual({ errorCode: '1603' });
+    expect(keyEventErrorCode({ exitCode: '1603', enrichErrorCodes: false }, 'GatherRuleExecutor')).toEqual({ errorCode: '1603' });
+    expect(keyEventErrorCode({ exitCode: '1603' }, 'ImeLogMonitor').errorText).toMatch(/^ERROR_INSTALL_FAILURE — /);
+  });
+
+  it('explains gather-rule codes when the rule opted in (agent-stamped enrichErrorCodes marker)', () => {
+    expect(keyEventErrorCode({ exitCode: '1603', enrichErrorCodes: true }, 'GatherRuleExecutor').errorText)
+      .toMatch(/^ERROR_INSTALL_FAILURE — /);
+    // Marker as a string after a DataJson roundtrip.
+    expect(keyEventErrorCode({ exitCode: '1603', enrichErrorCodes: 'true' }, 'GatherRuleExecutor').errorText)
+      .toMatch(/^ERROR_INSTALL_FAILURE — /);
+  });
 });

src/McpServer/autopilot-monitor-mcp/src/config.ts

@@ -31,6 +31,9 @@ export const API_BASE_URL = resolveApiBaseUrl();
 /** Entra ID login/token authority host (no trailing slash). */
 export const ENTRA_LOGIN_BASE_URL = 'https://login.microsoftonline.com';
 
+/** The product homepage — advertised as serverInfo.websiteUrl. */
+export const WEBSITE_BASE_URL = 'https://www.autopilotmonitor.com';
+
 /** Published customer documentation — base for citable search_docs links. */
 export const DOCS_BASE_URL = 'https://docs.autopilotmonitor.com';
 

src/McpServer/autopilot-monitor-mcp/src/deployment-state.ts

@@ -7,7 +7,8 @@
  *   mcp      live  in-process build info (this process IS the live deployment)
  *   mcp      manifest versions/mcp.json              → … + docsCommit
  *   web      live  GET {PORTAL}/version.json         → { component, commit, buildUtc }
- *   web      manifest versions/web.json              → { component, commit, deployedUtc, runId }
+ *   web      manifest versions/web.json              → { component, commit, deployedUtc, runId, docsCommit }
+ *            (docsCommit = the docs revision the live What's new panel was generated from)
  *   agent    manifest {AGENT}/version.json           → { version, commit, buildUtc, sha256, bootstrapVersion }
  *            (no live endpoint — the agent runs on devices)
  *

src/McpServer/autopilot-monitor-mcp/src/diag-zip-map.ts

@@ -114,5 +114,6 @@ export const DIAG_ZIP_MAP = {
     'Pre-provisioned (White Glove) blobs carry a -preprov suffix — that is normal.',
     'No archive ≠ a problem: upload mode may be Off or OnFailure (so successful sessions have none).',
     'Log naming is kebab-case since 2026-08-18: agent.log, bootstrap-script.log (was bootstrap_agent.log), bootstrap-msi.log (was msi-bootstrap.log), crash-*.log (was crash_*.log), gather-rules-debug.log, ime-pattern-matches.log. Archives from older agents/bootstraps carry the old names.',
+    'bootstrap-loader.log (since 2026-09-08) is the two-stage loader: it downloaded the installer, verified its publisher and started it. Its presence means the device was assigned the loader rather than the installer directly; the MDM-LOB MSI runs the same loader but logs to bootstrap-msi.log. bootstrap-script.log is the installer itself either way.',
   ],
 } as const;

src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts

@@ -758,6 +758,10 @@ export interface AuthMeResponse {
   homedApp: string;
   bootstrapTokenEnabled: boolean;
   unrestrictedModeEnabled: boolean;
+  /** When this user last viewed the Platform tab of What's new; null = never and the key is omitted (client treats as first visit). */
+  whatsNewSeenPlatformUtc?: string;
+  /** Same for the Agent tab; null = never and the key is omitted. */
+  whatsNewSeenAgentUtc?: string;
 }
 
 export interface AutoResolveCpeMappingItem {
@@ -1206,6 +1210,7 @@ export interface CveExposureSummary {
   distinctCves: number;
   kevCves: number;
   severityBreakdown: SeverityBreakdown;
+  priorityBreakdown: PriorityBreakdown;
   topCves: TopCve[];
   truncated: boolean;
 }
@@ -1739,8 +1744,11 @@ export interface FleetDailyPoint {
   failed: number;
 }
 
+/** Same bucket shape as FleetModelHealth. */
 export interface FleetFailingModel {
+  manufacturer: string;
   model: string;
+  label: string;
   failed: number;
   /** All sessions on this model in the window, including in-flight ones. */
   total: number;
@@ -1788,8 +1796,11 @@ export interface FleetHealthStats {
   p90DurationMinutes: number;
 }
 
+/** One device-model bucket. Sessions are grouped by (Manufacturer, Model) as stored on the session; the two fields travel separately so a client can address them as the two session fields they are (the dashboard search's manufacturer=… model=…), and Label is the display key — "{Manufacturer} {Model}" trimmed, or "Unknown" when both are blank. */
 export interface FleetModelHealth {
+  manufacturer: string;
   model: string;
+  label: string;
   /** All sessions on this model in the window, including in-flight ones. */
   total: number;
   succeeded: number;
@@ -1797,8 +1808,11 @@ export interface FleetModelHealth {
   failed: number;
 }
 
+/** Same bucket shape as FleetModelHealth. */
 export interface FleetSlowModel {
+  manufacturer: string;
   model: string;
+  label: string;
   avgMinutes: number;
   count: number;
 }
@@ -1845,6 +1859,8 @@ export interface GatherRule {
   activeFromPhase?: string | null;
   /** Emit behavior for collected results: null / "always" = emit on every collection (legacy behavior); "on_change" = poll on the trigger cadence but emit only when the collected result differs from the last emitted one. The first in-scope result always emits; the suppressed poll count is carried on the next emitted event (suppressedPolls / suppressedSinceUtc in the event data). */
   emitMode?: string | null;
+  /** Opt-in: let the backend explain error-code fields in this rule's output (exitCode, errorCode, hresult, …) with the Windows/MSI/Intune catalog, i.e. attach the *Info siblings the built-in events get. Default false — gather-rule payload keys are author-chosen and the codes usually come from third-party logs or commands (HP Image Assistant, Dell Command Update, custom scripts) with their own exit-code numbering, where the catalog meaning would be confidently wrong. Set to true only when the parsed source really uses Windows codes (e.g. an msiexec or IME log). The agent stamps enrichErrorCodes: true into the event data so the read-time enricher can honour it without knowing the rule. */
+  enrichErrorCodes: boolean;
   /** EventType for the emitted event (e.g., "gather_proxy_settings") */
   outputEventType: string;
   /** Severity for the emitted event Default: "Info" */
@@ -2326,6 +2342,7 @@ export interface HardwareRejectedResponse {
 export interface HealthCheck {
   name: string;
   description: string;
+  /** One of: "healthy" (working), "warning" (degraded but reachable), "unhealthy" (failing), "unknown" (not determined), "warming" (health/mcp only — the scale-to-zero MCP container did not answer inside the probe budget and is still starting; the caller should re-check, and it must NOT be rated as a fault in any aggregate or overall banner). */
   status: string;
   message: string;
   details?: Record<string, unknown>;
@@ -3078,6 +3095,13 @@ export interface PreviewWhitelistTenantEntry {
   tenantId: string;
 }
 
+/** Distinct-CVE counts grouped by their highest remediation priority (act/attend/track). Rows written before priorities existed carry no band and are counted in none - the three add up to at most DistinctCves. act equals the KEV set by construction (CvePriority.Compute: KEV ⇒ act). */
+export interface PriorityBreakdown {
+  act: number;
+  attend: number;
+  track: number;
+}
+
 /** Response of GET /api/progress/sessions/{sessionId}/events — the session's event stream after the serial knowledge proof passed. */
 export interface ProgressGetSessionEventsResponse {
   success: boolean;
@@ -4581,7 +4605,7 @@ export interface TenantConfiguration {
   rebootDelaySeconds?: number | null;
   /** Whether to enable geo-location detection (queries external IP service). null = use agent default (true). */
   enableGeoLocation?: boolean | null;
-  /** NTP server address for time check during enrollment. null = use agent default ("time.windows.com"). */
+  /** NTP server address for time check during enrollment. The initializer is the same value the table read maps a blank cell to and the agent falls back to, so a fresh configuration, a stored one and the manifest default agree (D-216). */
   ntpServer: string;
   /** Whether to automatically set the device timezone based on IP geolocation. Requires EnableGeoLocation to be true. Uses tzutil /s to apply. null = use agent default (false). */
   enableTimezoneAutoSet?: boolean | null;
@@ -5230,3 +5254,11 @@ export interface VerdictCalibrationTrendWindow {
   sessions: number;
   sharePct: number;
 }
+
+/** Body of PUT auth/me/whats-new-seen. */
+export interface WhatsNewSeenRequest {
+  /** What's-new channel: "platform" or "agent". */
+  channel: string;
+  /** UTC timestamp when the caller viewed the channel. */
+  seenUtc: string;
+}

src/McpServer/autopilot-monitor-mcp/src/mcp-server-factory.ts

@@ -11,6 +11,20 @@ import { registerResources } from './resources.js';
 import { registerPrompts } from './prompts.js';
 import type { DocsSearchBundle, SearchProvider } from './search-provider.js';
 import { hasGlobalScope, isGlobalAdmin, isDelegated, getDelegatedTenantIds, getHomeTenantId } from './client.js';
+import { WEBSITE_BASE_URL } from './config.js';
+
+/**
+ * serverInfo metadata (MCP `Implementation`). Hosts such as VS Code render `description`
+ * as a one-liner under the server name — omit it and they show "No description provided".
+ * Convention (spec + servers like Context7): one plain sentence on WHAT the server exposes,
+ * `websiteUrl` = product homepage. Role/safety guidance belongs in `instructions`, not here.
+ */
+export const SERVER_INFO = {
+  name: 'Autopilot-Monitor',
+  description:
+    'Autopilot Monitor provides troubleshooting for Windows Autopilot enrollments, including session timelines, analyze rules, error codes, and fleet analytics.',
+  websiteUrl: WEBSITE_BASE_URL,
+} as const;
 
 export interface ServerDeps {
   /** Advertised in serverInfo (initialize / discover / every 2026 result `_meta`) and on /health. */
@@ -88,7 +102,7 @@ const RESOURCE_CACHE_TTL_MS = 60 * 60 * 1000;
  */
 export function createMcpServer(deps: ServerDeps, ga: boolean, strictGa: boolean, delegated: boolean, managedTenants: string[], homeTenantId?: string): McpServer {
   const s = new McpServer(
-    { name: 'Autopilot-Monitor', version: deps.serverVersion },
+    { ...SERVER_INFO, version: deps.serverVersion },
     {
       // Delivered in `initialize` (2025 clients) and `server/discover` (2026-07-28 clients).
       instructions: buildInstructions(deps, ga, strictGa, delegated, managedTenants, homeTenantId),

src/McpServer/autopilot-monitor-mcp/src/rule-authoring-guide.ts

@@ -107,6 +107,13 @@ export const RULE_AUTHORING_GUIDE = {
       'Optional activePhases (array) or activeFromPhase restrict when the rule may run at all; ' +
       'emitMode "on_change" emits only when the collected payload differs from the previous run ' +
       '(default "always").',
+    errorCodes:
+      'Gather-rule output is NOT run through the Windows/MSI/Intune error-code catalog by default: ' +
+      'a captured exitCode/errorCode/hresult from a third-party log (HP Image Assistant, Dell ' +
+      'Command Update, custom scripts) uses the vendor\'s own numbering, and a catalog meaning would ' +
+      'be confidently wrong. Set enrichErrorCodes: true only when the parsed source really uses ' +
+      'Windows codes (e.g. an msiexec or IME log); the backend then attaches the *Info siblings ' +
+      '(exitCodeInfo, errorCodeInfo, ...) exactly like on built-in events.',
     output:
       'outputEventType names the emitted event; use the gather_ prefix convention (e.g. ' +
       '"gather_pending_reboot") so analyze rules and humans can tell collected events from ' +

src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts

@@ -178,6 +178,11 @@ export const GATHER_RULE_SCHEMA: Record<string, unknown> = {
             "on_change"
           ]
         },
+        "enrichErrorCodes": {
+          "type": "boolean",
+          "description": "Opt-in: let the backend explain error-code fields in this rule's output (exitCode, errorCode, hresult, ...) with the Windows/MSI/Intune error-code catalog, attaching the same *Info siblings built-in events get. Default false because gather-rule codes usually come from third-party logs or commands (HP Image Assistant, Dell Command Update, custom scripts) with their own exit-code numbering, where the catalog meaning would be wrong. Enable only when the parsed source really uses Windows codes (e.g. an msiexec or IME log).",
+          "default": false
+        },
         "outputEventType": {
           "type": "string",
           "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."

src/McpServer/autopilot-monitor-mcp/src/tools/admin.ts

@@ -1823,7 +1823,8 @@ export function registerAdminTools(server: McpServer, ga: boolean, strictGa: boo
       title: 'Vulnerability Summary',
       description:
         'Get a fleet-wide vulnerability exposure summary aggregated from detected CVEs: total affected devices, ' +
-        'distinct CVE count, KEV (CISA Known-Exploited) count, a severity breakdown, and the top CVEs ranked by how ' +
+        'distinct CVE count, KEV (CISA Known-Exploited) count, a severity breakdown, a priority breakdown ' +
+        '(act/attend/track counts over every CVE in the window), and the top CVEs ranked by how ' +
         'many devices they affect. Each top CVE carries cvssScore/cvssSeverity, isKev, epssScore (FIRST EPSS ' +
         'probability of exploitation within 30 days, 0-1, null when unscored) and priority ("act" = in CISA KEV, ' +
         '"attend" = EPSS >= 0.1 or CVSS >= 9.0, "track" = everything else) — rank remediation by priority, then EPSS, ' +

src/McpServer/autopilot-monitor-mcp/src/tools/sessions.ts

@@ -634,7 +634,7 @@ export function registerSessionTools(server: McpServer, ga: boolean, delegated:
           phase: phaseName(e.phase, s.enrollmentType),
           message: e.message,
           source: e.source,
-          ...keyEventErrorCode(e.data),
+          ...keyEventErrorCode(e.data, e.source),
         }));
 
         let analysis = null;
@@ -906,18 +906,40 @@ const ERROR_CODE_KEYS: ReadonlyArray<[code: string, info: string]> = [
   ['hresultFromWin32', 'hresultFromWin32Info'],
 ];
 
+/**
+ * `source` the agent stamps on gather-rule output. Those payload keys are author-chosen and the
+ * codes come from third-party logs/commands (HP Image Assistant, Dell Command Update, custom
+ * scripts) with their own numbering, so neither the backend enricher nor the local catalog
+ * fallback may explain them unless the rule opted in via `enrichErrorCodes` (the agent then
+ * stamps `enrichErrorCodes: true` into the data). The raw code always travels.
+ */
+const GATHER_RULE_SOURCE = 'GatherRuleExecutor';
+const ENRICH_OPT_IN_KEY = 'enrichErrorCodes';
+
+function isOptedOutGatherEvent(data: Record<string, unknown>, source: string | null | undefined): boolean {
+  if (typeof source !== 'string' || source.toLowerCase() !== GATHER_RULE_SOURCE.toLowerCase()) return false;
+  const marker = data[ENRICH_OPT_IN_KEY];
+  return !(marker === true || (typeof marker === 'string' && marker.toLowerCase() === 'true'));
+}
+
 /**
  * `errorCode` + `errorText` for a key event, only when the payload carries a code. The text
  * comes from the backend-enriched `*Info` sibling (symbol + catalog meaning); an older
  * response without the sibling falls back to the server's own catalog. A code the catalog
- * does not know is still surfaced as errorCode, without errorText.
+ * does not know is still surfaced as errorCode, without errorText. Gather-rule events
+ * (`source === GatherRuleExecutor`) get catalog text only when their rule opted in.
  */
-export function keyEventErrorCode(data: Record<string, unknown> | undefined): { errorCode?: string; errorText?: string } {
+export function keyEventErrorCode(
+  data: Record<string, unknown> | undefined,
+  source?: string | null,
+): { errorCode?: string; errorText?: string } {
   if (!data) return {};
+  const suppressCatalogText = isOptedOutGatherEvent(data, source);
   for (const [codeKey, infoKey] of ERROR_CODE_KEYS) {
     const raw = data[codeKey];
     if (raw === undefined || raw === null || raw === '' || raw === 0 || raw === '0') continue;
     const errorCode = String(raw);
+    if (suppressCatalogText) return { errorCode };
     const info = data[infoKey] as { description?: unknown; symbol?: unknown } | undefined;
     let symbol: string | undefined;
     let description: string | undefined;

src/Shared/AutopilotMonitor.Shared/Constants.cs

@@ -823,6 +823,27 @@ namespace AutopilotMonitor.Shared
             public const string Registry = "Registry";
             public const string WMI      = "WMI";
             public const string Network  = "Network";
+
+            /// <summary>
+            /// Stamped on every event the agent's gather-rule pipeline emits (executor, guard
+            /// events, collectors). Backend and MCP key off it to treat the payload as
+            /// author-defined (no error-code enrichment unless <see cref="GatherRuleDataKeys.EnrichErrorCodes"/>).
+            /// </summary>
+            public const string GatherRuleExecutor = "GatherRuleExecutor";
+        }
+
+        /// <summary>
+        /// Well-known keys the agent injects into gather-rule event data next to the
+        /// collector's own fields.
+        /// </summary>
+        public static class GatherRuleDataKeys
+        {
+            /// <summary>
+            /// <c>true</c> when the rule opted into <see cref="Models.GatherRule.EnrichErrorCodes"/>;
+            /// absent otherwise. Lets the read-time error-code enricher honour the rule setting
+            /// without knowing the rule.
+            /// </summary>
+            public const string EnrichErrorCodes = "enrichErrorCodes";
         }
 
         // -----------------------------------------------------------------------

src/Shared/AutopilotMonitor.Shared/DataAccess/IMetricsRepository.cs

@@ -86,6 +86,10 @@ namespace AutopilotMonitor.Shared.DataAccess
         // --- Live Presence (one row per user, upserted) ---
         /// <summary>Upserts the caller's presence row (PK=tenantId, RK=SHA-256(lowercase UPN) hex) with LastSeen=now.</summary>
         Task RecordUserPresenceAsync(string tenantId, string upn, string userRole);
+        /// <summary>Gets the caller's per-channel What's-new seen marks from the presence row; nulls mean never or unavailable.</summary>
+        Task<UserWhatsNewSeen> GetUserWhatsNewSeenAsync(string tenantId, string upn);
+        /// <summary>Monotonically merge-upserts the caller's What's-new seen mark for one channel without touching presence fields.</summary>
+        Task MarkUserWhatsNewSeenAsync(string tenantId, string upn, string channel, DateTime seenUtc);
         /// <summary>Returns all users whose LastSeen falls within the given window, newest first (cross-tenant).</summary>
         Task<List<UserPresenceEntry>> GetActivePresenceAsync(TimeSpan window);
         /// <summary>Retention cleanup: deletes presence rows whose LastSeen is older than the cutoff (drops one-off testers). Returns the number deleted.</summary>

src/Shared/AutopilotMonitor.Shared/DataAccess/IWhatsNewNotificationStateRepository.cs

@@ -0,0 +1,24 @@
+using System.Threading.Tasks;
+using AutopilotMonitor.Shared.Models.WhatsNew;
+
+namespace AutopilotMonitor.Shared.DataAccess
+{
+    /// <summary>
+    /// Persistence for the single <see cref="WhatsNewNotificationState"/> row. Same
+    /// ETag-based compare-and-swap contract as <see cref="ISlaTenantStatusRepository"/>: the
+    /// caller reads state + ETag, decides what is new, and commits the advanced watermark with
+    /// the ETag it observed; a false return means another writer won and this run must not send.
+    /// </summary>
+    public interface IWhatsNewNotificationStateRepository
+    {
+        /// <summary>Returns (null, null) when the row does not exist yet (first run).</summary>
+        Task<(WhatsNewNotificationState? State, string? ETag)> GetWithETagAsync();
+
+        /// <summary>
+        /// Conditional write: insert when <paramref name="ifMatchETag"/> is null (caller observed
+        /// no row), otherwise replace if the ETag still matches. Returns false on conflict
+        /// (row appeared / changed since the read) and on storage failure — never throws.
+        /// </summary>
+        Task<bool> TryUpsertAsync(WhatsNewNotificationState state, string? ifMatchETag);
+    }
+}

src/Shared/AutopilotMonitor.Shared/Models/Config/TenantConfiguration.cs

@@ -449,10 +449,11 @@ namespace AutopilotMonitor.Shared.Models
         public bool? EnableGeoLocation { get; set; }
 
         /// <summary>
-        /// NTP server address for time check during enrollment.
-        /// null = use agent default ("time.windows.com").
+        /// NTP server address for time check during enrollment. The initializer is the same
+        /// value the table read maps a blank cell to and the agent falls back to, so a fresh
+        /// configuration, a stored one and the manifest default agree (D-216).
         /// </summary>
-        public string NtpServer { get; set; } = default!;
+        public string NtpServer { get; set; } = "time.windows.com";
 
         /// <summary>
         /// Whether to automatically set the device timezone based on IP geolocation.

src/Shared/AutopilotMonitor.Shared/Models/ErrorCodeEntry.cs

@@ -20,7 +20,7 @@ namespace AutopilotMonitor.Shared.Models
 
     /// <summary>
     /// One Windows / MSI / Intune error-code catalog entry. Mirrors the structure of
-    /// <c>Resources/error-codes.json</c> (generated by <c>scripts/error-codes/generate.mjs</c>)
+    /// <c>Resources/error-codes.json</c> (generated by <c>tools/error-codes/generate.mjs</c>)
     /// and the TypeScript <c>ErrorCodeEntry</c> in the web app.
     /// </summary>
     public sealed class ErrorCodeEntry

src/Shared/AutopilotMonitor.Shared/Models/FleetHealthModels.cs

@@ -65,9 +65,18 @@ namespace AutopilotMonitor.Shared.Models
         public int Count { get; set; }
     }
 
+    /// <summary>
+    /// One device-model bucket. Sessions are grouped by (Manufacturer, Model) as stored on the
+    /// session; the two fields travel separately so a client can address them as the two
+    /// session fields they are (the dashboard search's <c>manufacturer=… model=…</c>), and
+    /// <see cref="Label"/> is the display key — "{Manufacturer} {Model}" trimmed, or "Unknown"
+    /// when both are blank.
+    /// </summary>
     public sealed class FleetModelHealth
     {
-        public string Model { get; set; } = default!;
+        public string Manufacturer { get; set; } = string.Empty;
+        public string Model { get; set; } = string.Empty;
+        public string Label { get; set; } = default!;
         /// <summary>All sessions on this model in the window, including in-flight ones.</summary>
         public int Total { get; set; }
         public int Succeeded { get; set; }
@@ -75,16 +84,22 @@ namespace AutopilotMonitor.Shared.Models
         public int Failed { get; set; }
     }
 
+    /// <summary>Same bucket shape as <see cref="FleetModelHealth"/>.</summary>
     public sealed class FleetSlowModel
     {
-        public string Model { get; set; } = default!;
+        public string Manufacturer { get; set; } = string.Empty;
+        public string Model { get; set; } = string.Empty;
+        public string Label { get; set; } = default!;
         public int AvgMinutes { get; set; }
         public int Count { get; set; }
     }
 
+    /// <summary>Same bucket shape as <see cref="FleetModelHealth"/>.</summary>
     public sealed class FleetFailingModel
     {
-        public string Model { get; set; } = default!;
+        public string Manufacturer { get; set; } = string.Empty;
+        public string Model { get; set; } = string.Empty;
+        public string Label { get; set; } = default!;
         public int Failed { get; set; }
         /// <summary>All sessions on this model in the window, including in-flight ones.</summary>
         public int Total { get; set; }

src/Shared/AutopilotMonitor.Shared/Models/InfrastructureApiModels.cs

@@ -37,6 +37,20 @@ namespace AutopilotMonitor.Shared.Models
 
         public bool BootstrapTokenEnabled { get; set; }
         public bool UnrestrictedModeEnabled { get; set; }
+
+        /// <summary>When this user last viewed the Platform tab of What's new; null = never and the key is omitted (client treats as first visit).</summary>
+        public DateTime? WhatsNewSeenPlatformUtc { get; set; }
+        /// <summary>Same for the Agent tab; null = never and the key is omitted.</summary>
+        public DateTime? WhatsNewSeenAgentUtc { get; set; }
+    }
+
+    /// <summary>Body of PUT auth/me/whats-new-seen.</summary>
+    public class WhatsNewSeenRequest : IApiRequest
+    {
+        /// <summary>What's-new channel: "platform" or "agent".</summary>
+        public string Channel { get; set; } = default!;
+        /// <summary>UTC timestamp when the caller viewed the channel.</summary>
+        public DateTime SeenUtc { get; set; }
     }
 
     /// <summary>
@@ -137,6 +151,13 @@ namespace AutopilotMonitor.Shared.Models
     {
         public string Name { get; set; } = string.Empty;
         public string Description { get; set; } = string.Empty;
+        /// <summary>
+        /// One of: "healthy" (working), "warning" (degraded but reachable), "unhealthy"
+        /// (failing), "unknown" (not determined), "warming" (health/mcp only — the
+        /// scale-to-zero MCP container did not answer inside the probe budget and is still
+        /// starting; the caller should re-check, and it must NOT be rated as a fault in any
+        /// aggregate or overall banner).
+        /// </summary>
         public string Status { get; set; } = "unknown";
         public string Message { get; set; } = string.Empty;
         public Dictionary<string, object>? Details { get; set; }

src/Shared/AutopilotMonitor.Shared/Models/Notifications/NotificationChannel.cs

@@ -10,8 +10,8 @@ namespace AutopilotMonitor.Shared.Models.Notifications
     /// per tenant. Stored as a JSON array in <c>TenantConfiguration.NotificationChannelsJson</c>
     /// (camelCase contract shared with the web UI).
     /// <para>
-    /// Routing granularity: enrollment/SLA events are opted into per channel via the
-    /// <c>NotifyOn*</c> toggles below; analyze rules reference a channel by <see cref="Id"/>
+    /// Routing granularity: enrollment/SLA events and What's new product updates are opted into
+    /// per channel via the <c>NotifyOn*</c> toggles below; analyze rules reference a channel by <see cref="Id"/>
     /// (rule-level notify, see <c>RuleState.NotifyChannelIds</c>). A channel with all toggles
     /// off that is only referenced by rules acts as a dedicated "rules-only" channel.
     /// </para>
@@ -94,6 +94,14 @@ namespace AutopilotMonitor.Shared.Models.Notifications
         /// </summary>
         public bool NotifyOnSlaEvents { get; set; }
 
+        /// <summary>
+        /// Receive "What's new" product updates: whenever new platform / agent changelog entries
+        /// go live in the portal's What's new panel, one digest message per batch is sent to this
+        /// channel (see <c>WhatsNewNotificationService</c>). Opt-in; the legacy synthesized channel
+        /// never receives them.
+        /// </summary>
+        public bool NotifyOnWhatsNew { get; set; }
+
         /// <summary>
         /// Parses <see cref="CustomHeadersJson"/> into request headers for the generic-webhook
         /// dispatcher. Empty unless <see cref="ProviderType"/> is GenericJson. Never throws.

src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs

@@ -165,6 +165,19 @@ namespace AutopilotMonitor.Shared.Models
         /// </summary>
         public string? EmitMode { get; set; }
 
+        /// <summary>
+        /// Opt-in: let the backend explain error-code fields in this rule's output
+        /// (<c>exitCode</c>, <c>errorCode</c>, <c>hresult</c>, …) with the Windows/MSI/Intune
+        /// catalog, i.e. attach the <c>*Info</c> siblings the built-in events get.
+        /// Default false — gather-rule payload keys are author-chosen and the codes usually come
+        /// from third-party logs or commands (HP Image Assistant, Dell Command Update, custom
+        /// scripts) with their own exit-code numbering, where the catalog meaning would be
+        /// confidently wrong. Set to true only when the parsed source really uses Windows codes
+        /// (e.g. an msiexec or IME log). The agent stamps <c>enrichErrorCodes: true</c> into the
+        /// event data so the read-time enricher can honour it without knowing the rule.
+        /// </summary>
+        public bool EnrichErrorCodes { get; set; } = false;
+
         // ===== OUTPUT =====
 
         /// <summary>

src/Shared/AutopilotMonitor.Shared/Models/UserWhatsNewSeen.cs

@@ -0,0 +1,17 @@
+using System;
+
+namespace AutopilotMonitor.Shared.Models
+{
+    /// <summary>The caller's per-channel What's-new seen marks from the UserPresence row.</summary>
+    public sealed class UserWhatsNewSeen
+    {
+        public UserWhatsNewSeen(DateTime? platformUtc = null, DateTime? agentUtc = null)
+        {
+            PlatformUtc = platformUtc;
+            AgentUtc = agentUtc;
+        }
+
+        public DateTime? PlatformUtc { get; }
+        public DateTime? AgentUtc { get; }
+    }
+}

src/Shared/AutopilotMonitor.Shared/Models/VulnerabilityApiModels.cs

@@ -336,6 +336,7 @@ namespace AutopilotMonitor.Shared.Models
         public int DistinctCves { get; set; }
         public int KevCves { get; set; }
         public SeverityBreakdown SeverityBreakdown { get; set; } = default!;
+        public PriorityBreakdown PriorityBreakdown { get; set; } = default!;
         public IReadOnlyList<TopCve> TopCves { get; set; } = default!;
         public bool Truncated { get; set; }
     }
@@ -350,6 +351,20 @@ namespace AutopilotMonitor.Shared.Models
         public int Low { get; set; }
     }
 
+    /// <summary>
+    /// Distinct-CVE counts grouped by their highest remediation priority (act/attend/track). Rows
+    /// written before priorities existed carry no band and are counted in none - the three add up
+    /// to at most <see cref="CveExposureSummary.DistinctCves"/>. act equals the KEV set by
+    /// construction (CvePriority.Compute: KEV ⇒ act).
+    /// </summary>
+    // Declaration order == wire order.
+    public class PriorityBreakdown
+    {
+        public int Act { get; set; }
+        public int Attend { get; set; }
+        public int Track { get; set; }
+    }
+
     /// <summary>
     /// A single CVE ranked by how many devices it affects in scope. <see cref="EpssScore"/>
     /// is the highest EPSS probability seen across the rows (null = unscored / legacy rows);

src/Shared/AutopilotMonitor.Shared/Models/WhatsNew/WhatsNewFeed.cs

@@ -0,0 +1,143 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+
+namespace AutopilotMonitor.Shared.Models.WhatsNew
+{
+    /// <summary>
+    /// The portal's <c>/whats-new.json</c> as the backend reads it — the same payload the What's new
+    /// panel renders (generated at web-deploy time from the docs changelogs by
+    /// <c>scripts/whats-new/build-whats-new.js</c>). Entries carry a content-hash id and the docs
+    /// commit date; the backend only needs ids (to diff against the last run) plus the display
+    /// fields for the digest message.
+    /// </summary>
+    public sealed class WhatsNewFeed
+    {
+        public const string PlatformChannel = "platform";
+        public const string AgentChannel = "agent";
+        public static readonly string[] Channels = { PlatformChannel, AgentChannel };
+
+        public string? GeneratedUtc { get; set; }
+        public string? DocsCommit { get; set; }
+        public IReadOnlyList<WhatsNewFeedEntry> Entries { get; set; } = Array.Empty<WhatsNewFeedEntry>();
+
+        /// <summary>Channel → docs URL of the full changelog ("View all updates" target).</summary>
+        public IReadOnlyDictionary<string, string> DocsUrls { get; set; } =
+            new Dictionary<string, string>(StringComparer.Ordinal);
+
+        /// <summary>
+        /// Parses the payload. Returns null for anything off-shape (wrong schema version, missing
+        /// channel, malformed entry) — the caller then skips the run rather than diffing against a
+        /// half-read list, which would look like "everything was removed" or "everything is new".
+        /// </summary>
+        public static WhatsNewFeed? Parse(string? json)
+        {
+            if (string.IsNullOrWhiteSpace(json))
+                return null;
+
+            try
+            {
+                using var doc = JsonDocument.Parse(json!);
+                var root = doc.RootElement;
+                if (root.ValueKind != JsonValueKind.Object)
+                    return null;
+                if (!root.TryGetProperty("schemaVersion", out var schema) || schema.ValueKind != JsonValueKind.Number || schema.GetInt32() != 1)
+                    return null;
+                if (!root.TryGetProperty("channels", out var channels) || channels.ValueKind != JsonValueKind.Object)
+                    return null;
+
+                var entries = new List<WhatsNewFeedEntry>();
+                var docsUrls = new Dictionary<string, string>(StringComparer.Ordinal);
+
+                foreach (var channelName in Channels)
+                {
+                    if (!channels.TryGetProperty(channelName, out var channel) || channel.ValueKind != JsonValueKind.Object)
+                        return null;
+                    if (!channel.TryGetProperty("entries", out var list) || list.ValueKind != JsonValueKind.Array)
+                        return null;
+
+                    if (channel.TryGetProperty("docsUrl", out var docsUrl) && docsUrl.ValueKind == JsonValueKind.String)
+                        docsUrls[channelName] = docsUrl.GetString()!;
+
+                    foreach (var item in list.EnumerateArray())
+                    {
+                        var entry = ParseEntry(channelName, item);
+                        if (entry == null)
+                            return null;
+                        entries.Add(entry);
+                    }
+                }
+
+                return new WhatsNewFeed
+                {
+                    GeneratedUtc = GetString(root, "generatedUtc"),
+                    DocsCommit = GetString(root, "docsCommit"),
+                    Entries = entries,
+                    DocsUrls = docsUrls,
+                };
+            }
+            catch (JsonException)
+            {
+                return null;
+            }
+        }
+
+        private static WhatsNewFeedEntry? ParseEntry(string channel, JsonElement item)
+        {
+            if (item.ValueKind != JsonValueKind.Object)
+                return null;
+
+            var id = GetString(item, "id");
+            var addedUtc = GetString(item, "addedUtc");
+            var body = GetString(item, "body");
+            if (string.IsNullOrWhiteSpace(id) || string.IsNullOrWhiteSpace(addedUtc) || body == null)
+                return null;
+            if (!DateTime.TryParse(addedUtc, null, System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal, out var added))
+                return null;
+
+            return new WhatsNewFeedEntry
+            {
+                Channel = channel,
+                Id = id!,
+                AddedUtc = added,
+                Period = GetString(item, "period") ?? string.Empty,
+                Title = GetString(item, "title"),
+                Body = body,
+                Link = GetString(item, "link"),
+            };
+        }
+
+        private static string? GetString(JsonElement element, string name)
+            => element.TryGetProperty(name, out var value) && value.ValueKind == JsonValueKind.String
+                ? value.GetString()
+                : null;
+    }
+
+    /// <summary>One changelog bullet as published in <c>/whats-new.json</c>.</summary>
+    public sealed class WhatsNewFeedEntry
+    {
+        /// <summary><see cref="WhatsNewFeed.PlatformChannel"/> or <see cref="WhatsNewFeed.AgentChannel"/>.</summary>
+        public string Channel { get; set; } = default!;
+
+        /// <summary>Content-hash id (stable across builds while the bullet text is unchanged).</summary>
+        public string Id { get; set; } = default!;
+
+        /// <summary>When the bullet was committed to the docs repo.</summary>
+        public DateTime AddedUtc { get; set; }
+
+        /// <summary>The changelog period heading, e.g. "September 2026".</summary>
+        public string Period { get; set; } = string.Empty;
+
+        /// <summary>Bold lead of platform bullets; agent bullets have none.</summary>
+        public string? Title { get; set; }
+
+        /// <summary>Inline markdown (**bold**, `code`, [label](url)).</summary>
+        public string Body { get; set; } = string.Empty;
+
+        /// <summary>First docs link of the bullet, if any.</summary>
+        public string? Link { get; set; }
+
+        /// <summary>Channel-qualified key used for the "already announced" set — ids are per-channel hashes.</summary>
+        public string Key => $"{Channel}:{Id}";
+    }
+}

src/Shared/AutopilotMonitor.Shared/Models/WhatsNew/WhatsNewNotificationState.cs

@@ -0,0 +1,30 @@
+using System;
+using System.Collections.Generic;
+
+namespace AutopilotMonitor.Shared.Models.WhatsNew
+{
+    /// <summary>
+    /// Platform-wide watermark of the What's new notifier: the channel-qualified entry keys that
+    /// were present in <c>/whats-new.json</c> the last time it was processed. A run diffs the live
+    /// payload against this set — keys not in it are "new" and get announced to every tenant
+    /// channel that opted in. Stored as one row; written with an ETag compare-and-swap so two
+    /// overlapping runs cannot both claim (and both announce) the same entries.
+    /// </summary>
+    public sealed class WhatsNewNotificationState
+    {
+        /// <summary>Entry keys (<c>{channel}:{id}</c>) of the last processed payload.</summary>
+        public HashSet<string> KnownEntryKeys { get; set; } = new(StringComparer.Ordinal);
+
+        /// <summary>Docs commit the last processed payload was generated from (diagnostics only).</summary>
+        public string? LastDocsCommit { get; set; }
+
+        /// <summary>When the state was last written.</summary>
+        public DateTime? LastRunUtc { get; set; }
+
+        /// <summary>When a digest was last dispatched to tenant channels.</summary>
+        public DateTime? LastNotifiedUtc { get; set; }
+
+        /// <summary>Number of entries announced in the last dispatched digest.</summary>
+        public int LastNotifiedEntryCount { get; set; }
+    }
+}

src/Shared/AutopilotMonitor.Shared/Resources/error-codes.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 2,
-  "description": "Single-source catalog of Windows / MSI / Intune error codes, generated by scripts/error-codes/generate.mjs from primary sources — never edit by hand. Consumed by the backend (ErrorCodeCatalog.cs, ErrorCodeEnricher.cs), the web app (utils/errorCodeMap.ts via the sync-error-codes prebuild step) and the MCP server (lookup_error_code). Keys are lowercase 8-digit hex ('0x80070005') or decimal MSI exit codes ('1603'; only 0, 1601-1654, 3010 — other decimal exit codes are installer-defined). Win32 codes live only as 0x8007xxxx entries; HRESULT_FROM_WIN32 values in the MSI range resolve to the decimal entry at lookup time. confidence: high = MS Learn or the IME build named in source; medium = paraphrase of an enum member name or of an analysis rule; low = carried over from the v1 catalog without a primary source. category is one of: msi, win32, com, appx, windows-update, cbs, intune-win32, intune-mobile, mdm-enrollment, autopilot, entra-join, delivery-optimization. imeRetriesDuringEsp marks the MSI return codes the IME retries automatically during the Autopilot ESP. enforcementStates maps the IME app enforcement state numbers to their names.",
+  "description": "Single-source catalog of Windows / MSI / Intune error codes, generated by tools/error-codes/generate.mjs from primary sources — never edit by hand. Consumed by the backend (ErrorCodeCatalog.cs, ErrorCodeEnricher.cs), the web app (utils/errorCodeMap.ts via the sync-error-codes prebuild step) and the MCP server (lookup_error_code). Keys are lowercase 8-digit hex ('0x80070005') or decimal MSI exit codes ('1603'; only 0, 1601-1654, 3010 — other decimal exit codes are installer-defined). Win32 codes live only as 0x8007xxxx entries; HRESULT_FROM_WIN32 values in the MSI range resolve to the decimal entry at lookup time. confidence: high = MS Learn or the IME build named in source; medium = paraphrase of an enum member name or of an analysis rule; low = carried over from the v1 catalog without a primary source. category is one of: msi, win32, com, appx, windows-update, cbs, intune-win32, intune-mobile, mdm-enrollment, autopilot, entra-join, delivery-optimization. imeRetriesDuringEsp marks the MSI return codes the IME retries automatically during the Autopilot ESP. enforcementStates maps the IME app enforcement state numbers to their names.",
   "entries": {
     "0": {"description":"The action completed successfully","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/win32/msi/error-codes","category":"msi","symbol":"ERROR_SUCCESS"},
     "1601": {"description":"The Windows Installer service couldn't be accessed. Contact your support personnel to verify that the Windows Installer service is properly registered","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/win32/msi/error-codes","category":"msi","symbol":"ERROR_INSTALL_SERVICE_FAILURE"},

src/Shared/AutopilotMonitor.Shared/Services/ErrorCodeCatalog.cs

@@ -13,7 +13,7 @@ namespace AutopilotMonitor.Shared.Services
     /// <summary>
     /// Single-source-of-truth lookup for Windows / MSI / Intune error codes. Loaded once
     /// from the embedded <c>Resources/error-codes.json</c> resource (schemaVersion 2,
-    /// generated by <c>scripts/error-codes/generate.mjs</c>) and exposed via dictionaries
+    /// generated by <c>tools/error-codes/generate.mjs</c>) and exposed via dictionaries
     /// keyed by normalised code string (lowercase hex, e.g. <c>0x80070005</c>, or decimal MSI
     /// exit code, e.g. <c>1603</c>), by symbol and by enforcement state.
     /// <para>

src/Web/autopilot-monitor-web/app/admin/components/OpsAlertRulesSection.tsx

@@ -394,7 +394,7 @@ export function OpsAlertRulesSection({
                       return (
                         <div key={et}>
                           <div className="flex items-center gap-3 py-1.5 px-3 rounded hover:bg-amber-100/50 dark:hover:bg-gray-700/50 transition-colors">
-                            <label className="relative inline-flex items-center cursor-pointer">
+                            <label className="relative inline-flex flex-shrink-0 items-center cursor-pointer">
                               <input
                                 type="checkbox"
                                 checked={rule.enabled}
@@ -403,14 +403,16 @@ export function OpsAlertRulesSection({
                               />
                               <div className="w-9 h-5 bg-gray-300 dark:bg-gray-600 rounded-full peer peer-checked:bg-amber-500 dark:peer-checked:bg-amber-500 transition-colors after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-4 after:w-4 after:transition-all peer-checked:after:translate-x-full"></div>
                             </label>
-                            <span className={`flex-1 text-sm font-mono ${rule.enabled ? "text-gray-900 dark:text-gray-100" : "text-gray-400 dark:text-gray-500"}`}>
+                            {/* min-w-0 + break-words: the event type is one long unbreakable token and
+                                would otherwise push the severity select off a phone-width viewport. */}
+                            <span className={`flex-1 min-w-0 break-words text-sm font-mono ${rule.enabled ? "text-gray-900 dark:text-gray-100" : "text-gray-400 dark:text-gray-500"}`}>
                               {et}
                             </span>
                             <select
                               value={rule.minSeverity}
                               onChange={(e) => setSeverity(et, e.target.value)}
                               disabled={!rule.enabled}
-                              className="text-xs px-2 py-1 rounded border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 disabled:opacity-40 disabled:cursor-not-allowed focus:outline-none focus:ring-1 focus:ring-amber-500"
+                              className="flex-shrink-0 text-xs px-2 py-1 rounded border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 disabled:opacity-40 disabled:cursor-not-allowed focus:outline-none focus:ring-1 focus:ring-amber-500"
                             >
                               {SEVERITIES.map(s => (
                                 <option key={s} value={s}>{s}+</option>

src/Web/autopilot-monitor-web/app/admin/components/VulnerabilityDataSection.tsx

@@ -10,6 +10,7 @@ import { useCanMutatePlatform } from "@/hooks/useCanMutatePlatform";
 import { SectionCardHeader } from "@/components/SectionCardHeader";
 import type {
   AdminConfiguration as WireAdminConfiguration,
+  CveExposureSummary,
   GetVulnerabilitySyncStatusResponse,
   TriggerEpssSyncResponse,
   TriggerMsrcSyncResponse,
@@ -18,26 +19,6 @@ import type {
   UpdateAdminConfigurationResponse,
 } from "@/utils/wire-types.generated";
 
-interface VulnerabilityTopCve {
-  cveId: string;
-  cvssSeverity: string;
-  cvssScore: number;
-  isKev: boolean;
-  affectedSessions: number;
-  sampleSoftware: string[];
-}
-
-interface VulnerabilitySummary {
-  windowDays: number;
-  totalAffectedSessions: number;
-  totalAffectedTenants: number | null;
-  distinctCves: number;
-  kevCves: number;
-  severityBreakdown: { critical: number; high: number; medium: number; low: number };
-  topCves: VulnerabilityTopCve[];
-  truncated: boolean;
-}
-
 interface VulnerabilityDataSectionProps {
   adminConfig: AdminConfiguration | null;
   loadingConfig: boolean;
@@ -94,7 +75,7 @@ export function VulnerabilityDataSection({
   } | null>(null);
 
   // Fleet exposure overview (read-only; cross-tenant via /api/global/metrics/vulnerability)
-  const [summary, setSummary] = useState<VulnerabilitySummary | null>(null);
+  const [summary, setSummary] = useState<CveExposureSummary | null>(null);
   const [summaryDays, setSummaryDays] = useState(30);
   const [loadingSummary, setLoadingSummary] = useState(false);
 
@@ -144,7 +125,7 @@ export function VulnerabilityDataSection({
   const refreshSummary = useCallback(async () => {
     setLoadingSummary(true);
     try {
-      setSummary(await fetchJson<VulnerabilitySummary>(api.metrics.globalVulnerability(summaryDays, 10), getAccessToken));
+      setSummary(await fetchJson<CveExposureSummary>(api.metrics.globalVulnerability(summaryDays, 10), getAccessToken));
     } catch {
       // Non-critical: the overview is auxiliary; config + sync still render.
       setSummary(null);