chore(submodule): todo for the IME overwrite fix

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/dependabot.yml

@@ -55,6 +55,10 @@ updates:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
 
+  # Every action is referenced by commit SHA with the version in a trailing comment;
+  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
+  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
+  # pins are reviewed in a PR instead of drifting silently or being bumped by hand.
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/action-pins.yml

@@ -0,0 +1,70 @@
+name: Action Pin Gate
+
+# Every third-party action must be referenced by a full commit SHA, never by a tag.
+# Tags are mutable: whoever controls an action repository can repoint v4 at new code,
+# and that code runs inside jobs that hold the code-signing identity, the storage
+# credentials and a token that can push to main. A SHA is the only reference an
+# upstream owner cannot change under us.
+#
+# Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
+# the other workflow files, so a guard placed there would stay silent for exactly the
+# commits it needs to inspect.
+#
+# Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
+# run is a signal to act on, not a merge barrier. Making it binding means adding
+# 'Verify action pins' as a required status check -- a branch-protection decision, not
+# something this file can assert.
+#
+# The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
+# PR that rewrites both the SHA and the trailing version comment. The comment is
+# therefore required too: it is what makes a pinned line reviewable.
+
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pins:
+    name: Verify action pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Every third-party action is pinned to a SHA
+        run: |
+          set -uo pipefail
+          failed=0
+          while IFS=: read -r file line ref; do
+            # Reusable workflows from this repository move with the commit that calls
+            # them, so there is nothing to pin.
+            case "$ref" in ./*) continue ;; esac
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
+              continue
+            fi
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+            else
+              echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
+            fi
+            failed=1
+          # -H is load-bearing: with a single matching file grep omits the name, the
+          # fields shift by one and every diagnostic points at nothing.
+          done < <(grep -nHE '^[[:space:]]*(-[[:space:]]+)?uses:' .github/workflows/*.yml \
+                   | sed -E 's/^([^:]+):([0-9]+):[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*/\1:\2:/')
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::Unpinned action references found -- fix them before this reaches main."
+            exit 1
+          fi
+          echo "All action references are pinned to commit SHAs."

.github/workflows/bootstrap-script-gates.yml

@@ -18,7 +18,7 @@ jobs:
     name: Bootstrap guard tests (PS 5.1)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install Pester 5+
         shell: powershell

.github/workflows/build-agent.yml

@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # Every released build is signed; a missing variable stops the run before a build
       # number is burnt.
@@ -122,7 +122,7 @@ jobs:
 
       # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
       - name: Setup .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
@@ -462,7 +462,7 @@ jobs:
       # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
       - name: Attest build provenance
         if: inputs.upload_blob || inputs.create_release
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: |
             ${{ steps.artifact.outputs.versioned_zip_release }}
@@ -470,13 +470,13 @@ jobs:
             staging/agent/AutopilotMonitor.SummaryDialog.exe
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
           path: ${{ steps.artifact.outputs.versioned_zip_release }}
 
       - name: Upload version metadata
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: version-metadata
           path: ${{ env.MANIFEST_NAME }}

.github/workflows/build-msi.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # The loader executes as SYSTEM on every enrolling device — a parse error or
       # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
@@ -111,8 +111,11 @@ jobs:
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
+      # Exact version, not a "5.*" range: wix writes the bytes of the MSI that customers
+      # install, so a compromised or simply broken point release must not flow into a build
+      # unnoticed. Bumping is a reviewed commit.
       - name: Install WiX toolset
-        run: dotnet tool install --global wix --version "5.*"
+        run: dotnet tool install --global wix --version 5.0.2
 
       # Version pinned; roll-forward because the tool targets an older runtime than the SDK.
       - name: Install AzureSignTool
@@ -235,12 +238,12 @@ jobs:
       # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (MSI)
         if: inputs.upload_blob
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: ${{ env.STABLE_MSI }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
           path: ${{ env.STABLE_MSI }}

.github/workflows/ci.yml

@@ -35,6 +35,7 @@ on:
       # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
       # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
       # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
       - '.github/workflows/bootstrap-script-gates.yml'
       - '.github/workflows/build-agent.yml'
       - '.github/workflows/build-msi.yml'
@@ -67,6 +68,7 @@ on:
       # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
       # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
       # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
       - '.github/workflows/bootstrap-script-gates.yml'
       - '.github/workflows/build-agent.yml'
       - '.github/workflows/build-msi.yml'
@@ -94,9 +96,9 @@ jobs:
     # windows-latest is required: the agent test projects target net48.
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
@@ -125,9 +127,9 @@ jobs:
       run:
         working-directory: src/Web/autopilot-monitor-web
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -159,9 +161,9 @@ jobs:
       run:
         working-directory: src/McpServer/autopilot-monitor-mcp
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -179,7 +181,7 @@ jobs:
       # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
       # is honored by vector-search-provider.ts.
       - name: Cache embedding model
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ${{ github.workspace }}/.hf-cache
           key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -193,9 +195,9 @@ jobs:
     name: Generated guardrails match rules/guardrails.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 
@@ -214,9 +216,9 @@ jobs:
     name: Generated wire types match shared-manifests.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 

.github/workflows/codeql.yml

@@ -102,15 +102,15 @@ jobs:
             build-mode: none
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         if: matrix.language == 'csharp'
         with:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -121,6 +121,6 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}

.github/workflows/combine-rules.yml

@@ -24,14 +24,17 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 
+      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # main, so an install-time script from a hijacked package would run with a token that
+      # can rewrite the repository. ajv is pure JS and needs no install hooks.
       - name: Install ajv-cli
-        run: npm install -g ajv-cli ajv-formats
+        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1
 
       - name: Validate Gather Rules
         run: |

.github/workflows/deploy-backend.yml

@@ -19,7 +19,7 @@ jobs:
     name: Build and Deploy Backend
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Login to Azure (OIDC)
         uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
@@ -29,7 +29,7 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 

.github/workflows/deploy-mcp.yml

@@ -26,7 +26,7 @@ jobs:
     name: Build and Deploy MCP Server
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # The published customer documentation lives in its own PUBLIC repo and is
       # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -36,7 +36,7 @@ jobs:
       # re-run actually rolls a new revision). /health reports the SHA captured
       # below so that staleness is checkable.
       - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: autopilotmonitor/autopilotmonitor-docs
           path: mcp-docs

.github/workflows/deploy-web.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and Deploy Job
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           lfs: false
           fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
@@ -56,7 +56,7 @@ jobs:
       # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
       # records which docs commit is live.
       - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: autopilotmonitor/autopilotmonitor-docs
           path: whats-new-docs
@@ -66,7 +66,7 @@ jobs:
         id: docs
         run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -114,12 +114,12 @@ jobs:
       # commit, workflow file) in a public transparency log.
       # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: ${{ steps.package.outputs.archive }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: portal-${{ github.sha }}
           path: ${{ steps.package.outputs.archive }}

.github/workflows/publish-scripts.yml

@@ -54,7 +54,7 @@ jobs:
     needs: gates
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Check code-signing configuration
         shell: pwsh
@@ -127,7 +127,7 @@ jobs:
       # when someone wants to look at the file.
       - name: Upload signed scripts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: signed-scripts
           path: ${{ runner.temp }}/signed-scripts

rules/analyze/ANALYZE-ESP-004.json

@@ -1,11 +1,11 @@
 {
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-ESP-004",
-  "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-  "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+  "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+  "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
   "severity": "warning",
   "category": "esp",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "enabled": true,
   "baseConfidence": 80,
   "conditions": [
@@ -26,6 +26,27 @@
       "value": "true",
       "required": true
     },
+    {
+      "signal": "esp_gave_up_on_app",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "failureType",
+      "operator": "equals",
+      "value": "esp_apps_timeout",
+      "required": true
+    },
+    {
+      "signal": "appName",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "appName",
+      "operator": "exists",
+      "value": "",
+      "filterField": "failureType",
+      "filterOperator": "equals",
+      "filterValue": "esp_apps_timeout",
+      "required": false
+    },
     {
       "signal": "espSyncFailureTimeoutMinutes",
       "source": "event_type",
@@ -38,34 +59,25 @@
     {
       "signal": "failedSubcategory",
       "source": "event_type",
-      "eventType": "enrollment_failed",
+      "eventType": "esp_failure_settle_started",
       "dataField": "failedSubcategory",
       "operator": "exists",
       "value": "",
       "required": false
-    },
-    {
-      "signal": "appName",
-      "source": "event_type",
-      "eventType": "app_install_failed",
-      "dataField": "appName",
-      "operator": "exists",
-      "value": "",
-      "required": false
     }
   ],
   "confidenceFactors": [
-    { "signal": "appName", "condition": "exists", "weight": 10 }
+    { "signal": "failedSubcategory", "condition": "exists", "weight": 10 }
   ],
-  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
   "remediation": [
     {
       "title": "Relieve ESP pressure so enrollments finish inside the window",
       "steps": [
-        "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-        "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-        "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-        "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+        "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+        "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+        "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+        "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
       ]
     }
   ],

rules/analyze/ANALYZE-ID-001.json

@@ -5,6 +5,7 @@
   "description": "Detects when a certificate with the configured subject is missing from the local machine personal store (LocalMachine\\My). Requires the gather rule GATHER-ID-002 (machine cert store inventory) to be enabled — the check runs against its gather_machine_cert_store output. A missing certificate may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
   "severity": "warning",
   "category": "identity",
+  "author": "Community",
   "isCommunity": true,
   "enabled": false,
   "evaluateOn": [

rules/dist/analyze-rules.json

@@ -2496,11 +2496,11 @@
     },
     {
       "ruleId": "ANALYZE-ESP-004",
-      "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-      "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+      "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+      "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
       "severity": "warning",
       "category": "esp",
-      "version": "1.0.1",
+      "version": "1.1.0",
       "enabled": true,
       "baseConfidence": 80,
       "conditions": [
@@ -2521,6 +2521,27 @@
           "value": "true",
           "required": true
         },
+        {
+          "signal": "esp_gave_up_on_app",
+          "source": "event_type",
+          "eventType": "app_install_failed",
+          "dataField": "failureType",
+          "operator": "equals",
+          "value": "esp_apps_timeout",
+          "required": true
+        },
+        {
+          "signal": "appName",
+          "source": "event_data",
+          "eventType": "app_install_failed",
+          "dataField": "appName",
+          "operator": "exists",
+          "value": "",
+          "filterField": "failureType",
+          "filterOperator": "equals",
+          "filterValue": "esp_apps_timeout",
+          "required": false
+        },
         {
           "signal": "espSyncFailureTimeoutMinutes",
           "source": "event_type",
@@ -2533,38 +2554,29 @@
         {
           "signal": "failedSubcategory",
           "source": "event_type",
-          "eventType": "enrollment_failed",
+          "eventType": "esp_failure_settle_started",
           "dataField": "failedSubcategory",
           "operator": "exists",
           "value": "",
           "required": false
-        },
-        {
-          "signal": "appName",
-          "source": "event_type",
-          "eventType": "app_install_failed",
-          "dataField": "appName",
-          "operator": "exists",
-          "value": "",
-          "required": false
         }
       ],
       "confidenceFactors": [
         {
-          "signal": "appName",
+          "signal": "failedSubcategory",
           "condition": "exists",
           "weight": 10
         }
       ],
-      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
       "remediation": [
         {
           "title": "Relieve ESP pressure so enrollments finish inside the window",
           "steps": [
-            "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-            "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-            "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-            "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+            "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+            "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+            "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+            "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
           ]
         }
       ],
@@ -2794,6 +2806,7 @@
       "description": "Detects when a certificate with the configured subject is missing from the local machine personal store (LocalMachine\\My). Requires the gather rule GATHER-ID-002 (machine cert store inventory) to be enabled — the check runs against its gather_machine_cert_store output. A missing certificate may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
       "severity": "warning",
       "category": "identity",
+      "author": "Community",
       "isCommunity": true,
       "enabled": false,
       "evaluateOn": [

rules/dist/ime-log-patterns.json

@@ -646,6 +646,22 @@
       "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
       "enabled": true
     },
+    {
+      "patternId": "PS-AGENT-ARG",
+      "category": "always",
+      "pattern": "^Adding argument (?<kind>[A-Za-z0-9]+) with value ",
+      "action": "agentInvocationArgument",
+      "description": "The first argument line of every AgentExecutor.exe invocation (powershell, remediationScript, detectionScript, requirementScript, ...). Opens the invocation that owns the policyId-less exit/output lines following it in AgentExecutor.log; PS-AGENT-SCRIPT-START upgrades a powershell invocation to its platform script. Also keeps the tracker's overwrite check active while the invocation runs.",
+      "enabled": true
+    },
+    {
+      "patternId": "PS-AGENT-COMPLETED",
+      "category": "always",
+      "pattern": "^Agent executor completed\\.",
+      "action": "agentExecutorCompleted",
+      "description": "Last line of an AgentExecutor.exe invocation. Closes the invocation's ownership of the exit/output lines in AgentExecutor.log and triggers the tracker's overwrite check: the executor wrote its end block at its own stream position, which may lie behind the tracker's bookmark when another process appended meanwhile.",
+      "enabled": true
+    },
     {
       "patternId": "PS-AGENT-ERROR",
       "category": "always",

rules/guardrails.json

@@ -94,7 +94,11 @@
     "C:\\Windows\\Panther",
     "C:\\Windows\\SetupDiag",
     "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
   ],
   "wmiQueryPrefixes": [
     "SELECT * FROM Win32_OperatingSystem",

rules/ime-log-patterns/PS-AGENT-ARG.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "PS-AGENT-ARG",
+  "category": "always",
+  "pattern": "^Adding argument (?<kind>[A-Za-z0-9]+) with value ",
+  "action": "agentInvocationArgument",
+  "description": "The first argument line of every AgentExecutor.exe invocation (powershell, remediationScript, detectionScript, requirementScript, ...). Opens the invocation that owns the policyId-less exit/output lines following it in AgentExecutor.log; PS-AGENT-SCRIPT-START upgrades a powershell invocation to its platform script. Also keeps the tracker's overwrite check active while the invocation runs.",
+  "enabled": true
+}

rules/ime-log-patterns/PS-AGENT-COMPLETED.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "PS-AGENT-COMPLETED",
+  "category": "always",
+  "pattern": "^Agent executor completed\\.",
+  "action": "agentExecutorCompleted",
+  "description": "Last line of an AgentExecutor.exe invocation. Closes the invocation's ownership of the exit/output lines in AgentExecutor.log and triggers the tracker's overwrite check: the executor wrote its end block at its own stream position, which may lie behind the tracker's bookmark when another process appended meanwhile.",
+  "enabled": true
+}

rules/schema/analyze-rule.schema.json

@@ -190,7 +190,7 @@
         },
         "operator": {
           "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
           "enum": ["equals", "not_equals", "contains", "not_contains", "regex", "not_regex", "gt", "lt", "gte", "lte", "exists", "not_exists", "count_gte", "count_per_group_gte", "in", "not_in"]
         },
         "value": {

rules/schema/guardrails.schema.json

@@ -8,6 +8,16 @@
     "$schema": { "type": "string" },
     "registryPrefixes": { "$ref": "#/$defs/categorizedList" },
     "filePrefixes": { "$ref": "#/$defs/stringList" },
+    "userProfileFilePrefixes": {
+      "description": "Folders under the signed-in user's profile that file collectors and diagnostics paths may read, RELATIVE to the profile root (e.g. \"AppData\\\\Local\\\\Vendor\"). Resolved against %LOGGED_ON_USER_PROFILE% at match time. Entries outside AppData\\Local / AppData\\Roaming are dropped at load: the C:\\Users hard block never admits them, so this list can only ever narrow what the block's exception already permits.",
+      "type": "array",
+      "items": {
+        "allOf": [
+          { "$ref": "#/$defs/safeString" },
+          { "pattern": "^AppData\\\\(Local|Roaming)(\\\\|$)" }
+        ]
+      }
+    },
     "wmiQueryPrefixes": { "$ref": "#/$defs/stringList" },
     "eventLogChannels": { "$ref": "#/$defs/categorizedList" },
     "blockedEventLogChannels": { "$ref": "#/$defs/stringList" },

rules/schema/ime-log-pattern.schema.json

@@ -71,6 +71,8 @@
             "scriptOutput",
             "scriptCompleted",
             "resetPlatformScriptContext",
+            "agentInvocationArgument",
+            "agentExecutorCompleted",
             "healthScriptResult",
             "healthScriptDetectionResult",
             "captureExitCode",

rules/scripts/combine.js

@@ -208,6 +208,14 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.filePrefixes)}
 ];
 
+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+${flatArray(guardrails.userProfileFilePrefixes ?? [])}
+];
+
 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.wmiQueryPrefixes)}
 ];

scripts/Bootstrap/Install-AutopilotMonitor.Tests.ps1

@@ -14,6 +14,22 @@
 BeforeAll {
     . (Join-Path $PSScriptRoot 'Install-AutopilotMonitor.ps1')
 
+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+
+    function New-FakePayload {
+        param([string[]]$Files)
+        $dir = Join-Path $TestDrive ([guid]::NewGuid().ToString())
+        New-Item -ItemType Directory -Path $dir -Force | Out-Null
+        foreach ($f in $Files) { Set-Content -Path (Join-Path $dir $f) -Value 'x' }
+        return $dir
+    }
+
     function New-FakeProfile {
         param([string]$Name, [double]$AgeMinutes)
         $p = Join-Path $TestDrive $Name
@@ -305,3 +321,93 @@ Describe 'logging purity' {
         Get-Content $LogFile -Raw | Should -Match 'SKIP: Agent was previously deployed'
     }
 }
+
+Describe 'Get-UnverifiedAgentBinaries' {
+    # The publisher gate on the extracted payload. What matters is the DECISION: which
+    # payload is accepted, which is refused, and which files are looked at at all.
+    BeforeEach {
+        Mock Write-Log { }
+        $script:ours = 'CN=glueckkanja AG, O=glueckkanja AG, C=DE'
+    }
+
+    It 'accepts a payload where every binary of ours is validly signed by us' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+    }
+
+    It 'checks the binaries we author and leaves third-party assemblies alone' {
+        $dir = New-FakePayload -Files @(
+            'AutopilotMonitor.Agent.exe',
+            'AutopilotMonitor.Agent.exe.config',
+            'AutopilotMonitor.Shared.dll',
+            'Newtonsoft.Json.dll',
+            'System.Management.Automation.dll'
+        )
+        $script:checked = @()
+        Mock Get-AuthenticodeSignature {
+            $script:checked += (Split-Path $FilePath -Leaf)
+            New-FakeSignature -Status 'Valid' -Subject $script:ours
+        }
+
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+        $script:checked | Should -Be @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+    }
+
+    It 'refuses an unsigned agent executable' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a tampered binary (hash mismatch)' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a validly signed binary from a different publisher' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses the whole payload when a single DLL of ours is swapped' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature {
+            if ((Split-Path $FilePath -Leaf) -eq 'AutopilotMonitor.Shared.dll') {
+                New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US'
+            } else {
+                New-FakeSignature -Status 'Valid' -Subject $script:ours
+            }
+        }
+        $rejected = Get-UnverifiedAgentBinaries -Path $dir
+        $rejected.Count | Should -Be 1
+        $rejected[0] | Should -BeLike 'AutopilotMonitor.Shared.dll*'
+    }
+
+    It 'refuses when the signature check itself throws' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { throw 'access denied' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses an empty payload instead of passing it' {
+        $dir = New-FakePayload -Files @('Newtonsoft.Json.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+}
+
+Describe 'publisher pin' {
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $ExpectedPublisher | Should -Be '*O=glueckkanja AG*'
+        $ExpectedPublisher | Should -Not -Match '^[0-9A-Fa-f]{40}$'
+    }
+}

scripts/Bootstrap/Install-AutopilotMonitor.ps1

@@ -12,8 +12,9 @@
       2. Downloads the monitoring agent ZIP from Azure Blob Storage
       3. Verifies integrity via SHA-256 hash from the version manifest (mandatory)
       4. Extracts the agent into %ProgramData%\AutopilotMonitor\Agent
-      5. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
-      6. Verifies the runtime process actually launched
+      5. Verifies the Authenticode signature and publisher of every binary we author
+      6. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
+      7. Verifies the runtime process actually launched
     Agent self-destructs when enrollment completes.
 
     Relax flow (guards 2+3): a real user profile (or a real LastLoggedOnUser)
@@ -76,6 +77,11 @@
       PowerShell 5.1 (IME) reads scripts without BOM as ANSI, corrupting multi-byte chars.
 
 .CHANGELOG
+    2026-09-08  v2.5  Publisher gate: every AutopilotMonitor binary in the extracted
+                      payload must carry a valid Authenticode signature from the
+                      expected publisher before --install runs. The SHA-256 manifest
+                      check stays and is unchanged; it proves the bytes, the signature
+                      proves the author.
     2026-08-08  v2.3  Windows 365 Cloud PC support: a positively identified Cloud PC
                       (Windows365 registry key AND CloudManagedDesktopExtension
                       service) now triggers the guard 2+3 relax alongside OOBE
@@ -128,7 +134,12 @@ param(
 )
 
 # Script version (bump on meaningful changes; see .CHANGELOG above)
-$ScriptVersion = "2.4"
+$ScriptVersion = "2.5"
+
+# The publisher every binary we author must carry. A -like pattern on the subject, NOT a
+# thumbprint: certificates are renewed, deployed copies of this script are not. Same value
+# the loader pins for this script.
+$ExpectedPublisher = "*O=glueckkanja AG*"
 
 # Configuration - Everything in ProgramData for easy cleanup
 $AgentBasePath = "$env:ProgramData\AutopilotMonitor"
@@ -329,6 +340,56 @@ function Get-BootstrapDecision {
     return [pscustomobject]@{ Install = $true; ReasonCode = $null; RelaxActive = $relax.Active }
 }
 
+# Returns the list of reasons why the extracted payload is not ours; an empty result means
+# every binary we author carries a valid Authenticode signature from the expected publisher.
+# Third-party assemblies keep their own publisher's signature and are not checked here.
+# Any error is a rejection: an unreadable signature is an unverified binary.
+function Get-UnverifiedAgentBinaries {
+    param([string]$Path)
+
+    $rejected = @()
+    $ourBinaries = @(
+        Get-ChildItem -Path $Path -Filter 'AutopilotMonitor.*' -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Extension -in @('.exe', '.dll') }
+    )
+
+    # An empty set is a rejection, not a pass: it means the extraction produced nothing we
+    # recognise, and the alternative would be a gate that silently approves an empty folder.
+    # The comma keeps a single rejection an ARRAY: PowerShell unrolls a one-element result to
+    # a bare string, and the caller reads .Count and indexes into it.
+    if ($ourBinaries.Count -eq 0) {
+        return , @("no AutopilotMonitor binaries found in $Path")
+    }
+
+    foreach ($binary in $ourBinaries) {
+        try {
+            $sig = Get-AuthenticodeSignature -FilePath $binary.FullName -ErrorAction Stop
+        }
+        catch {
+            $rejected += "$($binary.Name): signature check failed to run ($($_.Exception.Message))"
+            continue
+        }
+
+        if ($null -eq $sig) {
+            $rejected += "$($binary.Name): signature check returned nothing"
+            continue
+        }
+
+        $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<unsigned>' }
+
+        if ($sig.Status -ne 'Valid') {
+            $rejected += "$($binary.Name): signature status $($sig.Status)"
+            continue
+        }
+        if ($subject -notlike $ExpectedPublisher) {
+            $rejected += "$($binary.Name): unexpected publisher $subject"
+            continue
+        }
+    }
+
+    return , $rejected
+}
+
 # Main bootstrap flow. Only invoked when the script is run directly (see entry guard
 # at the bottom); never on dot-source.
 function Invoke-Bootstrap {
@@ -445,6 +506,20 @@ function Invoke-Bootstrap {
             }
         }
 
+        # Publisher gate. The SHA-256 above proves the ZIP is the one the manifest names, but
+        # that manifest lives in the same container as the ZIP and cannot outlive a compromise
+        # of the download host. The expected publisher travels inside THIS script, which the
+        # loader verified before running it, so the chain from the file an administrator
+        # assigns to the process that starts here stays publisher-anchored end to end.
+        # Fail-closed, exactly like the hash check: running unverified code as SYSTEM is the
+        # risk being removed.
+        Write-Log "Verifying Authenticode signatures of the agent binaries..."
+        $unverified = Get-UnverifiedAgentBinaries -Path $AgentBinPath
+        if ($unverified.Count -gt 0) {
+            throw "Authenticode verification FAILED ($($unverified -join '; ')). Refusing to run an agent that is not signed by the expected publisher."
+        }
+        Write-Log "Authenticode verification passed (publisher pin: $ExpectedPublisher)"
+
         Write-Log "Calling agent install mode (--install)..."
         & $agentExePath --install
         $installExitCode = $LASTEXITCODE

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/EspAndHelloTrackerShellCoreFailureInheritanceTests.cs

@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Signals;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// Session 683f1eff — a Shell-Core 62407 failure (<c>WhiteGlove_Failed</c>) arrived four
+    /// seconds into the provisioning tracker's 30-s settle window and terminalised the session
+    /// with nothing but its failure type: the HRESULT (0x80070652) and the failed subcategory
+    /// (Apps) the registry had already named never reached the terminal event, the backend
+    /// FailureReason or the termination-time app classification. The coordinator now inherits
+    /// the pending settle detail onto the Shell-Core args and records the terminal-failure
+    /// snapshot from it.
+    /// </summary>
+    public sealed class EspAndHelloTrackerShellCoreFailureInheritanceTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 6, DateTimeKind.Utc);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public FakeSignalIngressSink TrackerPostSink { get; } = new FakeSignalIngressSink();
+            public VirtualClock Clock { get; } = new VirtualClock(Fixed);
+            public List<EspFailureDetectedEventArgs> Forwarded { get; } = new List<EspFailureDetectedEventArgs>();
+
+            public Fixture() { Logger = new AgentLogger(Tmp.Path, AgentLogLevel.Debug); }
+
+            public EspAndHelloTracker BuildCoordinator(Func<EspFailureDetectedEventArgs?> pendingProbe)
+            {
+                var coordinator = new EspAndHelloTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: new InformationalEventPost(TrackerPostSink, Clock),
+                    logger: Logger,
+                    skipConfigProbe: () => ((bool?)false, (bool?)false),
+                    accountSetupActivityProbe: () => false,
+                    pendingEspFailureProbe: pendingProbe);
+                coordinator.EspFailureDetected += (_, args) => Forwarded.Add(args);
+                return coordinator;
+            }
+
+            public FakeSignalIngressSink.PostedSignal TerminalSignal() =>
+                Assert.Single(Ingress.Posted, p => p.Kind == DecisionSignalKind.EspTerminalFailure);
+
+            public void Dispose() { Tmp.Dispose(); }
+        }
+
+        private static EspFailureDetectedEventArgs PendingAppsFailure() => new EspFailureDetectedEventArgs(
+            failureType: "Provisioning_DeviceSetup_Apps_Failed",
+            errorCode: "0x80070652",
+            failedSubcategory: "Apps",
+            category: "DeviceSetup",
+            likelyCulpritApps: new[] { "ESP Finalizer US" });
+
+        [Fact]
+        public void ShellCore_failure_inside_the_settle_window_inherits_the_registry_detail()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(PendingAppsFailure);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);   // the signal that terminalised
+            Assert.Equal("0x80070652", args.ErrorCode);
+            Assert.Equal("Apps", args.FailedSubcategory);
+            Assert.Equal("DeviceSetup", args.Category);
+            Assert.Equal(new[] { "ESP Finalizer US" }, args.LikelyCulpritApps);
+
+            // Wire-through: the EspTerminalFailure signal payload carries the detail the
+            // DecisionEngine copies onto enrollment_failed.
+            var signal = f.TerminalSignal();
+            Assert.Equal("WhiteGlove_Failed", signal.Payload!["failureType"]);
+            Assert.Equal("0x80070652", signal.Payload["errorCode"]);
+            Assert.Equal("Apps", signal.Payload["failedSubcategory"]);
+            Assert.Equal("DeviceSetup", signal.Payload["category"]);
+            Assert.Equal("ESP Finalizer US", signal.Payload["likelyCulpritApps"]);
+
+            // Termination-time classification reads the same context.
+            Assert.NotNull(coordinator.LastEspTerminalFailure);
+            Assert.Equal("0x80070652", coordinator.LastEspTerminalFailure.ErrorCode);
+            Assert.True(coordinator.LastEspTerminalFailure.IsAppsSubcategory);
+        }
+
+        [Fact]
+        public void ShellCore_failure_without_a_pending_window_stays_bare()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => null);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("ESPProgress_Timeout");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("ESPProgress_Timeout", args.FailureType);
+            Assert.Null(args.ErrorCode);
+            Assert.Null(args.FailedSubcategory);
+            Assert.Null(args.Category);
+            Assert.Empty(args.LikelyCulpritApps);
+            Assert.Null(coordinator.LastEspTerminalFailure);
+
+            var signal = f.TerminalSignal();
+            Assert.False(signal.Payload!.ContainsKey("errorCode"));
+            Assert.False(signal.Payload.ContainsKey("failedSubcategory"));
+        }
+
+        [Fact]
+        public void A_throwing_probe_degrades_to_the_bare_failure()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => throw new InvalidOperationException("probe"));
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);
+            Assert.Null(args.ErrorCode);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleCollectorGuardTests.cs

@@ -456,5 +456,124 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
 
             SingleSecurityWarning();
         }
+
+        // -------------------------------------------------------------------
+        // %LOGGED_ON_USER_PROFILE% exception (userProfilePath overload)
+        //
+        // The token lifts the C:\Users hard block for AppData\Local and
+        // AppData\Roaming — and nothing more. The allowlist still decides,
+        // which is what the cases below pin down: the exception is a gate the
+        // allowlist has to open, never an allowance of its own.
+        // -------------------------------------------------------------------
+
+        private const string TestProfile = @"C:\Users\TestUser";
+
+        [Fact]
+        public void UserProfile_AppDataPath_WithoutAllowlistEntry_IsStillBlocked()
+        {
+            // The lifted hard block alone admits nothing: without a matching
+            // userProfileFilePrefixes entry the path falls through to the
+            // allowlist and is refused there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_OutsideAppData_IsBlockedByTheHardBlock()
+        {
+            foreach (var target in new[] { @"\Desktop\secret.txt", @"\Documents\notes.txt", @"\ntuser.dat" })
+            {
+                Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + target, unrestrictedMode: false, userProfilePath: TestProfile));
+            }
+        }
+
+        [Fact]
+        public void UserProfile_NullProfile_KeepsTheUsersHardBlock()
+        {
+            // No interactive user detected — the exception cannot apply and the
+            // path stays under the plain C:\Users block.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_TraversalOutOfAppData_IsBlocked()
+        {
+            // Spelling Documents as a traversal out of AppData must not survive
+            // Path.GetFullPath normalisation.
+            const string traversal = @"C:\Users\TestUser\AppData\Local\..\..\Documents\secret.txt";
+
+            Assert.Equal(@"C:\Users\TestUser\Documents\secret.txt", Path.GetFullPath(traversal));
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                traversal, unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_ForeignProfile_IsBlockedEvenUnderAppData()
+        {
+            // The exception is scoped to the DETECTED profile — a rule must not
+            // reach a second user's AppData by spelling the path out.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_IsAllowed()
+        {
+            // AppData\Local\RealmJoin is on userProfileFilePrefixes: the file itself, a
+            // subfolder below it, and the folder itself all pass.
+            foreach (var target in new[] { @"\tray.log", @"\Logs\rj.log", "" })
+            {
+                Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + @"\AppData\Local\RealmJoin" + target,
+                    unrestrictedMode: false, userProfilePath: TestProfile),
+                    $"expected allowed: ...\\RealmJoin{target}");
+            }
+        }
+
+        [Fact]
+        public void UserProfile_SiblingOfAnAllowlistedVendorFolder_IsBlocked()
+        {
+            // Segment-bounded: "RealmJoin" must not admit "RealmJoinSomethingElse".
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\RealmJoinSomethingElse\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_InAForeignProfile_IsBlocked()
+        {
+            // The allowlist is anchored to the DETECTED profile, not to C:\Users\*.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_WithoutADetectedUser_IsBlocked()
+        {
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_AppDataPath_IsAllowedInUnrestrictedMode()
+        {
+            // Where the exception does bite today: unrestricted mode returns
+            // before the allowlist, so the lifted hard block is the whole story.
+            Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+
+            // ...but only under AppData — Documents stays blocked even there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\Documents\secret.txt",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.cs

@@ -0,0 +1,527 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Session 46749560: IME's trace listener writes every log through one FileMode.Append
+    /// stream per process, so a process that resumes logging after another one appended
+    /// overwrites those bytes at its own stale position. The tracker had read the first version
+    /// and never saw the second — 6 of 16 script results and 4 of 16 executor end blocks were
+    /// lost while the final files looked intact. These tests drive that exact write pattern
+    /// (positional overwrite behind the bookmark) against the two multi-writer logs and pin the
+    /// contract: unchanged bytes never rewind, changed bytes are processed exactly once, and the
+    /// executor lines a rewind uncovers belong to the invocation that owns their file position.
+    /// </summary>
+    public sealed class ImeLogTrackerOverwriteRewindTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 10, 19, 30, 0, DateTimeKind.Utc);
+
+        private static List<ImeLogPattern> MarkerPatterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-MARK", Category = "always", Enabled = true,
+                Pattern = @"^marker (?<n>\d+)", Action = "noop",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private static readonly string[] ScriptPatternIds =
+        {
+            "PS-AGENT-INVOCATION", "PS-AGENT-ARG", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
+            "PS-AGENT-OUTPUT", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT", "PS-SCRIPT-RESULT",
+        };
+
+        /// <summary>The shipped pattern JSON — the same source combine.js embeds — so the contract is the real one.</summary>
+        private static List<ImeLogPattern> ScriptPatterns()
+        {
+            DirectoryInfo? dir = new DirectoryInfo(AppContext.BaseDirectory);
+            string? patternDir = null;
+            while (dir != null)
+            {
+                var candidate = Path.Combine(dir.FullName, "rules", "ime-log-patterns");
+                if (Directory.Exists(candidate)) { patternDir = candidate; break; }
+                dir = dir.Parent;
+            }
+            Assert.NotNull(patternDir);
+
+            var byId = new Dictionary<string, ImeLogPattern>(StringComparer.OrdinalIgnoreCase);
+            foreach (var file in Directory.GetFiles(patternDir, "*.json"))
+            {
+                var pattern = JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(file));
+                if (pattern?.PatternId != null) byId[pattern.PatternId] = pattern;
+            }
+            return ScriptPatternIds.Select(id =>
+            {
+                Assert.True(byId.TryGetValue(id, out var p), $"Shipped IME pattern '{id}' not found under {patternDir}.");
+                return p!;
+            }).ToList();
+        }
+
+        private static string Entry(string message, string thread = "1")
+            => $"<![LOG[{message}]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"X\" context=\"\" type=\"1\" thread=\"{thread}\" file=\"\">\r\n";
+
+        private const string PlatformId = "d39eeef3-e88e-41a0-82d7-5e28ee7b5acf";
+        private const string PlatformStartLine =
+            @"Adding argument powershell with value C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\73d664e4-0886-4a73-b745-c694da45ddb4_d39eeef3-e88e-41a0-82d7-5e28ee7b5acf.ps1 to the named argument list.";
+        private const string DetectionStartLine =
+            @"Adding argument detectionScript with value C:\Windows\IMECache\DetectionScripts\App_cc46aa62-e93a-41a1-bdd0-44f57e92a66d.ps1 to the named argument list.";
+        private const string GeneratedLine =
+            @"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\73d664e4-0886-4a73-b745-c694da45ddb4_d39eeef3-e88e-41a0-82d7-5e28ee7b5acf.ps1 is generated.";
+        private const string ResultLine =
+            "[PowerShell] User Id = 73d664e4-0886-4a73-b745-c694da45ddb4, Policy id = " + PlatformId + ", policy result = Success";
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            private readonly string _matchLog;
+            private readonly List<ImeLogPattern> _patterns;
+            public ImeLogTracker Tracker { get; private set; }
+            public DateTime Now { get; set; } = T0;
+            public string LogName { get; }
+            public string LogPath => Path.Combine(_tmp.Path, LogName);
+            public string StateDir { get; }
+            public List<ScriptExecutionState> Completed { get; } = new List<ScriptExecutionState>();
+
+            public Harness(string logName, List<ImeLogPattern> patterns)
+            {
+                LogName = logName;
+                _patterns = patterns;
+                var logDir = Path.Combine(_tmp.Path, "agent");
+                Directory.CreateDirectory(logDir);
+                _matchLog = Path.Combine(logDir, "ime-pattern-matches.log");
+                StateDir = Path.Combine(_tmp.Path, "state");
+                Tracker = Build();
+            }
+
+            private ImeLogTracker Build()
+            {
+                var t = new ImeLogTracker(_tmp.Path, _patterns, new AgentLogger(Path.Combine(_tmp.Path, "agent"), AgentLogLevel.Debug),
+                    matchLogPath: _matchLog, stateDirectory: StateDir);
+                t.UtcNowProvider = () => Now;
+                t.OnScriptCompleted = s => Completed.Add(s);
+                return t;
+            }
+
+            /// <summary>Agent restart: dispose, rebuild over the same state directory, restore the bookmark.</summary>
+            public void Restart()
+            {
+                Tracker.SaveStateForTest();
+                Tracker.Dispose();
+                Tracker = Build();
+                Tracker.LoadStateForTest();
+            }
+
+            public void Append(string text) => File.AppendAllText(LogPath, text, new UTF8Encoding(false));
+
+            /// <summary>What IME's stale writer does: write at its own position, over whatever is there.</summary>
+            public void Overwrite(long offset, string text)
+            {
+                using (var fs = new FileStream(LogPath, FileMode.Open, FileAccess.Write, FileShare.ReadWrite))
+                {
+                    fs.Seek(offset, SeekOrigin.Begin);
+                    var bytes = new UTF8Encoding(false).GetBytes(text);
+                    fs.Write(bytes, 0, bytes.Length);
+                }
+            }
+
+            public long Length => new FileInfo(LogPath).Length;
+
+            public Task Pass(CancellationToken token = default) => Tracker.CheckLogFilesAsync(token);
+
+            /// <summary>Marker numbers matched so far, in match order.</summary>
+            public List<int> Matched()
+            {
+                if (!File.Exists(_matchLog)) return new List<int>();
+                return File.ReadAllLines(_matchLog)
+                    .Select(l => Regex.Match(l, @"\[T-MARK\] <!\[LOG\[marker (\d+)"))
+                    .Where(m => m.Success).Select(m => int.Parse(m.Groups[1].Value)).ToList();
+            }
+
+            public ImeTrackerHealth Health => Tracker.GetHealthSnapshot();
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        // -----------------------------------------------------------------------
+        // Marker-level contract on AgentExecutor.log
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public async Task Unchanged_bytes_never_rewind_however_often_they_are_verified()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + "<![LOG[marker 2\nsecond line\n]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n" + Entry("marker 3"));
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+
+            for (var i = 0; i < 5; i++)
+            {
+                h.Tracker.RequestOverwriteCheckForTest();
+                h.Now = h.Now.AddSeconds(2);
+                await h.Pass();
+            }
+
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+            Assert.Equal(5, h.Health.VerifyPasses);
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+        }
+
+        [Fact]
+        public async Task Non_multi_writer_files_keep_no_ledger_and_are_never_verified()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+            Assert.Equal(0, h.Tracker.LedgerEntryCountForTest("AppWorkload.log"));
+            Assert.Equal(0, h.Health.VerifyPasses);
+            Assert.Equal(0, h.Health.VerifiedBytes);
+        }
+
+        [Fact]
+        public async Task Block_written_over_read_bytes_is_processed_once_and_the_surviving_tail_is_not_repeated()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            var one = Entry("marker 1");
+            h.Append(one + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+
+            // A stale writer lays two entries over the first two (same length: marker 3 survives
+            // intact at its old offset). No growth, no fragment — only the end signal finds it.
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8"));
+            Assert.Equal(3 * one.Length, h.Length);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            Assert.Equal(3 * one.Length, h.Health.OverwriteBytesReprocessed);
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            // Nothing left to find.
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Block_that_cuts_an_old_entry_leaves_a_fragment_that_is_never_matched()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // Longer than two old entries, shorter than three: the tail of marker 3's line survives
+            // as a fragment behind the new block.
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8 is a little longer"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Guard_zone_catches_a_short_block_when_the_file_grows_without_any_signal()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // Same-length replacement of marker 1 (no fragment), then an ordinary append by
+            // another writer: the growth pass re-checks the last 4 KB and finds the change.
+            h.Overwrite(0, Entry("marker 7"));
+            h.Append(Entry("marker 4"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 4 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            Assert.Equal(1, h.Health.VerifyPasses); // the full check that follows a guard hit
+            Assert.True(h.Health.VerifiedBytes > 0);
+        }
+
+        [Fact]
+        public async Task Guard_hit_rewinds_to_the_true_start_of_the_block_not_the_guard_zone()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            // ~6 KB of entries so the guard zone covers only the last few.
+            var sb = new StringBuilder();
+            for (var i = 1; i <= 60; i++) sb.Append(Entry($"marker {i}"));
+            h.Append(sb.ToString());
+            await h.Pass();
+            Assert.Equal(60, h.Matched().Count);
+
+            // A block over everything plus one more entry: the guard sees a change at its
+            // zone start, the full check must place the rewind at offset 0.
+            var block = new StringBuilder();
+            for (var i = 101; i <= 161; i++) block.Append(Entry($"marker {i}"));
+            h.Overwrite(0, block.ToString());
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            var matched = h.Matched();
+            Assert.Equal(60 + 61, matched.Count);
+            Assert.Equal(Enumerable.Range(101, 61), matched.Skip(60));
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Fragment_at_the_bookmark_triggers_the_check_when_no_ledger_entry_starts_in_the_guard_zone()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            var one = Entry("marker 1");
+            var big = Entry("marker 2 " + new string('x', 6000));
+            h.Append(one + big);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+
+            // The 6 KB entry is the last ledger entry and starts before the 4 KB guard zone, so
+            // the guard has nothing to check. The stale writer's block is longer than that entry:
+            // the pass after it starts mid-line — a fragment — and must not match it raw.
+            h.Overwrite(one.Length, Entry("marker 7 " + new string('y', 3000)) + Entry("marker 8 " + new string('z', 3100)));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Hidden_block_is_found_by_the_cadence_while_a_script_is_in_flight_and_the_cadence_is_throttled()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // A platform script is pending → contention. First pass in contention verifies at once.
+            h.Tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: null, exitObservedAtUtc: null, startedAtUtc: T0);
+            h.Now = T0.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.VerifyPasses);
+
+            // Same-length replacement, no growth, no signal: only the cadence can find it —
+            // and not before a second has passed since the last verification.
+            h.Overwrite(0, Entry("marker 7"));
+            h.Now = T0.AddMilliseconds(500);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+            Assert.Equal(1, h.Health.VerifyPasses);
+
+            h.Now = T0.AddMilliseconds(1200);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7 }, h.Matched());
+            Assert.Equal(2, h.Health.VerifyPasses);
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Without_contention_or_signal_nothing_is_verified()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+
+            for (var i = 0; i < 20; i++)
+            {
+                h.Now = h.Now.AddSeconds(1);
+                await h.Pass();
+            }
+
+            Assert.Equal(0, h.Health.VerifyPasses);
+            Assert.Equal(0, h.Health.VerifiedBytes);
+        }
+
+        [Fact]
+        public async Task Restart_seeds_the_ledger_so_an_overwrite_after_the_restart_is_still_found()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            h.Restart();
+            Assert.Equal(0, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            // First pass after the restart: nothing new to read, but the ledger is seeded from
+            // the bytes behind the persisted bookmark.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            h.Overwrite(0, Entry("marker 7"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // The counter is part of the persisted health.
+            h.Restart();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Rollover_clears_the_ledger_and_the_new_file_is_read_without_a_false_rewind()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            File.WriteAllText(h.LogPath, Entry("marker 7") + Entry("marker 8"), new UTF8Encoding(false));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+            Assert.Equal(2, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+        }
+
+        [Fact]
+        public async Task Cancelled_pass_does_not_lose_a_pending_check()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+
+            using (var cts = new CancellationTokenSource())
+            {
+                cts.Cancel();
+                await h.Pass(cts.Token);
+            }
+
+            // The cancelled pass touched nothing after the rewind; the next one reads it all.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+        }
+
+        // -----------------------------------------------------------------------
+        // The field scenario with the shipped patterns
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public async Task Executor_end_block_written_over_a_detection_invocation_belongs_to_its_own_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Executor E starts its platform script and waits for PowerShell.
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 12708"));
+            await h.Pass();
+            var executorPosition = h.Length;
+
+            // Detection executor D appends its whole run while E waits — the tracker reads it.
+            var detectionBlock = Entry("ExecutorLog AgentExecutor gets invoked") + Entry(DetectionStartLine)
+                + Entry("Powershell exit code is 3") + Entry("write output done. output = detected nothing, error = ")
+                + Entry("Agent executor completed.") + Entry(@"Writing result: False to resultFilePath: C:\x\App_cc46aa62.txt");
+            h.Append(detectionBlock);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // E ends: its end block lands at its own stale position, over D's lines.
+            var endBlock = Entry("Powershell exit code is 0") + Entry("write output done. output = Hello from E, error = ") + Entry("Agent executor completed.");
+            Assert.True(endBlock.Length < detectionBlock.Length);
+            h.Overwrite(executorPosition, endBlock);
+
+            // Nothing visible signalled the end; the cadence (E is pending) finds the block.
+            h.Now = h.Now.AddSeconds(1.5);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // IME's result line (in the other file) completes the script with E's own data.
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal("Hello from E", script.Stdout);
+        }
+
+        [Fact]
+        public async Task Detection_exit_lines_read_before_the_overwrite_never_reach_the_platform_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 1"));
+            await h.Pass();
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(DetectionStartLine)
+                + Entry("Powershell exit code is 3") + Entry("write output done. output = detected nothing, error = ") + Entry("Agent executor completed."));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // The platform result arrives without any end block ever becoming visible.
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Success", script.Result);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Ime_result_line_hidden_by_an_executor_start_line_is_recovered_from_the_ime_log()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            h.Append(Entry(GeneratedLine, "17") + Entry("Launch powershell executor in user session", "17") + Entry("process id = 10608", "17"));
+            await h.Pass();
+            var servicePosition = h.Length;
+
+            // The executor process appends its telemetry start line at the true end of file.
+            h.Append(Entry("[Telemetry] Telemetry is enabled. Starting mananger...", "1"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Empty(h.Completed);
+
+            // The service's first write after the script wait lands at ITS position — over the
+            // executor's line; the block is longer, so the pass sees a fragment at the bookmark.
+            h.Overwrite(servicePosition, Entry("Execution is done, collecting result", "17") + Entry(ResultLine, "17") + Entry("[PowerShell] Success, Result details length: 315", "17"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal("User", script.RunContext);
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ProvisioningStatusTrackerPendingFailureTests.cs

@@ -0,0 +1,92 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// <see cref="ProvisioningStatusTracker.TryGetPendingFailureArgs"/> exposes the registry
+    /// failure detail while its settle window is open and nothing once the window has fired —
+    /// the coordinator reads it when a Shell-Core failure terminalises first (session 683f1eff).
+    /// </summary>
+    public sealed class ProvisioningStatusTrackerPendingFailureTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 2, DateTimeKind.Utc);
+
+        private const string InProgressJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""inProgress"",""subcategoryStatusText"":""Apps (Working)""}
+        }";
+        private const string AppsFailedJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""failed"",""subcategoryStatusText"":""Apps (0x80070652)""}
+        }";
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public ProvisioningStatusTracker Tracker { get; }
+
+            public Fixture()
+            {
+                var post = new InformationalEventPost(new FakeSignalIngressSink(), new VirtualClock(Fixed));
+                var logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Tracker = new ProvisioningStatusTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: post,
+                    logger: logger,
+                    appxScanner: new FakeAppxDeploymentFailureScanner(),
+                    backgroundDispatcher: action => action());
+            }
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Nothing_pending_before_any_failure()
+        {
+            using var f = new Fixture();
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+
+        [Fact]
+        public void Armed_settle_window_exposes_the_registry_detail()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            var pending = f.Tracker.TryGetPendingFailureArgs();
+
+            Assert.NotNull(pending);
+            Assert.Equal("Provisioning_DeviceSetup_Apps_Failed", pending!.FailureType);
+            Assert.Equal("0x80070652", pending.ErrorCode);
+            Assert.Equal("Apps", pending.FailedSubcategory);
+            Assert.Equal("DeviceSetup", pending.Category);
+        }
+
+        [Fact]
+        public void Expired_settle_window_leaves_nothing_pending()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            f.Tracker.TriggerSettleTimerForTest("DeviceSetupCategory.Status");
+
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Telemetry/Gather/GuardrailsParityTests.cs

@@ -56,6 +56,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Telemetry.Gather
                 LoadEmbeddedGuardrails()["maxCommandLength"]!.Value<int>());
         }
 
+        [Fact]
+        public void User_profile_prefixes_are_all_accepted_by_the_loader()
+        {
+            // The loader drops entries outside AppData\Local / AppData\Roaming (the hard block
+            // would never release them anyway). A dropped entry is invisible at runtime — it
+            // just never matches — so a typo in the JSON must fail here instead.
+            var json = LoadEmbeddedGuardrails()["userProfileFilePrefixes"]?.ToObject<string[]>()
+                       ?? new string[0];
+
+            Assert.Equal(
+                json.Select(p => p.Trim().TrimEnd('\\')).OrderBy(p => p),
+                GatherRuleGuards.AllowedUserProfileFilePrefixes.OrderBy(p => p));
+        }
+
+        [Fact]
+        public void User_profile_prefixes_stay_under_the_hard_blocks_exception()
+        {
+            Assert.All(
+                GatherRuleGuards.AllowedUserProfileFilePrefixes,
+                prefix => Assert.Contains(
+                    GatherRuleGuards.AllowedUserProfileSubdirs,
+                    subdir => prefix.StartsWith(subdir, System.StringComparison.OrdinalIgnoreCase) &&
+                              (prefix.Length == subdir.Length || prefix[subdir.Length] == '\\')));
+        }
+
         [Fact]
         public void Blocked_event_log_channels_match_code_constants()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/EnrollmentOrchestratorTests.cs

@@ -265,6 +265,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             sut.Stop();
         }
 
+        [Fact]
+        public void Deadline_fired_late_keeps_the_due_time_as_stamp_and_carries_it_in_the_payload()
+        {
+            // A deadline that was due while the device slept (or the agent was down) fires only
+            // afterwards. The signal keeps the due time as OccurredAtUtc (D-238: the outage must not
+            // become session duration) and repeats it in the payload so the stale-fire guards
+            // identify the incarnation independently of the stamp.
+            using var rig = new EnrollmentOrchestratorRig(At);
+            var sut = rig.Build();
+            sut.Start();
+
+            var dueAt = At.AddMinutes(-5);
+            var scheduler = GetScheduler(sut);
+            scheduler.Schedule(new ActiveDeadline(
+                name: "hello_safety",
+                dueAtUtc: dueAt,
+                firesSignalKind: DecisionSignalKind.DeadlineFired,
+                firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = "hello_safety" }));
+
+            var signalLog = GetSignalLog(sut);
+            Assert.True(SpinWait.SpinUntil(() => ContainsDeadlineFired(signalLog), 3000));
+
+            DecisionSignal? fired = null;
+            foreach (var sig in signalLog.ReadAll())
+            {
+                if (sig.Kind == DecisionSignalKind.DeadlineFired) { fired = sig; break; }
+            }
+            Assert.NotNull(fired);
+            Assert.Equal(dueAt, fired!.OccurredAtUtc);
+            Assert.NotNull(fired.Payload);
+            Assert.Equal("hello_safety", fired.Payload![SignalPayloadKeys.Deadline]);
+            Assert.Equal(dueAt.ToString("O"), fired.Payload[SignalPayloadKeys.DeadlineDueAtUtc]);
+
+            sut.Stop();
+        }
+
         // ========================================================================= Quarantine
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/BoundedLineReader.cs

@@ -33,6 +33,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
         private readonly Stream _stream;
         private readonly int _maxLineBytes;
+        private readonly bool _hashLines;
         private readonly byte[] _readBuffer = new byte[ReadBufferSize];
         private int _readPos;
         private int _readLen;
@@ -41,21 +42,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
         private byte[] _line = new byte[4096];
         private int _lineLen;
+        private ulong _lineHash;
 
         /// <param name="stream">Seekable stream positioned at the first byte to read.</param>
         /// <param name="maxLineBytes">Upper bound of bytes kept per line; the remainder is discarded.</param>
-        public BoundedLineReader(Stream stream, int maxLineBytes)
+        /// <param name="hashLines">Fingerprint the raw bytes of every line (<see cref="LastLineHash"/>) — the
+        /// tracker's byte ledger needs it for multi-writer files only.</param>
+        public BoundedLineReader(Stream stream, int maxLineBytes, bool hashLines = false)
         {
             if (stream == null) throw new ArgumentNullException(nameof(stream));
             if (maxLineBytes <= 0) throw new ArgumentOutOfRangeException(nameof(maxLineBytes));
             _stream = stream;
             _maxLineBytes = maxLineBytes;
+            _hashLines = hashLines;
             _readBufferFileOffset = stream.Position;
         }
 
         /// <summary>Cap in bytes applied to every line.</summary>
         public int MaxLineBytes => _maxLineBytes;
 
+        /// <summary>
+        /// FNV-1a 64 over the bytes the most recently returned line was decoded from (BOM and
+        /// line terminator excluded; the capped prefix of a truncated line). Zero unless the
+        /// reader was created with hashing on.
+        /// </summary>
+        public ulong LastLineHash => _lineHash;
+
         /// <summary>Absolute file offset of the next unread byte (exact — no decoder read-ahead).</summary>
         public long Position => _readBufferFileOffset + _readPos;
 
@@ -78,6 +90,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             LastLineTerminated = false;
             LastLineTruncated = false;
             _lineLen = 0;
+            _lineHash = _hashLines ? Fnv1a64.OffsetBasis : 0UL;
             var sawAnyByte = false;
 
             while (true)
@@ -154,6 +167,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             // tail (and thus any CR) discarded, so the check is skipped there.
             if (LastLineTerminated && !LastLineTruncated && len > 0 && _line[start + len - 1] == (byte)'\r')
                 len--;
+            if (_hashLines)
+            {
+                // Fingerprint exactly the bytes the string is decoded from, so a tail that was
+                // first read unterminated and later gained its CRLF hashes the same.
+                var h = Fnv1a64.OffsetBasis;
+                var end = start + len;
+                for (var i = start; i < end; i++)
+                    h = (h ^ _line[i]) * Fnv1a64.Prime;
+                _lineHash = h;
+            }
             return len == 0 ? string.Empty : Encoding.UTF8.GetString(_line, start, len);
         }
     }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/CmTraceEntryAssembler.cs

@@ -0,0 +1,171 @@
+using System.Text;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>FNV-1a 64-bit — the entry fingerprint used by the tracker's byte ledger.</summary>
+    internal static class Fnv1a64
+    {
+        public const ulong OffsetBasis = 14695981039346656037UL;
+        public const ulong Prime = 1099511628211UL;
+
+        public static ulong Fold(ulong hash, ulong value) => (hash ^ value) * Prime;
+    }
+
+    /// <summary>One assembled CMTrace entry: its byte range in the file, the fingerprint of those bytes and the text.</summary>
+    internal struct AssembledEntry
+    {
+        public long Offset;
+        public int Length;
+        public ulong Hash;
+        public string Text;
+    }
+
+    /// <summary>
+    /// Turns physical lines into CMTrace entries: a line is one entry, unless it opens
+    /// <c>&lt;![LOG[</c> without its <c>]LOG]!&gt;</c> close — then the continuation lines up to the
+    /// closing one belong to it. Oversized lines and capped entries are dropped together with
+    /// their remaining continuation lines, so no fragment is ever matched as an entry.
+    /// <para>
+    /// The read loop and the ledger verification (<c>ImeLogTracker.Overwrite.cs</c>) both feed
+    /// this class, which is what makes their entry boundaries — and therefore the fingerprints
+    /// they compare — identical by construction.
+    /// </para>
+    /// </summary>
+    internal sealed class CmTraceEntryAssembler
+    {
+        public enum Outcome
+        {
+            /// <summary>The line was absorbed into an open multiline entry.</summary>
+            Buffered,
+            /// <summary>An entry is complete.</summary>
+            Entry,
+            /// <summary>A line over the byte cap was dropped (its entry with it).</summary>
+            OversizedDropped,
+            /// <summary>An open multiline entry hit the line/char cap and was dropped.</summary>
+            CapDropped,
+            /// <summary>A continuation line of a dropped entry was skipped.</summary>
+            Skipped,
+        }
+
+        private const string LogOpen = "<![LOG[";
+        private const string LogClose = "]LOG]!>";
+
+        private readonly int _maxLines;
+        private readonly int _maxChars;
+
+        private StringBuilder _buffer;
+        private int _lineCount;
+        private long _entryStart;
+        private ulong _entryHash;
+        private bool _skippingDroppedEntry;
+
+        public CmTraceEntryAssembler(int maxMultiLineBufferLines, int maxEntryBytes)
+        {
+            _maxLines = maxMultiLineBufferLines;
+            _maxChars = maxEntryBytes;
+        }
+
+        /// <summary>True while a multiline entry is being assembled.</summary>
+        public bool HasOpenEntry => _buffer != null;
+
+        /// <summary>File offset of the open multiline entry (valid while <see cref="HasOpenEntry"/>).</summary>
+        public long OpenEntryStart => _entryStart;
+
+        /// <summary>Line count of the entry dropped by the last <see cref="Outcome.CapDropped"/>.</summary>
+        public int DroppedLines { get; private set; }
+
+        /// <summary>Char count of the entry dropped by the last <see cref="Outcome.CapDropped"/>.</summary>
+        public int DroppedChars { get; private set; }
+
+        /// <summary>
+        /// Feeds one physical line. <paramref name="lineStart"/> / <paramref name="positionAfter"/>
+        /// are the line's file offsets (start, next unread byte), <paramref name="lineHash"/> the
+        /// reader's raw-byte fingerprint of the line.
+        /// </summary>
+        public Outcome Feed(string line, long lineStart, long positionAfter, bool truncated, ulong lineHash, out AssembledEntry entry)
+        {
+            entry = default(AssembledEntry);
+
+            if (truncated)
+            {
+                // The capped prefix only tells whether the line opened an entry whose remaining
+                // lines must be skipped rather than matched as raw text.
+                if (_buffer != null)
+                {
+                    _buffer = null;
+                    _lineCount = 0;
+                    _skippingDroppedEntry = true;
+                }
+                else if (line.StartsWith(LogOpen) && !line.Contains(LogClose))
+                {
+                    _skippingDroppedEntry = true;
+                }
+                return Outcome.OversizedDropped;
+            }
+
+            if (_skippingDroppedEntry)
+            {
+                // A line opening a new entry ends the skip and is processed itself — checked
+                // BEFORE the close-tag test, because a complete single-line entry contains both.
+                if (line.StartsWith(LogOpen))
+                    _skippingDroppedEntry = false;
+                else
+                {
+                    if (line.Contains(LogClose)) _skippingDroppedEntry = false;
+                    return Outcome.Skipped;
+                }
+            }
+
+            if (_buffer != null)
+            {
+                _buffer.Append('\n').Append(line);
+                _lineCount++;
+                _entryHash = Fnv1a64.Fold(_entryHash, lineHash);
+
+                if (line.Contains(LogClose))
+                {
+                    entry = new AssembledEntry
+                    {
+                        Offset = _entryStart,
+                        Length = (int)(positionAfter - _entryStart),
+                        Hash = _entryHash,
+                        Text = _buffer.ToString(),
+                    };
+                    _buffer = null;
+                    _lineCount = 0;
+                    return Outcome.Entry;
+                }
+
+                if (_lineCount >= _maxLines || _buffer.Length >= _maxChars)
+                {
+                    DroppedLines = _lineCount;
+                    DroppedChars = _buffer.Length;
+                    _buffer = null;
+                    _lineCount = 0;
+                    _skippingDroppedEntry = true;
+                    return Outcome.CapDropped;
+                }
+
+                return Outcome.Buffered;
+            }
+
+            if (line.StartsWith(LogOpen) && !line.Contains(LogClose))
+            {
+                _buffer = new StringBuilder(line);
+                _lineCount = 1;
+                _entryStart = lineStart;
+                _entryHash = lineHash;
+                return Outcome.Buffered;
+            }
+
+            entry = new AssembledEntry
+            {
+                Offset = lineStart,
+                Length = (int)(positionAfter - lineStart),
+                Hash = lineHash,
+                Text = line,
+            };
+            return Outcome.Entry;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Handlers.cs

@@ -222,19 +222,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // PowerShell script tracking handlers
         // -----------------------------------------------------------------------
 
-        // Returns the current platform-script accumulator, or null when no platform script is active.
+        // Returns the platform-script accumulator that owns the entry being processed, or null.
         // Health-script (remediation) state is no longer tracked line-by-line — the HS-NEW-RESULT
         // pattern delivers the full pre-detection / remediation / post-detection JSON in one shot
         // via HandleHealthScriptResult. The platform branch keeps its line-by-line accumulator
         // because PS-* patterns (PS-SCRIPT-CONTEXT / PS-SCRIPT-EXITCODE / PS-AGENT-OUTPUT / …) still
-        // arrive across multiple log lines.
-        private ScriptExecutionState GetCurrentPlatformScript()
-        {
-            if (!string.IsNullOrEmpty(_lastPlatformScriptPolicyId) &&
-                _pendingPlatformScripts.TryGetValue(_lastPlatformScriptPolicyId, out var state))
-                return state;
-            return null;
-        }
+        // arrive across multiple log lines; ownership is by file position (see
+        // ImeLogTracker.Overwrite.cs), never by which script happened to start last.
+        private ScriptExecutionState GetCurrentPlatformScript() => ResolvePlatformScriptForCurrentEntry();
 
         private void HandleScriptStarted(Match match, Dictionary<string, string> parameters)
         {
@@ -320,7 +315,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 try { OnScriptStarted?.Invoke(new ScriptStartedInfo { PolicyId = id, ScriptType = "platform" }); }
                 catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptStarted handler threw: {ex.Message}"); }
             }
-            _lastPlatformScriptPolicyId = id;
+            RecordInvocationMarker(id, isClose: false);
+            NoteInvocationActivity();
             // Started lines fire twice per script (agentexecutor + ime source) and carry no
             // outcome — the matching `platform script completed` line below carries result+exit
             // and stays on Info. Keep starts on Debug so Info reflects script outcomes only.
@@ -338,33 +334,34 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 : GetCurrentPlatformScript();
         }
 
-        // Session 6b4993e5 fix — platform-script stdout/exit cross-contamination.
-        //
-        // AgentExecutor.exe hosts BOTH platform scripts (…\Policies\Scripts\<id>.ps1) and
-        // proactive-remediation scripts (…\IMECache\HealthScripts\<id>\detect.ps1), and writes
-        // their lines interleaved into the shared AgentExecutor.log. The policyId-less
-        // PS-AGENT-EXITCODE ("Powershell exit code is N") and PS-AGENT-OUTPUT ("write output
-        // done. output = …") lines are routed to whichever platform script
-        // _lastPlatformScriptPolicyId points at. A remediation invocation's start
-        // ("Adding argument remediationScript …") does NOT match PS-AGENT-SCRIPT-START, so it
-        // never moves the pointer — its exit/output then bleed into the last-started PLATFORM
-        // script's slot (observed: platform c3e0124c emitted result=Failed but with exit 0 +
-        // stdout "[Compliant] No Classic Teams found" — the Teams remediation's output).
-        //
-        // Each AgentExecutor process logs "ExecutorLog AgentExecutor gets invoked" first, so a
-        // new banner means the previous invocation's line-capture context is over. Clearing the
-        // pointer here scopes line-capture to a single invocation: the immediately following
-        // "Adding argument powershell …\Policies\Scripts\<id>.ps1" (PS-AGENT-SCRIPT-START)
-        // re-establishes it for a platform invocation, while a remediation invocation leaves it
-        // null so its exit/output are dropped (the remediation's authoritative data still
-        // arrives via HS-NEW-RESULT). The platform script's final result is unaffected — it is
-        // keyed by policyId via PS-SCRIPT-RESULT, not by this pointer.
-        private void HandleAgentExecutorInvocationBoundary()
+        // AgentExecutor.exe hosts platform scripts (…\Policies\Scripts\<id>.ps1) as well as
+        // detection, requirement and proactive-remediation scripts, and its policyId-less
+        // PS-AGENT-EXITCODE / PS-AGENT-OUTPUT lines belong to whichever invocation owns that
+        // file position. The banner closes the previous invocation; the argument line that
+        // follows opens the next one — as a platform script when PS-AGENT-SCRIPT-START matched
+        // it, otherwise as an invocation whose exit/output are not captured (a remediation's
+        // authoritative data arrives via HS-NEW-RESULT; session 6b4993e5 saw its output bleed
+        // into a platform slot). "Agent executor completed" closes the invocation again.
+        private void HandleAgentExecutorInvocation()
         {
-            if (_lastPlatformScriptPolicyId == null) return;
-            _logger.Debug(
-                $"ImeLogTracker: AgentExecutor invocation boundary — clearing platform-script line-capture pointer (was {_lastPlatformScriptPolicyId}).");
-            _lastPlatformScriptPolicyId = null;
+            RecordInvocationMarker(null, isClose: true);
+            NoteInvocationActivity();
+        }
+
+        private void HandleAgentInvocationArgument(string kind)
+        {
+            RecordInvocationMarker(null, isClose: false);
+            NoteInvocationActivity();
+            if (!string.IsNullOrEmpty(kind) && !string.Equals(kind, "powershell", StringComparison.OrdinalIgnoreCase))
+                _logger.Debug($"ImeLogTracker: AgentExecutor invocation of kind '{kind}' — exit/output lines not captured as a platform script");
+        }
+
+        private void HandleAgentExecutorCompleted()
+        {
+            RecordInvocationMarker(null, isClose: true);
+            // The end block was written at the executor's own stream position — if that lay
+            // behind the bookmark, the ledger check on the next pass finds it.
+            RequestOverwriteCheck();
         }
 
         private void HandleScriptContext(Match match, Dictionary<string, string> parameters)
@@ -372,6 +369,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             var context = match.Groups["context"]?.Value;
             if (string.IsNullOrEmpty(context)) return;
 
+            NoteInvocationActivity();
             var runContext = string.Equals(context, "machine", StringComparison.OrdinalIgnoreCase) ? "System" : "User";
             var script = GetCurrentScriptForLineUpdate(parameters);
             if (script != null)
@@ -398,6 +396,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     script.ExitObservedAtUtc = LastMatchedLogTimestamp ?? DateTime.UtcNow;
                 _logger.Debug($"ImeLogTracker: script exit code {exitCode} for {script.PolicyId}");
             }
+            // An exit code means the executor just wrote its end block and IME is about to
+            // write the result — both land at a stale stream position when another process
+            // appended meanwhile. Check the ledgers on the next pass.
+            RequestOverwriteCheck();
         }
 
         private void HandleScriptOutput(Match match, Dictionary<string, string> parameters)
@@ -455,8 +457,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 _logger.Debug($"ImeLogTracker: platform script {id} PS-SCRIPT-RESULT arrived after fallback emit — skipping duplicate");
                 _pendingPlatformScripts.Remove(id);
-                if (string.Equals(_lastPlatformScriptPolicyId, id, StringComparison.OrdinalIgnoreCase))
-                    _lastPlatformScriptPolicyId = null;
                 return;
             }
 
@@ -496,17 +496,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             _platformScriptResultEmitted.Add(id);
             _pendingPlatformScripts.Remove(id);
             _stateDirty = true;
-            if (string.Equals(_lastPlatformScriptPolicyId, id, StringComparison.OrdinalIgnoreCase))
-                _lastPlatformScriptPolicyId = null;
+            // The result block is IME's first write after the script wait — the executor's end
+            // block in the other file may have landed behind the bookmark at the same time.
+            RequestOverwriteCheck();
         }
 
         /// <summary>
         /// Grace period after a platform script's AgentExecutor exit code is observed before
         /// <see cref="FlushStalePlatformScriptResults"/> emits a completion from that exit code.
-        /// IME logs its authoritative <c>PS-SCRIPT-RESULT</c> line within ~1 s of exit on healthy
-        /// reporting cycles, so 15 s lets the normal path win virtually always — the fallback is a
-        /// true safety net for the case where IME has not flushed its batch-send to the Microsoft
-        /// service before the (often short) Autopilot enrollment ends and the agent terminates.
+        /// IME logs its authoritative <c>PS-SCRIPT-RESULT</c> line within ~1 s of exit; when it
+        /// is missing after 15 s it was hidden by a concurrent writer (the ledger check in
+        /// <c>ImeLogTracker.Overwrite.cs</c> recovers that line) or the enrollment ended before
+        /// IME wrote it — this fallback is the safety net for the remaining cases.
         /// </summary>
         private static readonly TimeSpan PlatformScriptResultGrace = TimeSpan.FromSeconds(15);
 
@@ -578,11 +579,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 // the state file before a restart or the restarted tracker re-emits (H1).
                 _stateDirty = true;
                 foreach (var key in toRemove)
-                {
                     _pendingPlatformScripts.Remove(key);
-                    if (string.Equals(_lastPlatformScriptPolicyId, key, StringComparison.OrdinalIgnoreCase))
-                        _lastPlatformScriptPolicyId = null;
-                }
+                RequestOverwriteCheck();
             }
         }
 
@@ -602,7 +600,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 Stdout = stdout,
                 StartedAtUtc = startedAtUtc,
             };
-            _lastPlatformScriptPolicyId = policyId;
+            NextTestEntry();
+            RecordInvocationMarker(policyId, isClose: false);
         }
 
         /// <summary>Test seam: simulate the authoritative IME PS-SCRIPT-RESULT path for a platform
@@ -616,8 +615,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             if (_platformScriptResultEmitted.Contains(policyId))
             {
                 _pendingPlatformScripts.Remove(policyId);
-                if (string.Equals(_lastPlatformScriptPolicyId, policyId, StringComparison.OrdinalIgnoreCase))
-                    _lastPlatformScriptPolicyId = null;
                 return;
             }
 
@@ -642,8 +639,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             EmitScriptEvent(script);
             _platformScriptResultEmitted.Add(policyId);
             _pendingPlatformScripts.Remove(policyId);
-            if (string.Equals(_lastPlatformScriptPolicyId, policyId, StringComparison.OrdinalIgnoreCase))
-                _lastPlatformScriptPolicyId = null;
             _stateDirty = true;
         }
 
@@ -794,6 +789,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 return;
             }
             HandleHealthScriptResultJson(json);
+            // A remediation executor just ended too — its end block may sit behind the bookmark.
+            RequestOverwriteCheck();
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -78,243 +78,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
                 try
                 {
-                    var fileInfo = new FileInfo(filePath);
-                    if (!fileInfo.Exists) continue;
-
-                    // Captured BEFORE MarkChecked below stamps this pass. Growth measured
-                    // against a previously observed state is what makes this pass's lines valid
-                    // "written now" anchors — for the per-file measurement AND per-line anchoring.
-                    var hadPreviousObservation = _positionTracker.HasSeen(filePath);
-                    var lastCheckedUtc = _positionTracker.GetLastCheckedUtc(filePath);
-                    var passNowUtc = UtcNowProvider();
-
-                    var startPos = _positionTracker.GetSafePosition(filePath, fileInfo.Length);
-
-                    // Every look counts, including "no new data" and an empty first sight: the
-                    // NEXT pass's freshness window is measured from here. Restored bookmarks
-                    // deliberately carry no LastCheckedUtc — the first pass after a restart reads
-                    // downtime backlog and must never count as fresh.
-                    _positionTracker.MarkChecked(filePath, passNowUtc);
-
-                    if (startPos >= fileInfo.Length)
-                    {
-                        // M2: guard the interpolated string so it isn't built every 100 ms tick
-                        // (per file) when Trace is off — which is the production default (Info).
-                        if (_logger.LogLevel >= AgentLogLevel.Trace)
-                            _logger.Trace($"ImeLogTracker: {Path.GetFileName(filePath)} — no new data (pos={startPos}, size={fileInfo.Length})");
-                        continue;
-                    }
-                    if (_logger.LogLevel >= AgentLogLevel.Trace)
-                        _logger.Trace($"ImeLogTracker: reading {Path.GetFileName(filePath)} from pos {startPos} (size={fileInfo.Length}, delta={fileInfo.Length - startPos})");
-
-                    _currentSourceFileName = Path.GetFileName(filePath);
-                    _currentPassLinesAreFresh = hadPreviousObservation
-                        && lastCheckedUtc > DateTime.MinValue
-                        && (passNowUtc - lastCheckedUtc) <= FreshLineMaxAge;
-
-                    // Newest bias-less line of this pass — the calibration anchor. Bias-carrying
-                    // lines are skipped: they already state the writer's offset, so they need no
-                    // measurement and must not overwrite one.
-                    CmTraceLogEntry calibrationAnchor = null;
-
-                    using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
-                    {
-                        stream.Seek(startPos, SeekOrigin.Begin);
-
-                        var reader = new BoundedLineReader(stream, MaxEntryBytes);
-                        var stats = new PassStats();
-
-                        // Buffer for multiline CMTrace entries (e.g. AgentExecutor.log
-                        // "write output done. output = ..." spans many lines)
-                        StringBuilder multiLineBuffer = null;
-                        int multiLineCount = 0;
-                        // Set after a capped entry is dropped: its remaining physical lines
-                        // are skipped instead of being matched as raw text, until the entry
-                        // closes or a new entry begins (so no real entry is lost).
-                        bool skippingDroppedEntry = false;
-                        // File offset where the entry currently being assembled/processed
-                        // begins — the bookmark to fall back to when that entry is NOT
-                        // consumed (cancellation, or a held-back unterminated tail).
-                        long entryStart = startPos;
-                        // Where the next pass resumes. EOF unless an entry is left unconsumed.
-                        long resumePos;
-
-                        while (true)
-                        {
-                            // CancellationToken.None: cancellation is honoured by the explicit
-                            // check below (exact bookmark) rather than by an exception out of
-                            // the read, which the poll loop would log as an error.
-                            var line = await reader.ReadLineAsync(CancellationToken.None);
-                            if (line == null)
-                            {
-                                // EOF. An in-flight multiline entry here is an entry the writer
-                                // has not finished — hold it back (see HoldBackTail) instead of
-                                // dropping it and raw-matching its remaining lines next pass.
-                                if (multiLineBuffer != null && HoldBackTail(filePath, entryStart, fileInfo.Length, passNowUtc))
-                                {
-                                    _heldTailCount++;
-                                    resumePos = entryStart;
-                                    break;
-                                }
-                                resumePos = reader.Position;
-                                break;
-                            }
-
-                            if (token.IsCancellationRequested)
-                            {
-                                // Exact bookmark: nothing of this line (or of the multiline
-                                // entry it belongs to) has been handled.
-                                resumePos = multiLineBuffer != null ? entryStart : reader.LastLineStart;
-                                break;
-                            }
-
-                            if (multiLineBuffer == null)
-                                entryStart = reader.LastLineStart;
-
-                            _linesRead++;
-
-                            // A physical line over the cap is never matched: its captures would be
-                            // cut and the regexes would run over attacker-sized input. The capped
-                            // prefix is enough to tell whether it opened an entry whose remaining
-                            // lines must be skipped rather than raw-matched.
-                            if (reader.LastLineTruncated)
-                            {
-                                stats.OversizedLines++;
-                                _oversizedLines++;
-                                if (multiLineBuffer != null)
-                                {
-                                    multiLineBuffer = null;
-                                    multiLineCount = 0;
-                                    skippingDroppedEntry = true;
-                                }
-                                else if (line.StartsWith("<![LOG[") && !line.Contains("]LOG]!>"))
-                                {
-                                    skippingDroppedEntry = true;
-                                }
-                                continue;
-                            }
-
-                            if (!reader.LastLineTerminated && multiLineBuffer == null
-                                && HoldBackTail(filePath, reader.LastLineStart, fileInfo.Length, passNowUtc))
-                            {
-                                // Unterminated single line at EOF: the writer is mid-line.
-                                _heldTailCount++;
-                                resumePos = reader.LastLineStart;
-                                break;
-                            }
-
-                            if (skippingDroppedEntry)
-                            {
-                                // A line opening a new entry ends the skip and is processed
-                                // itself — checked BEFORE the close-tag test, because a complete
-                                // single-line entry contains both and must not be consumed as
-                                // the dropped entry's close.
-                                if (line.StartsWith("<![LOG["))
-                                    skippingDroppedEntry = false;
-                                else
-                                {
-                                    if (line.Contains("]LOG]!>")) skippingDroppedEntry = false;
-                                    continue;
-                                }
-                            }
-
-                            // --- Multiline CMTrace buffering ---
-                            // CMTrace entries: <![LOG[message]LOG]!><time=...>
-                            // When message contains newlines, the entry spans multiple lines.
-                            // We buffer until we find the closing ]LOG]!> tag.
-                            if (multiLineBuffer != null)
-                            {
-                                // Continuing a multiline entry
-                                multiLineBuffer.Append('\n').Append(line);
-                                multiLineCount++;
-
-                                if (line.Contains("]LOG]!>"))
-                                {
-                                    // Entry complete — use the assembled line
-                                    line = multiLineBuffer.ToString();
-                                    multiLineBuffer = null;
-                                    multiLineCount = 0;
-                                }
-                                else if (multiLineCount >= MaxMultiLineBufferLines || multiLineBuffer.Length >= MaxEntryBytes)
-                                {
-                                    // Safety limit — discard to bound memory and parser work. Warning
-                                    // (not Debug) so a capped entry is visible in the client log at the
-                                    // default level: a real IME entry this large would be news.
-                                    _logger.Warning($"ImeLogTracker: discarding multiline CMTrace buffer in {Path.GetFileName(filePath)} after {multiLineCount} lines / {multiLineBuffer.Length} chars (cap {MaxMultiLineBufferLines} lines / {MaxEntryBytes} chars) — entry dropped");
-                                    multiLineBuffer = null;
-                                    multiLineCount = 0;
-                                    skippingDroppedEntry = true;
-                                    continue;
-                                }
-                                else
-                                {
-                                    // Still accumulating — read next line
-                                    continue;
-                                }
-                            }
-                            else if (line.StartsWith("<![LOG[") && !line.Contains("]LOG]!>"))
-                            {
-                                // Start of a multiline CMTrace entry
-                                multiLineBuffer = new StringBuilder(line);
-                                multiLineCount = 1;
-                                continue;
-                            }
-
-                            // --- Normal processing (single-line or completed multiline) ---
-                            CmTraceLogEntry entry;
-                            string messageToMatch;
-                            _currentEntryOffset = entryStart;
-                            if (CmTraceLogParser.TryParseLine(line, out entry))
-                            {
-                                messageToMatch = entry.Message;
-                                if (entry.HasTimestamp && !entry.BiasMinutes.HasValue)
-                                    calibrationAnchor = entry;
-                            }
-                            else
-                            {
-                                // Non-CMTrace line - match raw
-                                messageToMatch = line;
-                                entry = null;
-                            }
-
-                            if (string.IsNullOrEmpty(messageToMatch)) continue;
-
-                            // Simulation mode delay
-                            if (SimulationMode && entry != null)
-                            {
-                                await ApplySimulationDelay(ResolveEntryUtc(entry), token);
-                            }
-
-                            MatchLine(filePath, line, messageToMatch, entry, stats);
-                        }
-
-                        ClearHeldTailIfConsumed(filePath, resumePos);
-                        _positionTracker.SetPosition(filePath, resumePos);
-                        _stateDirty = true;
-                        backlogBytes += Math.Max(0, fileInfo.Length - resumePos);
-
-                        // One line per pass and file, never per hostile line: the counters are
-                        // the operator's only trace that matching was skipped or cut short.
-                        if (stats.RegexTimeouts > 0 || stats.BudgetBreaks > 0 || stats.OversizedLines > 0)
-                        {
-                            _logger.Warning(
-                                $"ImeLogTracker: {Path.GetFileName(filePath)} pass skipped work — " +
-                                $"oversizedLines={stats.OversizedLines} (cap {MaxEntryBytes} bytes), " +
-                                $"regexTimeouts={stats.RegexTimeouts}, lineBudgetBreaks={stats.BudgetBreaks}" +
-                                (stats.FirstSkippedPatternId != null ? $", firstSkippedPattern={stats.FirstSkippedPatternId}" : string.Empty));
-                            RaiseTrackerDegradedOnce(Path.GetFileName(filePath), stats.FirstSkippedPatternId);
-                        }
-
-                        // Calibrate AFTER the pass: this pass's lines were resolved with the
-                        // offset established previously, at most one poll (100 ms) old. Buffering
-                        // the pass to calibrate first is not an option — the first pass of
-                        // AppWorkload.log can be hundreds of MB. The cost is a warm-up of one
-                        // growing pass, during which lines fall back to the reader zone and are
-                        // flagged as such.
-                        if (hadPreviousObservation && calibrationAnchor != null)
-                            CalibrateFrom(_currentSourceFileName, Path.GetFileName(filePath), calibrationAnchor);
-                        _currentEntryOffset = -1;
-                    }
+                    backlogBytes += await ProcessFileAsync(filePath, token);
                 }
                 catch (FileNotFoundException) { }
                 catch (IOException ex)
@@ -330,6 +94,246 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             }
         }
 
+        /// <summary>
+        /// One pass over one file: the bytes behind the bookmark, on a multi-writer file preceded
+        /// by the overwrite check that may move the bookmark back first (see
+        /// <c>ImeLogTracker.Overwrite.cs</c>). Returns the file's remaining backlog in bytes.
+        /// </summary>
+        private async Task<long> ProcessFileAsync(string filePath, CancellationToken token)
+        {
+            var fileInfo = new FileInfo(filePath);
+            if (!fileInfo.Exists) return 0;
+
+            // Captured BEFORE MarkChecked below stamps this pass. Growth measured
+            // against a previously observed state is what makes this pass's lines valid
+            // "written now" anchors — for the per-file measurement AND per-line anchoring.
+            var hadPreviousObservation = _positionTracker.HasSeen(filePath);
+            var lastCheckedUtc = _positionTracker.GetLastCheckedUtc(filePath);
+            var passNowUtc = UtcNowProvider();
+
+            var startPos = _positionTracker.GetSafePosition(filePath, fileInfo.Length);
+
+            // Every look counts, including "no new data" and an empty first sight: the
+            // NEXT pass's freshness window is measured from here. Restored bookmarks
+            // deliberately carry no LastCheckedUtc — the first pass after a restart reads
+            // downtime backlog and must never count as fresh.
+            _positionTracker.MarkChecked(filePath, passNowUtc);
+
+            var fileName = Path.GetFileName(filePath);
+            var ledger = IsMultiWriterLogFile(fileName) ? GetLedger(fileName) : null;
+
+            // Set by a rewind: entries that still read unchanged behind the old bookmark are
+            // skipped, and nothing below the old bookmark is fresh or a calibration anchor.
+            HashSet<LedgerEntry> rewoundEntries = null;
+            long oldBookmark = -1;
+
+            if (ledger != null)
+            {
+                var rewindTo = await PrepareLedgerAsync(filePath, fileName, ledger, startPos, passNowUtc, token);
+                if (rewindTo >= 0)
+                {
+                    rewoundEntries = ApplyRewind(filePath, fileName, ledger, rewindTo, startPos);
+                    oldBookmark = startPos;
+                    startPos = rewindTo;
+                }
+            }
+
+            if (startPos >= fileInfo.Length)
+            {
+                // M2: guard the interpolated string so it isn't built every 100 ms tick
+                // (per file) when Trace is off — which is the production default (Info).
+                if (_logger.LogLevel >= AgentLogLevel.Trace)
+                    _logger.Trace($"ImeLogTracker: {fileName} — no new data (pos={startPos}, size={fileInfo.Length})");
+                return 0;
+            }
+            if (_logger.LogLevel >= AgentLogLevel.Trace)
+                _logger.Trace($"ImeLogTracker: reading {fileName} from pos {startPos} (size={fileInfo.Length}, delta={fileInfo.Length - startPos})");
+
+            _currentSourceFileName = fileName;
+            var passLinesAreFresh = hadPreviousObservation
+                && lastCheckedUtc > DateTime.MinValue
+                && (passNowUtc - lastCheckedUtc) <= FreshLineMaxAge;
+            _currentPassLinesAreFresh = passLinesAreFresh;
+
+            // Newest bias-less line of this pass — the calibration anchor. Bias-carrying
+            // lines are skipped: they already state the writer's offset, so they need no
+            // measurement and must not overwrite one.
+            CmTraceLogEntry calibrationAnchor = null;
+
+            using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+            {
+                // Guard zone: the file grew and is open anyway — re-check the entries just behind
+                // the bookmark, where a stale writer's block lands when it is short.
+                if (ledger != null && rewoundEntries == null && ledger.Entries.Count > 0)
+                {
+                    var guardFrom = ledger.OffsetOfEntryAtOrAfter(startPos - OverwriteGuardBytes);
+                    if (guardFrom >= 0 && guardFrom < startPos)
+                    {
+                        var divergence = await FindOverwriteAsync(stream, ledger, guardFrom, startPos, token);
+                        _verifiedBytes += startPos - guardFrom;
+                        if (divergence >= 0)
+                        {
+                            // The guard saw only the tail of the ledger; the block may start earlier.
+                            var earliest = await FindOverwriteAsync(stream, ledger, ledger.StartOffset, startPos, token);
+                            _verifiedBytes += startPos - ledger.StartOffset;
+                            _verifyPasses++;
+                            if (earliest >= 0) divergence = earliest;
+                            rewoundEntries = ApplyRewind(filePath, fileName, ledger, divergence, startPos);
+                            oldBookmark = startPos;
+                            startPos = divergence;
+                        }
+                    }
+                }
+
+                stream.Seek(startPos, SeekOrigin.Begin);
+
+                var reader = new BoundedLineReader(stream, MaxEntryBytes, hashLines: ledger != null);
+                var assembler = new CmTraceEntryAssembler(MaxMultiLineBufferLines, MaxEntryBytes);
+                var stats = new PassStats();
+                var firstEntry = true;
+                // Where the next pass resumes. EOF unless an entry is left unconsumed.
+                long resumePos;
+
+                while (true)
+                {
+                    // CancellationToken.None: cancellation is honoured by the explicit
+                    // check below (exact bookmark) rather than by an exception out of
+                    // the read, which the poll loop would log as an error.
+                    var line = await reader.ReadLineAsync(CancellationToken.None);
+                    if (line == null)
+                    {
+                        // EOF. An in-flight multiline entry here is an entry the writer
+                        // has not finished — hold it back (see HoldBackTail) instead of
+                        // dropping it and raw-matching its remaining lines next pass.
+                        if (assembler.HasOpenEntry && HoldBackTail(filePath, assembler.OpenEntryStart, fileInfo.Length, passNowUtc))
+                        {
+                            _heldTailCount++;
+                            resumePos = assembler.OpenEntryStart;
+                            break;
+                        }
+                        resumePos = reader.Position;
+                        break;
+                    }
+
+                    if (token.IsCancellationRequested)
+                    {
+                        // Exact bookmark: nothing of this line (or of the multiline
+                        // entry it belongs to) has been handled.
+                        resumePos = assembler.HasOpenEntry ? assembler.OpenEntryStart : reader.LastLineStart;
+                        break;
+                    }
+
+                    _linesRead++;
+
+                    if (!reader.LastLineTruncated && !reader.LastLineTerminated && !assembler.HasOpenEntry
+                        && HoldBackTail(filePath, reader.LastLineStart, fileInfo.Length, passNowUtc))
+                    {
+                        // Unterminated single line at EOF: the writer is mid-line.
+                        _heldTailCount++;
+                        resumePos = reader.LastLineStart;
+                        break;
+                    }
+
+                    AssembledEntry entry;
+                    var outcome = assembler.Feed(line, reader.LastLineStart, reader.Position, reader.LastLineTruncated, reader.LastLineHash, out entry);
+                    if (outcome == CmTraceEntryAssembler.Outcome.OversizedDropped)
+                    {
+                        // A physical line over the cap is never matched: its captures would be
+                        // cut and the regexes would run over attacker-sized input.
+                        stats.OversizedLines++;
+                        _oversizedLines++;
+                        continue;
+                    }
+                    if (outcome == CmTraceEntryAssembler.Outcome.CapDropped)
+                    {
+                        // Warning (not Debug) so a capped entry is visible in the client log at the
+                        // default level: a real IME entry this large would be news.
+                        _logger.Warning($"ImeLogTracker: discarding multiline CMTrace buffer in {fileName} after {assembler.DroppedLines} lines / {assembler.DroppedChars} chars (cap {MaxMultiLineBufferLines} lines / {MaxEntryBytes} chars) — entry dropped");
+                        continue;
+                    }
+                    if (outcome != CmTraceEntryAssembler.Outcome.Entry) continue;
+
+                    if (firstEntry)
+                    {
+                        firstEntry = false;
+                        // A fragment right at the bookmark of a multi-writer file (the previous
+                        // entry ended exactly here, this one does not open an entry) is the tail of
+                        // a block a stale writer laid over already-read bytes: verify before reading on.
+                        if (ledger != null && rewoundEntries == null && entry.Offset == ledger.EndOffset
+                            && ledger.LastFragmentOffset != entry.Offset && !entry.Text.StartsWith("<![LOG["))
+                        {
+                            ledger.VerifyRequested = true;
+                            ledger.LastFragmentOffset = entry.Offset;
+                            resumePos = entry.Offset;
+                            break;
+                        }
+                    }
+
+                    if (ledger != null) ledger.Record(entry);
+                    if (rewoundEntries != null && rewoundEntries.Contains(new LedgerEntry { Offset = entry.Offset, Hash = entry.Hash }))
+                        continue; // unchanged behind the old bookmark — processed before the rewind
+
+                    _currentPassLinesAreFresh = passLinesAreFresh && entry.Offset >= oldBookmark;
+
+                    // --- Normal processing (single-line or completed multiline) ---
+                    CmTraceLogEntry parsed;
+                    string messageToMatch;
+                    _currentEntryOffset = entry.Offset;
+                    if (CmTraceLogParser.TryParseLine(entry.Text, out parsed))
+                    {
+                        messageToMatch = parsed.Message;
+                        if (parsed.HasTimestamp && !parsed.BiasMinutes.HasValue && entry.Offset >= oldBookmark)
+                            calibrationAnchor = parsed;
+                    }
+                    else
+                    {
+                        // Non-CMTrace line - match raw
+                        messageToMatch = entry.Text;
+                        parsed = null;
+                    }
+
+                    if (string.IsNullOrEmpty(messageToMatch)) continue;
+
+                    // Simulation mode delay
+                    if (SimulationMode && parsed != null)
+                    {
+                        await ApplySimulationDelay(ResolveEntryUtc(parsed), token);
+                    }
+
+                    MatchLine(filePath, entry.Text, messageToMatch, parsed, stats);
+                }
+
+                ClearHeldTailIfConsumed(filePath, resumePos);
+                _positionTracker.SetPosition(filePath, resumePos);
+                _stateDirty = true;
+                if (ledger != null) ledger.TrimBelow(RetentionFloor(fileName, resumePos));
+
+                // One line per pass and file, never per hostile line: the counters are
+                // the operator's only trace that matching was skipped or cut short.
+                if (stats.RegexTimeouts > 0 || stats.BudgetBreaks > 0 || stats.OversizedLines > 0)
+                {
+                    _logger.Warning(
+                        $"ImeLogTracker: {fileName} pass skipped work — " +
+                        $"oversizedLines={stats.OversizedLines} (cap {MaxEntryBytes} bytes), " +
+                        $"regexTimeouts={stats.RegexTimeouts}, lineBudgetBreaks={stats.BudgetBreaks}" +
+                        (stats.FirstSkippedPatternId != null ? $", firstSkippedPattern={stats.FirstSkippedPatternId}" : string.Empty));
+                    RaiseTrackerDegradedOnce(fileName, stats.FirstSkippedPatternId);
+                }
+
+                // Calibrate AFTER the pass: this pass's lines were resolved with the
+                // offset established previously, at most one poll (100 ms) old. Buffering
+                // the pass to calibrate first is not an option — the first pass of
+                // AppWorkload.log can be hundreds of MB. The cost is a warm-up of one
+                // growing pass, during which lines fall back to the reader zone and are
+                // flagged as such.
+                if (hadPreviousObservation && calibrationAnchor != null)
+                    CalibrateFrom(_currentSourceFileName, fileName, calibrationAnchor);
+                _currentEntryOffset = -1;
+
+                return Math.Max(0, fileInfo.Length - resumePos);
+            }
+        }
+
         private sealed class PassStats
         {
             public int RegexTimeouts;
@@ -828,10 +832,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         break;
 
                     case "resetplatformscriptcontext":
-                        // Session 6b4993e5 fix: a fresh AgentExecutor invocation banner
-                        // ("ExecutorLog AgentExecutor gets invoked") ends the previous
-                        // invocation's line-capture context. See HandleAgentExecutorInvocationBoundary.
-                        HandleAgentExecutorInvocationBoundary();
+                        // "ExecutorLog AgentExecutor gets invoked": a new process — the executor
+                        // lines that follow belong to its own argument line, never to the
+                        // previous invocation (session 6b4993e5).
+                        HandleAgentExecutorInvocation();
+                        break;
+
+                    case "agentinvocationargument":
+                        HandleAgentInvocationArgument(match.Groups["kind"]?.Value);
+                        break;
+
+                    case "agentexecutorcompleted":
+                        HandleAgentExecutorCompleted();
                         break;
 
                     case "healthscriptresult":
@@ -864,6 +876,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         internal void ProcessLogMessageForTest(string message, DateTime? sourceTimestampUtc = null)
         {
             if (string.IsNullOrEmpty(message)) return;
+            NextTestEntry();
             // The test seam hands in an already-resolved UTC instant, so it takes the same route a
             // writer-declared bias does: TimestampUtc set, no zone left to guess.
             var entry = sourceTimestampUtc.HasValue

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Overwrite.cs

@@ -0,0 +1,465 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>
+    /// Partial: overwrite-aware tailing of the two IME logs that several processes append to.
+    /// <para>
+    /// IME's trace listener opens each log once per process with FileMode.Append and
+    /// FileShare.ReadWrite and writes at its own stream position afterwards. AgentExecutor.exe
+    /// (two processes per user-context script, one per detection or remediation script) has such
+    /// a listener on AgentExecutor.log AND on IntuneManagementExtension.log. Whenever one process
+    /// resumes writing after another one appended, it overwrites those bytes: the final file
+    /// holds the last writer, while a tailer that trusts its bookmark read the first version and
+    /// never sees the second (session 46749560: 6 of 16 script results, 4 of 16 exit blocks).
+    /// </para>
+    /// <para>
+    /// So the bytes behind the bookmark are not immutable. The tracker keeps a fingerprint ledger
+    /// of every entry it read from these files, re-verifies it while script invocations are in
+    /// flight or right after a signal that a stale writer just wrote, and on the first changed
+    /// entry rewinds the bookmark — processing only entries it has not processed before.
+    /// </para>
+    /// </summary>
+    public partial class ImeLogTracker
+    {
+        /// <summary>Live logs with more than one writing process; archived rotations are closed files.</summary>
+        internal static readonly string[] MultiWriterLogFiles = { "AgentExecutor.log", "IntuneManagementExtension.log" };
+
+        /// <summary>Ledger depth behind the bookmark while no script is in flight.</summary>
+        internal const int LedgerRetentionBytes = 1024 * 1024;
+
+        /// <summary>Hard cap on the ledger depth, whatever is in flight.</summary>
+        internal const int LedgerMaxBytes = 4 * 1024 * 1024;
+
+        /// <summary>Entries this close to the bookmark are re-checked on every pass that found growth (the file is open anyway).</summary>
+        internal const int OverwriteGuardBytes = 4 * 1024;
+
+        /// <summary>After a restart the ledger is seeded from this many bytes before the persisted bookmark.</summary>
+        internal const int RestartSeedBytes = 64 * 1024;
+
+        /// <summary>Verification work per second while in contention — a deep ledger is checked less often, never skipped.</summary>
+        internal const long VerifyBudgetBytesPerSecond = 256 * 1024;
+
+        internal static readonly TimeSpan VerifyMinInterval = TimeSpan.FromSeconds(1);
+
+        /// <summary>How long an observed invocation keeps the files in contention on its own (detection executors have no pending slot).</summary>
+        internal static readonly TimeSpan InvocationContentionWindow = TimeSpan.FromSeconds(120);
+
+        /// <summary>A pending script older than this no longer holds the files in contention.</summary>
+        internal static readonly TimeSpan MaxPendingScriptContention = TimeSpan.FromHours(2);
+
+        private const int MaxInvocationMarkersPerFile = 512;
+        private const string TestSourceFileName = "TEST.log";
+        private const string LogOpenTag = "<![LOG[";
+
+        /// <summary>One processed entry: where it starts, how far it reaches, what its bytes hashed to.</summary>
+        internal struct LedgerEntry : IEquatable<LedgerEntry>
+        {
+            public long Offset;
+            public int Length;
+            public ulong Hash;
+
+            // Identity is (offset, hash): a tail first read unterminated and later completed
+            // keeps its hash but grows by its terminator.
+            public bool Equals(LedgerEntry other) => Offset == other.Offset && Hash == other.Hash;
+            public override bool Equals(object obj) => obj is LedgerEntry other && Equals(other);
+            public override int GetHashCode() => unchecked(((int)Offset * 397) ^ (int)Hash ^ (int)(Hash >> 32));
+        }
+
+        internal sealed class FileLedger
+        {
+            public readonly List<LedgerEntry> Entries = new List<LedgerEntry>();
+            public bool VerifyRequested;
+            public DateTime NextCadenceVerifyUtc = DateTime.MinValue;
+            public long LastFragmentOffset = -1;
+            public bool Seeded;
+            public bool RewindLogged;
+
+            public long StartOffset => Entries.Count > 0 ? Entries[0].Offset : -1;
+            public long EndOffset => Entries.Count > 0 ? Entries[Entries.Count - 1].Offset + Entries[Entries.Count - 1].Length : -1;
+
+            public int IndexOfFirstAtOrAfter(long offset)
+            {
+                int lo = 0, hi = Entries.Count;
+                while (lo < hi)
+                {
+                    var mid = (lo + hi) >> 1;
+                    if (Entries[mid].Offset < offset) lo = mid + 1; else hi = mid;
+                }
+                return lo;
+            }
+
+            /// <summary>Entry offset at or after <paramref name="offset"/>, or -1.</summary>
+            public long OffsetOfEntryAtOrAfter(long offset)
+            {
+                var idx = IndexOfFirstAtOrAfter(offset);
+                return idx < Entries.Count ? Entries[idx].Offset : -1;
+            }
+
+            public void Record(AssembledEntry e)
+            {
+                var idx = IndexOfFirstAtOrAfter(e.Offset);
+                if (idx < Entries.Count) Entries.RemoveRange(idx, Entries.Count - idx);
+                Entries.Add(new LedgerEntry { Offset = e.Offset, Length = e.Length, Hash = e.Hash });
+            }
+
+            /// <summary>Drops everything from <paramref name="offset"/> on and returns it — the entries a rewind must not process twice.</summary>
+            public HashSet<LedgerEntry> TruncateFrom(long offset)
+            {
+                var idx = IndexOfFirstAtOrAfter(offset);
+                var removed = new HashSet<LedgerEntry>();
+                for (var i = idx; i < Entries.Count; i++) removed.Add(Entries[i]);
+                if (idx < Entries.Count) Entries.RemoveRange(idx, Entries.Count - idx);
+                return removed;
+            }
+
+            public void TrimBelow(long floor)
+            {
+                var idx = IndexOfFirstAtOrAfter(floor);
+                if (idx > 0) Entries.RemoveRange(0, idx);
+            }
+
+            public void Clear()
+            {
+                Entries.Clear();
+                LastFragmentOffset = -1;
+            }
+        }
+
+        // Keyed by file name (unique within the log folder). Poll thread only.
+        private readonly Dictionary<string, FileLedger> _ledgers = new Dictionary<string, FileLedger>(StringComparer.OrdinalIgnoreCase);
+        private DateTime _contentionUntilUtc = DateTime.MinValue;
+
+        // Cumulative, restart-safe like the other health counters.
+        private long _overwriteRewinds;
+        private long _overwriteBytesReprocessed;
+        private long _verifyPasses;
+        private long _verifiedBytes;
+
+        internal static bool IsMultiWriterLogFile(string fileName)
+        {
+            foreach (var f in MultiWriterLogFiles)
+                if (string.Equals(f, fileName, StringComparison.OrdinalIgnoreCase)) return true;
+            return false;
+        }
+
+        private FileLedger GetLedger(string fileName)
+        {
+            FileLedger ledger;
+            if (!_ledgers.TryGetValue(fileName, out ledger))
+            {
+                ledger = new FileLedger();
+                _ledgers[fileName] = ledger;
+            }
+            return ledger;
+        }
+
+        /// <summary>A stale writer writes exactly when its script ends: every end signal asks both files for a check on the next pass.</summary>
+        private void RequestOverwriteCheck()
+        {
+            foreach (var ledger in _ledgers.Values) ledger.VerifyRequested = true;
+        }
+
+        private void NoteInvocationActivity()
+        {
+            _contentionUntilUtc = UtcNowProvider() + InvocationContentionWindow;
+        }
+
+        private bool InContention(DateTime nowUtc)
+        {
+            if (nowUtc < _contentionUntilUtc || _pendingHealthScript != null) return true;
+            foreach (var script in _pendingPlatformScripts.Values)
+            {
+                if (script.Result != null) continue;
+                if (!script.StartedAtUtc.HasValue || nowUtc - script.StartedAtUtc.Value < MaxPendingScriptContention) return true;
+            }
+            return false;
+        }
+
+        /// <summary>
+        /// Runs before a multi-writer file is read: rollover reset, restart seeding, then the
+        /// overwrite check when one is due. Returns the offset to rewind to, or -1.
+        /// </summary>
+        private async Task<long> PrepareLedgerAsync(string filePath, string fileName, FileLedger ledger, long bookmark, DateTime nowUtc, CancellationToken token)
+        {
+            if (ledger.Entries.Count > 0 && bookmark < ledger.EndOffset)
+            {
+                // The bookmark moved below what was read: the file was replaced (rollover).
+                ledger.Clear();
+                InvalidateInvocationMarkersFrom(fileName, 0);
+            }
+
+            if (!ledger.Seeded)
+            {
+                ledger.Seeded = true;
+                if (ledger.Entries.Count == 0 && bookmark > 0)
+                    await SeedLedgerAsync(filePath, ledger, bookmark, token).ConfigureAwait(false);
+            }
+
+            var due = ledger.VerifyRequested || (InContention(nowUtc) && nowUtc >= ledger.NextCadenceVerifyUtc);
+            if (!due || ledger.Entries.Count == 0) return -1;
+
+            var from = ledger.StartOffset;
+            var bytes = bookmark - from;
+            if (bytes <= 0)
+            {
+                ledger.VerifyRequested = false;
+                return -1;
+            }
+
+            long divergence;
+            using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+                divergence = await FindOverwriteAsync(stream, ledger, from, bookmark, token).ConfigureAwait(false);
+            if (token.IsCancellationRequested) return -1;
+
+            ledger.VerifyRequested = false;
+            var paceSeconds = Math.Max(VerifyMinInterval.TotalSeconds, (double)bytes / VerifyBudgetBytesPerSecond);
+            ledger.NextCadenceVerifyUtc = nowUtc.AddSeconds(paceSeconds);
+            _verifyPasses++;
+            _verifiedBytes += bytes;
+            return divergence;
+        }
+
+        /// <summary>
+        /// Re-reads [fromOffset, toOffset) with the read loop's assembler and compares against the
+        /// ledger. Returns the offset of the first entry whose bytes changed — a ledger entry not
+        /// reproduced, or an entry the ledger never had — or -1 when everything reads as before.
+        /// </summary>
+        private async Task<long> FindOverwriteAsync(FileStream stream, FileLedger ledger, long fromOffset, long toOffset, CancellationToken token)
+        {
+            var entries = ledger.Entries;
+            var idx = ledger.IndexOfFirstAtOrAfter(fromOffset);
+            if (idx >= entries.Count) return -1;
+
+            stream.Seek(entries[idx].Offset, SeekOrigin.Begin);
+            var reader = new BoundedLineReader(stream, MaxEntryBytes, hashLines: true);
+            var assembler = new CmTraceEntryAssembler(MaxMultiLineBufferLines, MaxEntryBytes);
+
+            while (reader.Position < toOffset)
+            {
+                var line = await reader.ReadLineAsync(CancellationToken.None).ConfigureAwait(false);
+                if (line == null) break;
+                if (token.IsCancellationRequested) return -1;
+
+                AssembledEntry e;
+                if (assembler.Feed(line, reader.LastLineStart, reader.Position, reader.LastLineTruncated, reader.LastLineHash, out e)
+                    != CmTraceEntryAssembler.Outcome.Entry)
+                    continue;
+                if (e.Offset >= toOffset) break;
+
+                if (idx < entries.Count && entries[idx].Offset < e.Offset) return entries[idx].Offset;
+                if (idx < entries.Count && entries[idx].Offset == e.Offset)
+                {
+                    if (entries[idx].Hash != e.Hash) return e.Offset;
+                    idx++;
+                    continue;
+                }
+                return e.Offset; // an entry the ledger never had: the bytes changed here
+            }
+
+            return idx < entries.Count && entries[idx].Offset < toOffset ? entries[idx].Offset : -1;
+        }
+
+        /// <summary>After a restart the ledger is empty: fingerprint the entries just behind the persisted bookmark without processing them.</summary>
+        private async Task SeedLedgerAsync(string filePath, FileLedger ledger, long bookmark, CancellationToken token)
+        {
+            var from = Math.Max(0, bookmark - RestartSeedBytes);
+            using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+            {
+                stream.Seek(from, SeekOrigin.Begin);
+                var reader = new BoundedLineReader(stream, MaxEntryBytes, hashLines: true);
+                var assembler = new CmTraceEntryAssembler(MaxMultiLineBufferLines, MaxEntryBytes);
+                var aligned = from == 0;
+                while (reader.Position < bookmark)
+                {
+                    var line = await reader.ReadLineAsync(CancellationToken.None).ConfigureAwait(false);
+                    if (line == null || token.IsCancellationRequested) break;
+                    if (!aligned)
+                    {
+                        // The seek may have landed mid-entry: wait for an entry boundary.
+                        if (!line.StartsWith(LogOpenTag)) continue;
+                        aligned = true;
+                    }
+                    AssembledEntry e;
+                    if (assembler.Feed(line, reader.LastLineStart, reader.Position, reader.LastLineTruncated, reader.LastLineHash, out e)
+                            == CmTraceEntryAssembler.Outcome.Entry
+                        && e.Offset + e.Length <= bookmark)
+                        ledger.Record(e);
+                }
+            }
+        }
+
+        /// <summary>Moves the bookmark back to the first changed entry; returns the entries to skip if they still read unchanged behind it.</summary>
+        private HashSet<LedgerEntry> ApplyRewind(string filePath, string fileName, FileLedger ledger, long rewindTo, long bookmark)
+        {
+            var removed = ledger.TruncateFrom(rewindTo);
+            _positionTracker.SetPosition(filePath, rewindTo);
+            _heldTails.Remove(filePath);
+            InvalidateInvocationMarkersFrom(fileName, rewindTo);
+            _overwriteRewinds++;
+            _overwriteBytesReprocessed += bookmark - rewindTo;
+
+            var message = $"ImeLogTracker: {fileName} changed behind the bookmark at offset {rewindTo} " +
+                          $"(a concurrent writer overwrote already-read bytes) — rewinding {bookmark - rewindTo} bytes";
+            if (!ledger.RewindLogged)
+            {
+                ledger.RewindLogged = true;
+                _logger.Info(message);
+            }
+            else
+            {
+                _logger.Debug(message);
+            }
+            return removed;
+        }
+
+        private long RetentionFloor(string fileName, long bookmark)
+        {
+            var floor = bookmark - LedgerRetentionBytes;
+            var oldest = OldestPendingScriptMarkerOffset(fileName);
+            if (oldest >= 0 && oldest < floor) floor = oldest;
+            var hardFloor = bookmark - LedgerMaxBytes;
+            return floor < hardFloor ? hardFloor : floor;
+        }
+
+        // -----------------------------------------------------------------------
+        // Invocation markers: who owns the policyId-less executor lines at a file position
+        // -----------------------------------------------------------------------
+        //
+        // AgentExecutor.log carries "Powershell exit code is N" / "write output done" without a
+        // policy id. Their owner is decided by FILE POSITION, not by the order lines were read:
+        // an executor writes its end block at its own stream position, i.e. directly after its
+        // own start block in the final bytes, so the nearest preceding invocation marker names
+        // it — and stays right after a rewind re-reads that region. A marker is a platform start
+        // (policy id), some other invocation (detection, remediation, requirement: null) or a
+        // close ("gets invoked" banner, "Agent executor completed").
+
+        private sealed class InvocationMarker
+        {
+            public long Offset;
+            public string PolicyId;
+            public bool IsClose;
+        }
+
+        private readonly Dictionary<string, List<InvocationMarker>> _invocationMarkers =
+            new Dictionary<string, List<InvocationMarker>>(StringComparer.OrdinalIgnoreCase);
+        private InvocationMarker _lastPlatformMarker;
+        private long _testEntryOrdinal;
+
+        private void RecordInvocationMarker(string policyId, bool isClose)
+        {
+            if (_currentEntryOffset < 0) return;
+            var file = _currentSourceFileName ?? TestSourceFileName;
+            List<InvocationMarker> list;
+            if (!_invocationMarkers.TryGetValue(file, out list))
+            {
+                list = new List<InvocationMarker>();
+                _invocationMarkers[file] = list;
+            }
+
+            if (list.Count > 0 && list[list.Count - 1].Offset == _currentEntryOffset)
+            {
+                // Two patterns on one line: the platform start outranks the generic argument line.
+                var last = list[list.Count - 1];
+                if (!isClose && policyId != null)
+                {
+                    last.PolicyId = policyId;
+                    last.IsClose = false;
+                    _lastPlatformMarker = last;
+                }
+                return;
+            }
+
+            if (list.Count >= MaxInvocationMarkersPerFile) list.RemoveAt(0);
+            var marker = new InvocationMarker { Offset = _currentEntryOffset, PolicyId = policyId, IsClose = isClose };
+            list.Add(marker);
+            if (!isClose && policyId != null) _lastPlatformMarker = marker;
+        }
+
+        /// <summary>The pending platform script that owns the entry being processed, or null.</summary>
+        private ScriptExecutionState ResolvePlatformScriptForCurrentEntry()
+        {
+            InvocationMarker marker = null;
+            List<InvocationMarker> list = null;
+            if (_currentSourceFileName != null && _currentEntryOffset >= 0 && _invocationMarkers.TryGetValue(_currentSourceFileName, out list))
+            {
+                for (var i = list.Count - 1; i >= 0; i--)
+                {
+                    if (list[i].Offset <= _currentEntryOffset)
+                    {
+                        marker = list[i];
+                        break;
+                    }
+                }
+            }
+
+            // A file without any marker (a context line after a rotation): the last platform start wins.
+            if (marker == null && (list == null || list.Count == 0)) marker = _lastPlatformMarker;
+            if (marker == null || marker.IsClose || marker.PolicyId == null) return null;
+
+            ScriptExecutionState state;
+            return _pendingPlatformScripts.TryGetValue(marker.PolicyId, out state) ? state : null;
+        }
+
+        private void InvalidateInvocationMarkersFrom(string fileName, long offset)
+        {
+            List<InvocationMarker> list;
+            if (!_invocationMarkers.TryGetValue(fileName, out list) || list.Count == 0) return;
+            var removedLast = false;
+            for (var i = list.Count - 1; i >= 0 && list[i].Offset >= offset; i--)
+            {
+                if (ReferenceEquals(list[i], _lastPlatformMarker)) removedLast = true;
+                list.RemoveAt(i);
+            }
+            if (removedLast)
+            {
+                _lastPlatformMarker = null;
+                for (var i = list.Count - 1; i >= 0; i--)
+                {
+                    if (!list[i].IsClose && list[i].PolicyId != null)
+                    {
+                        _lastPlatformMarker = list[i];
+                        break;
+                    }
+                }
+            }
+        }
+
+        private long OldestPendingScriptMarkerOffset(string fileName)
+        {
+            List<InvocationMarker> list;
+            if (!_invocationMarkers.TryGetValue(fileName, out list)) return -1;
+            long oldest = -1;
+            foreach (var marker in list)
+            {
+                if (marker.IsClose || marker.PolicyId == null || !_pendingPlatformScripts.ContainsKey(marker.PolicyId)) continue;
+                if (oldest < 0 || marker.Offset < oldest) oldest = marker.Offset;
+            }
+            return oldest;
+        }
+
+        // -----------------------------------------------------------------------
+        // Test seams
+        // -----------------------------------------------------------------------
+
+        /// <summary>Same effect as an end signal: both multi-writer ledgers are verified on the next pass.</summary>
+        internal void RequestOverwriteCheckForTest() => RequestOverwriteCheck();
+
+        internal int LedgerEntryCountForTest(string fileName)
+        {
+            FileLedger ledger;
+            return _ledgers.TryGetValue(fileName, out ledger) ? ledger.Entries.Count : 0;
+        }
+
+        /// <summary>Gives a seam-fed message a file position of its own so positional attribution behaves like in a real pass.</summary>
+        internal void NextTestEntry()
+        {
+            if (_currentSourceFileName == null) _currentSourceFileName = TestSourceFileName;
+            _currentEntryOffset = ++_testEntryOrdinal * 4096;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -181,7 +181,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // arrive across multiple log entries and IME may interleave platform scripts).
         private readonly Dictionary<string, ScriptExecutionState> _pendingPlatformScripts =
             new Dictionary<string, ScriptExecutionState>(StringComparer.OrdinalIgnoreCase);
-        private string _lastPlatformScriptPolicyId;
 
         // Health-script (remediation) line-by-line accumulator — single slot because IME
         // executes health scripts SEQUENTIALLY within a session (verified across multiple
@@ -367,6 +366,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     FilesTailed = _filesTailed,
                     BacklogBytes = _backlogBytes,
                     ImeAgentVersion = _imeAgentVersionSeen,
+                    OverwriteRewinds = _overwriteRewinds,
+                    OverwriteBytesReprocessed = _overwriteBytesReprocessed,
+                    VerifyPasses = _verifyPasses,
+                    VerifiedBytes = _verifiedBytes,
                     PatternHits = new Dictionary<string, int>(_patternHits, StringComparer.OrdinalIgnoreCase),
                 };
             }
@@ -1140,6 +1143,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     HealthScriptResultParseFailures = state.Health.HealthScriptResultParseFailures;
                     _imeAgentVersionSeen = state.Health.ImeAgentVersion;
                     _trackerDegradedFired = state.Health.TrackerDegradedFired;
+                    _overwriteRewinds = state.Health.OverwriteRewinds;
+                    _overwriteBytesReprocessed = state.Health.OverwriteBytesReprocessed;
+                    _verifyPasses = state.Health.VerifyPasses;
+                    _verifiedBytes = state.Health.VerifiedBytes;
                 }
                 if (state.PatternHits != null)
                 {
@@ -1209,6 +1216,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     HealthScriptResultParseFailures = HealthScriptResultParseFailures,
                     ImeAgentVersion = _imeAgentVersionSeen,
                     TrackerDegradedFired = _trackerDegradedFired,
+                    OverwriteRewinds = _overwriteRewinds,
+                    OverwriteBytesReprocessed = _overwriteBytesReprocessed,
+                    VerifyPasses = _verifyPasses,
+                    VerifiedBytes = _verifiedBytes,
                 };
                 state.PatternHits = new Dictionary<string, int>(_patternHits, StringComparer.OrdinalIgnoreCase);
             }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerHealth.cs

@@ -46,6 +46,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <summary>IME version as logged by IME itself ("Agent version is: …"), null until seen.</summary>
         public string ImeAgentVersion { get; set; }
 
+        /// <summary>
+        /// Times the bookmark of a multi-writer log (AgentExecutor.log, IntuneManagementExtension.log)
+        /// was moved back because bytes behind it had been overwritten by a concurrent IME
+        /// process. Expected nonzero whenever user-context scripts or detection scripts ran —
+        /// recovered data, not skipped work.
+        /// </summary>
+        public long OverwriteRewinds { get; set; }
+
+        /// <summary>Bytes re-read by those rewinds (only entries that changed are processed again).</summary>
+        public long OverwriteBytesReprocessed { get; set; }
+
+        /// <summary>Full ledger verifications run (cadence while scripts are in flight, end signals, fragments).</summary>
+        public long VerifyPasses { get; set; }
+
+        /// <summary>Bytes re-read for verification, guard-zone checks included — the cost of the overwrite detection.</summary>
+        public long VerifiedBytes { get; set; }
+
         /// <summary>Match count per enabled pattern ID — every enabled pattern is present, zeros included.</summary>
         public IReadOnlyDictionary<string, int> PatternHits { get; set; }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerStatePersistence.cs

@@ -165,6 +165,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         public int HealthScriptResultParseFailures { get; set; }
         public string ImeAgentVersion { get; set; }
         public bool TrackerDegradedFired { get; set; }
+        // Overwrite detection counters (null-defaulting on older state files).
+        public long OverwriteRewinds { get; set; }
+        public long OverwriteBytesReprocessed { get; set; }
+        public long VerifyPasses { get; set; }
+        public long VerifiedBytes { get; set; }
     }
 
     public class PackageStateData

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/EspAndHelloTracker.cs

@@ -44,6 +44,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         private readonly Func<bool> _userEspAppsSettledProbe;
         private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _starvedUserEspAppsProbe;
         private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _packageStatesProbe;
+        // Session 683f1eff: registry failure detail still sitting in an open settle window,
+        // consulted when a Shell-Core failure terminalises first (see OnShellCoreEspFailureDetected).
+        private readonly Func<EspFailureDetectedEventArgs> _pendingEspFailureProbe;
 
         // Session caa6cf50 gate-starvation fix (2026-06-11) — fire-once guard for the
         // user-ESP-apps-settled AccountSetup synthesis (see MaybeSynthesizeAccountSetupComplete).
@@ -174,8 +177,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// late "Installing-→-Error" promotion can classify the failure correctly
         /// AND refuse to promote when the failure originated outside the Apps
         /// subcategory (a non-Apps HRESULT does not describe per-app outcome).
-        /// Null when no HRESULT-carrying ESP failure has fired (or all observed
-        /// failures came from ShellCoreTracker, which has no HRESULT surface).
+        /// Null when no registry-derived failure detail has been observed — neither from
+        /// a settle window that expired nor from one a Shell-Core failure inherited.
         /// </summary>
         public Termination.EspTerminalFailureSnapshot LastEspTerminalFailure { get; private set; }
 
@@ -243,7 +246,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             Func<bool> accountSetupActivityProbe = null,
             Func<bool> userEspAppsSettledProbe = null,
             Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> starvedUserEspAppsProbe = null,
-            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null)
+            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null,
+            Func<EspFailureDetectedEventArgs> pendingEspFailureProbe = null)
         {
             _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
             _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
@@ -277,6 +281,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             // provisioning tracker name not-completed apps on an Apps-subcategory failure.
             _packageStatesProbe = packageStatesProbe
                 ?? (() => Array.Empty<Ime.AppPackageState>());
+            // Test seam: defaults to the provisioning tracker's open settle window (null when
+            // none is armed or the tracker is not running, e.g. Device Preparation).
+            _pendingEspFailureProbe = pendingEspFailureProbe
+                ?? (() => _provisioningTracker?.TryGetPendingFailureArgs());
         }
 
         /// <summary>
@@ -658,6 +666,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         internal void TriggerEspExitedForTest(DateTime occurredAtUtc) =>
             OnEspExited(this, new EspExitedEventArgs(occurredAtUtc));
 
+        // Test seam for a Shell-Core 62407 failure — drives the coordinator forwarder including
+        // the pending-settle inheritance, without a real ShellCoreTracker.
+        internal void TriggerShellCoreEspFailureForTest(string failureType) =>
+            OnShellCoreEspFailureDetected(this, failureType);
+
         // Test seam for HelloWizardStarted — same contract as TriggerEspExitedForTest.
         internal void TriggerHelloWizardStartedForTest(DateTime occurredAtUtc) =>
             OnHelloWizardStarted(this, new HelloWizardStartedEventArgs(occurredAtUtc));
@@ -673,33 +686,56 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         // Forwarder for ShellCoreTracker (event-log-derived ESP failures, e.g. Shell-Core 62407
         // failure descriptions). Source-event timestamp is mirrored so the adapter can stamp the
         // DecisionSignal with the historical instant on backfill. ShellCoreTracker has no HRESULT
-        // surface, so only FailureType is set on the args.
+        // surface; the registry detail is inherited from an open settle window (see below).
         private void OnShellCoreEspFailureDetected(object sender, string failureType)
         {
             LastEventOccurredAtUtc = (sender as ShellCoreTracker)?.LastEventOccurredAtUtc;
             try
             {
-                EspFailureDetected?.Invoke(this, new EspFailureDetectedEventArgs(failureType));
+                EspFailureDetected?.Invoke(this, BuildShellCoreFailureArgs(failureType));
             }
             catch (Exception ex) { _logger.Error($"Error forwarding ShellCore EspFailureDetected for '{failureType}'", ex); }
             finally { LastEventOccurredAtUtc = null; }
         }
 
-        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
-        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
-        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
-        // surfaced today, so the adapter falls back to clock.
-        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        // Session 683f1eff: the Shell-Core 62407 failure usually lands INSIDE the provisioning
+        // tracker's 30-s settle window — after the registry named the failed subcategory and its
+        // HRESULT, before the settle timer would have forwarded them. The engine terminalises on
+        // the first EspTerminalFailure and the agent stops seconds later, so whatever this signal
+        // carries is all the terminal event, the backend FailureReason and the termination-time
+        // app classification ever see (a third of all ESP terminal failures took this path). The
+        // pending detail is inherited here; FailureType stays the Shell-Core value because that
+        // is the signal that actually terminalised.
+        private EspFailureDetectedEventArgs BuildShellCoreFailureArgs(string failureType)
+        {
+            EspFailureDetectedEventArgs pending = null;
+            try { pending = _pendingEspFailureProbe(); }
+            catch (Exception ex) { _logger.Warning($"EspAndHelloTracker: pending ESP failure probe threw: {ex.Message}"); }
+
+            if (pending == null)
+                return new EspFailureDetectedEventArgs(failureType);
+
+            RecordTerminalFailureSnapshot(pending);
+            _logger.Info(
+                $"EspAndHelloTracker: Shell-Core failure '{failureType}' inherits the pending provisioning failure detail " +
+                $"(category={pending.Category ?? "n/a"}, failedSubcategory={pending.FailedSubcategory ?? "n/a"}, " +
+                $"errorCode={pending.ErrorCode ?? "n/a"})");
+            return new EspFailureDetectedEventArgs(
+                failureType,
+                errorCode: pending.ErrorCode,
+                failedSubcategory: pending.FailedSubcategory,
+                category: pending.Category,
+                likelyCulpritApps: pending.LikelyCulpritApps);
+        }
+
+        // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full failure context
+        // (HRESULT + failedSubcategory + category) so EnrollmentTerminationHandler can read it on
+        // the terminal-failure pathway. Only update when the args carry at least one of the three
+        // fields, so a bare Shell-Core failure cannot wipe out the registry snapshot. Deliberately
+        // NOT gated on ErrorCode alone — a non-Apps subcategory failure without HRESULT is still
+        // useful for downstream "should we promote?" gating.
+        private void RecordTerminalFailureSnapshot(EspFailureDetectedEventArgs args)
         {
-            LastEventOccurredAtUtc = null;
-            // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full
-            // failure context (HRESULT + failedSubcategory + category) before
-            // forwarding so EnrollmentTerminationHandler can read it on the terminal-
-            // failure pathway. Only update when the args carry at least one of the
-            // three fields, so a later ShellCore-derived failure (which has none of
-            // them) cannot wipe out the registry snapshot. We deliberately do NOT
-            // gate on ErrorCode alone — a non-Apps subcategory failure without
-            // HRESULT is still useful for downstream "should we promote?" gating.
             if (!string.IsNullOrEmpty(args?.ErrorCode)
                 || !string.IsNullOrEmpty(args?.FailedSubcategory)
                 || !string.IsNullOrEmpty(args?.Category))
@@ -709,6 +745,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                     failedSubcategory: args.FailedSubcategory,
                     category: args.Category);
             }
+        }
+
+        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
+        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
+        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
+        // surfaced today, so the adapter falls back to clock.
+        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        {
+            LastEventOccurredAtUtc = null;
+            RecordTerminalFailureSnapshot(args);
             try
             {
                 EspFailureDetected?.Invoke(this, args);

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ProvisioningStatusTracker.cs

@@ -80,6 +80,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             "AccountSetupCategory.Status"
         };
 
+        // Order in which TryGetPendingFailureArgs resolves concurrently armed settle windows.
+        private static readonly string[] PendingFailurePreference =
+        {
+            "DeviceSetupCategory.Status",
+            "AccountSetupCategory.Status",
+            "DevicePreparationCategory.Status"
+        };
+
         private readonly AgentLogger _logger;
         private readonly string _sessionId;
         private readonly string _tenantId;
@@ -1711,6 +1719,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         internal void TriggerSettleTimerForTest(string categoryName)
             => OnProvisioningFailureSettleExpired(categoryName);
 
+        /// <summary>
+        /// The registry-derived failure detail of a settle window that is still open (armed,
+        /// not yet expired or retracted) — null when none is pending. Read by the coordinator
+        /// when a Shell-Core 62407 failure arrives inside the window, so the terminal signal
+        /// inherits HRESULT / failed subcategory / category instead of racing them away
+        /// (session 683f1eff). Windows fail one category at a time, but should two be armed
+        /// the device-phase category wins: it is the one the ESP page reports.
+        /// </summary>
+        internal EspFailureDetectedEventArgs TryGetPendingFailureArgs()
+        {
+            lock (_stateLock)
+            {
+                if (_provisioningFailureSettleArgs == null || _provisioningFailureSettleArgs.Count == 0)
+                    return null;
+                foreach (var category in PendingFailurePreference)
+                {
+                    if (_provisioningFailureSettleArgs.TryGetValue(category, out var args) && args != null)
+                        return args;
+                }
+                return null;
+            }
+        }
+
         private bool HasCategorySucceededChanged(string categoryName, bool? newValue)
         {
             if (!_lastCategorySucceeded.TryGetValue(categoryName, out var oldValue))

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/DiagnosticsPathGuards.cs

@@ -70,12 +70,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             @"C:\Windows\System32\config",  // SAM, SECURITY, SYSTEM hives
         };
 
-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
-        {
-            @"AppData\Local",
-            @"AppData\Roaming",
-        };
+        // The allowed user-profile subdirectories and the vendor allowlist under them live in
+        // GatherRuleGuards, which owns the embedded guardrails.json — one copy for both guards.
 
         /// <summary>
         /// Returns true if the given path is allowed for diagnostics collection.
@@ -135,7 +131,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                     (normalizedDir.Length == BlockedUsersPrefix.Length ||
                      normalizedDir[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
                 {
-                    if (!IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
+                    if (!GatherRuleGuards.IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
                         return false;
                 }
 
@@ -169,7 +165,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                     }
                 }
 
-                return false;
+                // Vendor folders under the signed-in user's profile — same allowlist the file
+                // collectors use, since it answers the same question: which folders below a
+                // profile carry enrollment-relevant logs rather than the user's own data.
+                return GatherRuleGuards.IsUserProfilePathOnAllowlist(normalizedDir, userProfilePath);
             }
             catch
             {
@@ -178,38 +177,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             }
         }
 
-        /// <summary>
-        /// Returns true if the normalized path falls under one of the allowed subdirectories
-        /// of the detected user profile (AppData\Local, AppData\Roaming).
-        /// Only applies when %LOGGED_ON_USER_PROFILE% was used to resolve the path.
-        /// </summary>
-        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
-        {
-            if (string.IsNullOrEmpty(userProfilePath))
-                return false;
-
-            try
-            {
-                var normalizedProfile = Path.GetFullPath(userProfilePath);
-                foreach (var subdir in AllowedUserProfileSubdirs)
-                {
-                    var allowedPrefix = Path.GetFullPath(Path.Combine(normalizedProfile, subdir));
-                    if (normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
-                        (normalizedPath.Length == allowedPrefix.Length ||
-                         normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar))
-                    {
-                        return true;
-                    }
-                }
-            }
-            catch
-            {
-                // Path normalization failure — deny
-            }
-
-            return false;
-        }
-
         /// <summary>
         /// Checks whether any component of the path (directories or file) is a symlink,
         /// junction, or other reparse point. Returns true if a reparse point is detected.

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleGuards.cs

@@ -32,6 +32,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         // -----------------------------------------------------------------------
         public static readonly IReadOnlyList<string> AllowedRegistryPrefixes;
         public static readonly IReadOnlyList<string> AllowedFilePrefixes;
+
+        /// <summary>
+        /// Folders under the signed-in user's profile that file collectors and
+        /// admin-configured diagnostics paths may read, RELATIVE to the profile root
+        /// (e.g. <c>AppData\Local\Vendor</c>). Resolved against the path
+        /// %LOGGED_ON_USER_PROFILE% produced, at match time — the profile name is not
+        /// known when the list is authored, which is why these entries cannot live in
+        /// <see cref="AllowedFilePrefixes"/> (matched literally against the expanded path).
+        /// </summary>
+        public static readonly IReadOnlyList<string> AllowedUserProfileFilePrefixes;
         public static readonly IReadOnlyList<string> AllowedWmiQueryPrefixes;
         public static readonly IReadOnlyCollection<string> AllowedCommands;
         public static readonly IReadOnlyList<string> AllowedEventLogChannels;
@@ -63,8 +73,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             Path.GetFullPath(@"C:\Windows\System32\config"),  // SAM, SECURITY, SYSTEM hives
         };
 
-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
+        // The only subdirectories of a user profile the C:\Users hard block will ever
+        // release (used with %LOGGED_ON_USER_PROFILE%). Single copy for both guards —
+        // DiagnosticsPathGuards delegates here.
+        internal static readonly string[] AllowedUserProfileSubdirs = new[]
         {
             @"AppData\Local",
             @"AppData\Roaming",
@@ -118,6 +130,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                     AllowedRegistryPrefixes = FlattenCategorized(obj, "registryPrefixes", "prefixes");
                     AllowedFilePrefixes = obj["filePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+                    AllowedUserProfileFilePrefixes = LoadUserProfilePrefixes(obj);
                     AllowedWmiQueryPrefixes = obj["wmiQueryPrefixes"]?.ToObject<List<string>>() ?? new List<string>();
 
                     var commands = FlattenCategorized(obj, "allowedCommands", "commands");
@@ -136,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
             AllowedRegistryPrefixes = new List<string>();
             AllowedFilePrefixes = new List<string>();
+            AllowedUserProfileFilePrefixes = new List<string>();
             AllowedWmiQueryPrefixes = new List<string>();
             AllowedCommands = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
             AllowedEventLogChannels = new List<string>();
@@ -143,6 +157,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             ResidualWmiPrefixes = new List<string>();
         }
 
+        /// <summary>
+        /// Reads <c>userProfileFilePrefixes</c> and drops every entry that is rooted, carries a
+        /// traversal, or does not sit under one of <see cref="AllowedUserProfileSubdirs"/>.
+        /// The C:\Users hard block releases nothing outside AppData, so such an entry could only
+        /// ever be dead text — dropping it at load keeps the list honest instead of silently
+        /// ineffective, and no configuration can widen the hard block's exception.
+        /// </summary>
+        private static List<string> LoadUserProfilePrefixes(JObject obj)
+        {
+            var raw = obj["userProfileFilePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+            var result = new List<string>();
+
+            foreach (var entry in raw)
+            {
+                if (string.IsNullOrWhiteSpace(entry))
+                    continue;
+
+                var trimmed = entry.Trim().TrimEnd('\\');
+                if (Path.IsPathRooted(trimmed))
+                    continue;
+                if (trimmed.IndexOf("..", StringComparison.Ordinal) >= 0)
+                    continue;
+
+                foreach (var subdir in AllowedUserProfileSubdirs)
+                {
+                    if (trimmed.StartsWith(subdir, StringComparison.OrdinalIgnoreCase) &&
+                        (trimmed.Length == subdir.Length || trimmed[subdir.Length] == '\\'))
+                    {
+                        result.Add(trimmed);
+                        break;
+                    }
+                }
+            }
+
+            return result;
+        }
+
         private static void DeriveWmiClassAllowlist(
             IReadOnlyList<string> entries,
             out HashSet<string> classes,
@@ -265,12 +316,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
             // C:\Users block always applies (even in unrestricted mode)
             // Exception: paths under <userProfilePath>\AppData\Local or AppData\Roaming
-            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used.
+            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used. The exception
+            // only LIFTS the block — in restricted mode the allowlist below still decides.
             if (normalizedPath.StartsWith(BlockedUsersPrefix, StringComparison.OrdinalIgnoreCase) &&
                 (normalizedPath.Length == BlockedUsersPrefix.Length ||
                  normalizedPath[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
             {
-                if (!DiagnosticsPathGuards.IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
+                if (!IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
                     return false;
             }
 
@@ -288,9 +340,61 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             if (unrestrictedMode)
                 return true;
 
-            return AllowedFilePrefixes.Any(prefix =>
+            if (AllowedFilePrefixes.Any(prefix =>
                 normalizedPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) &&
-                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\'));
+                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\')))
+            {
+                return true;
+            }
+
+            // Vendor folders under the signed-in user's profile. Only reachable when the rule
+            // spelled %LOGGED_ON_USER_PROFILE% and the resolver found an interactive user —
+            // a null profile denies, so a machine with nobody signed in cannot widen anything.
+            return IsUserProfilePathOnAllowlist(normalizedPath, userProfilePath);
+        }
+
+        /// <summary>
+        /// True when the normalized path sits under one of <see cref="AllowedUserProfileSubdirs"/>
+        /// of the detected user profile. This is the C:\Users hard block's only exception; it
+        /// releases the block and nothing else. A null profile denies.
+        /// </summary>
+        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileSubdirs.Any(subdir =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, subdir));
+
+        /// <summary>
+        /// True when the normalized path is admitted by an entry of
+        /// <see cref="AllowedUserProfileFilePrefixes"/> under the detected user profile.
+        /// </summary>
+        internal static bool IsUserProfilePathOnAllowlist(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileFilePrefixes.Any(prefix =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, prefix));
+
+        /// <summary>
+        /// Segment-bounded match of <paramref name="normalizedPath"/> against
+        /// &lt;profile&gt;\&lt;relativePrefix&gt;. Both sides go through Path.GetFullPath, so a
+        /// traversal spelled into either one cannot slip past the boundary check.
+        /// </summary>
+        private static bool MatchesProfileRelativePrefix(
+            string normalizedPath, string userProfilePath, string relativePrefix)
+        {
+            if (string.IsNullOrEmpty(normalizedPath) || string.IsNullOrEmpty(userProfilePath))
+                return false;
+
+            try
+            {
+                var allowedPrefix = Path.GetFullPath(
+                    Path.Combine(Path.GetFullPath(userProfilePath), relativePrefix));
+
+                return normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
+                       (normalizedPath.Length == allowedPrefix.Length ||
+                        normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar);
+            }
+            catch
+            {
+                // Path normalization failure — deny.
+                return false;
+            }
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/AgentSelfMetricsCollector.cs

@@ -209,6 +209,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
                         data["ime_line_budget_breaks"] = health.BudgetBreaks;
                         data["ime_held_tails"] = health.HeldTails;
                         data["ime_unanchored_patterns"] = health.UnanchoredPatterns;
+                        data["ime_overwrite_rewinds"] = health.OverwriteRewinds;
+                        data["ime_overwrite_bytes_reprocessed"] = health.OverwriteBytesReprocessed;
+                        data["ime_verify_passes"] = health.VerifyPasses;
+                        data["ime_verified_bytes"] = health.VerifiedBytes;
                     }
                 }
                 catch (Exception ex)

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/DeadlineFiredEventArgs.cs

@@ -9,9 +9,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
     /// <para>
     /// The orchestrator consumes this event and translates it into a synthetic
     /// <c>DeadlineFired</c>-<see cref="AutopilotMonitor.DecisionCore.Signals.DecisionSignal"/>
-    /// whose <c>OccurredAtUtc</c> equals the deadline's <see cref="ActiveDeadline.DueAtUtc"/>,
-    /// not the wall-clock firing time — so replay stays deterministic even if the agent
-    /// restarts long after the deadline has passed.
+    /// whose <c>OccurredAtUtc</c> equals the deadline's <see cref="ActiveDeadline.DueAtUtc"/>
+    /// (the policy instant the wait expired), with the due time repeated in the payload. The
+    /// firing clock is deliberately NOT the stamp: a timer due during Modern Standby or a
+    /// reboot fires only afterwards, and the outage would otherwise become session duration
+    /// (D-238).
     /// </para>
     /// </summary>
     public sealed class DeadlineFiredEventArgs : EventArgs

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs

@@ -1,6 +1,7 @@
 #nullable enable
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.IO;
 using System.Threading;
 using System.Threading.Tasks;
@@ -1159,7 +1160,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 var evidence = new Evidence(
                     kind: EvidenceKind.Synthetic,
                     identifier: e.Deadline.Name,
-                    summary: $"deadline '{e.Deadline.Name}' fired at {e.Deadline.DueAtUtc:O}");
+                    summary: $"deadline '{e.Deadline.Name}' due {e.Deadline.DueAtUtc:O} fired at {e.FiredAtUtc:O}");
 
                 // The reducer reads the deadline name under SignalPayloadKeys.Deadline
                 // (see HandleDeadlineFiredV1 in DecisionEngine.Shared). Forward the
@@ -1180,7 +1181,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                     payload[SignalPayloadKeys.Deadline] = e.Deadline.Name;
                 }
 
-                // OccurredAtUtc = DueAtUtc (not firedAt) — replay-determinism per DeadlineFiredEventArgs doc.
+                // OccurredAtUtc = DueAtUtc, not the firing clock (D-238). Every effect of the
+                // resulting step (phase_transition, enrollment_complete) is stamped with the signal
+                // time; a timer that came due during Modern Standby or a reboot fires only afterwards,
+                // and the firing clock would make the verdict — and the session duration — grow by
+                // the whole outage (measured: days for devices closed right after provisioning).
+                // The due time also travels in the payload so the stale-fire guards identify the
+                // deadline incarnation independently of the stamp.
+                payload[SignalPayloadKeys.DeadlineDueAtUtc] = e.Deadline.DueAtUtc.ToString("O", CultureInfo.InvariantCulture);
+
                 _ingress.Post(
                     kind: DecisionSignalKind.DeadlineFired,
                     occurredAtUtc: e.Deadline.DueAtUtc,

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/IDeadlineScheduler.cs

@@ -39,7 +39,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// <summary>
         /// Wird vom Timer-Thread geraised, wenn ein Deadline fällig wird. Subscriber
         /// ist typischerweise der Orchestrator, der daraus ein synthetisches
-        /// <c>DeadlineFired</c>-Signal mit <c>OccurredAtUtc = deadline.DueAtUtc</c> erzeugt.
+        /// <c>DeadlineFired</c>-Signal mit <c>OccurredAtUtc = deadline.DueAtUtc</c> erzeugt; die
+        /// Fälligkeit reist zusätzlich im Payload (<c>SignalPayloadKeys.DeadlineDueAtUtc</c>).
         /// </summary>
         event EventHandler<DeadlineFiredEventArgs>? Fired;
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Termination/EnrollmentTerminationHandler.cs

@@ -584,6 +584,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                     ["heldTails"] = health.HeldTails,
                     ["unanchoredPatterns"] = health.UnanchoredPatterns,
                     ["hsParseFailures"] = health.HealthScriptResultParseFailures,
+                    ["overwriteRewinds"] = health.OverwriteRewinds,
+                    ["overwriteBytesReprocessed"] = health.OverwriteBytesReprocessed,
+                    ["verifyPasses"] = health.VerifyPasses,
+                    ["verifiedBytes"] = health.VerifiedBytes,
                     ["agentVersion"] = _agentVersion ?? string.Empty,
                 };
                 if (!string.IsNullOrEmpty(health.ImeAgentVersion))

src/Agent/AutopilotMonitor.DecisionCore.Tests/DeadlineFireTimeStampTests.cs

@@ -0,0 +1,191 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using Xunit;
+
+namespace AutopilotMonitor.DecisionCore.Tests
+{
+    /// <summary>
+    /// The reducer identifies a deadline incarnation through the due time carried in the
+    /// payload (<see cref="SignalPayloadKeys.DeadlineDueAtUtc"/>), never through the signal
+    /// time: the host stamps <c>DeadlineFired</c> with the due time (D-238), but the guards
+    /// must stay correct for any stamp — a late fire after Modern Standby or a restart, a
+    /// replayed signal, or a future switch to the firing clock. Without the key they fall back
+    /// to the signal time (pre-key signal logs, where the two were equal by contract).
+    /// </summary>
+    public sealed class DeadlineFireTimeStampTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 9, 6, 31, 0, DateTimeKind.Utc);
+
+        private static DecisionSignal MakeSignal(
+            long ordinal,
+            DecisionSignalKind kind,
+            DateTime occurredAtUtc,
+            IReadOnlyDictionary<string, string>? payload = null) =>
+            new DecisionSignal(
+                sessionSignalOrdinal: ordinal,
+                sessionTraceOrdinal: ordinal,
+                kind: kind,
+                kindSchemaVersion: 1,
+                occurredAtUtc: occurredAtUtc,
+                sourceOrigin: "test",
+                evidence: new Evidence(EvidenceKind.Synthetic, $"t-{kind}-{ordinal}", $"synthetic {kind}"),
+                payload: payload);
+
+        /// <summary>What the host posts: name plus due time, OccurredAtUtc = firing clock.</summary>
+        private static Dictionary<string, string> FiredPayload(string deadlineName, DateTime dueAtUtc) =>
+            new Dictionary<string, string>
+            {
+                [SignalPayloadKeys.Deadline] = deadlineName,
+                [SignalPayloadKeys.DeadlineDueAtUtc] = dueAtUtc.ToString("O", CultureInfo.InvariantCulture),
+            };
+
+        // ============================================================== helper
+
+        [Fact]
+        public void DeadlineDueAtUtc_reads_the_payload_and_falls_back_to_the_signal_time()
+        {
+            var due = T0.AddMinutes(5);
+            var fired = T0.AddMinutes(9);
+
+            var withKey = MakeSignal(1, DecisionSignalKind.DeadlineFired, fired, FiredPayload(DeadlineNames.HelloSafety, due));
+            Assert.Equal(due, DecisionEngine.DeadlineDueAtUtc(withKey));
+            Assert.Equal(DateTimeKind.Utc, DecisionEngine.DeadlineDueAtUtc(withKey).Kind);
+
+            var withoutKey = MakeSignal(2, DecisionSignalKind.DeadlineFired, fired,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.HelloSafety });
+            Assert.Equal(fired, DecisionEngine.DeadlineDueAtUtc(withoutKey));
+
+            var garbage = MakeSignal(3, DecisionSignalKind.DeadlineFired, fired,
+                new Dictionary<string, string> { [SignalPayloadKeys.DeadlineDueAtUtc] = "not-a-time" });
+            Assert.Equal(fired, DecisionEngine.DeadlineDueAtUtc(garbage));
+        }
+
+        // ============================================================== Classic: standby at the Hello prompt
+
+        [Fact]
+        public void Late_HelloSafety_fire_stamps_the_resolution_and_the_grace_window_from_the_firing_clock()
+        {
+            // Session ac5660b8 shape: ESP exits, the user leaves the device at the Hello prompt, it
+            // enters Modern Standby, HelloSafety is due during the sleep and fires ~3 min late after
+            // wake. Fed with the firing clock as signal time, the reducer must stamp the Hello
+            // timeout fact, the Finalizing step and the FinalizingGrace due time from that time —
+            // the stamp policy is the host's choice (D-238), the reducer follows the signal.
+            var engine = new DecisionEngine();
+            var state = DecisionState.CreateInitial("sess-standby", "tenant", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "AccountSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(2, DecisionSignalKind.AccountSetupProvisioningComplete, T0.AddMinutes(2))).NewState;
+            state = engine.Reduce(state, MakeSignal(3, DecisionSignalKind.DesktopArrived, T0.AddMinutes(3))).NewState;
+
+            var espExit = T0.AddMinutes(6).AddSeconds(50.2144855);
+            state = engine.Reduce(state, MakeSignal(4, DecisionSignalKind.EspExiting, espExit)).NewState;
+            var helloSafety = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.HelloSafety);
+            Assert.Equal(espExit.AddSeconds(300), helloSafety.DueAtUtc);
+
+            // Timer fires after wake, 2m 54s past due.
+            var firedAt = helloSafety.DueAtUtc.AddSeconds(174);
+            var finalizing = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.DeadlineFired, firedAt,
+                FiredPayload(DeadlineNames.HelloSafety, helloSafety.DueAtUtc)));
+
+            Assert.True(finalizing.Transition.Taken);
+            Assert.Equal(SessionStage.Finalizing, finalizing.NewState.Stage);
+            Assert.Equal("Timeout", finalizing.NewState.HelloOutcome!.Value);
+            Assert.Equal(firedAt, finalizing.NewState.HelloResolvedUtc!.Value);
+
+            var grace = Assert.Single(finalizing.NewState.Deadlines, d => d.Name == DeadlineNames.FinalizingGrace);
+            Assert.Equal(firedAt.AddSeconds(5), grace.DueAtUtc);
+
+            // The chained grace fires on time and completes; nothing carries the old due time.
+            var completed = engine.Reduce(finalizing.NewState, MakeSignal(6, DecisionSignalKind.DeadlineFired, grace.DueAtUtc,
+                FiredPayload(DeadlineNames.FinalizingGrace, grace.DueAtUtc)));
+            Assert.Equal(SessionStage.Completed, completed.NewState.Stage);
+            Assert.Equal(SessionOutcome.EnrollmentComplete, completed.NewState.Outcome);
+            Assert.Contains(completed.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry
+                && e.Parameters != null
+                && e.Parameters.TryGetValue("eventType", out var et) && et == "enrollment_complete");
+        }
+
+        // ============================================================== SelfDeploying guard C
+
+        [Fact]
+        public void SelfDeploying_guard_C_matches_the_incarnation_by_payload_due_time_not_by_firing_clock()
+        {
+            var engine = new DecisionEngine();
+            var state = DecisionState.CreateInitial("sd-late", "t", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "DeviceSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(2, DecisionSignalKind.DeviceSetupProvisioningComplete, T0.AddMinutes(3))).NewState;
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.DeviceOnlyEspDetection);
+            Assert.Equal(T0.AddMinutes(8), armed.DueAtUtc);
+
+            // A stale fire of an OLDER incarnation (due T+5) arriving late: dead-end, deadline kept.
+            var stale = engine.Reduce(state, MakeSignal(3, DecisionSignalKind.DeadlineFired, T0.AddMinutes(12),
+                FiredPayload(DeadlineNames.DeviceOnlyEspDetection, T0.AddMinutes(5))));
+            Assert.False(stale.Transition.Taken);
+            Assert.Equal("device_only_esp_detection_stale_due_at_mismatch", stale.Transition.DeadEndReason);
+            Assert.Single(stale.NewState.Deadlines, d => d.Name == DeadlineNames.DeviceOnlyEspDetection);
+
+            // The real fire, 4 min late (standby), carries the armed due time: terminal.
+            var real = engine.Reduce(stale.NewState, MakeSignal(4, DecisionSignalKind.DeadlineFired, T0.AddMinutes(12),
+                FiredPayload(DeadlineNames.DeviceOnlyEspDetection, armed.DueAtUtc)));
+            Assert.True(real.Transition.Taken);
+            Assert.Equal(SessionStage.Completed, real.NewState.Stage);
+        }
+
+        // ============================================================== RealmJoin re-arm guard
+
+        [Fact]
+        public void RealmJoin_rearm_guard_compares_the_payload_due_time_not_the_firing_clock()
+        {
+            var engine = new DecisionEngine();
+            var state = DecisionState.CreateInitial("rj-late", "t", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "DeviceSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(2, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(2),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "AccountSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(3, DecisionSignalKind.EspExiting, T0.AddMinutes(3))).NewState;
+            state = engine.Reduce(state, MakeSignal(4, DecisionSignalKind.HelloResolved, T0.AddMinutes(4),
+                new Dictionary<string, string> { [SignalPayloadKeys.HelloOutcome] = "Success" })).NewState;
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "100" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            var first = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+
+            // Simulate the activity-based re-arm: the armed incarnation is now due later.
+            var rearmedDue = first.DueAtUtc.AddMinutes(25);
+            var rearmed = state.ToBuilder()
+                .CancelDeadline(DeadlineNames.RealmJoinTimeout)
+                .AddDeadline(new ActiveDeadline(
+                    name: DeadlineNames.RealmJoinTimeout,
+                    dueAtUtc: rearmedDue,
+                    firesSignalKind: DecisionSignalKind.DeadlineFired,
+                    firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }))
+                .Build();
+
+            // The OLD incarnation's fire arrives late — after the re-armed due time on the clock.
+            // Only the payload due time identifies it as superseded.
+            var firedAt = rearmedDue.AddMinutes(1);
+            var stale = engine.Reduce(rearmed, MakeSignal(7, DecisionSignalKind.DeadlineFired, firedAt,
+                FiredPayload(DeadlineNames.RealmJoinTimeout, first.DueAtUtc)));
+            Assert.False(stale.Transition.Taken);
+            Assert.Equal("realmjoin_timeout_stale_superseded_by_rearm", stale.Transition.DeadEndReason);
+            Assert.Null(stale.NewState.RealmJoinFacts.Outcome);
+
+            // The re-armed incarnation's own fire, same firing clock: timeout is applied.
+            var real = engine.Reduce(stale.NewState, MakeSignal(8, DecisionSignalKind.DeadlineFired, firedAt,
+                FiredPayload(DeadlineNames.RealmJoinTimeout, rearmedDue)));
+            Assert.True(real.Transition.Taken);
+            Assert.Equal("Timeout", real.NewState.RealmJoinFacts.Outcome!.Value);
+            Assert.Equal(SessionStage.Finalizing, real.NewState.Stage);
+        }
+    }
+}

src/Agent/AutopilotMonitor.DecisionCore.Tests/RealmJoinGateTests.cs

@@ -706,7 +706,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
             var deadline = Assert.Single(signalStep.NewState.Deadlines, d => d.Name == DeadlineNames.DeviceOnlyEspDetection);
             Assert.Equal(T0.AddMinutes(7), deadline.DueAtUtc);
 
-            // DeadlineFired (OccurredAtUtc = DueAtUtc per scheduler contract) → terminal.
+            // DeadlineFired at the due time (no payload due key → helper falls back to the signal time) → terminal.
             var step = engine.Reduce(signalStep.NewState, MakeSignal(3, DecisionSignalKind.DeadlineFired, T0.AddMinutes(7),
                 new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.DeviceOnlyEspDetection }));
 

src/Agent/AutopilotMonitor.DecisionCore.Tests/SelfDeployingDeadlineTerminalTests.cs

@@ -443,8 +443,9 @@ namespace AutopilotMonitor.DecisionCore.Tests
         {
             // Cancel-then-rearm race: old deadline (DueAt=T+8) fires queued; before processing,
             // DeviceSetupProvisioningComplete arrives (signal at T+10) → cancel+rearm to DueAt=T+15.
-            // The queued OLD fire (OccurredAtUtc=T+8) arrives. Guard C must dead-end WITHOUT
-            // cancelling the new deadline.
+            // The queued OLD fire arrives carrying its due time T+8 (no payload key here, so the
+            // helper falls back to the signal time). Guard C must dead-end WITHOUT cancelling the
+            // new deadline.
             var engine = new DecisionEngine();
             var state = PrimeDeviceSetup(engine, DecisionState.CreateInitial("sd-11", "t", T0));
 
@@ -467,7 +468,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
                 firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.DeviceOnlyEspDetection }));
             state = rearmedBuilder.Build();
 
-            // OLD queued fire arrives with OccurredAtUtc=T+8 — mismatches new deadline at T+15.
+            // OLD queued fire arrives with due time T+8 — mismatches the new deadline at T+15.
             var step = engine.Reduce(state, MakeSignal(99, DecisionSignalKind.DeadlineFired, T0.AddMinutes(8),
                 new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.DeviceOnlyEspDetection }));
 

src/Agent/AutopilotMonitor.DecisionCore.Tests/SerializationTests.cs

@@ -54,6 +54,37 @@ namespace AutopilotMonitor.DecisionCore.Tests
             Assert.Equal("AccountSetup", roundtripped.Payload!["phase"]);
         }
 
+        [Fact]
+        public void SignalSerializer_roundtrip_keeps_date_like_payload_strings_verbatim()
+        {
+            // The shared reader tokenizes ISO-8601 strings as dates; the string dictionaries must
+            // still come back as the round-trip text the writer produced, never culture-formatted
+            // (the DeadlineFired due time is parsed back with the "o" format on replay).
+            var due = new DateTime(2026, 4, 20, 9, 55, 0, DateTimeKind.Utc);
+            var original = new DecisionSignal(
+                sessionSignalOrdinal: 7,
+                sessionTraceOrdinal: 7,
+                kind: DecisionSignalKind.DeadlineFired,
+                kindSchemaVersion: 1,
+                occurredAtUtc: due.AddMinutes(5),
+                sourceOrigin: "DeadlineScheduler",
+                evidence: new Evidence(
+                    kind: EvidenceKind.Synthetic,
+                    identifier: "hello_safety",
+                    summary: "deadline fired",
+                    derivationInputs: new Dictionary<string, string> { ["armedAt"] = "2026-04-20T09:50:00.0000000Z" }),
+                payload: new Dictionary<string, string>
+                {
+                    ["deadline"] = "hello_safety",
+                    ["deadlineDueAtUtc"] = due.ToString("O"),
+                });
+
+            var roundtripped = SignalSerializer.Deserialize(SignalSerializer.Serialize(original));
+
+            Assert.Equal("2026-04-20T09:55:00.0000000Z", roundtripped.Payload!["deadlineDueAtUtc"]);
+            Assert.Equal("2026-04-20T09:50:00.0000000Z", roundtripped.Evidence.DerivationInputs!["armedAt"]);
+        }
+
         [Fact]
         public void SignalSerializer_Deserialize_MissingEvidence_throws()
         {

src/Backend/AutopilotMonitor.Functions.Tests/AnalyzeRulesFunctionAuthorEndpointTests.cs

@@ -0,0 +1,206 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text;
+using AutopilotMonitor.Functions.Functions.Rules;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Azure.Core.Serialization;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Newtonsoft.Json;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Analyze twin of <see cref="GatherRulesFunctionAuthorEndpointTests"/>: the rule Author is
+/// stamped from the caller's JWT on create, on a PUT-upsert of an unknown rule and on the
+/// template copy, and a true update keeps the original creator over editor and body.
+/// Before this pin, custom analyze rules were created as "Autopilot Monitor" and the edit
+/// path let the browser choose the author.
+/// </summary>
+public class AnalyzeRulesFunctionAuthorEndpointTests
+{
+    private const string TenantId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+    private const string RuleId = "ANALYZE-CUSTOM-777";
+    private const string TemplateRuleId = "ANALYZE-SEC-004";
+
+    private sealed class FakeHttpResponseData : HttpResponseData
+    {
+        public FakeHttpResponseData(FunctionContext context) : base(context) { }
+        public override HttpStatusCode StatusCode { get; set; } = HttpStatusCode.OK;
+        public override HttpHeadersCollection Headers { get; set; } = new();
+        public override Stream Body { get; set; } = new MemoryStream();
+        public override HttpCookies Cookies { get; } = new Mock<HttpCookies>().Object;
+    }
+
+    private static FunctionContext BuildContext(ClaimsPrincipal? principal)
+    {
+        var services = new ServiceCollection();
+        services.AddOptions();
+        services.Configure<WorkerOptions>(o => o.Serializer =
+            new JsonObjectSerializer(ApiJsonOptions.Create()));
+        var provider = services.BuildServiceProvider();
+
+        var items = new Dictionary<object, object>();
+        if (principal != null)
+        {
+            items["ClaimsPrincipal"] = principal;
+        }
+
+        var context = new Mock<FunctionContext>();
+        context.SetupGet(c => c.Items).Returns(items);
+        context.SetupGet(c => c.InstanceServices).Returns(provider);
+        return context.Object;
+    }
+
+    private static HttpRequestData BuildRequest(ClaimsPrincipal? principal, object body)
+    {
+        var context = BuildContext(principal);
+        var req = new Mock<HttpRequestData>(context);
+        req.SetupGet(r => r.Headers).Returns(new HttpHeadersCollection());
+        req.SetupGet(r => r.Body).Returns(
+            new MemoryStream(Encoding.UTF8.GetBytes(JsonConvert.SerializeObject(body))));
+        req.Setup(r => r.CreateResponse()).Returns(() => new FakeHttpResponseData(context));
+        return req.Object;
+    }
+
+    private static ClaimsPrincipal Principal(params (string Type, string Value)[] claims)
+        => new(new ClaimsIdentity(claims.Select(c => new Claim(c.Type, c.Value)), "TestAuth"));
+
+    private static ClaimsPrincipal AlicePrincipal()
+        => Principal(("tid", TenantId), ("name", "Alice Admin"), ("upn", "alice@contoso.com"));
+
+    private static (AnalyzeRulesFunction function, List<AnalyzeRule> stored) BuildFunction(
+        AnalyzeRule? existingTenantRule = null, AnalyzeRule? globalRule = null)
+    {
+        var repo = new Mock<IRuleRepository>(MockBehavior.Loose);
+        var stored = new List<AnalyzeRule>();
+
+        repo.Setup(r => r.AnalyzeRuleExistsAsync(It.IsAny<string>(), It.IsAny<string>())).ReturnsAsync(false);
+        repo.Setup(r => r.GetAnalyzeRulesAsync("global")).ReturnsAsync(
+            globalRule == null ? new List<AnalyzeRule>() : new List<AnalyzeRule> { globalRule });
+        repo.Setup(r => r.GetAnalyzeRulesAsync(TenantId)).ReturnsAsync(
+            existingTenantRule == null ? new List<AnalyzeRule>() : new List<AnalyzeRule> { existingTenantRule });
+        repo.Setup(r => r.GetRuleStatesAsync(TenantId)).ReturnsAsync(new Dictionary<string, RuleState>());
+        repo.Setup(r => r.StoreRuleStateAsync(TenantId, It.IsAny<string>(), It.IsAny<RuleState>())).ReturnsAsync(true);
+        repo.Setup(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), TenantId))
+            .Callback<AnalyzeRule, string>((rule, _) => stored.Add(rule))
+            .ReturnsAsync(true);
+
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+        return (new AnalyzeRulesFunction(NullLogger<AnalyzeRulesFunction>.Instance, service), stored);
+    }
+
+    private static AnalyzeRule SpoofedPayload() => new()
+    {
+        RuleId = RuleId,
+        Title = "Proxy PAC unreachable",
+        Description = "Custom",
+        Severity = "warning",
+        Category = "network",
+        Explanation = "The PAC file could not be fetched.",
+        IsBuiltIn = false,
+        IsCommunity = false,
+        Enabled = true,
+        Author = "Spoofed Author",
+        Conditions = new List<RuleCondition>
+        {
+            new() { Signal = "pac_failed", Source = "event_type", EventType = "network_pac_failed", Required = true }
+        },
+    };
+
+    [Fact]
+    public async Task CreateRule_stamps_author_from_jwt_not_from_body()
+    {
+        var (function, stored) = BuildFunction();
+        var req = BuildRequest(AlicePrincipal(), SpoofedPayload());
+
+        var response = await function.CreateRule(req);
+
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+        var written = Assert.Single(stored);
+        Assert.Equal("Alice Admin", written.Author);
+    }
+
+    [Fact]
+    public async Task CreateRule_falls_back_to_product_name_without_identifying_claims()
+    {
+        var (function, stored) = BuildFunction();
+        var req = BuildRequest(Principal(("tid", TenantId)), SpoofedPayload());
+
+        var response = await function.CreateRule(req);
+
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+        var written = Assert.Single(stored);
+        Assert.Equal("Autopilot Monitor", written.Author);
+    }
+
+    [Fact]
+    public async Task UpdateRule_upsert_of_unknown_rule_stamps_author_from_jwt()
+    {
+        var (function, stored) = BuildFunction(existingTenantRule: null);
+        var req = BuildRequest(AlicePrincipal(), SpoofedPayload());
+
+        var response = await function.UpdateRule(req, RuleId);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var written = Assert.Single(stored);
+        Assert.Equal("Alice Admin", written.Author);
+    }
+
+    [Fact]
+    public async Task UpdateRule_true_update_keeps_original_author_over_editor_and_body()
+    {
+        var existing = SpoofedPayload();
+        existing.Author = "Original Creator";
+        existing.CreatedAt = new DateTime(2026, 1, 2, 3, 4, 5, DateTimeKind.Utc);
+        var (function, stored) = BuildFunction(existing);
+        var req = BuildRequest(
+            Principal(("tid", TenantId), ("name", "Bob Editor")), SpoofedPayload());
+
+        var response = await function.UpdateRule(req, RuleId);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var written = Assert.Single(stored);
+        Assert.Equal("Original Creator", written.Author);
+        Assert.Equal(existing.CreatedAt, written.CreatedAt);
+    }
+
+    [Fact]
+    public async Task CreateFromTemplate_stamps_the_copying_admin_not_the_template_author()
+    {
+        var template = new AnalyzeRule
+        {
+            RuleId = TemplateRuleId,
+            Title = "AutoLogon enabled for an unexpected user",
+            Description = "Template",
+            Severity = "warning",
+            Category = "security",
+            Explanation = "Template",
+            IsBuiltIn = true,
+            Author = "Autopilot Monitor",
+            Conditions = new List<RuleCondition>
+            {
+                new() { Signal = "autologon", Source = "event_type", EventType = "autologon_analysis", Operator = "equals", Value = "PLACEHOLDER", Required = true }
+            },
+            TemplateVariables = new List<TemplateVariable>
+            {
+                new() { Name = "allowed", Label = "Allowed", ConditionIndex = 0, Field = "value" }
+            },
+        };
+        var (function, stored) = BuildFunction(globalRule: template);
+        var req = BuildRequest(AlicePrincipal(), new { variables = new Dictionary<string, string> { ["allowed"] = "KIOSK-1" } });
+
+        var response = await function.CreateFromTemplate(req, TemplateRuleId);
+
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+        var written = Assert.Single(stored);
+        Assert.Equal("Alice Admin", written.Author);
+        Assert.Equal(TemplateRuleId, written.DerivedFromTemplateRuleId);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AppInstallIncompleteCloseTests.cs

@@ -0,0 +1,63 @@
+using Azure.Data.Tables;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Observation-end closure of app rows: a row still InProgress when the session's observation
+/// ended becomes "Incomplete" (terminal, non-failure, outcome unknown). Pins the pure per-row
+/// predicate behind <see cref="TableStorageService.CloseOpenAppInstallsForSessionAsync"/> and
+/// the disclosed bucket in the app-metrics payload.
+/// </summary>
+public class AppInstallIncompleteCloseTests
+{
+    private static TableEntity Row(string? status, DateTimeOffset? completedAt = null)
+    {
+        var row = new TableEntity("tenant", "session_App");
+        if (status != null) row["Status"] = status;
+        if (completedAt.HasValue) row["CompletedAt"] = completedAt.Value;
+        return row;
+    }
+
+    [Theory]
+    [InlineData("InProgress")]
+    [InlineData("")]
+    [InlineData(null)]
+    public void ShouldClose_OpenRow(string? status)
+        => Assert.True(TableStorageService.ShouldCloseAsIncomplete(Row(status)));
+
+    [Theory]
+    [InlineData("Succeeded")]
+    [InlineData("Failed")]
+    [InlineData("Incomplete")]
+    public void ShouldClose_LeavesTerminalRowsAlone(string status)
+        => Assert.False(TableStorageService.ShouldCloseAsIncomplete(Row(status)));
+
+    [Fact]
+    public void ShouldClose_NeverClosesARowWithAnEnd()
+    {
+        // Out-of-order arrival can leave a CompletedAt on a row whose status batch is late —
+        // an end is an end.
+        Assert.False(TableStorageService.ShouldCloseAsIncomplete(Row("InProgress", DateTimeOffset.UtcNow)));
+    }
+
+    [Fact]
+    public void AppMetrics_DisclosesIncompleteOutsideTheRate()
+    {
+        var payload = MetricsMath.BuildAppMetricsPayload(new[]
+        {
+            new AppInstallSummary { AppName = "App", Status = "Succeeded", TerminalState = "Installed", DurationSeconds = 30 },
+            new AppInstallSummary { AppName = "App", Status = "Failed", TerminalState = "Error", DurationSeconds = 30 },
+            new AppInstallSummary { AppName = "App", Status = "Incomplete" },
+        });
+
+        var group = Assert.Single(payload.TopFailingApps);
+        Assert.Equal(3, group.TotalInstalls);
+        Assert.Equal(1, group.Incomplete);
+        Assert.Equal(50.0, group.FailureRate);
+        Assert.Equal(1, payload.TotalIncomplete);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AppInstallTerminalStateAndReconcileTests.cs

@@ -155,6 +155,30 @@ public class AppInstallTerminalStateAndReconcileTests
         Assert.Equal("Succeeded", summary.Status);
     }
 
+    [Fact]
+    public void Reconcile_IncompleteIsSticky_AgainstLateProgressBatch()
+    {
+        // Closed by the observation-end step; a straggling started/progress batch must not reopen it.
+        var existing = new TableEntity("tenant", "session_App") { ["Status"] = "Incomplete" };
+        var summary = new AppInstallSummary { AppName = "App", Status = "InProgress", StartedAt = T0 };
+
+        TableStorageService.ReconcileAppInstallSummaryWithExisting(summary, existing);
+
+        Assert.Equal("Incomplete", summary.Status);
+    }
+
+    [Fact]
+    public void Reconcile_RealTerminalOverridesIncomplete()
+    {
+        // The completion arrived after the close step: real evidence beats the hedge.
+        var existing = new TableEntity("tenant", "session_App") { ["Status"] = "Incomplete" };
+        var summary = new AppInstallSummary { AppName = "App", Status = "Succeeded", StartedAt = T0 };
+
+        TableStorageService.ReconcileAppInstallSummaryWithExisting(summary, existing);
+
+        Assert.Equal("Succeeded", summary.Status);
+    }
+
     [Fact]
     public void Reconcile_Q4Guard_DoesNotFireWithoutStoredCompletedAt()
     {

src/Backend/AutopilotMonitor.Functions.Tests/BuiltInRulesTests.cs

@@ -175,7 +175,7 @@ public class BuiltInRulesTests
             "cancelStuckAndSetCurrent", "imeSessionChange", "imeImpersonation", "imeTokenFailure",
             "enrollmentCompleted", "userSessionZeroApps", "updateDoTelemetry", "scriptStarted",
             "scriptContext", "scriptExitCode", "scriptOutput", "scriptCompleted",
-            "resetPlatformScriptContext",
+            "resetPlatformScriptContext", "agentInvocationArgument", "agentExecutorCompleted",
             "healthScriptResult", "healthScriptDetectionResult",
             "captureExitCode", "captureHResult",
             "captureAppVersion", "captureAppTypeWinGet", "captureAppTypeMsi",

src/Backend/AutopilotMonitor.Functions.Tests/CertTenantBindingTests.cs

@@ -37,9 +37,9 @@ public class CertTenantBindingTests
     /// Tenant stamped into <c>device-cert-sample.pem</c> by the Intune MDM Device CA. The sample is
     /// a public-key-only cert from an internal test device; the GUID is the test tenant's own id.
     /// </summary>
-    private static readonly Guid SampleCertTenantId = Guid.Parse("b54dc1af-5320-4f60-b5d4-821e0cf2a359");
+    internal static readonly Guid SampleCertTenantId = Guid.Parse("b54dc1af-5320-4f60-b5d4-821e0cf2a359");
 
-    private static string SampleCertBase64()
+    internal static string SampleCertBase64()
     {
         var assemblyDir = Path.GetDirectoryName(typeof(CertTenantBindingTests).Assembly.Location)!;
         var pem = File.ReadAllText(Path.Combine(assemblyDir, DeviceSamplePem));
@@ -351,7 +351,7 @@ public class CertTenantBindingTests
 
     // ---------------------------------------------------------------- harness
 
-    private static SecurityValidator BuildValidator(ILogger logger)
+    internal static SecurityValidator BuildValidator(ILogger logger)
     {
         var configRepo = Mock.Of<IConfigRepository>();
         var cache = new MemoryCache(new MemoryCacheOptions());
@@ -390,7 +390,7 @@ public class CertTenantBindingTests
             deviceAssociationValidator: null);
     }
 
-    private static HttpRequestData BuildRequestWithCert(
+    internal static HttpRequestData BuildRequestWithCert(
         string certBase64,
         IDictionary<object, object>? items = null)
     {

src/Backend/AutopilotMonitor.Functions.Tests/LatestVersionsServiceTests.cs

@@ -10,7 +10,7 @@ using Microsoft.Extensions.Logging.Abstractions;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Tests for <see cref="LatestVersionsService"/> — the 12h-cached reader for the
+/// Tests for <see cref="LatestVersionsService"/> — the short-TTL reader for the
 /// public <c>version.json</c> blob. Verifies cache hit/miss, forceRefresh bypass,
 /// and failure fallback without hammering the blob on every call.
 /// </summary>
@@ -140,6 +140,28 @@ public class LatestVersionsServiceTests
         Assert.Equal(1, handler.CallCount);
     }
 
+    [Fact]
+    public async Task GetAsync_HttpFailure_AfterSuccess_ServesLastKnownGood()
+    {
+        var (svc, handler, _) = Create();
+
+        await svc.GetAsync(forceRefresh: false, CancellationToken.None);
+        handler.Responder = _ => new HttpResponseMessage(HttpStatusCode.InternalServerError);
+
+        // The refresh fails, but the version line must not blank out: the last good
+        // value stands until the blob answers again.
+        var afterFailure = await svc.GetAsync(forceRefresh: true, CancellationToken.None);
+
+        Assert.NotNull(afterFailure);
+        Assert.Equal("1.0.706", afterFailure!.AgentVersion);
+        Assert.True(afterFailure.FromCache);
+
+        // ...and it is what the short failure cache serves to the next callers, too.
+        var next = await svc.GetAsync(forceRefresh: false, CancellationToken.None);
+        Assert.Equal("1.0.706", next!.AgentVersion);
+        Assert.Equal(2, handler.CallCount);
+    }
+
     [Fact]
     public async Task GetAsync_MalformedJson_ReturnsNull()
     {

src/Backend/AutopilotMonitor.Functions.Tests/McpOrganizationUsageAggregationTests.cs

@@ -1,12 +1,14 @@
 using AutopilotMonitor.Functions.Functions.Metrics;
+using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.DataAccess;
 using Xunit;
 
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Tests for the pure fold behind GET metrics/mcp-usage/organization: one item per account, the
-/// delegated (MSP) marker from the row's home tenant, and the three windows (today / month / range).
+/// Tests for the pure folds behind GET metrics/mcp-usage/organization (and its global twin): one item per
+/// account, the delegated (MSP) marker from the row's home tenant, the three windows (today / month / range),
+/// and the tenant's organization windows over every account.
 /// </summary>
 public class McpOrganizationUsageAggregationTests
 {
@@ -86,6 +88,57 @@ public class McpOrganizationUsageAggregationTests
         Assert.Equal(newer, items[1].LastRequestAt);
     }
 
+    [Fact]
+    public void OrganizationQuota_SumsTodayAndMonthOverEveryAccount_AndCarriesTheTenantLimits()
+    {
+        var rows = new[]
+        {
+            Row(Member, "20260815", 100),                 // last month: neither window
+            Row(Member, "20260901", 20),                  // month
+            Row(Member, "20260902", 2),                   // today + month
+            Row(MspAdmin, "20260902", 5, home: MspHome),  // delegated reads count against the same windows
+            Row(Member, "20260903", 7),                   // read window past today (range only)
+        };
+
+        var quota = McpUsageMetricsFunction.BuildOrganizationQuota(
+            rows, new McpQuotaService.TenantPlanLimits("pro", 1500, 15000), "20260902", "20260901");
+
+        Assert.Equal("pro", quota.TenantPlan);
+        Assert.Equal(1500, quota.DailyLimit);
+        Assert.Equal(15000, quota.MonthlyLimit);
+        Assert.Equal(7, quota.DailyUsed);
+        Assert.Equal(27, quota.MonthlyUsed);
+    }
+
+    [Fact]
+    public void OrganizationDaily_SumsEveryAccountPerDay_InsideTheRange_OldestFirst()
+    {
+        var rows = new[]
+        {
+            Row(Member, "20260815", 100),                 // before the range
+            Row(Member, "20260902", 2),
+            Row(MspAdmin, "20260902", 5, home: MspHome),  // same day, delegated — one bar
+            Row(Member, "20260901", 20),
+            Row(Member, "20260903", 7),                   // after the range (read window)
+        };
+
+        var daily = McpUsageMetricsFunction.BuildOrganizationDaily(rows, "20260901", "20260902");
+
+        Assert.Equal(new[] { ("20260901", 20L), ("20260902", 7L) }, daily.Select(d => (d.Date, d.Requests)));
+    }
+
+    [Fact]
+    public void OrganizationQuota_LiftedWindows_StillReportTheCounters()
+    {
+        var quota = McpUsageMetricsFunction.BuildOrganizationQuota(
+            new[] { Row(Member, "20260902", 3) }, new McpQuotaService.TenantPlanLimits("pro", 0, 0), "20260902", "20260901");
+
+        Assert.Equal(0, quota.DailyLimit);
+        Assert.Equal(0, quota.MonthlyLimit);
+        Assert.Equal(3, quota.DailyUsed);
+        Assert.Equal(3, quota.MonthlyUsed);
+    }
+
     [Theory]
     [InlineData("2026-09-02", "20260902")]
     [InlineData("20260902", "20260902")]

src/Backend/AutopilotMonitor.Functions.Tests/RequestRowMarkersTests.cs

@@ -0,0 +1,119 @@
+using AutopilotMonitor.Functions.Middleware;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The agent security gate stamps two dimensions onto the request row through
+/// <c>FunctionContext.Items</c>: the tenant it proved (<c>ValidatedTenantId</c>) and the outcome of
+/// the device-validation chain (<c>DeviceValidation</c>). These tests pin
+///   - that a request which passes the gate carries both, and one rejected before the chain
+///     carries neither (a rejected certificate must not attribute the row to the claimed tenant),
+///   - that the middleware takes the proven tenant before the <c>X-Tenant-Id</c> header and never
+///     takes the header on a route that does not validate it — register and config take the tenant
+///     from body/query, so a client-sent header there is attacker-controlled.
+/// </summary>
+public class RequestRowMarkersTests
+{
+    private const string RegisterPath = "/api/agent/register-session";
+    private const string ConfigPath = "/api/agent/config";
+    private const string TelemetryPath = "/api/agent/telemetry";
+    private const string OtherTenant = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+
+    // ---------------------------------------------------------------- validator stamps
+
+    [Fact]
+    public async Task ValidateRequest_PassingTheGate_StampsProvenTenantAndDeviceValidation()
+    {
+        var items = new Dictionary<object, object>();
+        var validator = CertTenantBindingTests.BuildValidator(Mock.Of<ILogger>());
+        var tenantId = CertTenantBindingTests.SampleCertTenantId.ToString();
+
+        var result = await validator.ValidateRequestAsync(
+            CertTenantBindingTests.BuildRequestWithCert(CertTenantBindingTests.SampleCertBase64(), items),
+            tenantId);
+
+        Assert.True(result.IsValid);
+        Assert.Equal(tenantId, Assert.Contains(RequestRowMarkers.ValidatedTenantKey, items));
+        // The harness runs the tenant without a device validator (AllowInsecureAgentRequests).
+        Assert.Equal(RequestRowMarkers.DeviceValidation.None, Assert.Contains(RequestRowMarkers.DeviceValidationKey, items));
+    }
+
+    [Fact]
+    public async Task ValidateRequest_CertificateOfAnotherTenant_StampsNeither()
+    {
+        var items = new Dictionary<object, object>();
+        var validator = CertTenantBindingTests.BuildValidator(Mock.Of<ILogger>());
+
+        var result = await validator.ValidateRequestAsync(
+            CertTenantBindingTests.BuildRequestWithCert(CertTenantBindingTests.SampleCertBase64(), items),
+            tenantId: OtherTenant);
+
+        Assert.False(result.IsValid);
+        // The row must not be attributed to the tenant the caller merely claimed …
+        Assert.DoesNotContain(RequestRowMarkers.ValidatedTenantKey, items);
+        // … and the device chain never ran, so there is no outcome to report.
+        Assert.DoesNotContain(RequestRowMarkers.DeviceValidationKey, items);
+        // The binding outcome itself still rides along (denominator for the cert-tenant telemetry).
+        Assert.Equal(CertTenantBinding.Outcome.Mismatch, Assert.Contains(CertTenantBinding.RequestItemKey, items));
+    }
+
+    [Fact]
+    public void DeviceValidationValue_IsTheValidatorName_AndNoneForUnknown()
+    {
+        Assert.Equal("None", RequestRowMarkers.DeviceValidationValue(ValidatorType.Unknown));
+        foreach (var validator in Enum.GetValues<ValidatorType>().Where(v => v != ValidatorType.Unknown))
+            Assert.Equal(validator.ToString(), RequestRowMarkers.DeviceValidationValue(validator));
+
+        // The three non-validator values must never collide with a validator name.
+        var validatorNames = Enum.GetNames<ValidatorType>();
+        Assert.DoesNotContain(RequestRowMarkers.DeviceValidation.None, validatorNames);
+        Assert.DoesNotContain(RequestRowMarkers.DeviceValidation.Transient, validatorNames);
+        Assert.DoesNotContain(RequestRowMarkers.DeviceValidation.Rejected, validatorNames);
+    }
+
+    // ---------------------------------------------------------------- middleware attribution
+
+    [Fact]
+    public void ResolveTenantId_PolicyTenantWins()
+    {
+        var items = new Dictionary<object, object> { [RequestRowMarkers.ValidatedTenantKey] = OtherTenant };
+        Assert.Equal("policy-tenant", RequestTelemetryMiddleware.ResolveTenantId("policy-tenant", items, RegisterPath, OtherTenant));
+    }
+
+    [Theory]
+    [InlineData(RegisterPath)]
+    [InlineData(ConfigPath)]
+    [InlineData(TelemetryPath)]
+    public void ResolveTenantId_ProvenTenantBeatsTheHeaderOnEveryRoute(string path)
+    {
+        var proven = CertTenantBindingTests.SampleCertTenantId.ToString();
+        var items = new Dictionary<object, object> { [RequestRowMarkers.ValidatedTenantKey] = proven };
+        Assert.Equal(proven, RequestTelemetryMiddleware.ResolveTenantId(null, items, path, OtherTenant));
+    }
+
+    [Theory]
+    [InlineData(RegisterPath)]
+    [InlineData(ConfigPath)]
+    [InlineData("/api/agent/upload-url")]
+    [InlineData("/api/bootstrap/register-session")]
+    public void ResolveTenantId_HeaderIsIgnoredOnRoutesThatDoNotValidateIt(string path)
+    {
+        // Without a stamp from the validator (the request never passed the gate) a client-sent
+        // header must not attribute the row to any tenant.
+        Assert.Null(RequestTelemetryMiddleware.ResolveTenantId(null, new Dictionary<object, object>(), path, OtherTenant));
+    }
+
+    [Fact]
+    public void ResolveTenantId_HeaderIsHonoredOnlyOnTrustedRoutes_AndOnlyAsGuid()
+    {
+        var none = new Dictionary<object, object>();
+        Assert.Equal(OtherTenant, RequestTelemetryMiddleware.ResolveTenantId(null, none, TelemetryPath, OtherTenant));
+        Assert.Equal(OtherTenant, RequestTelemetryMiddleware.ResolveTenantId(null, none, "/api/agent/distress", OtherTenant));
+        Assert.Null(RequestTelemetryMiddleware.ResolveTenantId(null, none, TelemetryPath, "not-a-guid"));
+        Assert.Null(RequestTelemetryMiddleware.ResolveTenantId(null, none, TelemetryPath, null));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/RuleEngineEspSoftFailureTests.cs

@@ -7,19 +7,21 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Pins ANALYZE-ESP-004 ("ESP Timeout with 'Continue Anyway' — Soft Failure").
+/// Pins ANALYZE-ESP-004 ("ESP Gave Up on a Blocking App with 'Continue Anyway' — Soft Failure").
 ///
 /// Background (tenant c9787ba2, session cb7036a6): a slow blocking app (Encompass
 /// Hybrid Installer) does not finish inside the 30-min Device-ESP window, so the ESP
 /// fails terminally in DeviceSetup. The profile allows "Continue anyway", so the user
 /// most likely dismissed the failure screen and reached the desktop — but the agent
-/// only ever sees the terminal failure and the session is recorded as Failed. The
-/// DecisionEngine already stamps the enrollment_failed event with
-/// <c>mayHaveContinuedAnyway=true</c>; this rule turns that into a customer-visible
-/// "soft failure" advisory with the root-cause remediation.
+/// only ever sees the terminal failure and the session is recorded as Failed.
 ///
-/// The rule keys ONLY on <c>mayHaveContinuedAnyway==true</c> (set exclusively on the
-/// ESP terminal-failure path), so an ordinary hard failure must not trip it.
+/// The rule needs THREE facts: the terminal enrollment_failed, the DecisionEngine's
+/// <c>mayHaveContinuedAnyway=true</c> stamp (profile allows the button), and the agent's own
+/// timeout verdict — an app_install_failed promoted with <c>failureType=esp_apps_timeout</c>
+/// (ESP gave up while the app was still installing, no per-app HRESULT). Session 683f1eff:
+/// an ESP failure with a real HRESULT (0x80070652, installer collision) on a Continue-anyway
+/// profile fired the rule and rendered the configured 90-min limit as if it had elapsed —
+/// the continue-anyway flag alone proves nothing about timing.
 /// </summary>
 public class RuleEngineEspSoftFailureTests
 {
@@ -37,8 +39,9 @@ public class RuleEngineEspSoftFailureTests
 
         var events = new List<EnrollmentEvent>
         {
+            SettleStartedEvent(errorCode: null),
             EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
         };
 
         var outcome = await RunAsync(rule, events);
@@ -47,13 +50,15 @@ public class RuleEngineEspSoftFailureTests
         Assert.Equal("ANALYZE-ESP-004", result.RuleId);
         Assert.Equal("warning", result.Severity);
 
-        // Required gate matched on the continue-anyway flag.
+        // Required gates: the continue-anyway flag AND the agent's timeout verdict.
         var gate = AsDict(result.MatchedConditions["may_have_continued"]);
         Assert.Equal("true", AsString(gate["value"]));
+        var verdict = AsDict(result.MatchedConditions["esp_gave_up_on_app"]);
+        Assert.Equal("esp_apps_timeout", AsString(verdict["value"]));
 
-        // Interpolation material for the explanation / remediation templates is present:
-        // {{espSyncFailureTimeoutMinutes}}, {{failedSubcategory}} (from enrollment_failed)
-        // and {{appName}} (from app_install_failed).
+        // Interpolation material: {{espSyncFailureTimeoutMinutes}} (enrollment_failed),
+        // {{failedSubcategory}} (esp_failure_settle_started — the terminal event drops it when
+        // the Shell-Core failure wins the race) and {{appName}} (the promoted app).
         var timeout = AsDict(result.MatchedConditions["espSyncFailureTimeoutMinutes"]);
         Assert.Equal("30", AsString(timeout["value"]));
 
@@ -65,6 +70,48 @@ public class RuleEngineEspSoftFailureTests
         Assert.Equal(FailedAppName, AsString(failedApp["value"]));
     }
 
+    [Fact]
+    public async Task ANALYZE_ESP_004_stays_silent_on_a_hard_failure_with_continue_anyway()
+    {
+        // Session 683f1eff: continue-anyway profile, but the ESP failed on a real installer
+        // error (0x80070652 / MSI 1618) after 19 minutes. The failed app carries no
+        // esp_apps_timeout verdict — the rule must not turn an installer collision into
+        // "the ESP reached its 90-min timeout".
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-ESP-004");
+
+        var events = new List<EnrollmentEvent>
+        {
+            SettleStartedEvent(errorCode: "0x80070652"),
+            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
+            AppInstallFailed(failureType: null, exitCodeClass: "Retry"),
+        };
+
+        var outcome = await RunAsync(rule, events);
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task ANALYZE_ESP_004_names_the_timed_out_app_not_another_failed_one()
+    {
+        // Two failed apps: one hard installer failure earlier in the run, one promoted
+        // esp_apps_timeout at the terminal. {{appName}} must be the timed-out app.
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-ESP-004");
+
+        var events = new List<EnrollmentEvent>
+        {
+            AppInstallFailed(failureType: null, exitCodeClass: "Failed", appName: "Contoso Agent", sequence: 100),
+            SettleStartedEvent(errorCode: null),
+            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
+        };
+
+        var outcome = await RunAsync(rule, events);
+
+        var result = Assert.Single(outcome.Results);
+        var failedApp = AsDict(result.MatchedConditions["appName"]);
+        Assert.Equal(FailedAppName, AsString(failedApp["value"]));
+    }
+
     [Fact]
     public async Task ANALYZE_ESP_004_does_not_fire_when_continue_anyway_is_false()
     {
@@ -75,7 +122,7 @@ public class RuleEngineEspSoftFailureTests
         var events = new List<EnrollmentEvent>
         {
             EnrollmentFailedEvent(mayHaveContinuedAnyway: "false"),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
         };
 
         var outcome = await RunAsync(rule, events);
@@ -92,7 +139,7 @@ public class RuleEngineEspSoftFailureTests
         var events = new List<EnrollmentEvent>
         {
             EnrollmentFailedEvent(mayHaveContinuedAnyway: null),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
         };
 
         var outcome = await RunAsync(rule, events);
@@ -132,23 +179,61 @@ public class RuleEngineEspSoftFailureTests
         return data;
     }
 
-    private static EnrollmentEvent AppInstallFailed() => new()
+    private static EnrollmentEvent SettleStartedEvent(string? errorCode)
     {
-        EventId = Guid.NewGuid().ToString(),
-        TenantId = TenantId,
-        SessionId = SessionId,
-        EventType = "app_install_failed",
-        Timestamp = DateTime.UtcNow,
-        Sequence = 220,
-        Data = new Dictionary<string, object>
+        var data = new Dictionary<string, object>
         {
-            ["appName"] = FailedAppName,
+            ["category"] = "DeviceSetup",
+            ["failedSubcategory"] = "Certificates",
+            ["failureType"] = "Provisioning_DeviceSetup_Certificates_Failed",
+            ["settleSeconds"] = 30,
+            ["reason"] = "wait_for_late_ime_signals",
+        };
+        if (errorCode != null)
+            data["errorCode"] = errorCode;
+        return new EnrollmentEvent
+        {
+            EventId = Guid.NewGuid().ToString(),
+            TenantId = TenantId,
+            SessionId = SessionId,
+            EventType = "esp_failure_settle_started",
+            Timestamp = DateTime.UtcNow,
+            Sequence = 212,
+            Data = data,
+        };
+    }
+
+    private static EnrollmentEvent AppInstallFailed(
+        string? failureType,
+        string? exitCodeClass = null,
+        string appName = FailedAppName,
+        int sequence = 220)
+    {
+        var data = new Dictionary<string, object>
+        {
+            ["appName"] = appName,
             ["state"] = "Error",
             ["targeted"] = "Device",
-            ["failureType"] = "esp_apps_timeout",
-            ["errorDetail"] = "Install status unconfirmed — ESP gave up while this app was still installing.",
+        };
+        if (failureType != null)
+        {
+            data["failureType"] = failureType;
+            data["confidence"] = "presumed";
+            data["errorDetail"] = "Install status unconfirmed — ESP gave up while this app was still installing.";
         }
-    };
+        if (exitCodeClass != null)
+            data["exitCodeClass"] = exitCodeClass;
+        return new EnrollmentEvent
+        {
+            EventId = Guid.NewGuid().ToString(),
+            TenantId = TenantId,
+            SessionId = SessionId,
+            EventType = "app_install_failed",
+            Timestamp = DateTime.UtcNow,
+            Sequence = sequence,
+            Data = data,
+        };
+    }
 
     private static Dictionary<string, object> AsDict(object o)
     {

src/Backend/AutopilotMonitor.Functions.Tests/RuleEngineEventTypeNotExistsTests.cs

@@ -7,12 +7,17 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Pins the absence gate on <c>event_type</c> conditions: <c>not_exists</c> without a
-/// <c>dataField</c> matches when no event of that type occurs in the session and is disproved by
-/// a single such event. Before this branch an absent type always evaluated false, so a required
-/// "must not have happened" condition could never be expressed (ANALYZE-ID-004 v2 relies on it).
-/// The dataField variant keeps its historical meaning (some event of the type has an empty field)
-/// and is not touched here.
+/// Pins the absence gates on conditions.
+///
+/// Without a <c>dataField</c>, <c>not_exists</c> matches when no event of that type occurs in
+/// the session and is disproved by a single such event (ANALYZE-ID-004 v2 relies on it).
+///
+/// With a <c>dataField</c>, <c>not_exists</c> matches when no event of the type carries a
+/// non-empty value at that field — including when the type is absent — and is disproved by a
+/// single non-empty value; on <c>event_data</c> the same-event filter narrows the inspected set
+/// first. Before this the per-event loop's null short-circuit rejected a missing field before
+/// the operator ever ran, so "the ESP failure carried no HRESULT" (session 683f1eff) could not be
+/// expressed at all, while the precondition gate already had the absence semantics.
 /// </summary>
 public class RuleEngineEventTypeNotExistsTests
 {
@@ -24,7 +29,7 @@ public class RuleEngineEventTypeNotExistsTests
     {
         var events = new List<EnrollmentEvent> { Event("marker_seen", 1) };
 
-        var outcome = await RunAsync(Rule(), events);
+        var outcome = await RunAsync(TypeAbsenceRule(), events);
 
         var result = Assert.Single(outcome.Results);
         var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["disproof_absent"]);
@@ -37,12 +42,111 @@ public class RuleEngineEventTypeNotExistsTests
     {
         var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2) };
 
-        var outcome = await RunAsync(Rule(), events);
+        var outcome = await RunAsync(TypeAbsenceRule(), events);
 
         Assert.Empty(outcome.Results);
     }
 
-    private static AnalyzeRule Rule() => new()
+    [Fact]
+    public async Task Field_not_exists_matches_when_no_event_carries_the_field()
+    {
+        // The event type is present, the field is not — the shape of an ESP failure without an
+        // HRESULT (esp_failure_settle_started without errorCode).
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        var result = Assert.Single(outcome.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal("disproof", evidence["eventType"]);
+        Assert.Equal("errorCode", evidence["field"]);
+        Assert.Equal(1, evidence["count"]);
+    }
+
+    [Fact]
+    public async Task Field_not_exists_matches_when_the_event_type_is_absent()
+    {
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        var result = Assert.Single(outcome.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal(0, evidence["count"]);
+    }
+
+    [Theory]
+    [InlineData("event_type")]
+    [InlineData("event_data")]
+    public async Task A_non_empty_value_on_any_event_vetoes_a_required_field_not_exists(string source)
+    {
+        var events = new List<EnrollmentEvent>
+        {
+            Event("marker_seen", 1),
+            Event("disproof", 2),
+            Event("disproof", 3, ("errorCode", "0x80070652")),
+        };
+
+        var outcome = await RunAsync(FieldAbsenceRule(source), events);
+
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task An_empty_string_does_not_count_as_a_carried_value()
+    {
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2, ("errorCode", "")) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        Assert.Single(outcome.Results);
+    }
+
+    [Fact]
+    public async Task Event_data_field_not_exists_inspects_only_the_filtered_events()
+    {
+        // The carrier of the field is filtered out (kind=a); among kind=b events nobody carries it.
+        var events = new List<EnrollmentEvent>
+        {
+            Event("marker_seen", 1),
+            Event("disproof", 2, ("kind", "a"), ("errorCode", "0x80070652")),
+            Event("disproof", 3, ("kind", "b")),
+        };
+
+        var matched = await RunAsync(FieldAbsenceRule("event_data", filterKind: "b"), events);
+        var result = Assert.Single(matched.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal(1, evidence["count"]);
+
+        var vetoed = await RunAsync(FieldAbsenceRule("event_data", filterKind: "a"), events);
+        Assert.Empty(vetoed.Results);
+    }
+
+    private static AnalyzeRule TypeAbsenceRule() => Rule(
+        new RuleCondition { Signal = "disproof_absent", Source = "event_type", EventType = "disproof", Operator = "not_exists", Value = "", Required = true });
+
+    private static AnalyzeRule FieldAbsenceRule(string source, string? filterKind = null)
+    {
+        var absence = new RuleCondition
+        {
+            Signal = "code_absent",
+            Source = source,
+            EventType = "disproof",
+            DataField = "errorCode",
+            Operator = "not_exists",
+            Value = "",
+            Required = true,
+        };
+        if (filterKind != null)
+        {
+            absence.FilterField = "kind";
+            absence.FilterOperator = "equals";
+            absence.FilterValue = filterKind;
+        }
+        return Rule(absence);
+    }
+
+    private static AnalyzeRule Rule(RuleCondition absence) => new()
     {
         // Custom-namespace rule: a built-in ID outside the live catalog is hidden by the
         // sunset filter in AnalyzeRuleService (IsBuiltIn defaults to true).
@@ -58,11 +162,11 @@ public class RuleEngineEventTypeNotExistsTests
         Conditions = new List<RuleCondition>
         {
             new() { Signal = "marker", Source = "event_type", EventType = "marker_seen", Operator = "exists", Value = "", Required = true },
-            new() { Signal = "disproof_absent", Source = "event_type", EventType = "disproof", Operator = "not_exists", Value = "", Required = true },
+            absence,
         },
     };
 
-    private static EnrollmentEvent Event(string eventType, int sequence) => new()
+    private static EnrollmentEvent Event(string eventType, int sequence, params (string key, string value)[] data) => new()
     {
         EventId = Guid.NewGuid().ToString(),
         TenantId = TenantId,
@@ -70,7 +174,7 @@ public class RuleEngineEventTypeNotExistsTests
         EventType = eventType,
         Timestamp = DateTime.UtcNow.AddMinutes(sequence),
         Sequence = sequence,
-        Data = new Dictionary<string, object>(),
+        Data = data.ToDictionary(d => d.key, d => (object)d.value),
     };
 
     private static async Task<AnalysisOutcome> RunAsync(AnalyzeRule rule, List<EnrollmentEvent> events)

src/Backend/AutopilotMonitor.Functions.Tests/RuleSubmissionServiceTests.cs

@@ -0,0 +1,530 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Pagination;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The pure pieces of <see cref="RuleSubmissionService"/> (id suggestion, repo file, snapshot
+/// stripping, attribution shape) and the review state machine against mocked repositories.
+/// </summary>
+public class RuleSubmissionServiceTests
+{
+    private const string TenantId = "11111111-1111-1111-1111-111111111111";
+
+    // ── id suggestion ───────────────────────────────────────────────────────
+
+    [Fact]
+    public void Suggest_is_max_plus_one_and_never_fills_a_gap()
+    {
+        // 001 and 003 exist, 002 is a retired id — the next is 004, not 002.
+        var taken = new[] { "ANALYZE-NET-001", "ANALYZE-NET-003", "ANALYZE-APP-018", "GATHER-NET-009" };
+        Assert.Equal("ANALYZE-NET-004", RuleSubmissionService.SuggestPublishedRuleId("analyze", "network", taken));
+    }
+
+    [Fact]
+    public void Suggest_starts_at_001_for_an_empty_category_and_maps_the_kind_convention()
+    {
+        Assert.Equal("ANALYZE-NET-001", RuleSubmissionService.SuggestPublishedRuleId("analyze", "network", Array.Empty<string>()));
+        Assert.Equal("GATHER-DEVICE-001", RuleSubmissionService.SuggestPublishedRuleId("gather", "device", Array.Empty<string>()));
+        Assert.Equal("ANALYZE-DEV-001", RuleSubmissionService.SuggestPublishedRuleId("analyze", "device", Array.Empty<string>()));
+        Assert.Equal("ANALYZE-ENRL-001", RuleSubmissionService.SuggestPublishedRuleId("analyze", "enrollment", Array.Empty<string>()));
+        Assert.Equal("GATHER-ENROLL-001", RuleSubmissionService.SuggestPublishedRuleId("gather", "enrollment", Array.Empty<string>()));
+    }
+
+    [Fact]
+    public void Suggest_is_case_insensitive_over_taken_ids()
+    {
+        Assert.Equal("ANALYZE-SEC-008", RuleSubmissionService.SuggestPublishedRuleId("analyze", "security", new[] { "analyze-sec-007" }));
+    }
+
+    [Fact]
+    public void Suggest_falls_back_to_the_upper_cased_category_when_unmapped()
+    {
+        Assert.Equal("ANALYZE-OFFICE-001", RuleSubmissionService.SuggestPublishedRuleId("analyze", "office", Array.Empty<string>()));
+    }
+
+    // ── freeze + repo file ──────────────────────────────────────────────────
+
+    private static AnalyzeRule CustomAnalyzeRule() => new()
+    {
+        RuleId = "ANALYZE-CUSTOM-003",
+        Title = "Proxy PAC unreachable",
+        Description = "PAC download fails",
+        Severity = "warning",
+        Category = "network",
+        Version = "1.2.0",
+        Author = "Alice Admin",
+        Enabled = false,
+        IsBuiltIn = false,
+        IsCommunity = false,
+        Provenance = "embedded",
+        MarkSessionAsFailed = true,
+        Notify = true,
+        NotifyChannelIds = new List<string> { "chan-1" },
+        DerivedFromTemplateRuleId = "ANALYZE-SEC-004",
+        Explanation = "The PAC file could not be fetched.",
+        Conditions = new List<RuleCondition>
+        {
+            new() { Signal = "pac_failed", Source = "event_type", EventType = "network_pac_failed", Required = true },
+        },
+        CreatedAt = new DateTime(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+        UpdatedAt = new DateTime(2026, 2, 1, 0, 0, 0, DateTimeKind.Utc),
+    };
+
+    [Fact]
+    public void Freeze_strips_server_and_tenant_fields_and_keeps_the_rule()
+    {
+        var json = RuleSubmissionService.FreezeRule(CustomAnalyzeRule());
+        var node = JsonNode.Parse(json)!.AsObject();
+
+        foreach (var stripped in new[] { "isBuiltIn", "provenance", "createdAt", "updatedAt", "markSessionAsFailed", "notifyDefault", "notify", "notifyChannelIds" })
+            Assert.False(node.ContainsKey(stripped), $"{stripped} must not be frozen");
+
+        Assert.Equal("ANALYZE-CUSTOM-003", node["ruleId"]!.GetValue<string>());
+        Assert.Equal("Alice Admin", node["author"]!.GetValue<string>());
+        Assert.Equal("ANALYZE-SEC-004", node["derivedFromTemplateRuleId"]!.GetValue<string>());
+        Assert.Single(node["conditions"]!.AsArray());
+    }
+
+    [Fact]
+    public void RepoFile_carries_schema_pointer_assigned_id_credit_and_community_flag_in_repo_order()
+    {
+        var s = new RuleSubmission
+        {
+            RuleKind = RuleSubmissionKinds.Analyze,
+            RuleJson = RuleSubmissionService.FreezeRule(CustomAnalyzeRule()),
+            AttributionName = RuleAttributionModes.AnonymousAuthor,
+        };
+
+        var file = RuleSubmissionService.BuildRepoFile(s, "ANALYZE-NET-002");
+
+        Assert.Equal("rules/analyze/ANALYZE-NET-002.json", file.Path);
+        Assert.EndsWith("\n", file.Content);
+        var node = JsonNode.Parse(file.Content)!.AsObject();
+        var keys = node.Select(kv => kv.Key).ToList();
+        Assert.Equal(new[] { "$schema", "ruleId", "title", "description", "severity", "category", "version", "author", "enabled", "isCommunity" }, keys.Take(10));
+        Assert.Equal("../schema/analyze-rule.schema.json", node["$schema"]!.GetValue<string>());
+        Assert.Equal("ANALYZE-NET-002", node["ruleId"]!.GetValue<string>());
+        Assert.Equal("Community contribution", node["author"]!.GetValue<string>());
+        Assert.True(node["isCommunity"]!.GetValue<bool>());
+        // Analyze rules ship enabled — the tenant's own toggle state does not travel.
+        Assert.True(node["enabled"]!.GetValue<bool>());
+        Assert.False(node.ContainsKey("derivedFromTemplateRuleId"));
+        Assert.False(node.ContainsKey("isBuiltIn"));
+        Assert.Contains("\"explanation\": \"The PAC file could not be fetched.\"", file.Content);
+    }
+
+    [Fact]
+    public void RepoFile_for_a_gather_rule_ships_disabled_and_without_severity()
+    {
+        var gather = new GatherRule
+        {
+            RuleId = "GATHER-CUSTOM-001",
+            Title = "BIOS config",
+            Description = "Reads the BIOS registry block",
+            Category = "device",
+            Enabled = true,
+            IsBuiltIn = false,
+            CollectorType = "registry",
+            Target = "HKLM\\SOFTWARE\\Vendor\\BIOS",
+            Trigger = "startup",
+            OutputEventType = "gather_bios_config",
+        };
+        var s = new RuleSubmission
+        {
+            RuleKind = RuleSubmissionKinds.Gather,
+            RuleJson = RuleSubmissionService.FreezeRule(gather),
+            AttributionName = "Contoso IT",
+        };
+
+        var file = RuleSubmissionService.BuildRepoFile(s, "GATHER-DEVICE-009");
+
+        Assert.Equal("rules/gather/GATHER-DEVICE-009.json", file.Path);
+        var node = JsonNode.Parse(file.Content)!.AsObject();
+        Assert.Equal("../schema/gather-rule.schema.json", node["$schema"]!.GetValue<string>());
+        Assert.False(node["enabled"]!.GetValue<bool>());
+        Assert.Equal("Contoso IT", node["author"]!.GetValue<string>());
+        Assert.False(node.ContainsKey("severity"));
+        // No \u escaping of the backslash-heavy registry path beyond JSON's own rules.
+        Assert.Contains("HKLM\\\\SOFTWARE\\\\Vendor\\\\BIOS", file.Content);
+    }
+
+    // ── attribution ─────────────────────────────────────────────────────────
+
+    [Theory]
+    [InlineData("Alice A.")]
+    [InlineData("Contoso IT & Ops (EMEA)")]
+    [InlineData("Zoë Müller-Lüdenscheidt")]
+    public void AttributionName_accepts_names(string name)
+        => Assert.Equal(name, RuleSubmissionService.ValidateAttributionName(name));
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("<script>")]
+    [InlineData("https://example.com")]
+    [InlineData("line\nbreak")]
+    public void AttributionName_rejects_markup_urls_and_control_characters(string name)
+        => Assert.Throws<ArgumentException>(() => RuleSubmissionService.ValidateAttributionName(name));
+
+    [Theory]
+    [InlineData(null, null)]
+    [InlineData("", null)]
+    [InlineData("  alice@contoso.com  ", "alice@contoso.com")]
+    public void Email_is_trimmed_or_null(string? input, string? expected)
+        => Assert.Equal(expected, RuleSubmissionService.NormalizeEmail(input));
+
+    [Theory]
+    [InlineData("alice")]
+    [InlineData("@contoso.com")]
+    [InlineData("alice@")]
+    [InlineData("a@b@c")]
+    [InlineData("alice @contoso.com")]
+    public void Email_rejects_non_addresses(string input)
+        => Assert.Throws<ArgumentException>(() => RuleSubmissionService.NormalizeEmail(input));
+
+    // ── review state machine ────────────────────────────────────────────────
+
+    private static (RuleSubmissionService service, Mock<IRuleSubmissionRepository> repo) Build(
+        RuleSubmission row, IEnumerable<string>? globalAnalyzeIds = null, IEnumerable<string>? reservedIds = null)
+    {
+        var repo = new Mock<IRuleSubmissionRepository>(MockBehavior.Loose);
+        repo.Setup(r => r.GetAsync(row.SubmissionId)).ReturnsAsync(row);
+        repo.Setup(r => r.UpdateAsync(It.IsAny<RuleSubmission>())).ReturnsAsync(true);
+        repo.Setup(r => r.GetReservedPublishedRuleIdsAsync())
+            .ReturnsAsync(new HashSet<string>(reservedIds ?? Array.Empty<string>(), StringComparer.OrdinalIgnoreCase));
+
+        var rules = new Mock<IRuleRepository>(MockBehavior.Loose);
+        rules.Setup(r => r.GetAnalyzeRulesAsync("global")).ReturnsAsync(
+            (globalAnalyzeIds ?? Array.Empty<string>()).Select(id => new AnalyzeRule { RuleId = id, IsBuiltIn = true }).ToList());
+        rules.Setup(r => r.GetGatherRulesAsync("global")).ReturnsAsync(new List<GatherRule>());
+
+        var metrics = new Mock<IMetricsRepository>(MockBehavior.Loose);
+        var config = new Mock<TenantConfigurationService>(MockBehavior.Loose,
+            Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, new MemoryCache(new MemoryCacheOptions()));
+
+        var service = new RuleSubmissionService(repo.Object, rules.Object, metrics.Object, config.Object,
+            NullLogger<RuleSubmissionService>.Instance);
+        return (service, repo);
+    }
+
+    private static RuleSubmission PendingRow() => new()
+    {
+        SubmissionId = "a1b2c3d4e5f6",
+        BatchId = "b",
+        TenantId = TenantId,
+        RuleKind = RuleSubmissionKinds.Analyze,
+        SourceRuleId = "ANALYZE-CUSTOM-003",
+        Title = "Proxy PAC unreachable",
+        Category = "network",
+        RuleJson = RuleSubmissionService.FreezeRule(CustomAnalyzeRule()),
+        SubmittedBy = "alice@contoso.com",
+        SubmittedByName = "Alice Admin",
+        SubmittedAt = DateTime.UtcNow,
+        Status = RuleSubmissionStatuses.Pending,
+    };
+
+    [Fact]
+    public async Task Approve_requires_a_reserved_id_of_the_same_kind()
+    {
+        var (service, _) = Build(PendingRow());
+
+        await Assert.ThrowsAsync<ArgumentException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve" }, "ga@example.com"));
+        await Assert.ThrowsAsync<ArgumentException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve", PublishedRuleId = "ANALYZE-CUSTOM-009" }, "ga@example.com"));
+        await Assert.ThrowsAsync<ArgumentException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve", PublishedRuleId = "GATHER-NET-002" }, "ga@example.com"));
+    }
+
+    [Fact]
+    public async Task Approve_refuses_an_id_taken_by_the_catalog_or_another_approval()
+    {
+        var (service, _) = Build(PendingRow(), globalAnalyzeIds: new[] { "ANALYZE-NET-001" }, reservedIds: new[] { "ANALYZE-NET-002" });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve", PublishedRuleId = "ANALYZE-NET-001" }, "ga@example.com"));
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve", PublishedRuleId = "ANALYZE-NET-002" }, "ga@example.com"));
+    }
+
+    [Fact]
+    public async Task Approve_stores_id_comment_adaptation_flag_and_reviewer()
+    {
+        var (service, repo) = Build(PendingRow());
+        RuleSubmission? written = null;
+        repo.Setup(r => r.UpdateAsync(It.IsAny<RuleSubmission>())).Callback<RuleSubmission>(s => written = s).ReturnsAsync(true);
+
+        var result = await service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve", PublishedRuleId = "ANALYZE-NET-003", ReviewComment = "Taken, will generalise the title.", WillBeAdapted = true },
+            "ga@example.com");
+
+        Assert.Same(result, written);
+        Assert.Equal(RuleSubmissionStatuses.Approved, result.Status);
+        Assert.Equal("ANALYZE-NET-003", result.PublishedRuleId);
+        Assert.True(result.WillBeAdapted);
+        Assert.Equal("Taken, will generalise the title.", result.ReviewComment);
+        Assert.Equal("ga@example.com", result.ReviewedBy);
+        Assert.NotNull(result.ReviewedAt);
+    }
+
+    [Fact]
+    public async Task Decline_requires_a_comment_and_clears_the_published_id()
+    {
+        var row = PendingRow();
+        row.Status = RuleSubmissionStatuses.Approved;
+        row.PublishedRuleId = "ANALYZE-NET-003";
+        var (service, _) = Build(row);
+
+        await Assert.ThrowsAsync<ArgumentException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "decline" }, "ga@example.com"));
+
+        var result = await service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "decline", ReviewComment = "Too tenant-specific." }, "ga@example.com");
+
+        Assert.Equal(RuleSubmissionStatuses.Declined, result.Status);
+        Assert.Null(result.PublishedRuleId);
+        Assert.False(result.WillBeAdapted);
+    }
+
+    [Fact]
+    public async Task Published_is_derived_and_final()
+    {
+        var row = PendingRow();
+        row.Status = RuleSubmissionStatuses.Approved;
+        row.PublishedRuleId = "ANALYZE-NET-003";
+        var (service, _) = Build(row, globalAnalyzeIds: new[] { "ANALYZE-NET-003" });
+
+        var items = await service.ToItemsAsync(new[] { row });
+        Assert.Equal(RuleSubmissionStatuses.Published, items[0].Status);
+        Assert.Equal(RuleSubmissionStatuses.Approved, row.Status);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "decline", ReviewComment = "too late" }, "ga@example.com"));
+    }
+
+    [Fact]
+    public async Task Approved_but_unpublished_stays_approved_on_the_wire()
+    {
+        var row = PendingRow();
+        row.Status = RuleSubmissionStatuses.Approved;
+        row.PublishedRuleId = "ANALYZE-NET-003";
+        var (service, _) = Build(row, globalAnalyzeIds: new[] { "ANALYZE-NET-001" });
+
+        var items = await service.ToItemsAsync(new[] { row });
+        Assert.Equal(RuleSubmissionStatuses.Approved, items[0].Status);
+    }
+
+    [Fact]
+    public async Task Withdraw_only_pending_and_only_own_tenant()
+    {
+        var row = PendingRow();
+        var (service, _) = Build(row);
+
+        Assert.False(await service.WithdrawAsync("22222222-2222-2222-2222-222222222222", "a1b2c3d4e5f6", crossTenantAllowed: false));
+        Assert.True(await service.WithdrawAsync(TenantId, "a1b2c3d4e5f6", crossTenantAllowed: false));
+        Assert.Equal(RuleSubmissionStatuses.Withdrawn, row.Status);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.WithdrawAsync(TenantId, "a1b2c3d4e5f6", crossTenantAllowed: false));
+        await Assert.ThrowsAsync<InvalidOperationException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "approve", PublishedRuleId = "ANALYZE-NET-003" }, "ga@example.com"));
+    }
+
+    [Fact]
+    public async Task Operator_delete_passes_through_to_the_repository()
+    {
+        var (service, repo) = Build(PendingRow());
+        repo.Setup(r => r.DeleteAsync("a1b2c3d4e5f6")).ReturnsAsync(true);
+
+        Assert.True(await service.DeleteAsync("a1b2c3d4e5f6"));
+        repo.Verify(r => r.DeleteAsync("a1b2c3d4e5f6"), Times.Once);
+    }
+
+    [Fact]
+    public async Task Unknown_decision_is_a_bad_request()
+    {
+        var (service, _) = Build(PendingRow());
+        await Assert.ThrowsAsync<ArgumentException>(() => service.ReviewAsync("a1b2c3d4e5f6",
+            new ReviewRuleSubmissionRequest { Decision = "maybe" }, "ga@example.com"));
+    }
+
+    [Fact]
+    public async Task Detail_returns_the_typed_rule_suggested_id_and_repo_file()
+    {
+        var (service, _) = Build(PendingRow(), globalAnalyzeIds: new[] { "ANALYZE-NET-001" });
+
+        var detail = await service.GetDetailAsync("a1b2c3d4e5f6");
+
+        Assert.NotNull(detail);
+        Assert.NotNull(detail!.AnalyzeRule);
+        Assert.Null(detail.GatherRule);
+        Assert.Equal("ANALYZE-CUSTOM-003", detail.AnalyzeRule!.RuleId);
+        Assert.False(detail.AnalyzeRule.IsBuiltIn);
+        Assert.Equal("ANALYZE-NET-002", detail.SuggestedPublishedRuleId);
+        Assert.Equal("rules/analyze/ANALYZE-NET-002.json", detail.RepoFile!.Path);
+    }
+
+    // ── submit ──────────────────────────────────────────────────────────────
+
+    private static (RuleSubmissionService service, List<RuleSubmission> stored) BuildForSubmit(
+        List<AnalyzeRule> tenantAnalyze, List<RuleSubmission>? existing = null, TenantConfiguration? config = null)
+    {
+        var stored = new List<RuleSubmission>();
+        var repo = new Mock<IRuleSubmissionRepository>(MockBehavior.Loose);
+        repo.Setup(r => r.GetForTenantAsync(TenantId)).ReturnsAsync(existing ?? new List<RuleSubmission>());
+        repo.Setup(r => r.AddAsync(It.IsAny<RuleSubmission>())).Callback<RuleSubmission>(stored.Add).ReturnsAsync(true);
+        repo.Setup(r => r.GetReservedPublishedRuleIdsAsync()).ReturnsAsync(new HashSet<string>());
+
+        var rules = new Mock<IRuleRepository>(MockBehavior.Loose);
+        rules.Setup(r => r.GetAnalyzeRulesAsync(TenantId)).ReturnsAsync(tenantAnalyze);
+        rules.Setup(r => r.GetGatherRulesAsync(TenantId)).ReturnsAsync(new List<GatherRule>());
+        rules.Setup(r => r.GetAnalyzeRulesAsync("global")).ReturnsAsync(new List<AnalyzeRule>());
+        rules.Setup(r => r.GetGatherRulesAsync("global")).ReturnsAsync(new List<GatherRule>());
+
+        var metrics = new Mock<IMetricsRepository>(MockBehavior.Loose);
+        metrics.Setup(m => m.GetRuleStatsAsync(TenantId, It.IsAny<string?>(), It.IsAny<string?>(), It.IsAny<string?>(), It.IsAny<int>()))
+            .ReturnsAsync(new List<RuleStatsEntry>
+            {
+                new() { RuleId = "ANALYZE-CUSTOM-003", FireCount = 4, SessionsEvaluated = 40, EvaluationCount = 41 },
+                new() { RuleId = "ANALYZE-CUSTOM-003", FireCount = 1, SessionsEvaluated = 10, EvaluationCount = 10 },
+                new() { RuleId = "ANALYZE-CUSTOM-999", FireCount = 99, SessionsEvaluated = 99, EvaluationCount = 99 },
+            });
+
+        var configRepo = new Mock<IConfigRepository>(MockBehavior.Loose);
+        var configService = new Mock<TenantConfigurationService>(MockBehavior.Loose, configRepo.Object,
+            NullLogger<TenantConfigurationService>.Instance, new MemoryCache(new MemoryCacheOptions()));
+        configService.Setup(c => c.GetConfigurationIfExistsAsync(TenantId)).ReturnsAsync(config);
+
+        var service = new RuleSubmissionService(repo.Object, rules.Object, metrics.Object, configService.Object,
+            NullLogger<RuleSubmissionService>.Instance);
+        return (service, stored);
+    }
+
+    private static SubmitRuleSubmissionsRequest Request(params string[] ruleIds) => new()
+    {
+        TenantId = TenantId,
+        Items = ruleIds.Select(id => new RuleSubmissionItemRef { Kind = "analyze", RuleId = id }).ToList(),
+        Comment = "Fires when the PAC download fails during ESP.",
+        AttributionMode = RuleAttributionModes.Anonymous,
+    };
+
+    [Fact]
+    public async Task Submit_freezes_the_tenant_rule_records_findings_and_fire_stats()
+    {
+        var (service, stored) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() });
+
+        var created = await service.SubmitAsync(TenantId, Request("ANALYZE-CUSTOM-003"), "alice@contoso.com", "Alice Admin");
+
+        var s = Assert.Single(created);
+        Assert.Same(s, Assert.Single(stored));
+        Assert.Equal(12, s.SubmissionId.Length);
+        Assert.Equal(12, s.BatchId.Length);
+        Assert.Equal(RuleSubmissionStatuses.Pending, s.Status);
+        Assert.Equal("Community contribution", s.AttributionName);
+        Assert.Null(s.ContactEmail);
+        Assert.Equal("Proxy PAC unreachable", s.Title);
+        Assert.Equal("network", s.Category);
+        Assert.Equal("ANALYZE-SEC-004", s.DerivedFromTemplateRuleId);
+        Assert.Contains(s.ValidationFindings, f => f.Level == "info" && f.Message.Contains("ANALYZE-SEC-004"));
+        Assert.DoesNotContain(s.ValidationFindings, f => f.Level == "error");
+        Assert.Equal(5, s.SourceFireStats!.FireCount);
+        Assert.Equal(50, s.SourceFireStats.SessionsEvaluated);
+        Assert.DoesNotContain("isBuiltIn", s.RuleJson);
+    }
+
+    [Fact]
+    public async Task Submit_rejects_built_in_and_unknown_rules_without_storing_anything()
+    {
+        var builtIn = CustomAnalyzeRule();
+        builtIn.RuleId = "ANALYZE-NET-001";
+        builtIn.IsBuiltIn = true;
+        var (service, stored) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule(), builtIn });
+
+        var ex = await Assert.ThrowsAsync<ArgumentException>(() =>
+            service.SubmitAsync(TenantId, Request("ANALYZE-CUSTOM-003", "ANALYZE-NET-001", "ANALYZE-CUSTOM-404"), "alice@contoso.com", "Alice Admin"));
+
+        Assert.Contains("ANALYZE-NET-001", ex.Message);
+        Assert.Contains("ANALYZE-CUSTOM-404", ex.Message);
+        Assert.Empty(stored);
+    }
+
+    [Fact]
+    public async Task Submit_rejects_a_rule_whose_draft_validation_fails()
+    {
+        var broken = CustomAnalyzeRule();
+        broken.Conditions = new List<RuleCondition>();
+        var (service, stored) = BuildForSubmit(new List<AnalyzeRule> { broken });
+
+        var ex = await Assert.ThrowsAsync<ArgumentException>(() =>
+            service.SubmitAsync(TenantId, Request("ANALYZE-CUSTOM-003"), "alice@contoso.com", "Alice Admin"));
+
+        Assert.Contains("at least one condition", ex.Message);
+        Assert.Empty(stored);
+    }
+
+    [Fact]
+    public async Task Submit_refuses_a_second_pending_submission_of_the_same_rule()
+    {
+        var (service, _) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() }, existing: new List<RuleSubmission> { PendingRow() });
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            service.SubmitAsync(TenantId, Request("ANALYZE-CUSTOM-003"), "alice@contoso.com", "Alice Admin"));
+    }
+
+    [Fact]
+    public async Task Submit_enforces_the_daily_cap()
+    {
+        var existing = Enumerable.Range(0, RuleSubmissionService.MaxSubmissionsPerTenantPerDay)
+            .Select(i => { var r = PendingRow(); r.SourceRuleId = $"OTHER-{i}"; r.Status = RuleSubmissionStatuses.Declined; return r; })
+            .ToList();
+        var (service, _) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() }, existing);
+
+        await Assert.ThrowsAsync<InvalidOperationException>(() =>
+            service.SubmitAsync(TenantId, Request("ANALYZE-CUSTOM-003"), "alice@contoso.com", "Alice Admin"));
+    }
+
+    [Fact]
+    public async Task Submit_organization_attribution_uses_the_company_name_and_fails_without_one()
+    {
+        var withName = new TenantConfiguration { TenantId = TenantId, DomainName = "contoso.example", CompanyName = "Contoso Ltd." };
+        var (service, _) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() }, config: withName);
+        var request = Request("ANALYZE-CUSTOM-003");
+        request.AttributionMode = RuleAttributionModes.Organization;
+
+        var created = await service.SubmitAsync(TenantId, request, "alice@contoso.com", "Alice Admin");
+        Assert.Equal("Contoso Ltd.", created[0].AttributionName);
+
+        var (noConfig, _) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() }, config: null);
+        await Assert.ThrowsAsync<ArgumentException>(() => noConfig.SubmitAsync(TenantId, request, "alice@contoso.com", "Alice Admin"));
+    }
+
+    [Fact]
+    public async Task Submit_stores_the_contact_email_when_given()
+    {
+        var (service, _) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() });
+        var request = Request("ANALYZE-CUSTOM-003");
+        request.Email = " alice.reply@contoso.com ";
+
+        var created = await service.SubmitAsync(TenantId, request, "alice@contoso.com", "Alice Admin");
+        Assert.Equal("alice.reply@contoso.com", created[0].ContactEmail);
+    }
+
+    [Fact]
+    public async Task Submit_person_attribution_freezes_the_requested_name()
+    {
+        var (service, _) = BuildForSubmit(new List<AnalyzeRule> { CustomAnalyzeRule() });
+        var request = Request("ANALYZE-CUSTOM-003");
+        request.AttributionMode = RuleAttributionModes.Person;
+        request.AttributionName = "  Alice A.  ";
+
+        var created = await service.SubmitAsync(TenantId, request, "alice@contoso.com", "Alice Admin");
+        Assert.Equal("Alice A.", created[0].AttributionName);
+        Assert.Equal(RuleAttributionModes.Person, created[0].AttributionMode);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/RuleSubmissionsWireParityTests.cs

@@ -0,0 +1,136 @@
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Wire pins for the rule-submission responses (typed from the start — the anonymous side is
+/// the literal a client sees, so a reordered or renamed property fails here first).
+/// </summary>
+public class RuleSubmissionsWireParityTests
+{
+    private static readonly DateTime T0 = new(2026, 9, 9, 10, 30, 0, DateTimeKind.Utc);
+
+    private static RuleSubmissionItem Item() => new()
+    {
+        SubmissionId = "a1b2c3d4e5f6",
+        BatchId = "0f0e0d0c0b0a",
+        TenantId = "11111111-1111-1111-1111-111111111111",
+        RuleKind = "analyze",
+        SourceRuleId = "ANALYZE-CUSTOM-003",
+        Title = "Proxy PAC unreachable",
+        Category = "network",
+        Comment = "Fires when the PAC download fails.",
+        SubmittedBy = "alice@contoso.com",
+        SubmittedByName = "Alice Admin",
+        ContactEmail = "alice.reply@contoso.com",
+        AttributionMode = "anonymous",
+        AttributionName = "Community contribution",
+        SubmittedAt = T0,
+        Status = "approved",
+        ValidationFindings = new List<RuleSubmissionFinding> { new() { Level = "info", Message = "Derived from template ANALYZE-SEC-004" } },
+        SourceFireStats = new RuleSubmissionFireStats { Days = 30, FireCount = 42, SessionsEvaluated = 310, EvaluationCount = 312 },
+        ReviewedBy = "ga@example.com",
+        ReviewedAt = T0.AddDays(1),
+        ReviewComment = "Taken.",
+        WillBeAdapted = true,
+        PublishedRuleId = "ANALYZE-NET-002",
+        DerivedFromTemplateRuleId = "ANALYZE-SEC-004",
+    };
+
+    private static object ItemLiteral() => new
+    {
+        submissionId = "a1b2c3d4e5f6",
+        batchId = "0f0e0d0c0b0a",
+        tenantId = "11111111-1111-1111-1111-111111111111",
+        ruleKind = "analyze",
+        sourceRuleId = "ANALYZE-CUSTOM-003",
+        title = "Proxy PAC unreachable",
+        category = "network",
+        comment = "Fires when the PAC download fails.",
+        submittedBy = "alice@contoso.com",
+        submittedByName = "Alice Admin",
+        contactEmail = "alice.reply@contoso.com",
+        attributionMode = "anonymous",
+        attributionName = "Community contribution",
+        submittedAt = T0,
+        status = "approved",
+        validationFindings = new List<object> { new { level = "info", message = "Derived from template ANALYZE-SEC-004" } },
+        sourceFireStats = new { days = 30, fireCount = 42, sessionsEvaluated = 310, evaluationCount = 312 },
+        reviewedBy = "ga@example.com",
+        reviewedAt = T0.AddDays(1),
+        reviewComment = "Taken.",
+        willBeAdapted = true,
+        publishedRuleId = "ANALYZE-NET-002",
+        derivedFromTemplateRuleId = "ANALYZE-SEC-004",
+    };
+
+    [Fact]
+    public void Submit_response_shape()
+    {
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new { success = true, message = "Rule submitted for review.", batchId = "0f0e0d0c0b0a", submissions = new List<object> { ItemLiteral() } },
+            new SubmitRuleSubmissionsResponse { Success = true, Message = "Rule submitted for review.", BatchId = "0f0e0d0c0b0a", Submissions = new List<RuleSubmissionItem> { Item() } });
+    }
+
+    [Fact]
+    public void List_nonPaged_has_no_nextLink_key()
+    {
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new { success = true, count = 1, submissions = new List<object> { ItemLiteral() } },
+            new RuleSubmissionListResponse { Success = true, Count = 1, Submissions = new List<RuleSubmissionItem> { Item() } });
+    }
+
+    [Fact]
+    public void List_paged_carries_nextLink()
+    {
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new { success = true, count = 1, submissions = new List<object> { ItemLiteral() }, nextLink = "/api/global/rule-submissions?pageSize=20&continuation=abc" },
+            new RuleSubmissionListResponse { Success = true, Count = 1, Submissions = new List<RuleSubmissionItem> { Item() }, NextLink = "/api/global/rule-submissions?pageSize=20&continuation=abc" });
+    }
+
+    [Fact]
+    public void List_last_page_drops_the_nextLink_key()
+    {
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new { success = true, count = 0, submissions = new List<object>() },
+            new RuleSubmissionListResponse { Success = true, Count = 0, Submissions = new List<RuleSubmissionItem>(), NextLink = null });
+    }
+
+    [Fact]
+    public void Detail_shape_with_analyze_rule_omits_the_gather_slot()
+    {
+        var rule = new AnalyzeRule
+        {
+            RuleId = "ANALYZE-CUSTOM-003", Title = "Proxy PAC unreachable", Description = "d", Severity = "warning", Category = "network",
+            Explanation = "e", IsBuiltIn = false, Conditions = new List<RuleCondition>(),
+        };
+        var typed = new RuleSubmissionDetailResponse
+        {
+            Success = true,
+            Submission = Item(),
+            AnalyzeRule = rule,
+            LiveFireStats = new RuleSubmissionFireStats { Days = 30, FireCount = 1, SessionsEvaluated = 2, EvaluationCount = 3 },
+            SuggestedPublishedRuleId = "ANALYZE-NET-002",
+            RepoFile = new RuleSubmissionRepoFile { Path = "rules/analyze/ANALYZE-NET-002.json", Content = "{}\n" },
+        };
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new
+            {
+                success = true,
+                submission = ItemLiteral(),
+                analyzeRule = rule,
+                liveFireStats = new { days = 30, fireCount = 1, sessionsEvaluated = 2, evaluationCount = 3 },
+                suggestedPublishedRuleId = "ANALYZE-NET-002",
+                repoFile = new { path = "rules/analyze/ANALYZE-NET-002.json", content = "{}\n" },
+            },
+            typed);
+    }
+
+    [Fact]
+    public void Review_response_shape()
+    {
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new { success = true, message = "Submission approved.", submission = ItemLiteral() },
+            new ReviewRuleSubmissionResponse { Success = true, Message = "Submission approved.", Submission = Item() });
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/SharedManifestParityTests.cs

@@ -88,6 +88,12 @@ public sealed class SharedManifestParityTests
             ["webhookProviderTypes"] = EnumMap<WebhookProviderType>(),
             ["annotationLanes"] = AnnotationLanes.All,
             ["annotationVerdicts"] = AnnotationVerdicts.All,
+            // Community rule submissions: kinds, effective statuses (incl. the derived "published"),
+            // attribution modes and reviewer decisions — the MCP tool schemas enumerate these.
+            ["ruleSubmissionKinds"] = RuleSubmissionKinds.All,
+            ["ruleSubmissionStatuses"] = RuleSubmissionStatuses.All,
+            ["ruleAttributionModes"] = RuleAttributionModes.All,
+            ["ruleSubmissionDecisions"] = RuleSubmissionDecisions.All,
             // Ops vocabularies. Declaration order kept for severities — it IS the ladder
             // (Info < Warning < Error < Critical), and the MCP renders it in that order.
             ["opsEventCategories"] = ConstStrings(typeof(OpsEventCategory)),

src/Backend/AutopilotMonitor.Functions.Tests/TableRuleSubmissionRepositoryTests.cs

@@ -0,0 +1,195 @@
+using AutopilotMonitor.Functions.DataAccess.TableStorage;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Round-trip pins for the RuleSubmissions Store/Map pair (memory:
+/// feedback_table_storage_serialization — every new field in <see cref="RuleSubmission"/>
+/// MUST be exercised in Store+Map so silent drops surface here), plus the key and filter shapes.
+/// </summary>
+public class TableRuleSubmissionRepositoryTests
+{
+    private const string TenantId = "11111111-1111-1111-1111-111111111111";
+
+    private static RuleSubmission Full() => new()
+    {
+        SubmissionId = "a1b2c3d4e5f6",
+        BatchId = "0f0e0d0c0b0a",
+        TenantId = TenantId,
+        RuleKind = RuleSubmissionKinds.Analyze,
+        SourceRuleId = "ANALYZE-CUSTOM-003",
+        Title = "Proxy PAC unreachable",
+        Category = "network",
+        RuleJson = "{\"ruleId\":\"ANALYZE-CUSTOM-003\",\"title\":\"Proxy PAC unreachable\"}",
+        Comment = "Fires when the PAC download fails during ESP.",
+        SubmittedBy = "alice@contoso.com",
+        SubmittedByName = "Alice Admin",
+        ContactEmail = "alice.reply@contoso.com",
+        AttributionMode = RuleAttributionModes.Person,
+        AttributionName = "Alice A.",
+        SubmittedAt = new DateTime(2026, 9, 9, 10, 30, 0, DateTimeKind.Utc),
+        Status = RuleSubmissionStatuses.Approved,
+        ValidationFindings = new List<RuleSubmissionFinding>
+        {
+            new() { Level = "info", Message = "Derived from template ANALYZE-SEC-004" },
+        },
+        SourceFireStats = new RuleSubmissionFireStats { Days = 30, FireCount = 42, SessionsEvaluated = 310, EvaluationCount = 312 },
+        ReviewedBy = "ga@example.com",
+        ReviewedAt = new DateTime(2026, 9, 10, 8, 0, 0, DateTimeKind.Utc),
+        ReviewComment = "Taken, generalised for the community.",
+        WillBeAdapted = true,
+        PublishedRuleId = "ANALYZE-NET-002",
+        DerivedFromTemplateRuleId = "ANALYZE-SEC-004",
+    };
+
+    [Fact]
+    public void Roundtrip_all_fields_survive_store_and_map()
+    {
+        var original = Full();
+
+        var mapped = TableRuleSubmissionRepository.MapSubmission(
+            TableRuleSubmissionRepository.StoreSubmission(original));
+
+        Assert.Equal(original.SubmissionId, mapped.SubmissionId);
+        Assert.Equal(original.BatchId, mapped.BatchId);
+        Assert.Equal(original.TenantId, mapped.TenantId);
+        Assert.Equal(original.RuleKind, mapped.RuleKind);
+        Assert.Equal(original.SourceRuleId, mapped.SourceRuleId);
+        Assert.Equal(original.Title, mapped.Title);
+        Assert.Equal(original.Category, mapped.Category);
+        Assert.Equal(original.RuleJson, mapped.RuleJson);
+        Assert.Equal(original.Comment, mapped.Comment);
+        Assert.Equal(original.SubmittedBy, mapped.SubmittedBy);
+        Assert.Equal(original.SubmittedByName, mapped.SubmittedByName);
+        Assert.Equal(original.ContactEmail, mapped.ContactEmail);
+        Assert.Equal(original.AttributionMode, mapped.AttributionMode);
+        Assert.Equal(original.AttributionName, mapped.AttributionName);
+        Assert.Equal(original.SubmittedAt, mapped.SubmittedAt);
+        Assert.Equal(original.Status, mapped.Status);
+        Assert.Single(mapped.ValidationFindings);
+        Assert.Equal("info", mapped.ValidationFindings[0].Level);
+        Assert.Equal(original.ValidationFindings[0].Message, mapped.ValidationFindings[0].Message);
+        Assert.NotNull(mapped.SourceFireStats);
+        Assert.Equal(42, mapped.SourceFireStats!.FireCount);
+        Assert.Equal(310, mapped.SourceFireStats.SessionsEvaluated);
+        Assert.Equal(312, mapped.SourceFireStats.EvaluationCount);
+        Assert.Equal(30, mapped.SourceFireStats.Days);
+        Assert.Equal(original.ReviewedBy, mapped.ReviewedBy);
+        Assert.Equal(original.ReviewedAt, mapped.ReviewedAt);
+        Assert.Equal(original.ReviewComment, mapped.ReviewComment);
+        Assert.True(mapped.WillBeAdapted);
+        Assert.Equal(original.PublishedRuleId, mapped.PublishedRuleId);
+        Assert.Equal(original.DerivedFromTemplateRuleId, mapped.DerivedFromTemplateRuleId);
+    }
+
+    [Fact]
+    public void Roundtrip_pending_row_keeps_nulls_null()
+    {
+        var original = Full();
+        original.Status = RuleSubmissionStatuses.Pending;
+        original.Comment = null;
+        original.ContactEmail = null;
+        original.SourceFireStats = null;
+        original.ValidationFindings = new List<RuleSubmissionFinding>();
+        original.ReviewedBy = null;
+        original.ReviewedAt = null;
+        original.ReviewComment = null;
+        original.WillBeAdapted = false;
+        original.PublishedRuleId = null;
+        original.DerivedFromTemplateRuleId = null;
+
+        var mapped = TableRuleSubmissionRepository.MapSubmission(
+            TableRuleSubmissionRepository.StoreSubmission(original));
+
+        Assert.Null(mapped.Comment);
+        Assert.Null(mapped.ContactEmail);
+        Assert.Null(mapped.SourceFireStats);
+        Assert.Empty(mapped.ValidationFindings);
+        Assert.Null(mapped.ReviewedBy);
+        Assert.Null(mapped.ReviewedAt);
+        Assert.Null(mapped.ReviewComment);
+        Assert.False(mapped.WillBeAdapted);
+        Assert.Null(mapped.PublishedRuleId);
+        Assert.Null(mapped.DerivedFromTemplateRuleId);
+    }
+
+    [Fact]
+    public void Store_uses_the_single_partition_and_an_inverted_tick_row_key()
+    {
+        var s = Full();
+        var entity = TableRuleSubmissionRepository.StoreSubmission(s);
+
+        Assert.Equal("submissions", entity.PartitionKey);
+        Assert.Equal($"{RowKeyCodec.InvertedTicks(s.SubmittedAt)}_{s.SubmissionId}", entity.RowKey);
+    }
+
+    [Fact]
+    public void Newer_submission_sorts_first()
+    {
+        var older = Full();
+        var newer = Full();
+        newer.SubmittedAt = older.SubmittedAt.AddMinutes(5);
+
+        var olderKey = TableRuleSubmissionRepository.StoreSubmission(older).RowKey;
+        var newerKey = TableRuleSubmissionRepository.StoreSubmission(newer).RowKey;
+
+        Assert.True(string.CompareOrdinal(newerKey, olderKey) < 0);
+    }
+
+    [Fact]
+    public void Map_tolerates_a_corrupt_json_column()
+    {
+        var entity = TableRuleSubmissionRepository.StoreSubmission(Full());
+        entity["ValidationFindingsJson"] = "{not json";
+        entity["SourceFireStatsJson"] = "[]";
+
+        var mapped = TableRuleSubmissionRepository.MapSubmission(entity);
+
+        Assert.Empty(mapped.ValidationFindings);
+        Assert.Null(mapped.SourceFireStats);
+    }
+
+    // ── retention rule (shared by the sweep and this pin) ──
+
+    private static readonly DateTime Now = new(2026, 12, 1, 12, 0, 0, DateTimeKind.Utc);
+
+    [Theory]
+    [InlineData("withdrawn", 29, false)]
+    [InlineData("withdrawn", 30, true)]
+    [InlineData("declined", 89, false)]
+    [InlineData("declined", 90, true)]
+    [InlineData("pending", 400, false)]
+    [InlineData("approved", 400, false)]
+    public void Retention_expires_only_closed_rows_at_their_window(string status, int ageDays, bool expired)
+    {
+        var s = Full();
+        s.Status = status;
+        s.SubmittedAt = Now.AddDays(-ageDays);
+        s.ReviewedAt = status == "declined" ? Now.AddDays(-ageDays) : null;
+
+        Assert.Equal(expired, RuleSubmissionRetention.IsExpired(s, Now));
+    }
+
+    [Fact]
+    public void Retention_of_a_declined_row_counts_from_the_decision_not_the_submission()
+    {
+        var s = Full();
+        s.Status = RuleSubmissionStatuses.Declined;
+        s.SubmittedAt = Now.AddDays(-200);
+        s.ReviewedAt = Now.AddDays(-10);
+
+        Assert.False(RuleSubmissionRetention.IsExpired(s, Now));
+    }
+
+    [Theory]
+    [InlineData(null, null, "PartitionKey eq 'submissions'")]
+    [InlineData("t'1", null, "PartitionKey eq 'submissions' and TenantId eq 't''1'")]
+    [InlineData(null, "pending", "PartitionKey eq 'submissions' and Status eq 'pending'")]
+    [InlineData("t1", "approved", "PartitionKey eq 'submissions' and TenantId eq 't1' and Status eq 'approved'")]
+    public void Filter_escapes_and_composes(string? tenantId, string? status, string expected)
+    {
+        Assert.Equal(expected, TableRuleSubmissionRepository.BuildFilter(tenantId, status));
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/TypedContractCompletionWireParityTests.cs

@@ -184,6 +184,7 @@ public class TypedContractCompletionWireParityTests
                 totalInstalls = 4,
                 totalSkipped = 1,
                 totalUnmeasured = 1,
+                totalIncomplete = 0,
                 totalCollisionExcluded = 0,
                 slowestApps = new[]
                 {
@@ -195,6 +196,7 @@ public class TypedContractCompletionWireParityTests
                         skipped = 1,
                         unmeasured = 1,
                         failed = 1,
+                        incomplete = 0,
                         failureRate = 33.3,
                         avgDurationSeconds = 120.0,
                         maxDurationSeconds = 240,
@@ -225,6 +227,7 @@ public class TypedContractCompletionWireParityTests
                 TotalInstalls = 4,
                 TotalSkipped = 1,
                 TotalUnmeasured = 1,
+                TotalIncomplete = 0,
                 TotalCollisionExcluded = 0,
                 SlowestApps = new[]
                 {
@@ -236,6 +239,7 @@ public class TypedContractCompletionWireParityTests
                         Skipped = 1,
                         Unmeasured = 1,
                         Failed = 1,
+                        Incomplete = 0,
                         FailureRate = 33.3,
                         AvgDurationSeconds = 120.0,
                         MaxDurationSeconds = 240,
@@ -684,6 +688,7 @@ public class TypedContractCompletionWireParityTests
                     skipped = 0,
                     unmeasured = 0,
                     failed = 0,
+                    incomplete = 0,
                     failureRate = 0.0,
                     avgDurationSeconds = 0.0,
                     p95DurationSeconds = 0,
@@ -715,6 +720,7 @@ public class TypedContractCompletionWireParityTests
                     Skipped = 0,
                     Unmeasured = 0,
                     Failed = 0,
+                    Incomplete = 0,
                     FailureRate = 0.0,
                     AvgDurationSeconds = 0.0,
                     P95DurationSeconds = 0,

src/Backend/AutopilotMonitor.Functions/DataAccess/DataAccessServiceExtensions.cs

@@ -34,6 +34,7 @@ namespace AutopilotMonitor.Functions.DataAccess
             services.AddSingleton<ISessionAnnotationRepository, TableSessionAnnotationRepository>();
             services.AddSingleton<IBootstrapRepository, TableBootstrapRepository>();
             services.AddSingleton<INotificationRepository, TableNotificationRepository>();
+            services.AddSingleton<IRuleSubmissionRepository, TableRuleSubmissionRepository>();
             services.AddSingleton<ITenantNotificationRepository, TableTenantNotificationRepository>();
             services.AddSingleton<ISlaTenantStatusRepository, TableSlaTenantStatusRepository>();
             // What's new notifier watermark (single platform row in the AdminConfiguration table).

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableMetricsRepository.cs

@@ -142,6 +142,9 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
         public Task ResolveEspBlockingForSessionAsync(string tenantId, string sessionId)
             => _storage.ResolveEspBlockingForSessionAsync(tenantId, sessionId);
 
+        public Task<int> CloseOpenAppInstallsForSessionAsync(string tenantId, string sessionId)
+            => _storage.CloseOpenAppInstallsForSessionAsync(tenantId, sessionId);
+
         public Task<bool> SaveTimeAttributionAggregateAsync(TimeAttributionDailyAggregate aggregate)
             => _storage.SaveTimeAttributionAggregateAsync(aggregate);
 

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableRuleSubmissionRepository.cs

@@ -0,0 +1,294 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Pagination;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Pagination;
+using Azure;
+using Azure.Data.Tables;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.DataAccess.TableStorage
+{
+    /// <summary>
+    /// Table-storage implementation of <see cref="IRuleSubmissionRepository"/>.
+    /// PK = <see cref="PartitionKey"/> for every tenant, RK = inverted ticks + id (newest first).
+    /// </summary>
+    public class TableRuleSubmissionRepository : IRuleSubmissionRepository
+    {
+        internal const string PartitionKey = "submissions";
+
+        private readonly TableClient _tableClient;
+        private readonly ILogger<TableRuleSubmissionRepository> _logger;
+
+        public TableRuleSubmissionRepository(TableStorageService storage, ILogger<TableRuleSubmissionRepository> logger)
+        {
+            _tableClient = storage.GetTableClient(Constants.TableNames.RuleSubmissions);
+            _logger = logger;
+        }
+
+        public async Task<bool> AddAsync(RuleSubmission submission)
+        {
+            try
+            {
+                await _tableClient.AddEntityAsync(StoreSubmission(submission));
+                return true;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to store rule submission {SubmissionId}", submission.SubmissionId);
+                return false;
+            }
+        }
+
+        public async Task<RuleSubmission?> GetAsync(string submissionId)
+        {
+            var entity = await FindEntityAsync(submissionId);
+            return entity == null ? null : MapSubmission(entity);
+        }
+
+        public async Task<List<RuleSubmission>> GetForTenantAsync(string tenantId)
+        {
+            var results = new List<RuleSubmission>();
+            try
+            {
+                await foreach (var entity in _tableClient.QueryAsync<TableEntity>(filter: BuildFilter(tenantId, status: null)))
+                {
+                    results.Add(MapSubmission(entity));
+                }
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                _logger.LogDebug("RuleSubmissions table does not exist yet, returning empty list");
+            }
+            return results;
+        }
+
+        public async Task<RawPage<RuleSubmission>> GetPageAsync(string? tenantId, string? status, int pageSize, string? continuation)
+        {
+            if (pageSize < 1) throw new ArgumentOutOfRangeException(nameof(pageSize));
+            try
+            {
+                var (entities, nextRawToken) = await AzureTablesPaginator.FetchPageAsync<TableEntity>(
+                    client: _tableClient,
+                    filter: BuildFilter(tenantId, status),
+                    pageSize: pageSize,
+                    continuation: continuation);
+
+                var page = new List<RuleSubmission>(entities.Count);
+                foreach (var entity in entities) page.Add(MapSubmission(entity));
+                // RowKey is the inverted tick of SubmittedAt — newest first by construction.
+                return new RawPage<RuleSubmission>(page, nextRawToken);
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                _logger.LogDebug("RuleSubmissions table does not exist yet, returning empty page");
+                return RawPage<RuleSubmission>.Empty;
+            }
+        }
+
+        public async Task<bool> UpdateAsync(RuleSubmission submission)
+        {
+            var existing = await FindEntityAsync(submission.SubmissionId);
+            if (existing == null)
+            {
+                _logger.LogWarning("UpdateAsync: rule submission {SubmissionId} not found", submission.SubmissionId);
+                return false;
+            }
+
+            var entity = StoreSubmission(submission);
+            entity.RowKey = existing.RowKey;
+            entity.ETag = existing.ETag;
+            try
+            {
+                // If-Match on the ETag: two reviewers deciding the same submission cannot both win.
+                await _tableClient.UpdateEntityAsync(entity, existing.ETag, TableUpdateMode.Replace);
+                return true;
+            }
+            catch (RequestFailedException ex) when (ex.Status == 412)
+            {
+                _logger.LogWarning("UpdateAsync: rule submission {SubmissionId} changed underneath the reviewer", submission.SubmissionId);
+                return false;
+            }
+        }
+
+        public async Task<HashSet<string>> GetReservedPublishedRuleIdsAsync()
+        {
+            var ids = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            try
+            {
+                await foreach (var entity in _tableClient.QueryAsync<TableEntity>(
+                    filter: BuildFilter(tenantId: null, status: RuleSubmissionStatuses.Approved),
+                    select: new[] { "PublishedRuleId" }))
+                {
+                    var id = entity.GetString("PublishedRuleId");
+                    if (!string.IsNullOrEmpty(id)) ids.Add(id!);
+                }
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                _logger.LogDebug("RuleSubmissions table does not exist yet");
+            }
+            return ids;
+        }
+
+        public async Task<int> DeleteExpiredAsync(DateTime nowUtc)
+        {
+            var deleted = 0;
+            try
+            {
+                // The expiry rule is the shared RuleSubmissionRetention, so the sweep and its
+                // test cannot disagree; only the two closed statuses are scanned.
+                foreach (var status in new[] { RuleSubmissionStatuses.Withdrawn, RuleSubmissionStatuses.Declined })
+                {
+                    var expired = new List<TableEntity>();
+                    await foreach (var entity in _tableClient.QueryAsync<TableEntity>(filter: BuildFilter(tenantId: null, status)))
+                    {
+                        if (RuleSubmissionRetention.IsExpired(MapSubmission(entity), nowUtc)) expired.Add(entity);
+                    }
+                    foreach (var entity in expired)
+                    {
+                        try
+                        {
+                            await _tableClient.DeleteEntityAsync(entity.PartitionKey, entity.RowKey);
+                            deleted++;
+                        }
+                        catch (RequestFailedException ex) when (ex.Status == 404)
+                        {
+                            // Already gone — a parallel sweep or a tenant offboarding won the race.
+                        }
+                    }
+                }
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                _logger.LogDebug("RuleSubmissions table does not exist yet");
+            }
+            return deleted;
+        }
+
+        public async Task<bool> DeleteAsync(string submissionId)
+        {
+            var existing = await FindEntityAsync(submissionId);
+            if (existing == null) return false;
+            try
+            {
+                await _tableClient.DeleteEntityAsync(existing.PartitionKey, existing.RowKey);
+                return true;
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                return false;
+            }
+        }
+
+        private async Task<TableEntity?> FindEntityAsync(string submissionId)
+        {
+            try
+            {
+                await foreach (var entity in _tableClient.QueryAsync<TableEntity>(
+                    filter: $"PartitionKey eq '{PartitionKey}' and SubmissionId eq '{Escape(submissionId)}'"))
+                {
+                    return entity;
+                }
+            }
+            catch (RequestFailedException ex) when (ex.Status == 404)
+            {
+                _logger.LogDebug("RuleSubmissions table does not exist yet");
+            }
+            return null;
+        }
+
+        internal static string BuildFilter(string? tenantId, string? status)
+        {
+            var filter = $"PartitionKey eq '{PartitionKey}'";
+            if (!string.IsNullOrEmpty(tenantId)) filter += $" and TenantId eq '{Escape(tenantId!)}'";
+            if (!string.IsNullOrEmpty(status)) filter += $" and Status eq '{Escape(status!)}'";
+            return filter;
+        }
+
+        private static string Escape(string value) => value.Replace("'", "''");
+
+        // ── Store / Map ─────────────────────────────────────────────────────────
+        // internal static: pinned by round-trip unit tests — every property must survive
+        // Store→Map, so any new field lands in BOTH methods plus the test.
+
+        internal static TableEntity StoreSubmission(RuleSubmission s) =>
+            new(PartitionKey, $"{RowKeyCodec.InvertedTicks(s.SubmittedAt)}_{s.SubmissionId}")
+            {
+                ["SubmissionId"] = s.SubmissionId,
+                ["BatchId"] = s.BatchId,
+                ["TenantId"] = s.TenantId,
+                ["RuleKind"] = s.RuleKind,
+                ["SourceRuleId"] = s.SourceRuleId,
+                ["Title"] = s.Title,
+                ["Category"] = s.Category,
+                ["RuleJson"] = s.RuleJson,
+                ["Comment"] = s.Comment ?? string.Empty,
+                ["SubmittedBy"] = s.SubmittedBy,
+                ["SubmittedByName"] = s.SubmittedByName,
+                ["ContactEmail"] = s.ContactEmail ?? string.Empty,
+                ["AttributionMode"] = s.AttributionMode,
+                ["AttributionName"] = s.AttributionName,
+                ["SubmittedAt"] = s.SubmittedAt,
+                ["Status"] = s.Status,
+                ["ValidationFindingsJson"] = JsonSerializer.Serialize(s.ValidationFindings),
+                ["SourceFireStatsJson"] = s.SourceFireStats == null ? string.Empty : JsonSerializer.Serialize(s.SourceFireStats),
+                ["ReviewedBy"] = s.ReviewedBy ?? string.Empty,
+                ["ReviewedAt"] = s.ReviewedAt,
+                ["ReviewComment"] = s.ReviewComment ?? string.Empty,
+                ["WillBeAdapted"] = s.WillBeAdapted,
+                ["PublishedRuleId"] = s.PublishedRuleId ?? string.Empty,
+                ["DerivedFromTemplateRuleId"] = s.DerivedFromTemplateRuleId ?? string.Empty,
+            };
+
+        internal static RuleSubmission MapSubmission(TableEntity e) => new()
+        {
+            SubmissionId = e.GetString("SubmissionId") ?? string.Empty,
+            BatchId = e.GetString("BatchId") ?? string.Empty,
+            TenantId = e.GetString("TenantId") ?? string.Empty,
+            RuleKind = e.GetString("RuleKind") ?? string.Empty,
+            SourceRuleId = e.GetString("SourceRuleId") ?? string.Empty,
+            Title = e.GetString("Title") ?? string.Empty,
+            Category = e.GetString("Category") ?? string.Empty,
+            RuleJson = e.GetString("RuleJson") ?? string.Empty,
+            Comment = NullIfEmpty(e.GetString("Comment")),
+            SubmittedBy = e.GetString("SubmittedBy") ?? string.Empty,
+            SubmittedByName = e.GetString("SubmittedByName") ?? string.Empty,
+            ContactEmail = NullIfEmpty(e.GetString("ContactEmail")),
+            AttributionMode = e.GetString("AttributionMode") ?? RuleAttributionModes.Anonymous,
+            AttributionName = e.GetString("AttributionName") ?? RuleAttributionModes.AnonymousAuthor,
+            SubmittedAt = e.GetDateTimeOffset("SubmittedAt")?.UtcDateTime ?? DateTime.MinValue,
+            Status = e.GetString("Status") ?? RuleSubmissionStatuses.Pending,
+            ValidationFindings = DeserializeOrDefault<List<RuleSubmissionFinding>>(e.GetString("ValidationFindingsJson")) ?? new List<RuleSubmissionFinding>(),
+            SourceFireStats = DeserializeOrDefault<RuleSubmissionFireStats>(e.GetString("SourceFireStatsJson")),
+            ReviewedBy = NullIfEmpty(e.GetString("ReviewedBy")),
+            ReviewedAt = e.GetDateTimeOffset("ReviewedAt")?.UtcDateTime,
+            ReviewComment = NullIfEmpty(e.GetString("ReviewComment")),
+            WillBeAdapted = e.GetBoolean("WillBeAdapted") ?? false,
+            PublishedRuleId = NullIfEmpty(e.GetString("PublishedRuleId")),
+            DerivedFromTemplateRuleId = NullIfEmpty(e.GetString("DerivedFromTemplateRuleId")),
+        };
+
+        private static T? DeserializeOrDefault<T>(string? json) where T : class
+        {
+            if (string.IsNullOrEmpty(json)) return null;
+            try
+            {
+                return JsonSerializer.Deserialize<T>(json!);
+            }
+            catch (JsonException)
+            {
+                // A corrupt column must not hide the submission itself.
+                return null;
+            }
+        }
+
+        private static string? NullIfEmpty(string? value) => string.IsNullOrEmpty(value) ? null : value;
+    }
+}

src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableSessionRepository.cs

@@ -101,6 +101,13 @@ namespace AutopilotMonitor.Functions.DataAccess.TableStorage
                 // complete. Positive evidence only (listed ⇒ EspBlocking=true, absent ⇒ stays
                 // unknown). Idempotent + fail-soft like the counter reconcile above.
                 await _storage.ResolveEspBlockingForSessionAsync(tenantId, sessionId);
+                // Observation end: app rows still InProgress on a terminal session never get a
+                // terminal event — close them as Incomplete (outcome unknown, not a failure).
+                // Early for the ingest path (verdict batch, the agent may still be watching),
+                // never wrong in the end state: a real terminal arriving later still wins via
+                // the sticky-status reconcile, and the shutdown batch re-runs the close for rows
+                // opened after the verdict. Idempotent + fail-soft.
+                await _storage.CloseOpenAppInstallsForSessionAsync(tenantId, sessionId);
 
                 // F1 PR2: compute + persist the time-attribution breakdown once, now that the
                 // terminal write stamped CompletedAt/DurationSeconds and the event stream is

src/Backend/AutopilotMonitor.Functions/Functions/Apps/AppsAnalyticsHelper.cs

@@ -291,6 +291,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
             var measured = installed.Where(MetricsMath.HasMeasuredDuration).ToList();
             var succeeded = installed.Count;
             var failed = summaries.Count(s => s.Status == "Failed");
+            var incomplete = summaries.Count(s => s.Status == "Incomplete");
             var failureRate = MetricsMath.TerminalFailureRatePct(failed, succeeded);
             var avgDurationSeconds = measured.Count > 0 ? Math.Round(measured.Average(s => s.DurationSeconds), 0) : 0;
             var p95DurationSeconds = Percentile(measured.Select(s => s.DurationSeconds).ToList(), 0.95);
@@ -423,6 +424,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
                     Skipped = skipped,
                     Unmeasured = installed.Count - measured.Count,
                     Failed = failed,
+                    Incomplete = incomplete,
                     FailureRate = failureRate,
                     AvgDurationSeconds = avgDurationSeconds,
                     P95DurationSeconds = p95DurationSeconds,

src/Backend/AutopilotMonitor.Functions/Functions/Config/GetLatestVersionsFunction.cs

@@ -13,7 +13,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
 {
     /// <summary>
     /// Returns the latest published agent + bootstrap script versions.
-    /// Cached in-memory for 12h; supports <c>?refresh=true</c> to bypass the cache.
+    /// Cached in-memory for a few minutes; supports <c>?refresh=true</c> to bypass the cache.
     /// Authenticated users only (read-only metadata).
     /// </summary>
     public class GetLatestVersionsFunction
@@ -44,15 +44,18 @@ namespace AutopilotMonitor.Functions.Functions.Config
 
                 var response = req.CreateResponse(HttpStatusCode.OK);
 
-                // Force-refresh responses MUST NOT be browser-cached.
-                // Normal cached responses may be stored for up to 1h (aligns with 12h backend cache).
+                // Force-refresh responses MUST NOT be browser-cached. Normal responses are
+                // held for a minute only: the portal announces this number as "Latest agent
+                // version" right after a release, and a browser cache measured in hours would
+                // keep showing the previous release long after the backend refreshed. The
+                // payload is a few dozen bytes, so revalidating often is free.
                 if (forceRefresh)
                 {
                     response.Headers.Add("Cache-Control", "no-store");
                 }
                 else
                 {
-                    response.Headers.Add("Cache-Control", "public, max-age=3600");
+                    response.Headers.Add("Cache-Control", "public, max-age=60");
                 }
 
                 await response.WriteAsJsonAsync(new GetLatestVersionsResponse

src/Backend/AutopilotMonitor.Functions/Functions/Metrics/McpUsageMetricsFunction.cs

@@ -115,6 +115,29 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                 return await req.UnauthorizedAsync("Unable to determine tenant identity");
             }
 
+            return await OrganizationUsageResponseAsync(req, tenantId);
+        }
+
+        /// <summary>
+        /// GET /api/global/metrics/mcp-usage/organization?tenantId=&amp;dateFrom=&amp;dateTo= — the same organization
+        /// breakdown for ONE tenant named by a Global Admin / Global Reader (the tenant MCP Usage page under a tenant
+        /// override). There is no aggregate path: tenantId is required. Catalogued with TenantScoping.None on
+        /// purpose — the route enumerates a tenant's accounts, which a delegated (MSP) caller must never reach.
+        /// </summary>
+        [Function("GetGlobalMcpOrganizationUsage")]
+        public async Task<HttpResponseData> GetGlobalOrganizationUsage(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "global/metrics/mcp-usage/organization")] HttpRequestData req)
+        {
+            if (!Guid.TryParse(req.Query["tenantId"], out var tenantGuid))
+            {
+                return await req.BadRequestAsync("tenantId is required");
+            }
+
+            return await OrganizationUsageResponseAsync(req, tenantGuid.ToString());
+        }
+
+        private async Task<HttpResponseData> OrganizationUsageResponseAsync(HttpRequestData req, string tenantId)
+        {
             try
             {
                 var nowUtc = DateTime.UtcNow;
@@ -127,6 +150,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                 var readFrom = string.CompareOrdinal(dateFrom, monthStart) < 0 ? dateFrom : monthStart;
                 var readTo = string.CompareOrdinal(dateTo, today) > 0 ? dateTo : today;
                 var records = await _userUsageRepo.GetTenantUsageAsync(tenantId, readFrom, readTo);
+                var limits = await _quotaService.ResolveTenantPlanAsync(tenantId);
 
                 var response = req.CreateResponse(HttpStatusCode.OK);
                 await response.WriteAsJsonAsync(new GetMcpOrganizationUsageResponse
@@ -135,6 +159,8 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                     DateFrom = dateFrom,
                     DateTo = dateTo,
                     Users = AggregateOrganizationUsage(records, tenantId, dateFrom, dateTo, today, monthStart),
+                    Quota = BuildOrganizationQuota(records, limits, today, monthStart),
+                    Daily = BuildOrganizationDaily(records, dateFrom, dateTo),
                 });
                 return response;
             }
@@ -144,6 +170,46 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
             }
         }
 
+        /// <summary>Pure: requests charged to the tenant per day inside [dateFrom, dateTo], oldest first.</summary>
+        internal static List<McpOrganizationDailyItem> BuildOrganizationDaily(
+            IEnumerable<TenantUsageRecord> records, string dateFrom, string dateTo)
+        {
+            var byDay = new SortedDictionary<string, long>(StringComparer.Ordinal);
+            foreach (var record in records)
+            {
+                if (string.CompareOrdinal(record.Date, dateFrom) < 0 || string.CompareOrdinal(record.Date, dateTo) > 0)
+                    continue;
+                byDay[record.Date] = byDay.TryGetValue(record.Date, out var sum) ? sum + record.RequestCount : record.RequestCount;
+            }
+
+            return byDay.Select(kv => new McpOrganizationDailyItem { Date = kv.Key, Requests = kv.Value }).ToList();
+        }
+
+        /// <summary>
+        /// Pure: the tenant's organization windows from the same counter rows — today's and this month's total over
+        /// every account charged to the tenant, against the tenant plan's limits (0 = unlimited).
+        /// </summary>
+        internal static McpOrganizationQuotaNode BuildOrganizationQuota(
+            IEnumerable<TenantUsageRecord> records, McpQuotaService.TenantPlanLimits limits, string today, string monthStart)
+        {
+            long dailyUsed = 0, monthlyUsed = 0;
+            foreach (var record in records)
+            {
+                if (record.Date == today) dailyUsed += record.RequestCount;
+                if (string.CompareOrdinal(record.Date, monthStart) >= 0 && string.CompareOrdinal(record.Date, today) <= 0)
+                    monthlyUsed += record.RequestCount;
+            }
+
+            return new McpOrganizationQuotaNode
+            {
+                TenantPlan = limits.TenantPlan,
+                DailyLimit = limits.TenantDailyLimit,
+                MonthlyLimit = limits.TenantMonthlyLimit,
+                DailyUsed = dailyUsed,
+                MonthlyUsed = monthlyUsed,
+            };
+        }
+
         /// <summary>
         /// Pure: folds the organization counter rows into one item per account. A row whose HomeTenantId is set
         /// and differs from the tenant was charged by a delegated (MSP) read. Ordered by this month's usage.

src/Backend/AutopilotMonitor.Functions/Functions/Rules/AnalyzeRulesFunction.cs

@@ -55,6 +55,10 @@ namespace AutopilotMonitor.Functions.Functions.Rules
                 return await req.BadRequestAsync("Invalid rule data");
             }
 
+            // Author is stamped from the creator's token, never from the payload
+            // (anti-spoof), and stays immutable through every later update.
+            rule.Author = TenantHelper.GetUserDisplayName(req) ?? "Autopilot Monitor";
+
             try
             {
                 var success = await _ruleService.CreateRuleAsync(tenantId, rule);
@@ -88,6 +92,11 @@ namespace AutopilotMonitor.Functions.Functions.Rules
 
             rule.RuleId = ruleId;
 
+            // Same anti-spoof stamp as CreateRule: on a true update the service replaces
+            // this with the original author (immutable attribution), but a full-payload PUT
+            // that upserts a rule with no existing row must not store the payload's author.
+            rule.Author = TenantHelper.GetUserDisplayName(req) ?? "Autopilot Monitor";
+
             try
             {
                 var success = await _ruleService.UpdateRuleAsync(tenantId, rule);
@@ -124,7 +133,8 @@ namespace AutopilotMonitor.Functions.Functions.Rules
 
             try
             {
-                var newRule = await _ruleService.CreateFromTemplateAsync(tenantId, ruleId, variables);
+                var author = TenantHelper.GetUserDisplayName(req) ?? "Autopilot Monitor";
+                var newRule = await _ruleService.CreateFromTemplateAsync(tenantId, ruleId, variables, author);
 
                 var response = req.CreateResponse(HttpStatusCode.Created);
                 await response.WriteAsJsonAsync(new CreateAnalyzeRuleFromTemplateResponse { Success = true, Rule = newRule, Message = "Custom rule created from template" });

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/DeleteGlobalRuleSubmissionFunction.cs

@@ -0,0 +1,52 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>
+    /// Operator hard delete of a submission (test/demo rows, or a tenant's request). The row
+    /// vanishes from both lists; a published rule in the repo is untouched.
+    /// </summary>
+    public class DeleteGlobalRuleSubmissionFunction
+    {
+        private readonly ILogger<DeleteGlobalRuleSubmissionFunction> _logger;
+        private readonly RuleSubmissionService _service;
+
+        public DeleteGlobalRuleSubmissionFunction(ILogger<DeleteGlobalRuleSubmissionFunction> logger, RuleSubmissionService service)
+        {
+            _logger = logger;
+            _service = service;
+        }
+
+        [Function("DeleteGlobalRuleSubmission")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "global/rule-submissions/{submissionId}")] HttpRequestData req,
+            string submissionId)
+        {
+            try
+            {
+                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
+                var user = TenantHelper.GetUserIdentifier(req);
+                if (string.IsNullOrWhiteSpace(submissionId)) return await req.BadRequestAsync("submissionId is required.");
+
+                var existing = await _service.GetAsync(submissionId);
+                if (existing == null) return await req.NotFoundAsync("Submission not found.");
+
+                if (!await _service.DeleteAsync(submissionId)) return await req.NotFoundAsync("Submission not found.");
+
+                // Warning on purpose: an operator delete is rare and must be visible in App Insights.
+                _logger.LogWarning("Rule submission {SubmissionId} ({RuleId}, tenant {TenantId}, status {Status}) deleted by {User}",
+                    submissionId, existing.SourceRuleId, existing.TenantId, existing.Status, user);
+                return await req.OkAsync(new SuccessMessageResponse { Success = true, Message = "Submission deleted." });
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "DeleteGlobalRuleSubmission");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/GetGlobalRuleSubmissionFunction.cs

@@ -0,0 +1,41 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>One submission with the frozen rule, live fire stats, the suggested id and the repo file.</summary>
+    public class GetGlobalRuleSubmissionFunction
+    {
+        private readonly ILogger<GetGlobalRuleSubmissionFunction> _logger;
+        private readonly RuleSubmissionService _service;
+
+        public GetGlobalRuleSubmissionFunction(ILogger<GetGlobalRuleSubmissionFunction> logger, RuleSubmissionService service)
+        {
+            _logger = logger;
+            _service = service;
+        }
+
+        [Function("GetGlobalRuleSubmission")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "global/rule-submissions/{submissionId}")] HttpRequestData req,
+            string submissionId)
+        {
+            try
+            {
+                // Authentication + GlobalReadOrAdmin authorization enforced by PolicyEnforcementMiddleware
+                if (string.IsNullOrWhiteSpace(submissionId)) return await req.BadRequestAsync("submissionId is required.");
+
+                var detail = await _service.GetDetailAsync(submissionId);
+                if (detail == null) return await req.NotFoundAsync("Submission not found.");
+                return await req.OkAsync(detail);
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "GetGlobalRuleSubmission");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/GetGlobalRuleSubmissionsFunction.cs

@@ -0,0 +1,77 @@
+using System.Web;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Pagination;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Pagination;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>Operator list across tenants: <c>?tenantId=</c> and <c>?status=</c> are server-side filters, paging as for session reports.</summary>
+    public class GetGlobalRuleSubmissionsFunction
+    {
+        private readonly ILogger<GetGlobalRuleSubmissionsFunction> _logger;
+        private readonly RuleSubmissionService _service;
+
+        public GetGlobalRuleSubmissionsFunction(ILogger<GetGlobalRuleSubmissionsFunction> logger, RuleSubmissionService service)
+        {
+            _logger = logger;
+            _service = service;
+        }
+
+        [Function("GetGlobalRuleSubmissions")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "global/rule-submissions")] HttpRequestData req)
+        {
+            try
+            {
+                // Authentication + GlobalReadOrAdmin authorization enforced by PolicyEnforcementMiddleware
+                var callerTenantId = TenantHelper.GetTenantId(req);
+
+                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var parsed = RuleSubmissionsPagination.ParseQuery(query);
+                if (parsed.Error != null) return await req.BadRequestAsync(parsed.Error);
+
+                var pageSize = parsed.PageSize ?? RuleSubmissionsPagination.DefaultPageSize;
+
+                string? azureToken = null;
+                if (parsed.Continuation != null)
+                {
+                    if (!RuleSubmissionsPagination.TryAcceptContinuation(
+                            parsed.Continuation, callerTenantId, parsed.FilterTenantId, parsed.FilterStatus,
+                            out azureToken, out var rejectReason))
+                    {
+                        _logger.LogWarning("GetGlobalRuleSubmissions: continuation rejected ({Reason})", rejectReason);
+                        return await req.BadRequestAsync($"Invalid continuation token ({rejectReason}). Restart pagination from the first page.");
+                    }
+                }
+
+                var page = await _service.GetPageAsync(parsed.FilterTenantId, parsed.FilterStatus, pageSize, azureToken);
+                var items = await _service.ToItemsAsync(page.Items);
+
+                string? nextLink = null;
+                if (!string.IsNullOrEmpty(page.NextRawToken))
+                {
+                    var fp = RuleSubmissionsPagination.Fingerprint(callerTenantId, parsed.FilterTenantId, parsed.FilterStatus);
+                    var wireToken = ContinuationToken.Encode(page.NextRawToken!, callerTenantId, fp);
+                    nextLink = RuleSubmissionsPagination.BuildNextLink(pageSize, wireToken, parsed.FilterTenantId, parsed.FilterStatus);
+                }
+
+                return await req.OkAsync(new RuleSubmissionListResponse
+                {
+                    Success = true,
+                    Count = items.Count,
+                    Submissions = items,
+                    NextLink = nextLink,
+                });
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "GetGlobalRuleSubmissions");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/GetRuleSubmissionsFunction.cs

@@ -0,0 +1,41 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>The submitting tenant's own submissions, newest first, with the effective status.</summary>
+    public class GetRuleSubmissionsFunction
+    {
+        private readonly ILogger<GetRuleSubmissionsFunction> _logger;
+        private readonly RuleSubmissionService _service;
+
+        public GetRuleSubmissionsFunction(ILogger<GetRuleSubmissionsFunction> logger, RuleSubmissionService service)
+        {
+            _logger = logger;
+            _service = service;
+        }
+
+        [Function("GetRuleSubmissions")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "rules/submissions")] HttpRequestData req)
+        {
+            try
+            {
+                // Authentication + TenantAdminOrGA authorization enforced by PolicyEnforcementMiddleware.
+                // Always the JWT tenant — a GA reads foreign tenants through global/rule-submissions?tenantId=.
+                var tenantId = req.GetRequestContext().TenantId;
+                var rows = await _service.GetForTenantAsync(tenantId);
+                var items = await _service.ToItemsAsync(rows);
+                return await req.OkAsync(new RuleSubmissionListResponse { Success = true, Count = items.Count, Submissions = items });
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "GetRuleSubmissions");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/ReviewRuleSubmissionFunction.cs

@@ -0,0 +1,92 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>The reviewer's decision (portal or MCP). The submitter is told through a tenant notification.</summary>
+    public class ReviewRuleSubmissionFunction
+    {
+        private readonly ILogger<ReviewRuleSubmissionFunction> _logger;
+        private readonly RuleSubmissionService _service;
+        private readonly TenantNotificationService _tenantNotifications;
+
+        public ReviewRuleSubmissionFunction(
+            ILogger<ReviewRuleSubmissionFunction> logger,
+            RuleSubmissionService service,
+            TenantNotificationService tenantNotifications)
+        {
+            _logger = logger;
+            _service = service;
+            _tenantNotifications = tenantNotifications;
+        }
+
+        [Function("ReviewRuleSubmission")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "patch", Route = "global/rule-submissions/{submissionId}")] HttpRequestData req,
+            string submissionId)
+        {
+            try
+            {
+                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
+                var reviewer = TenantHelper.GetUserIdentifier(req);
+                if (string.IsNullOrWhiteSpace(submissionId)) return await req.BadRequestAsync("submissionId is required.");
+
+                var read = await req.ReadAsync<ReviewRuleSubmissionRequest>();
+                if (read.Error != null) return read.Error;
+
+                RuleSubmission updated;
+                try
+                {
+                    updated = await _service.ReviewAsync(submissionId, read.Value!, reviewer);
+                }
+                catch (KeyNotFoundException ex)
+                {
+                    return await req.NotFoundAsync(ex.Message);
+                }
+                catch (ArgumentException ex)
+                {
+                    return await req.BadRequestAsync(ex.Message);
+                }
+                catch (InvalidOperationException ex)
+                {
+                    return await req.ConflictAsync(ex.Message);
+                }
+
+                var approved = updated.Status == RuleSubmissionStatuses.Approved;
+                var title = approved
+                    ? $"Rule submission approved: {updated.SourceRuleId}"
+                    : $"Rule submission declined: {updated.SourceRuleId}";
+                var message = approved
+                    ? (updated.WillBeAdapted
+                        ? $"\"{updated.Title}\" will be published as {updated.PublishedRuleId} after a small adaptation for the community."
+                        : $"\"{updated.Title}\" will be published as {updated.PublishedRuleId}.")
+                    : $"\"{updated.Title}\" was not accepted for the community pool.";
+                if (!string.IsNullOrEmpty(updated.ReviewComment)) message += $" Reviewer: {updated.ReviewComment}";
+
+                // Best effort; the submissions list carries the same facts.
+                _ = _tenantNotifications.CreateNotificationAsync(
+                    updated.TenantId, "rule_submission_decided", title, message,
+                    href: updated.RuleKind == RuleSubmissionKinds.Analyze ? "/analyze-rules" : "/gather-rules");
+
+                _logger.LogInformation("Rule submission {SubmissionId} {Status} by {Reviewer} (published id {PublishedRuleId})",
+                    submissionId, updated.Status, reviewer, updated.PublishedRuleId ?? "-");
+
+                var item = (await _service.ToItemsAsync(new[] { updated }))[0];
+                return await req.OkAsync(new ReviewRuleSubmissionResponse
+                {
+                    Success = true,
+                    Message = approved ? "Submission approved." : "Submission declined.",
+                    Submission = item,
+                });
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "ReviewRuleSubmission");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/SubmitRuleSubmissionsFunction.cs

@@ -0,0 +1,137 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>
+    /// A tenant admin submits one or more of the tenant's custom rules for the community pool.
+    /// The body carries only rule references; the service freezes the rules server-side.
+    /// </summary>
+    public class SubmitRuleSubmissionsFunction
+    {
+        private readonly ILogger<SubmitRuleSubmissionsFunction> _logger;
+        private readonly RuleSubmissionService _service;
+        private readonly IMaintenanceRepository _maintenanceRepo;
+        private readonly TelegramNotificationService _telegram;
+        private readonly GlobalNotificationService _globalNotifications;
+
+        public SubmitRuleSubmissionsFunction(
+            ILogger<SubmitRuleSubmissionsFunction> logger,
+            RuleSubmissionService service,
+            IMaintenanceRepository maintenanceRepo,
+            TelegramNotificationService telegram,
+            GlobalNotificationService globalNotifications)
+        {
+            _logger = logger;
+            _service = service;
+            _maintenanceRepo = maintenanceRepo;
+            _telegram = telegram;
+            _globalNotifications = globalNotifications;
+        }
+
+        [Function("SubmitRuleSubmissions")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "rules/submissions")] HttpRequestData req)
+        {
+            try
+            {
+                // Authentication + TenantAdminOrGA authorization enforced by PolicyEnforcementMiddleware
+                var requestCtx = req.GetRequestContext();
+                var tenantId = requestCtx.TenantId;
+                var userIdentifier = requestCtx.UserPrincipalName;
+
+                var read = await req.ReadAsync<SubmitRuleSubmissionsRequest>(262_144);
+                if (read.Error != null) return read.Error;
+                var request = read.Value!;
+
+                // Same tenant-tamper gate as the session report: non-GAs submit for their JWT
+                // tenant only; a GA may submit on behalf of a foreign tenant and must name it.
+                if (!requestCtx.IsGlobalAdmin)
+                {
+                    if (!string.IsNullOrEmpty(request.TenantId)
+                        && !string.Equals(request.TenantId, tenantId, StringComparison.OrdinalIgnoreCase))
+                    {
+                        _logger.LogWarning(
+                            "SubmitRuleSubmissions: BLOCKED cross-tenant body for non-GA user={User} jwtTenant={JwtTenant} bodyTenant={BodyTenant}",
+                            userIdentifier, tenantId, request.TenantId);
+                        return await req.ForbiddenAsync("Body tenantId must match your authenticated tenant.");
+                    }
+                    request.TenantId = tenantId;
+                }
+                else if (string.IsNullOrEmpty(request.TenantId))
+                {
+                    return await req.BadRequestAsync("tenantId is required in body for Global Admin submissions.");
+                }
+
+                if (!SecurityValidator.IsValidGuid(request.TenantId))
+                    return await req.BadRequestAsync("Invalid tenantId.");
+
+                var displayName = TenantHelper.GetUserDisplayName(req) ?? userIdentifier;
+                List<RuleSubmission> created;
+                try
+                {
+                    created = await _service.SubmitAsync(request.TenantId, request, userIdentifier, displayName);
+                }
+                catch (ArgumentException ex)
+                {
+                    return await req.BadRequestAsync(ex.Message);
+                }
+                catch (InvalidOperationException ex)
+                {
+                    return await req.ConflictAsync(ex.Message);
+                }
+
+                if (!requestCtx.IsGlobalAdmin)
+                {
+                    foreach (var s in created)
+                    {
+                        await _maintenanceRepo.LogAuditEntryAsync(
+                            request.TenantId, "CREATE", "RuleSubmission", s.SubmissionId, userIdentifier,
+                            new Dictionary<string, string>
+                            {
+                                { "Action", "SubmitRuleSubmission" },
+                                { "RuleKind", s.RuleKind },
+                                { "RuleId", s.SourceRuleId },
+                                { "BatchId", s.BatchId },
+                                { "AttributionMode", s.AttributionMode },
+                                { "HasComment", (s.Comment != null).ToString() },
+                            });
+                    }
+                }
+
+                // Operator notifications — best effort, one per rule so every id has its own deep link.
+                foreach (var s in created)
+                {
+                    _ = _telegram.SendRuleSubmissionAsync(s.SubmissionId, request.TenantId, userIdentifier, s.RuleKind, s.SourceRuleId, s.Title, s.Comment ?? string.Empty);
+                    _ = _globalNotifications.CreateNotificationAsync(
+                        "rule_submission",
+                        $"Rule submission {s.SubmissionId}",
+                        $"{s.SourceRuleId} \"{s.Title}\" ({s.RuleKind}) — {userIdentifier} (Tenant: {request.TenantId})",
+                        href: $"/admin/reports/rule-submissions?submissionId={Uri.EscapeDataString(s.SubmissionId)}");
+                }
+
+                _logger.LogInformation("Rule submissions stored: {Count} rule(s), batch {BatchId}, tenant {TenantId}, by {User}",
+                    created.Count, created[0].BatchId, request.TenantId, userIdentifier);
+
+                var items = await _service.ToItemsAsync(created);
+                return await req.OkAsync(new SubmitRuleSubmissionsResponse
+                {
+                    Success = true,
+                    Message = created.Count == 1 ? "Rule submitted for review." : $"{created.Count} rules submitted for review.",
+                    BatchId = created[0].BatchId,
+                    Submissions = items,
+                });
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "SubmitRuleSubmissions");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Functions/Rules/Submissions/WithdrawRuleSubmissionFunction.cs

@@ -0,0 +1,55 @@
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Azure.Functions.Worker;
+using Microsoft.Azure.Functions.Worker.Http;
+using Microsoft.Extensions.Logging;
+
+namespace AutopilotMonitor.Functions.Functions.Rules.Submissions
+{
+    /// <summary>The submitter takes a pending submission back. The row stays (status withdrawn) for the audit trail.</summary>
+    public class WithdrawRuleSubmissionFunction
+    {
+        private readonly ILogger<WithdrawRuleSubmissionFunction> _logger;
+        private readonly RuleSubmissionService _service;
+
+        public WithdrawRuleSubmissionFunction(ILogger<WithdrawRuleSubmissionFunction> logger, RuleSubmissionService service)
+        {
+            _logger = logger;
+            _service = service;
+        }
+
+        [Function("WithdrawRuleSubmission")]
+        public async Task<HttpResponseData> Run(
+            [HttpTrigger(AuthorizationLevel.Anonymous, "delete", Route = "rules/submissions/{submissionId}")] HttpRequestData req,
+            string submissionId)
+        {
+            try
+            {
+                // Authentication + TenantAdminOrGA authorization enforced by PolicyEnforcementMiddleware
+                var requestCtx = req.GetRequestContext();
+                if (string.IsNullOrWhiteSpace(submissionId)) return await req.BadRequestAsync("submissionId is required.");
+
+                bool withdrawn;
+                try
+                {
+                    // A foreign tenant's submission answers 404 for a non-GA — the row's existence is not theirs to learn.
+                    withdrawn = await _service.WithdrawAsync(requestCtx.TenantId, submissionId, crossTenantAllowed: requestCtx.IsGlobalAdmin);
+                }
+                catch (InvalidOperationException ex)
+                {
+                    return await req.ConflictAsync(ex.Message);
+                }
+
+                if (!withdrawn) return await req.NotFoundAsync("Submission not found.");
+
+                _logger.LogInformation("Rule submission {SubmissionId} withdrawn by {User}", submissionId, requestCtx.UserPrincipalName);
+                return await req.OkAsync(new SuccessMessageResponse { Success = true, Message = "Submission withdrawn." });
+            }
+            catch (Exception ex)
+            {
+                return await req.InternalServerErrorAsync(_logger, ex, "WithdrawRuleSubmission");
+            }
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Helpers/MetricsMath.cs

@@ -10,8 +10,8 @@ public static class MetricsMath
     /// <summary>
     /// App-install failure rate over finished installs only: Failed / (Failed + Succeeded), one
     /// decimal, 0 when nothing finished. The same outcome-quota convention as the enrollment
-    /// success rate — "InProgress" rows (still installing, or orphaned by a session that died
-    /// mid-install) never dilute the rate. Shared by the app-metrics payload and the Apps
+    /// success rate — "InProgress" rows (still installing) and "Incomplete" rows (observation
+    /// ended before any outcome) never dilute the rate. Shared by the app-metrics payload and the Apps
     /// dashboard aggregations so the definition can't drift between panes.
     /// </summary>
     public static double TerminalFailureRatePct(int failed, int succeeded)
@@ -94,6 +94,8 @@ public static class MetricsMath
             var installed = succeededAll.Where(s => !IsSkipTerminalState(s)).ToList();
             var measured = installed.Where(HasMeasuredDuration).ToList();
             var failed = g.Where(s => s.Status == "Failed").ToList();
+            // Observation ended before any outcome — disclosed, outside the rate and the durations.
+            var incomplete = g.Count(s => s.Status == "Incomplete");
             var total = g.Count();
 
             // DoAggregator is the single source for the DO rollup: it filters rows that actually
@@ -109,6 +111,7 @@ public static class MetricsMath
                 Skipped = skipped.Count,
                 Unmeasured = installed.Count - measured.Count,
                 Failed = failed.Count,
+                Incomplete = incomplete,
                 // Skips leave the rate (they are not attempts); legacy rows stay in it.
                 FailureRate = TerminalFailureRatePct(failed.Count, installed.Count),
                 AvgDurationSeconds = measured.Count > 0 ? Math.Round(measured.Average(s => s.DurationSeconds), 0) : 0,
@@ -151,6 +154,7 @@ public static class MetricsMath
             TotalInstalls = summaryList.Count,
             TotalSkipped = appGroups.Sum(a => a.Skipped),
             TotalUnmeasured = appGroups.Sum(a => a.Unmeasured),
+            TotalIncomplete = appGroups.Sum(a => a.Incomplete),
             TotalCollisionExcluded = totalCollisionExcluded,
             SlowestApps = slowestApps,
             TopFailingApps = topFailingApps,

src/Backend/AutopilotMonitor.Functions/Middleware/RequestTelemetryMiddleware.cs

@@ -30,6 +30,9 @@ public class RequestTelemetryMiddleware : IFunctionsWorkerMiddleware
     // agent/register-session + agent/upload-url (tenant from body), bootstrap/validate/{code},
     // bootstrap/sessions{,/{code}}, bootstrap/config, bootstrap/register-session — where a client
     // could send X-Tenant-Id:<valid-guid> and pollute tenant attribution in telemetry.
+    // Those routes get their TenantId from RequestRowMarkers.ValidatedTenantKey instead, which
+    // SecurityValidator stamps only once the tenant is proven (see ResolveTenantId). The list
+    // stays for the routes that never reach the validator (distress is pre-auth).
     private static readonly HashSet<string> TenantHeaderTrustedPaths = new(StringComparer.OrdinalIgnoreCase)
     {
         "/api/agent/telemetry",
@@ -43,6 +46,35 @@ public class RequestTelemetryMiddleware : IFunctionsWorkerMiddleware
         _telemetryClient = telemetryClient;
     }
 
+    /// <summary>
+    /// Tenant attribution for the request row, most trusted source first: the policy pipeline's
+    /// tenant (portal / MCP routes), then the tenant <c>SecurityValidator</c> proved for an agent
+    /// request (<see cref="RequestRowMarkers.ValidatedTenantKey"/> — the only source for
+    /// register / config / upload-url, which validate no tenant header), and last the
+    /// <c>X-Tenant-Id</c> header on the exact routes that validate it themselves
+    /// (<see cref="TenantHeaderTrustedPaths"/>), when it is a well-formed GUID. Any other route
+    /// gets no tenant: an anonymous caller must not be able to pollute the attribution.
+    /// </summary>
+    internal static string? ResolveTenantId(
+        string? policyTenantId,
+        IDictionary<object, object> items,
+        string path,
+        string? headerTenantId)
+    {
+        if (!string.IsNullOrEmpty(policyTenantId))
+            return policyTenantId;
+
+        if (items.TryGetValue(RequestRowMarkers.ValidatedTenantKey, out var validated)
+            && validated is string validatedTenantId && !string.IsNullOrEmpty(validatedTenantId))
+            return validatedTenantId;
+
+        if (TenantHeaderTrustedPaths.Contains(path)
+            && !string.IsNullOrEmpty(headerTenantId) && Guid.TryParse(headerTenantId, out _))
+            return headerTenantId;
+
+        return null;
+    }
+
     public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next)
     {
         var httpContext = context.GetHttpContext();
@@ -154,23 +186,17 @@ public class RequestTelemetryMiddleware : IFunctionsWorkerMiddleware
             if (context.Items.TryGetValue(DeviceIdentityBinding.RequestItemKey, out var identityBinding) && identityBinding is string identityOutcome)
                 requestTelemetry.Properties[DeviceIdentityBinding.RequestItemKey] = identityOutcome;
 
+            // DEVICE-VALIDATION — the admitting validator (or None / Transient / Rejected), set by
+            // SecurityValidator once the device-validation chain has run. Same carrier and reasoning.
+            if (context.Items.TryGetValue(RequestRowMarkers.DeviceValidationKey, out var deviceValidation) && deviceValidation is string deviceValidationOutcome)
+                requestTelemetry.Properties[RequestRowMarkers.DeviceValidationKey] = deviceValidationOutcome;
+
             var reqCtx = context.GetRequestContext();
-            var tenantId = reqCtx.TenantId;
-            if (string.IsNullOrEmpty(tenantId))
-            {
-                // Device ingest endpoints do not run through PolicyEnforcementMiddleware, so
-                // reqCtx.TenantId is empty — but they carry a cert/token-validated tenant in the
-                // X-Tenant-Id header. Only honor the header on the exact routes that actually
-                // validate it (TenantHeaderTrustedPaths) and only when it is a well-formed GUID, so
-                // other/anonymous routes cannot pollute the requests table with arbitrary tenant ids.
-                var path = httpContext.Request.Path.Value ?? string.Empty;
-                if (TenantHeaderTrustedPaths.Contains(path))
-                {
-                    var headerTenant = httpContext.Request.Headers["X-Tenant-Id"].FirstOrDefault();
-                    if (!string.IsNullOrEmpty(headerTenant) && Guid.TryParse(headerTenant, out _))
-                        tenantId = headerTenant;
-                }
-            }
+            var tenantId = ResolveTenantId(
+                reqCtx.TenantId,
+                context.Items,
+                httpContext.Request.Path.Value ?? string.Empty,
+                httpContext.Request.Headers["X-Tenant-Id"].FirstOrDefault());
             if (!string.IsNullOrEmpty(tenantId))
                 requestTelemetry.Properties["TenantId"] = tenantId;
             if (!string.IsNullOrEmpty(reqCtx.UserPrincipalName))

src/Backend/AutopilotMonitor.Functions/Pagination/RuleSubmissionsPagination.cs

@@ -0,0 +1,92 @@
+using System.Collections.Generic;
+using System.Collections.Specialized;
+using System.Globalization;
+using System.Text;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Shared.Pagination;
+
+namespace AutopilotMonitor.Functions.Pagination
+{
+    /// <summary>
+    /// Pure helpers for the <c>GET /api/global/rule-submissions</c> pagination surface — the
+    /// SessionReportsPagination contract with a second server-side filter (<c>status</c>). Both
+    /// filters are bound into the continuation fingerprint so a token issued for one view cannot
+    /// resume another.
+    /// </summary>
+    public static class RuleSubmissionsPagination
+    {
+        public const int DefaultPageSize = 200;
+
+        public static string Fingerprint(string callerTenantId, string? filterTenantId, string? filterStatus) =>
+            ContinuationToken.ComputeFingerprint(new[]
+            {
+                new KeyValuePair<string, string?>("scope", "rule-submissions"),
+                new KeyValuePair<string, string?>("tenantId", callerTenantId),
+                new KeyValuePair<string, string?>("filterTenantId", filterTenantId),
+                new KeyValuePair<string, string?>("filterStatus", filterStatus),
+            });
+
+        public sealed class Parsed
+        {
+            public string? FilterTenantId { get; init; }
+            public string? FilterStatus { get; init; }
+            public int? PageSize { get; init; }
+            public string? Continuation { get; init; }
+            public string? Error { get; init; }
+        }
+
+        public static Parsed ParseQuery(NameValueCollection? query)
+        {
+            var filterTenantIdRaw = query?["tenantId"];
+            var filterStatusRaw = query?["status"];
+            var pageSizeRaw = query?["pageSize"];
+            var continuationRaw = query?["continuation"];
+
+            if (!QueryParams.TryPageSize(pageSizeRaw, out var pageSize, out var pageSizeError))
+                return new Parsed { Error = pageSizeError };
+
+            if (!string.IsNullOrEmpty(filterStatusRaw)
+                && System.Array.IndexOf(Shared.Models.RuleSubmissionStatuses.Stored, filterStatusRaw) < 0)
+            {
+                return new Parsed { Error = $"status must be one of: {string.Join(", ", Shared.Models.RuleSubmissionStatuses.Stored)}" };
+            }
+
+            var continuation = pageSize.HasValue && !string.IsNullOrEmpty(continuationRaw)
+                ? continuationRaw
+                : null;
+
+            return new Parsed
+            {
+                FilterTenantId = string.IsNullOrEmpty(filterTenantIdRaw) ? null : filterTenantIdRaw,
+                FilterStatus = string.IsNullOrEmpty(filterStatusRaw) ? null : filterStatusRaw,
+                PageSize = pageSize,
+                Continuation = continuation,
+            };
+        }
+
+        public static bool TryAcceptContinuation(
+            string raw,
+            string callerTenantId,
+            string? filterTenantId,
+            string? filterStatus,
+            out string azureToken,
+            out string? rejectReason)
+        {
+            var fp = Fingerprint(callerTenantId, filterTenantId, filterStatus);
+            return ContinuationToken.TryDecode(raw, callerTenantId, fp, out azureToken, out rejectReason);
+        }
+
+        public static string BuildNextLink(int pageSize, string wireContinuation, string? filterTenantId, string? filterStatus)
+        {
+            var sb = new StringBuilder("/api/global/rule-submissions");
+            sb.Append('?');
+            sb.Append("pageSize=").Append(pageSize.ToString(CultureInfo.InvariantCulture));
+            sb.Append("&continuation=").Append(System.Uri.EscapeDataString(wireContinuation));
+            if (!string.IsNullOrEmpty(filterTenantId))
+                sb.Append("&tenantId=").Append(System.Uri.EscapeDataString(filterTenantId!));
+            if (!string.IsNullOrEmpty(filterStatus))
+                sb.Append("&status=").Append(System.Uri.EscapeDataString(filterStatus!));
+            return sb.ToString();
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Program.cs

@@ -318,6 +318,7 @@ builder.Services.AddSingleton<AutopilotMonitor.Functions.Services.Diagnostics.Di
 builder.Services.AddSingleton<AutopilotMonitor.Functions.Services.Diagnostics.DiagnosticsBlobCascadeDeleter>();
 builder.Services.AddSingleton<AutopilotMonitor.Functions.Services.Diagnostics.SessionReportDiagnosticsArchiveCopier>();
 builder.Services.AddSingleton<SessionReportService>();
+builder.Services.AddSingleton<RuleSubmissionService>();
 builder.Services.AddSingleton<BootstrapSessionService>();
 
 // Queue producers + handlers. Consumers are [QueueTrigger] functions under Functions/Queue/

src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs

@@ -354,6 +354,11 @@ public static class EndpointAccessPolicyCatalog
         // troubleshooting action, not a config change — a support-driven Operator may use it.
         // Viewer and the read-only Global Reader stay excluded (the tier admits no Viewer/Reader).
         new("POST",   "diagnostics/files",                  EndpointPolicy.TenantAdminOrOperator),
+        // Community rule submissions: the tenant admin submits references to own custom rules
+        // (frozen server-side), lists and withdraws them for the JWT tenant only.
+        new("POST",   "rules/submissions",                  EndpointPolicy.TenantAdminOrGA),
+        new("GET",    "rules/submissions",                  EndpointPolicy.TenantAdminOrGA),
+        new("DELETE", "rules/submissions/{submissionId}",   EndpointPolicy.TenantAdminOrGA),
         new("DELETE", "sessions/{sessionId}",      EndpointPolicy.TenantAdminOrGA, TenantScoping.QueryParam),
         new("GET",    "tenants/{tenantId}/admins",           EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam),
         new("POST",   "tenants/{tenantId}/admins",           EndpointPolicy.TenantAdminOrGA, TenantScoping.RouteParam),
@@ -507,12 +512,20 @@ public static class EndpointAccessPolicyCatalog
         new("GET",    "global/metrics/vulnerability", EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),
         new("GET",    "global/metrics/mcp-usage",       EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),
         new("GET",    "global/metrics/mcp-usage/daily", EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),
+        // One tenant's organization usage by account (?tenantId= read by the handler): deliberately None, not
+        // QueryParam — the route enumerates accounts (UPNs), which the delegated path must never reach.
+        new("GET",    "global/metrics/mcp-usage/organization", EndpointPolicy.GlobalReadOrAdmin),
         new("GET",    "global/distress-reports",    EndpointPolicy.GlobalReadOrAdmin),
         new("GET",    "global/session-reports",     EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),
         // Mints the HMAC ticket for the anonymous proxied stream above (the MCP's report download).
         new("POST",   "global/session-reports/download-ticket", EndpointPolicy.GlobalReadOrAdmin),
         new("GET",    "global/session-reports/download-url", EndpointPolicy.GlobalReadOrAdmin),
         new("PATCH",  "global/session-reports/{reportId}/note", EndpointPolicy.GlobalAdminOnly),
+        // Community rule submissions, operator side: cross-tenant read (Global Reader included), decision GA-only.
+        new("GET",    "global/rule-submissions",            EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),
+        new("GET",    "global/rule-submissions/{submissionId}", EndpointPolicy.GlobalReadOrAdmin),
+        new("PATCH",  "global/rule-submissions/{submissionId}", EndpointPolicy.GlobalAdminOnly),
+        new("DELETE", "global/rule-submissions/{submissionId}", EndpointPolicy.GlobalAdminOnly),
         // Flywheel evaluation stream: all annotation lanes across tenants (verdict/rule filters).
         new("GET",    "global/session-annotations", EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),
         new("GET",    "global/rules/gather",        EndpointPolicy.GlobalReadOrAdmin, TenantScoping.QueryParam),

src/Backend/AutopilotMonitor.Functions/Security/RequestRowMarkers.cs

@@ -0,0 +1,51 @@
+using Microsoft.Azure.Functions.Worker.Http;
+using AutopilotMonitor.Shared.Models;
+
+namespace AutopilotMonitor.Functions.Security
+{
+    /// <summary>
+    /// Request-row dimensions the agent security gate stamps via <c>FunctionContext.Items</c>;
+    /// <c>RequestTelemetryMiddleware</c> copies them onto the <c>requests</c> row it emits per call.
+    /// Same carrier as <see cref="CertTenantBinding.RequestItemKey"/>: worker-side
+    /// <c>LogInformation</c> never reaches App Insights, so the accepting path would otherwise be
+    /// invisible — only its failures would leave a trace.
+    /// </summary>
+    public static class RequestRowMarkers
+    {
+        /// <summary>
+        /// The tenant the request was proven to belong to (certificate tenant binding matched, or
+        /// the bootstrap token belongs to it). Agent routes that take the tenant from the body or
+        /// the query string carry no trusted header, so this is the only safe source for the
+        /// <c>TenantId</c> dimension on register / config / upload-url rows.
+        /// </summary>
+        public const string ValidatedTenantKey = "ValidatedTenantId";
+
+        /// <summary>
+        /// Outcome of the device-validation chain: the admitting <see cref="ValidatorType"/> name,
+        /// or one of <see cref="DeviceValidation"/>. Absent when an earlier stage (certificate,
+        /// certificate tenant, hardware, rate limit) ended the request — the chain never ran.
+        /// </summary>
+        public const string DeviceValidationKey = "DeviceValidation";
+
+        /// <summary>Closed set of non-validator values, so <c>summarize by</c> stays stable.</summary>
+        public static class DeviceValidation
+        {
+            /// <summary>Tenant runs without a device validator (<c>AllowInsecureAgentRequests</c>).</summary>
+            public const string None = "None";
+            /// <summary>Every enabled validator failed transiently — the agent got 503 Retry-After.</summary>
+            public const string Transient = "Transient";
+            /// <summary>Every enabled validator missed definitively — the agent got 403.</summary>
+            public const string Rejected = "Rejected";
+        }
+
+        public static string DeviceValidationValue(ValidatorType validatedBy)
+            => validatedBy == ValidatorType.Unknown ? DeviceValidation.None : validatedBy.ToString();
+
+        public static void Stamp(HttpRequestData req, string key, string value)
+        {
+            var items = req.FunctionContext?.Items;
+            if (items != null)
+                items[key] = value;
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions/Security/SecurityValidator.cs

@@ -272,6 +272,9 @@ namespace AutopilotMonitor.Functions.Security
                     };
                 }
 
+                RequestRowMarkers.Stamp(req, RequestRowMarkers.ValidatedTenantKey, tenantId);
+                RequestRowMarkers.Stamp(req, RequestRowMarkers.DeviceValidationKey,
+                    RequestRowMarkers.DeviceValidationValue(ValidatorType.Bootstrap));
                 return new SecurityValidationResult
                 {
                     IsValid = true,
@@ -350,6 +353,11 @@ namespace AutopilotMonitor.Functions.Security
                 };
             }
 
+            // From here on the tenant is proven (known, not suspended, certificate issued to it).
+            // Register / config / upload-url take the tenant from body or query, not from a
+            // validated header, so this stamp is what gives their request rows a TenantId.
+            RequestRowMarkers.Stamp(req, RequestRowMarkers.ValidatedTenantKey, tenantId);
+
             // 2. Check rate limit (DoS protection)
             // Effective limit = per-tenant override if set, otherwise the global default.
             var rateLimitValue = await ResolveDeviceRateLimitAsync(config);
@@ -510,6 +518,7 @@ namespace AutopilotMonitor.Functions.Security
                         "Device validation transient failure for tenant {TenantId}, serial {SerialNumber}. Returning 503 Retry-After.",
                         tenantId, serialNumber);
 
+                    RequestRowMarkers.Stamp(req, RequestRowMarkers.DeviceValidationKey, RequestRowMarkers.DeviceValidation.Transient);
                     return new SecurityValidationResult
                     {
                         IsValid = false,
@@ -523,6 +532,7 @@ namespace AutopilotMonitor.Functions.Security
                 LogRequestRejection("device", tenantId, req, sessionId,
                     extraReason: deviceValidationError,
                     thumbprint: certValidation.Thumbprint);
+                RequestRowMarkers.Stamp(req, RequestRowMarkers.DeviceValidationKey, RequestRowMarkers.DeviceValidation.Rejected);
                 return new SecurityValidationResult
                 {
                     IsValid = false,
@@ -595,7 +605,10 @@ namespace AutopilotMonitor.Functions.Security
                 });
             }
 
-            // All checks passed
+            // All checks passed. The admitting validator rides on the request row: the Sessions
+            // row keeps ValidatedBy per session, this is the per-request counter and timestamp.
+            RequestRowMarkers.Stamp(req, RequestRowMarkers.DeviceValidationKey,
+                RequestRowMarkers.DeviceValidationValue(validatedBy));
             TryGetIntuneDeviceIdFromCertSubject(certValidation.Subject, out var certIntuneDeviceId);
             return new SecurityValidationResult
             {

src/Backend/AutopilotMonitor.Functions/Services/AnalyzeRuleService.cs

@@ -322,6 +322,16 @@ namespace AutopilotMonitor.Functions.Services
                 rule.Notify = null;
             }
 
+            var existing = (await _ruleRepo.GetAnalyzeRulesAsync(tenantId))
+                .FirstOrDefault(r => r.RuleId == rule.RuleId && !r.IsBuiltIn && !r.IsCommunity);
+            if (existing != null)
+            {
+                rule.CreatedAt = existing.CreatedAt;
+                // Author is stamped from the creator's token at create time and is
+                // immutable afterwards — updates (incl. cross-tenant GA edits) keep it.
+                rule.Author = existing.Author;
+            }
+
             rule.UpdatedAt = DateTime.UtcNow;
             return await _ruleRepo.StoreAnalyzeRuleAsync(rule, tenantId);
         }
@@ -333,7 +343,8 @@ namespace AutopilotMonitor.Functions.Services
         public async Task<AnalyzeRule> CreateFromTemplateAsync(
             string tenantId,
             string templateRuleId,
-            Dictionary<string, string> variableValues)
+            Dictionary<string, string> variableValues,
+            string? author = null)
         {
             var allRules = await GetAllRulesForTenantAsync(tenantId);
             var template = allRules.FirstOrDefault(r => r.RuleId == templateRuleId);
@@ -370,6 +381,8 @@ namespace AutopilotMonitor.Functions.Services
             customRule.RuleId = $"{templateRuleId}-CUSTOM";
             customRule.IsBuiltIn = false;
             customRule.IsCommunity = false;
+            // The copy is the tenant's rule, not the template author's.
+            customRule.Author = string.IsNullOrWhiteSpace(author) ? "Autopilot Monitor" : author!;
             customRule.Enabled = true;
             customRule.DerivedFromTemplateRuleId = templateRuleId;
             customRule.TemplateVariables = new List<TemplateVariable>();

src/Backend/AutopilotMonitor.Functions/Services/EventIngestProcessor.Classification.cs

@@ -92,6 +92,9 @@ namespace AutopilotMonitor.Functions.Services
                         classification.HasCompletionEvidenceCandidate = true;
                         break;
                     case "agent_shutting_down":
+                        // Every shutdown ends this agent run's observation; the max-lifetime
+                        // flavour additionally carries the verdict mapping below.
+                        classification.AgentShutdownEvent = evt;
                         if (IsMaxLifetimeAgentShutdown(evt))
                             classification.AgentMaxLifetimeShutdownEvent = evt;
                         break;
@@ -705,6 +708,14 @@ namespace AutopilotMonitor.Functions.Services
         public EnrollmentEvent? EspFailureEvent { get; set; }
         public EnrollmentEvent? SessionStalledEvent { get; set; }
 
+        /// <summary>
+        /// Any <c>agent_shutting_down</c> in the batch — the agent's last word for this run.
+        /// After the status write, a terminal session closes its still-open app rows on this
+        /// batch: apps that started after the verdict (the agent keeps watching after
+        /// enrollment_complete) got their row only after the terminal seam had already run.
+        /// </summary>
+        public EnrollmentEvent? AgentShutdownEvent { get; set; }
+
         /// <summary>
         /// <c>agent_shutting_down</c> with <c>Data.reason == "max_lifetime"</c> — the V2
         /// watchdog shutdown that deliberately carries no enrollment verdict. Mapped to a

src/Backend/AutopilotMonitor.Functions/Services/EventIngestProcessor.cs

@@ -276,6 +276,21 @@ namespace AutopilotMonitor.Functions.Services
                         updatedSession?.AgentVersion, skewScan);
             }
 
+            // Observation end: the batch carrying agent_shutting_down is the agent's last word.
+            // On a terminal session an app row still InProgress now will never get a terminal
+            // event — close it as Incomplete. The terminal seam already did this on the verdict
+            // batch; this re-run catches rows opened after the verdict (the IME keeps installing
+            // and the agent keeps watching after enrollment_complete). Non-terminal sessions
+            // (reboot shutdown, WhiteGlove part 1) keep their rows open. Idempotent + fail-soft.
+            if (classification.AgentShutdownEvent != null
+                && updatedSession != null
+                && (updatedSession.Status == SessionStatus.Succeeded
+                    || updatedSession.Status == SessionStatus.Failed
+                    || updatedSession.Status == SessionStatus.Incomplete))
+            {
+                await _metricsRepo.CloseOpenAppInstallsForSessionAsync(request.TenantId, request.SessionId);
+            }
+
             // Auto-analyze fan-out: enqueue a queue message instead of running fire-and-forget
             // Task.Run inside the function. The previous in-function approach could be killed
             // mid-flight by Functions scale-in (HTTP 200 returned → worker unloaded → rules

src/Backend/AutopilotMonitor.Functions/Services/LatestVersionsService.cs

@@ -11,8 +11,14 @@ namespace AutopilotMonitor.Functions.Services
 {
     /// <summary>
     /// Exposes the latest published agent/bootstrap versions as read from the
-    /// public <c>version.json</c> blob. Caches the result in memory for 12h
-    /// (short TTL on transient failures). Admin endpoint can force-refresh.
+    /// public <c>version.json</c> blob. The TTL is deliberately short: this number is
+    /// what the portal announces right after a release ("Latest agent version" in the
+    /// What's new panel), so a long cache shows the previous release for hours — and
+    /// because the cache is per Function instance, different instances would announce
+    /// different versions at the same time. The origin is a 200-byte no-cache blob
+    /// behind the download alias, so refetching it every few minutes costs nothing.
+    /// On a fetch failure the last known good value is kept rather than blanking the
+    /// display. Admin endpoint can force-refresh.
     /// </summary>
     public interface ILatestVersionsService
     {
@@ -33,13 +39,19 @@ namespace AutopilotMonitor.Functions.Services
         // it could silently serve a stale version while the release pipeline is green.
         public const string VersionJsonUrl = Constants.AgentDownloadBaseUrl + "/" + Constants.AgentVersionFileName;
         private const string CacheKey = "latest-versions";
-        private static readonly TimeSpan CacheDuration = TimeSpan.FromHours(12);
-        private static readonly TimeSpan FailureCacheDuration = TimeSpan.FromMinutes(5);
+        private static readonly TimeSpan CacheDuration = TimeSpan.FromMinutes(5);
+        private static readonly TimeSpan FailureCacheDuration = TimeSpan.FromMinutes(1);
 
         private readonly IHttpClientFactory _httpClientFactory;
         private readonly IMemoryCache _cache;
         private readonly ILogger<LatestVersionsService> _logger;
 
+        /// <summary>
+        /// Survives cache expiry: served when the blob read fails so a transient hiccup
+        /// hides the version line for at most one request instead of a full failure TTL.
+        /// </summary>
+        private volatile LatestVersions? _lastGood;
+
         public LatestVersionsService(
             IHttpClientFactory httpClientFactory,
             IMemoryCache cache,
@@ -85,15 +97,22 @@ namespace AutopilotMonitor.Functions.Services
                     FromCache: false);
 
                 _cache.Set(CacheKey, result, CacheDuration);
+                _lastGood = result;
                 _logger.LogInformation("LatestVersions refreshed: agent={AgentVersion}, bootstrap={BootstrapVersion}", version, bootstrapVersion);
                 return result;
             }
             catch (Exception ex)
             {
-                _logger.LogWarning(ex, "Failed to fetch {Url}; caching null for {Minutes}m", VersionJsonUrl, FailureCacheDuration.TotalMinutes);
-                // Cache failure briefly to avoid hammering blob on repeated calls
-                _cache.Set(CacheKey, (LatestVersions?)null, FailureCacheDuration);
-                return null;
+                var lastGood = _lastGood;
+                _logger.LogWarning(
+                    ex,
+                    "Failed to fetch {Url}; serving {Fallback} for {Minutes}m",
+                    VersionJsonUrl,
+                    lastGood == null ? "nothing" : $"the value fetched at {lastGood.FetchedAtUtc:O}",
+                    FailureCacheDuration.TotalMinutes);
+                // Cache the outcome briefly to avoid hammering the blob on repeated calls.
+                _cache.Set(CacheKey, lastGood, FailureCacheDuration);
+                return lastGood == null ? null : lastGood with { FromCache = true };
             }
         }
     }

src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.Aggregation.cs

@@ -328,7 +328,12 @@ namespace AutopilotMonitor.Functions.Services
                         // Idempotent, positive-evidence-only; also heals sessions that went
                         // terminal before the resolution seam existed (hadNoRow backfill).
                         if (eventCountMoved || hadNoRow)
+                        {
                             await _metricsRepo.ResolveEspBlockingForSessionAsync(session.TenantId, session.SessionId);
+                            // Same late-batch reasoning: an app row opened after the agent's
+                            // shutdown batch was never closed — the sweep is its self-heal.
+                            await _metricsRepo.CloseOpenAppInstallsForSessionAsync(session.TenantId, session.SessionId);
+                        }
                     }
 
                     if (breakdown == null)
@@ -1045,6 +1050,20 @@ namespace AutopilotMonitor.Functions.Services
                 _logger.LogWarning(ex, "Failed to cleanup old tenant notifications");
             }
 
+            try
+            {
+                // Closed community rule submissions: withdrawn 30d, declined 90d (RuleSubmissionRetention);
+                // pending/approved/published rows are never swept.
+                var deleted = await _ruleSubmissionRepo.DeleteExpiredAsync(now);
+                if (deleted > 0)
+                    _logger.LogInformation("Rule submissions cleanup: deleted {Count} closed rows (withdrawn {WithdrawnDays}d / declined {DeclinedDays}d)",
+                        deleted, RuleSubmissionRetention.WithdrawnDays, RuleSubmissionRetention.DeclinedDays);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "Failed to cleanup closed rule submissions");
+            }
+
             try
             {
                 var deleted = await _hardwareRejectionTracker.DeleteOlderThanAsync(now.AddDays(-hardwareRejectionRetentionDays));

src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.cs

@@ -41,6 +41,7 @@ namespace AutopilotMonitor.Functions.Services
         private readonly INotificationRepository _notificationRepo;
         private readonly ITenantNotificationRepository _tenantNotificationRepo;
         private readonly IHardwareRejectionNotificationTracker _hardwareRejectionTracker;
+        private readonly IRuleSubmissionRepository _ruleSubmissionRepo;
         private readonly IDelegationInvitationRepository _delegationInvitationRepo;
         private readonly DataAccess.TableStorage.BackupJobsRepository _backupJobsRepo;
         private readonly OpsEventService _opsEventService;
@@ -75,6 +76,7 @@ namespace AutopilotMonitor.Functions.Services
             INotificationRepository notificationRepo,
             ITenantNotificationRepository tenantNotificationRepo,
             IHardwareRejectionNotificationTracker hardwareRejectionTracker,
+            IRuleSubmissionRepository ruleSubmissionRepo,
             IDelegationInvitationRepository delegationInvitationRepo,
             DataAccess.TableStorage.BackupJobsRepository backupJobsRepo,
             OpsEventService opsEventService,
@@ -103,6 +105,7 @@ namespace AutopilotMonitor.Functions.Services
             _opsEventRepo = opsEventRepo;
             _notificationRepo = notificationRepo;
             _tenantNotificationRepo = tenantNotificationRepo;
+            _ruleSubmissionRepo = ruleSubmissionRepo;
             _hardwareRejectionTracker = hardwareRejectionTracker;
             _delegationInvitationRepo = delegationInvitationRepo;
             _backupJobsRepo = backupJobsRepo;

src/Backend/AutopilotMonitor.Functions/Services/McpQuotaService.cs

@@ -204,6 +204,13 @@ namespace AutopilotMonitor.Functions.Services
             return Compose(userLimits, await ResolveTenantLimitsAsync(chargeTenantId, definitions));
         }
 
+        /// <summary>
+        /// One charged tenant's organization windows alone (plan name + tenant limits; no counters, no per-user
+        /// part) — for the organization usage report.
+        /// </summary>
+        public virtual async Task<TenantPlanLimits> ResolveTenantPlanAsync(string chargeTenantId)
+            => await ResolveTenantLimitsAsync(chargeTenantId, await LoadDefinitionsAsync());
+
         private async Task<(UserPlanLimits Limits, List<PlanTierDefinition> Definitions)> ResolveUserLimitsAsync(
             AdminIdentity? identity, string? homeTenantId)
         {
@@ -227,7 +234,7 @@ namespace AutopilotMonitor.Functions.Services
             var planName = overridePlan ?? await _entitlementService.GetMcpUsagePlanNameAsync(homeTenantId);
 
             // 3. Limits: admin-edited SectionUsagePlans definitions, else catalog fallbacks.
-            var definitions = await LoadDefinitionsAsync(planName);
+            var definitions = await LoadDefinitionsAsync();
 
             // User limits: the definition for the (possibly overridden) plan name, else the catalog fallback
             // for the edition plans, else Community (fail-closed for overrides naming a plan that exists nowhere).
@@ -257,7 +264,7 @@ namespace AutopilotMonitor.Functions.Services
                 tenantDefinition?.TenantMonthlyRequestLimit ?? entitlements.McpTenantMonthlyRequestLimit);
         }
 
-        private async Task<List<PlanTierDefinition>> LoadDefinitionsAsync(string planName)
+        private async Task<List<PlanTierDefinition>> LoadDefinitionsAsync()
         {
             try
             {
@@ -266,7 +273,7 @@ namespace AutopilotMonitor.Functions.Services
             }
             catch (Exception ex)
             {
-                _logger.LogWarning(ex, "[McpQuota] Plan definitions unavailable — using catalog fallback for plan {Plan}", planName);
+                _logger.LogWarning(ex, "[McpQuota] Plan definitions unavailable — using catalog fallback");
                 return new List<PlanTierDefinition>();
             }
         }
@@ -393,7 +400,9 @@ namespace AutopilotMonitor.Functions.Services
         }
 
         private sealed record UserPlanLimits(string PlanName, int DailyLimit, int MonthlyLimit);
-        private sealed record TenantPlanLimits(string TenantPlan, int TenantDailyLimit, int TenantMonthlyLimit);
+
+        /// <summary>The charged tenant's plan name and organization-wide windows (0 = unlimited).</summary>
+        public sealed record TenantPlanLimits(string TenantPlan, int TenantDailyLimit, int TenantMonthlyLimit);
     }
 
     /// <summary>

src/Backend/AutopilotMonitor.Functions/Services/Offboarding/TenantOffboardingHandler.cs

@@ -141,6 +141,7 @@ namespace AutopilotMonitor.Functions.Services.Offboarding
         {
             (Constants.TableNames.BootstrapSessions, "CodeLookup"),
             (Constants.TableNames.SessionReports, "reports"),
+            (Constants.TableNames.RuleSubmissions, "submissions"),
         };
 
         // Plan §6.3.2 — Variant C (TenantId property only).