fix(rules,engine,agent): ESP-004 gates on the esp_apps_timeout verdict; not_exists absence gate; Shell-Core failure inherits settle detail (D-234, D-235)

ANALYZE-ESP-004 fired on every ESP terminal failure of a Continue-anyway profile and rendered the configured FirstSync limit as elapsed time — the mayHaveContinuedAnyway flag only says the profile has the button. The rule now requires the agent's own verdict (app_install_failed with failureType=esp_apps_timeout), names that app via a same-event filter, reads failedSubcategory from esp_failure_settle_started and words the limit as a limit. Verified with test_analyze_rule: cb7036a6 fires, 683f1eff (0x80070652 after 19 min) stays silent. Rule engine: not_exists with a dataField on event_type/event_data conditions matches when no event of the type carries a non-empty value — including an absent type — instead of being dead behind the fieldValue null short-circuit. Schema and MCP authoring guide say so. Agent: a Shell-Core 62407 failure that lands inside the provisioning tracker's 30-s settle window (a third of all ESP terminal failures) now inherits the pending errorCode / failedSubcategory / category / likelyCulpritApps, so enrollment_failed, Sessions.FailureReason and the termination-time app classification see the HRESULT the registry had already named. failureType stays the Shell-Core value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix(web): omit the two default field values from the browser catalog (D-233)
2026-10-24 20:53:06 +00:00 · 2026-09-09 17:20:24 +02:00 · 2026-09-09 15:26:29 +02:00 · 2026-09-09 14:59:56 +02:00 · 2026-09-09 14:55:30 +02:00 · 2026-09-09 14:55:22 +02:00
30 changed files with 843 additions and 137 deletions
@@ -1,11 +1,11 @@
 {
  "$schema": "../schema/analyze-rule.schema.json",
  "ruleId": "ANALYZE-ESP-004",
-  "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-  "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+  "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+  "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
  "severity": "warning",
  "category": "esp",
-  "version": "1.0.1",
+  "version": "1.1.0",
  "enabled": true,
  "baseConfidence": 80,
  "conditions": [
@@ -26,6 +26,27 @@
      "value": "true",
      "required": true
    },
+    {
+      "signal": "esp_gave_up_on_app",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "failureType",
+      "operator": "equals",
+      "value": "esp_apps_timeout",
+      "required": true
+    },
+    {
+      "signal": "appName",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "appName",
+      "operator": "exists",
+      "value": "",
+      "filterField": "failureType",
+      "filterOperator": "equals",
+      "filterValue": "esp_apps_timeout",
+      "required": false
+    },
    {
      "signal": "espSyncFailureTimeoutMinutes",
      "source": "event_type",
@@ -38,34 +59,25 @@
    {
      "signal": "failedSubcategory",
      "source": "event_type",
-      "eventType": "enrollment_failed",
+      "eventType": "esp_failure_settle_started",
      "dataField": "failedSubcategory",
      "operator": "exists",
      "value": "",
      "required": false
-    },
-    {
-      "signal": "appName",
-      "source": "event_type",
-      "eventType": "app_install_failed",
-      "dataField": "appName",
-      "operator": "exists",
-      "value": "",
-      "required": false
    }
  ],
  "confidenceFactors": [
-    { "signal": "appName", "condition": "exists", "weight": 10 }
+    { "signal": "failedSubcategory", "condition": "exists", "weight": 10 }
  ],
-  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
  "remediation": [
    {
      "title": "Relieve ESP pressure so enrollments finish inside the window",
      "steps": [
-        "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-        "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-        "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-        "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+        "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+        "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+        "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+        "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
      ]
    }
  ],
@@ -2496,11 +2496,11 @@
    },
    {
      "ruleId": "ANALYZE-ESP-004",
-      "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-      "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+      "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+      "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
      "severity": "warning",
      "category": "esp",
-      "version": "1.0.1",
+      "version": "1.1.0",
      "enabled": true,
      "baseConfidence": 80,
      "conditions": [
@@ -2521,6 +2521,27 @@
          "value": "true",
          "required": true
        },
+        {
+          "signal": "esp_gave_up_on_app",
+          "source": "event_type",
+          "eventType": "app_install_failed",
+          "dataField": "failureType",
+          "operator": "equals",
+          "value": "esp_apps_timeout",
+          "required": true
+        },
+        {
+          "signal": "appName",
+          "source": "event_data",
+          "eventType": "app_install_failed",
+          "dataField": "appName",
+          "operator": "exists",
+          "value": "",
+          "filterField": "failureType",
+          "filterOperator": "equals",
+          "filterValue": "esp_apps_timeout",
+          "required": false
+        },
        {
          "signal": "espSyncFailureTimeoutMinutes",
          "source": "event_type",
@@ -2533,38 +2554,29 @@
        {
          "signal": "failedSubcategory",
          "source": "event_type",
-          "eventType": "enrollment_failed",
+          "eventType": "esp_failure_settle_started",
          "dataField": "failedSubcategory",
          "operator": "exists",
          "value": "",
          "required": false
-        },
-        {
-          "signal": "appName",
-          "source": "event_type",
-          "eventType": "app_install_failed",
-          "dataField": "appName",
-          "operator": "exists",
-          "value": "",
-          "required": false
        }
      ],
      "confidenceFactors": [
        {
-          "signal": "appName",
+          "signal": "failedSubcategory",
          "condition": "exists",
          "weight": 10
        }
      ],
-      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
      "remediation": [
        {
          "title": "Relieve ESP pressure so enrollments finish inside the window",
          "steps": [
-            "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-            "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-            "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-            "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+            "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+            "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+            "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+            "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
          ]
        }
      ],
@@ -190,7 +190,7 @@
        },
        "operator": {
          "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
          "enum": ["equals", "not_equals", "contains", "not_contains", "regex", "not_regex", "gt", "lt", "gte", "lte", "exists", "not_exists", "count_gte", "count_per_group_gte", "in", "not_in"]
        },
        "value": {
@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Signals;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// Session 683f1eff — a Shell-Core 62407 failure (<c>WhiteGlove_Failed</c>) arrived four
+    /// seconds into the provisioning tracker's 30-s settle window and terminalised the session
+    /// with nothing but its failure type: the HRESULT (0x80070652) and the failed subcategory
+    /// (Apps) the registry had already named never reached the terminal event, the backend
+    /// FailureReason or the termination-time app classification. The coordinator now inherits
+    /// the pending settle detail onto the Shell-Core args and records the terminal-failure
+    /// snapshot from it.
+    /// </summary>
+    public sealed class EspAndHelloTrackerShellCoreFailureInheritanceTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 6, DateTimeKind.Utc);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public FakeSignalIngressSink TrackerPostSink { get; } = new FakeSignalIngressSink();
+            public VirtualClock Clock { get; } = new VirtualClock(Fixed);
+            public List<EspFailureDetectedEventArgs> Forwarded { get; } = new List<EspFailureDetectedEventArgs>();
+
+            public Fixture() { Logger = new AgentLogger(Tmp.Path, AgentLogLevel.Debug); }
+
+            public EspAndHelloTracker BuildCoordinator(Func<EspFailureDetectedEventArgs?> pendingProbe)
+            {
+                var coordinator = new EspAndHelloTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: new InformationalEventPost(TrackerPostSink, Clock),
+                    logger: Logger,
+                    skipConfigProbe: () => ((bool?)false, (bool?)false),
+                    accountSetupActivityProbe: () => false,
+                    pendingEspFailureProbe: pendingProbe);
+                coordinator.EspFailureDetected += (_, args) => Forwarded.Add(args);
+                return coordinator;
+            }
+
+            public FakeSignalIngressSink.PostedSignal TerminalSignal() =>
+                Assert.Single(Ingress.Posted, p => p.Kind == DecisionSignalKind.EspTerminalFailure);
+
+            public void Dispose() { Tmp.Dispose(); }
+        }
+
+        private static EspFailureDetectedEventArgs PendingAppsFailure() => new EspFailureDetectedEventArgs(
+            failureType: "Provisioning_DeviceSetup_Apps_Failed",
+            errorCode: "0x80070652",
+            failedSubcategory: "Apps",
+            category: "DeviceSetup",
+            likelyCulpritApps: new[] { "ESP Finalizer US" });
+
+        [Fact]
+        public void ShellCore_failure_inside_the_settle_window_inherits_the_registry_detail()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(PendingAppsFailure);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);   // the signal that terminalised
+            Assert.Equal("0x80070652", args.ErrorCode);
+            Assert.Equal("Apps", args.FailedSubcategory);
+            Assert.Equal("DeviceSetup", args.Category);
+            Assert.Equal(new[] { "ESP Finalizer US" }, args.LikelyCulpritApps);
+
+            // Wire-through: the EspTerminalFailure signal payload carries the detail the
+            // DecisionEngine copies onto enrollment_failed.
+            var signal = f.TerminalSignal();
+            Assert.Equal("WhiteGlove_Failed", signal.Payload!["failureType"]);
+            Assert.Equal("0x80070652", signal.Payload["errorCode"]);
+            Assert.Equal("Apps", signal.Payload["failedSubcategory"]);
+            Assert.Equal("DeviceSetup", signal.Payload["category"]);
+            Assert.Equal("ESP Finalizer US", signal.Payload["likelyCulpritApps"]);
+
+            // Termination-time classification reads the same context.
+            Assert.NotNull(coordinator.LastEspTerminalFailure);
+            Assert.Equal("0x80070652", coordinator.LastEspTerminalFailure.ErrorCode);
+            Assert.True(coordinator.LastEspTerminalFailure.IsAppsSubcategory);
+        }
+
+        [Fact]
+        public void ShellCore_failure_without_a_pending_window_stays_bare()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => null);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("ESPProgress_Timeout");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("ESPProgress_Timeout", args.FailureType);
+            Assert.Null(args.ErrorCode);
+            Assert.Null(args.FailedSubcategory);
+            Assert.Null(args.Category);
+            Assert.Empty(args.LikelyCulpritApps);
+            Assert.Null(coordinator.LastEspTerminalFailure);
+
+            var signal = f.TerminalSignal();
+            Assert.False(signal.Payload!.ContainsKey("errorCode"));
+            Assert.False(signal.Payload.ContainsKey("failedSubcategory"));
+        }
+
+        [Fact]
+        public void A_throwing_probe_degrades_to_the_bare_failure()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => throw new InvalidOperationException("probe"));
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);
+            Assert.Null(args.ErrorCode);
+        }
+    }
+}
@@ -0,0 +1,92 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// <see cref="ProvisioningStatusTracker.TryGetPendingFailureArgs"/> exposes the registry
+    /// failure detail while its settle window is open and nothing once the window has fired —
+    /// the coordinator reads it when a Shell-Core failure terminalises first (session 683f1eff).
+    /// </summary>
+    public sealed class ProvisioningStatusTrackerPendingFailureTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 2, DateTimeKind.Utc);
+
+        private const string InProgressJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""inProgress"",""subcategoryStatusText"":""Apps (Working)""}
+        }";
+        private const string AppsFailedJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""failed"",""subcategoryStatusText"":""Apps (0x80070652)""}
+        }";
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public ProvisioningStatusTracker Tracker { get; }
+
+            public Fixture()
+            {
+                var post = new InformationalEventPost(new FakeSignalIngressSink(), new VirtualClock(Fixed));
+                var logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Tracker = new ProvisioningStatusTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: post,
+                    logger: logger,
+                    appxScanner: new FakeAppxDeploymentFailureScanner(),
+                    backgroundDispatcher: action => action());
+            }
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Nothing_pending_before_any_failure()
+        {
+            using var f = new Fixture();
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+
+        [Fact]
+        public void Armed_settle_window_exposes_the_registry_detail()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            var pending = f.Tracker.TryGetPendingFailureArgs();
+
+            Assert.NotNull(pending);
+            Assert.Equal("Provisioning_DeviceSetup_Apps_Failed", pending!.FailureType);
+            Assert.Equal("0x80070652", pending.ErrorCode);
+            Assert.Equal("Apps", pending.FailedSubcategory);
+            Assert.Equal("DeviceSetup", pending.Category);
+        }
+
+        [Fact]
+        public void Expired_settle_window_leaves_nothing_pending()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            f.Tracker.TriggerSettleTimerForTest("DeviceSetupCategory.Status");
+
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+    }
+}
@@ -44,6 +44,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        private readonly Func<bool> _userEspAppsSettledProbe;
        private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _starvedUserEspAppsProbe;
        private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _packageStatesProbe;
+        // Session 683f1eff: registry failure detail still sitting in an open settle window,
+        // consulted when a Shell-Core failure terminalises first (see OnShellCoreEspFailureDetected).
+        private readonly Func<EspFailureDetectedEventArgs> _pendingEspFailureProbe;

        // Session caa6cf50 gate-starvation fix (2026-06-11) — fire-once guard for the
        // user-ESP-apps-settled AccountSetup synthesis (see MaybeSynthesizeAccountSetupComplete).
@@ -174,8 +177,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        /// late "Installing-→-Error" promotion can classify the failure correctly
        /// AND refuse to promote when the failure originated outside the Apps
        /// subcategory (a non-Apps HRESULT does not describe per-app outcome).
-        /// Null when no HRESULT-carrying ESP failure has fired (or all observed
-        /// failures came from ShellCoreTracker, which has no HRESULT surface).
+        /// Null when no registry-derived failure detail has been observed — neither from
+        /// a settle window that expired nor from one a Shell-Core failure inherited.
        /// </summary>
        public Termination.EspTerminalFailureSnapshot LastEspTerminalFailure { get; private set; }

@@ -243,7 +246,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            Func<bool> accountSetupActivityProbe = null,
            Func<bool> userEspAppsSettledProbe = null,
            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> starvedUserEspAppsProbe = null,
-            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null)
+            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null,
+            Func<EspFailureDetectedEventArgs> pendingEspFailureProbe = null)
        {
            _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
            _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
@@ -277,6 +281,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            // provisioning tracker name not-completed apps on an Apps-subcategory failure.
            _packageStatesProbe = packageStatesProbe
                ?? (() => Array.Empty<Ime.AppPackageState>());
+            // Test seam: defaults to the provisioning tracker's open settle window (null when
+            // none is armed or the tracker is not running, e.g. Device Preparation).
+            _pendingEspFailureProbe = pendingEspFailureProbe
+                ?? (() => _provisioningTracker?.TryGetPendingFailureArgs());
        }

        /// <summary>
@@ -658,6 +666,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        internal void TriggerEspExitedForTest(DateTime occurredAtUtc) =>
            OnEspExited(this, new EspExitedEventArgs(occurredAtUtc));

+        // Test seam for a Shell-Core 62407 failure — drives the coordinator forwarder including
+        // the pending-settle inheritance, without a real ShellCoreTracker.
+        internal void TriggerShellCoreEspFailureForTest(string failureType) =>
+            OnShellCoreEspFailureDetected(this, failureType);
+
        // Test seam for HelloWizardStarted — same contract as TriggerEspExitedForTest.
        internal void TriggerHelloWizardStartedForTest(DateTime occurredAtUtc) =>
            OnHelloWizardStarted(this, new HelloWizardStartedEventArgs(occurredAtUtc));
@@ -673,33 +686,56 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        // Forwarder for ShellCoreTracker (event-log-derived ESP failures, e.g. Shell-Core 62407
        // failure descriptions). Source-event timestamp is mirrored so the adapter can stamp the
        // DecisionSignal with the historical instant on backfill. ShellCoreTracker has no HRESULT
-        // surface, so only FailureType is set on the args.
+        // surface; the registry detail is inherited from an open settle window (see below).
        private void OnShellCoreEspFailureDetected(object sender, string failureType)
        {
            LastEventOccurredAtUtc = (sender as ShellCoreTracker)?.LastEventOccurredAtUtc;
            try
            {
-                EspFailureDetected?.Invoke(this, new EspFailureDetectedEventArgs(failureType));
+                EspFailureDetected?.Invoke(this, BuildShellCoreFailureArgs(failureType));
            }
            catch (Exception ex) { _logger.Error($"Error forwarding ShellCore EspFailureDetected for '{failureType}'", ex); }
            finally { LastEventOccurredAtUtc = null; }
        }

-        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
-        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
-        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
-        // surfaced today, so the adapter falls back to clock.
-        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        // Session 683f1eff: the Shell-Core 62407 failure usually lands INSIDE the provisioning
+        // tracker's 30-s settle window — after the registry named the failed subcategory and its
+        // HRESULT, before the settle timer would have forwarded them. The engine terminalises on
+        // the first EspTerminalFailure and the agent stops seconds later, so whatever this signal
+        // carries is all the terminal event, the backend FailureReason and the termination-time
+        // app classification ever see (a third of all ESP terminal failures took this path). The
+        // pending detail is inherited here; FailureType stays the Shell-Core value because that
+        // is the signal that actually terminalised.
+        private EspFailureDetectedEventArgs BuildShellCoreFailureArgs(string failureType)
+        {
+            EspFailureDetectedEventArgs pending = null;
+            try { pending = _pendingEspFailureProbe(); }
+            catch (Exception ex) { _logger.Warning($"EspAndHelloTracker: pending ESP failure probe threw: {ex.Message}"); }
+
+            if (pending == null)
+                return new EspFailureDetectedEventArgs(failureType);
+
+            RecordTerminalFailureSnapshot(pending);
+            _logger.Info(
+                $"EspAndHelloTracker: Shell-Core failure '{failureType}' inherits the pending provisioning failure detail " +
+                $"(category={pending.Category ?? "n/a"}, failedSubcategory={pending.FailedSubcategory ?? "n/a"}, " +
+                $"errorCode={pending.ErrorCode ?? "n/a"})");
+            return new EspFailureDetectedEventArgs(
+                failureType,
+                errorCode: pending.ErrorCode,
+                failedSubcategory: pending.FailedSubcategory,
+                category: pending.Category,
+                likelyCulpritApps: pending.LikelyCulpritApps);
+        }
+
+        // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full failure context
+        // (HRESULT + failedSubcategory + category) so EnrollmentTerminationHandler can read it on
+        // the terminal-failure pathway. Only update when the args carry at least one of the three
+        // fields, so a bare Shell-Core failure cannot wipe out the registry snapshot. Deliberately
+        // NOT gated on ErrorCode alone — a non-Apps subcategory failure without HRESULT is still
+        // useful for downstream "should we promote?" gating.
+        private void RecordTerminalFailureSnapshot(EspFailureDetectedEventArgs args)
        {
-            LastEventOccurredAtUtc = null;
-            // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full
-            // failure context (HRESULT + failedSubcategory + category) before
-            // forwarding so EnrollmentTerminationHandler can read it on the terminal-
-            // failure pathway. Only update when the args carry at least one of the
-            // three fields, so a later ShellCore-derived failure (which has none of
-            // them) cannot wipe out the registry snapshot. We deliberately do NOT
-            // gate on ErrorCode alone — a non-Apps subcategory failure without
-            // HRESULT is still useful for downstream "should we promote?" gating.
            if (!string.IsNullOrEmpty(args?.ErrorCode)
                || !string.IsNullOrEmpty(args?.FailedSubcategory)
                || !string.IsNullOrEmpty(args?.Category))
@@ -709,6 +745,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                    failedSubcategory: args.FailedSubcategory,
                    category: args.Category);
            }
+        }
+
+        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
+        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
+        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
+        // surfaced today, so the adapter falls back to clock.
+        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        {
+            LastEventOccurredAtUtc = null;
+            RecordTerminalFailureSnapshot(args);
            try
            {
                EspFailureDetected?.Invoke(this, args);
@@ -80,6 +80,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            "AccountSetupCategory.Status"
        };

+        // Order in which TryGetPendingFailureArgs resolves concurrently armed settle windows.
+        private static readonly string[] PendingFailurePreference =
+        {
+            "DeviceSetupCategory.Status",
+            "AccountSetupCategory.Status",
+            "DevicePreparationCategory.Status"
+        };
+
        private readonly AgentLogger _logger;
        private readonly string _sessionId;
        private readonly string _tenantId;
@@ -1711,6 +1719,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        internal void TriggerSettleTimerForTest(string categoryName)
            => OnProvisioningFailureSettleExpired(categoryName);

+        /// <summary>
+        /// The registry-derived failure detail of a settle window that is still open (armed,
+        /// not yet expired or retracted) — null when none is pending. Read by the coordinator
+        /// when a Shell-Core 62407 failure arrives inside the window, so the terminal signal
+        /// inherits HRESULT / failed subcategory / category instead of racing them away
+        /// (session 683f1eff). Windows fail one category at a time, but should two be armed
+        /// the device-phase category wins: it is the one the ESP page reports.
+        /// </summary>
+        internal EspFailureDetectedEventArgs TryGetPendingFailureArgs()
+        {
+            lock (_stateLock)
+            {
+                if (_provisioningFailureSettleArgs == null || _provisioningFailureSettleArgs.Count == 0)
+                    return null;
+                foreach (var category in PendingFailurePreference)
+                {
+                    if (_provisioningFailureSettleArgs.TryGetValue(category, out var args) && args != null)
+                        return args;
+                }
+                return null;
+            }
+        }
+
        private bool HasCategorySucceededChanged(string categoryName, bool? newValue)
        {
            if (!_lastCategorySucceeded.TryGetValue(categoryName, out var oldValue))
@@ -10,7 +10,7 @@ using Microsoft.Extensions.Logging.Abstractions;
 namespace AutopilotMonitor.Functions.Tests;

 /// <summary>
-/// Tests for <see cref="LatestVersionsService"/> — the 12h-cached reader for the
+/// Tests for <see cref="LatestVersionsService"/> — the short-TTL reader for the
 /// public <c>version.json</c> blob. Verifies cache hit/miss, forceRefresh bypass,
 /// and failure fallback without hammering the blob on every call.
 /// </summary>
@@ -140,6 +140,28 @@ public class LatestVersionsServiceTests
        Assert.Equal(1, handler.CallCount);
    }

+    [Fact]
+    public async Task GetAsync_HttpFailure_AfterSuccess_ServesLastKnownGood()
+    {
+        var (svc, handler, _) = Create();
+
+        await svc.GetAsync(forceRefresh: false, CancellationToken.None);
+        handler.Responder = _ => new HttpResponseMessage(HttpStatusCode.InternalServerError);
+
+        // The refresh fails, but the version line must not blank out: the last good
+        // value stands until the blob answers again.
+        var afterFailure = await svc.GetAsync(forceRefresh: true, CancellationToken.None);
+
+        Assert.NotNull(afterFailure);
+        Assert.Equal("1.0.706", afterFailure!.AgentVersion);
+        Assert.True(afterFailure.FromCache);
+
+        // ...and it is what the short failure cache serves to the next callers, too.
+        var next = await svc.GetAsync(forceRefresh: false, CancellationToken.None);
+        Assert.Equal("1.0.706", next!.AgentVersion);
+        Assert.Equal(2, handler.CallCount);
+    }
+
    [Fact]
    public async Task GetAsync_MalformedJson_ReturnsNull()
    {
@@ -7,19 +7,21 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;

 /// <summary>
-/// Pins ANALYZE-ESP-004 ("ESP Timeout with 'Continue Anyway' — Soft Failure").
+/// Pins ANALYZE-ESP-004 ("ESP Gave Up on a Blocking App with 'Continue Anyway' — Soft Failure").
 ///
 /// Background (tenant c9787ba2, session cb7036a6): a slow blocking app (Encompass
 /// Hybrid Installer) does not finish inside the 30-min Device-ESP window, so the ESP
 /// fails terminally in DeviceSetup. The profile allows "Continue anyway", so the user
 /// most likely dismissed the failure screen and reached the desktop — but the agent
-/// only ever sees the terminal failure and the session is recorded as Failed. The
-/// DecisionEngine already stamps the enrollment_failed event with
-/// <c>mayHaveContinuedAnyway=true</c>; this rule turns that into a customer-visible
-/// "soft failure" advisory with the root-cause remediation.
+/// only ever sees the terminal failure and the session is recorded as Failed.
 ///
-/// The rule keys ONLY on <c>mayHaveContinuedAnyway==true</c> (set exclusively on the
-/// ESP terminal-failure path), so an ordinary hard failure must not trip it.
+/// The rule needs THREE facts: the terminal enrollment_failed, the DecisionEngine's
+/// <c>mayHaveContinuedAnyway=true</c> stamp (profile allows the button), and the agent's own
+/// timeout verdict — an app_install_failed promoted with <c>failureType=esp_apps_timeout</c>
+/// (ESP gave up while the app was still installing, no per-app HRESULT). Session 683f1eff:
+/// an ESP failure with a real HRESULT (0x80070652, installer collision) on a Continue-anyway
+/// profile fired the rule and rendered the configured 90-min limit as if it had elapsed —
+/// the continue-anyway flag alone proves nothing about timing.
 /// </summary>
 public class RuleEngineEspSoftFailureTests
 {
@@ -37,8 +39,9 @@ public class RuleEngineEspSoftFailureTests

        var events = new List<EnrollmentEvent>
        {
+            SettleStartedEvent(errorCode: null),
            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
        };

        var outcome = await RunAsync(rule, events);
@@ -47,13 +50,15 @@ public class RuleEngineEspSoftFailureTests
        Assert.Equal("ANALYZE-ESP-004", result.RuleId);
        Assert.Equal("warning", result.Severity);

-        // Required gate matched on the continue-anyway flag.
+        // Required gates: the continue-anyway flag AND the agent's timeout verdict.
        var gate = AsDict(result.MatchedConditions["may_have_continued"]);
        Assert.Equal("true", AsString(gate["value"]));
+        var verdict = AsDict(result.MatchedConditions["esp_gave_up_on_app"]);
+        Assert.Equal("esp_apps_timeout", AsString(verdict["value"]));

-        // Interpolation material for the explanation / remediation templates is present:
-        // {{espSyncFailureTimeoutMinutes}}, {{failedSubcategory}} (from enrollment_failed)
-        // and {{appName}} (from app_install_failed).
+        // Interpolation material: {{espSyncFailureTimeoutMinutes}} (enrollment_failed),
+        // {{failedSubcategory}} (esp_failure_settle_started — the terminal event drops it when
+        // the Shell-Core failure wins the race) and {{appName}} (the promoted app).
        var timeout = AsDict(result.MatchedConditions["espSyncFailureTimeoutMinutes"]);
        Assert.Equal("30", AsString(timeout["value"]));

@@ -65,6 +70,48 @@ public class RuleEngineEspSoftFailureTests
        Assert.Equal(FailedAppName, AsString(failedApp["value"]));
    }

+    [Fact]
+    public async Task ANALYZE_ESP_004_stays_silent_on_a_hard_failure_with_continue_anyway()
+    {
+        // Session 683f1eff: continue-anyway profile, but the ESP failed on a real installer
+        // error (0x80070652 / MSI 1618) after 19 minutes. The failed app carries no
+        // esp_apps_timeout verdict — the rule must not turn an installer collision into
+        // "the ESP reached its 90-min timeout".
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-ESP-004");
+
+        var events = new List<EnrollmentEvent>
+        {
+            SettleStartedEvent(errorCode: "0x80070652"),
+            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
+            AppInstallFailed(failureType: null, exitCodeClass: "Retry"),
+        };
+
+        var outcome = await RunAsync(rule, events);
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task ANALYZE_ESP_004_names_the_timed_out_app_not_another_failed_one()
+    {
+        // Two failed apps: one hard installer failure earlier in the run, one promoted
+        // esp_apps_timeout at the terminal. {{appName}} must be the timed-out app.
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-ESP-004");
+
+        var events = new List<EnrollmentEvent>
+        {
+            AppInstallFailed(failureType: null, exitCodeClass: "Failed", appName: "Contoso Agent", sequence: 100),
+            SettleStartedEvent(errorCode: null),
+            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
+        };
+
+        var outcome = await RunAsync(rule, events);
+
+        var result = Assert.Single(outcome.Results);
+        var failedApp = AsDict(result.MatchedConditions["appName"]);
+        Assert.Equal(FailedAppName, AsString(failedApp["value"]));
+    }
+
    [Fact]
    public async Task ANALYZE_ESP_004_does_not_fire_when_continue_anyway_is_false()
    {
@@ -75,7 +122,7 @@ public class RuleEngineEspSoftFailureTests
        var events = new List<EnrollmentEvent>
        {
            EnrollmentFailedEvent(mayHaveContinuedAnyway: "false"),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
        };

        var outcome = await RunAsync(rule, events);
@@ -92,7 +139,7 @@ public class RuleEngineEspSoftFailureTests
        var events = new List<EnrollmentEvent>
        {
            EnrollmentFailedEvent(mayHaveContinuedAnyway: null),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
        };

        var outcome = await RunAsync(rule, events);
@@ -132,23 +179,61 @@ public class RuleEngineEspSoftFailureTests
        return data;
    }

-    private static EnrollmentEvent AppInstallFailed() => new()
+    private static EnrollmentEvent SettleStartedEvent(string? errorCode)
    {
-        EventId = Guid.NewGuid().ToString(),
-        TenantId = TenantId,
-        SessionId = SessionId,
-        EventType = "app_install_failed",
-        Timestamp = DateTime.UtcNow,
-        Sequence = 220,
-        Data = new Dictionary<string, object>
+        var data = new Dictionary<string, object>
        {
-            ["appName"] = FailedAppName,
+            ["category"] = "DeviceSetup",
+            ["failedSubcategory"] = "Certificates",
+            ["failureType"] = "Provisioning_DeviceSetup_Certificates_Failed",
+            ["settleSeconds"] = 30,
+            ["reason"] = "wait_for_late_ime_signals",
+        };
+        if (errorCode != null)
+            data["errorCode"] = errorCode;
+        return new EnrollmentEvent
+        {
+            EventId = Guid.NewGuid().ToString(),
+            TenantId = TenantId,
+            SessionId = SessionId,
+            EventType = "esp_failure_settle_started",
+            Timestamp = DateTime.UtcNow,
+            Sequence = 212,
+            Data = data,
+        };
+    }
+
+    private static EnrollmentEvent AppInstallFailed(
+        string? failureType,
+        string? exitCodeClass = null,
+        string appName = FailedAppName,
+        int sequence = 220)
+    {
+        var data = new Dictionary<string, object>
+        {
+            ["appName"] = appName,
            ["state"] = "Error",
            ["targeted"] = "Device",
-            ["failureType"] = "esp_apps_timeout",
-            ["errorDetail"] = "Install status unconfirmed — ESP gave up while this app was still installing.",
+        };
+        if (failureType != null)
+        {
+            data["failureType"] = failureType;
+            data["confidence"] = "presumed";
+            data["errorDetail"] = "Install status unconfirmed — ESP gave up while this app was still installing.";
        }
-    };
+        if (exitCodeClass != null)
+            data["exitCodeClass"] = exitCodeClass;
+        return new EnrollmentEvent
+        {
+            EventId = Guid.NewGuid().ToString(),
+            TenantId = TenantId,
+            SessionId = SessionId,
+            EventType = "app_install_failed",
+            Timestamp = DateTime.UtcNow,
+            Sequence = sequence,
+            Data = data,
+        };
+    }

    private static Dictionary<string, object> AsDict(object o)
    {
@@ -7,12 +7,17 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;

 /// <summary>
-/// Pins the absence gate on <c>event_type</c> conditions: <c>not_exists</c> without a
-/// <c>dataField</c> matches when no event of that type occurs in the session and is disproved by
-/// a single such event. Before this branch an absent type always evaluated false, so a required
-/// "must not have happened" condition could never be expressed (ANALYZE-ID-004 v2 relies on it).
-/// The dataField variant keeps its historical meaning (some event of the type has an empty field)
-/// and is not touched here.
+/// Pins the absence gates on conditions.
+///
+/// Without a <c>dataField</c>, <c>not_exists</c> matches when no event of that type occurs in
+/// the session and is disproved by a single such event (ANALYZE-ID-004 v2 relies on it).
+///
+/// With a <c>dataField</c>, <c>not_exists</c> matches when no event of the type carries a
+/// non-empty value at that field — including when the type is absent — and is disproved by a
+/// single non-empty value; on <c>event_data</c> the same-event filter narrows the inspected set
+/// first. Before this the per-event loop's null short-circuit rejected a missing field before
+/// the operator ever ran, so "the ESP failure carried no HRESULT" (session 683f1eff) could not be
+/// expressed at all, while the precondition gate already had the absence semantics.
 /// </summary>
 public class RuleEngineEventTypeNotExistsTests
 {
@@ -24,7 +29,7 @@ public class RuleEngineEventTypeNotExistsTests
    {
        var events = new List<EnrollmentEvent> { Event("marker_seen", 1) };

-        var outcome = await RunAsync(Rule(), events);
+        var outcome = await RunAsync(TypeAbsenceRule(), events);

        var result = Assert.Single(outcome.Results);
        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["disproof_absent"]);
@@ -37,12 +42,111 @@ public class RuleEngineEventTypeNotExistsTests
    {
        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2) };

-        var outcome = await RunAsync(Rule(), events);
+        var outcome = await RunAsync(TypeAbsenceRule(), events);

        Assert.Empty(outcome.Results);
    }

-    private static AnalyzeRule Rule() => new()
+    [Fact]
+    public async Task Field_not_exists_matches_when_no_event_carries_the_field()
+    {
+        // The event type is present, the field is not — the shape of an ESP failure without an
+        // HRESULT (esp_failure_settle_started without errorCode).
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        var result = Assert.Single(outcome.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal("disproof", evidence["eventType"]);
+        Assert.Equal("errorCode", evidence["field"]);
+        Assert.Equal(1, evidence["count"]);
+    }
+
+    [Fact]
+    public async Task Field_not_exists_matches_when_the_event_type_is_absent()
+    {
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        var result = Assert.Single(outcome.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal(0, evidence["count"]);
+    }
+
+    [Theory]
+    [InlineData("event_type")]
+    [InlineData("event_data")]
+    public async Task A_non_empty_value_on_any_event_vetoes_a_required_field_not_exists(string source)
+    {
+        var events = new List<EnrollmentEvent>
+        {
+            Event("marker_seen", 1),
+            Event("disproof", 2),
+            Event("disproof", 3, ("errorCode", "0x80070652")),
+        };
+
+        var outcome = await RunAsync(FieldAbsenceRule(source), events);
+
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task An_empty_string_does_not_count_as_a_carried_value()
+    {
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2, ("errorCode", "")) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        Assert.Single(outcome.Results);
+    }
+
+    [Fact]
+    public async Task Event_data_field_not_exists_inspects_only_the_filtered_events()
+    {
+        // The carrier of the field is filtered out (kind=a); among kind=b events nobody carries it.
+        var events = new List<EnrollmentEvent>
+        {
+            Event("marker_seen", 1),
+            Event("disproof", 2, ("kind", "a"), ("errorCode", "0x80070652")),
+            Event("disproof", 3, ("kind", "b")),
+        };
+
+        var matched = await RunAsync(FieldAbsenceRule("event_data", filterKind: "b"), events);
+        var result = Assert.Single(matched.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal(1, evidence["count"]);
+
+        var vetoed = await RunAsync(FieldAbsenceRule("event_data", filterKind: "a"), events);
+        Assert.Empty(vetoed.Results);
+    }
+
+    private static AnalyzeRule TypeAbsenceRule() => Rule(
+        new RuleCondition { Signal = "disproof_absent", Source = "event_type", EventType = "disproof", Operator = "not_exists", Value = "", Required = true });
+
+    private static AnalyzeRule FieldAbsenceRule(string source, string? filterKind = null)
+    {
+        var absence = new RuleCondition
+        {
+            Signal = "code_absent",
+            Source = source,
+            EventType = "disproof",
+            DataField = "errorCode",
+            Operator = "not_exists",
+            Value = "",
+            Required = true,
+        };
+        if (filterKind != null)
+        {
+            absence.FilterField = "kind";
+            absence.FilterOperator = "equals";
+            absence.FilterValue = filterKind;
+        }
+        return Rule(absence);
+    }
+
+    private static AnalyzeRule Rule(RuleCondition absence) => new()
    {
        // Custom-namespace rule: a built-in ID outside the live catalog is hidden by the
        // sunset filter in AnalyzeRuleService (IsBuiltIn defaults to true).
@@ -58,11 +162,11 @@ public class RuleEngineEventTypeNotExistsTests
        Conditions = new List<RuleCondition>
        {
            new() { Signal = "marker", Source = "event_type", EventType = "marker_seen", Operator = "exists", Value = "", Required = true },
-            new() { Signal = "disproof_absent", Source = "event_type", EventType = "disproof", Operator = "not_exists", Value = "", Required = true },
+            absence,
        },
    };

-    private static EnrollmentEvent Event(string eventType, int sequence) => new()
+    private static EnrollmentEvent Event(string eventType, int sequence, params (string key, string value)[] data) => new()
    {
        EventId = Guid.NewGuid().ToString(),
        TenantId = TenantId,
@@ -70,7 +174,7 @@ public class RuleEngineEventTypeNotExistsTests
        EventType = eventType,
        Timestamp = DateTime.UtcNow.AddMinutes(sequence),
        Sequence = sequence,
-        Data = new Dictionary<string, object>(),
+        Data = data.ToDictionary(d => d.key, d => (object)d.value),
    };

    private static async Task<AnalysisOutcome> RunAsync(AnalyzeRule rule, List<EnrollmentEvent> events)
@@ -13,7 +13,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
 {
    /// <summary>
    /// Returns the latest published agent + bootstrap script versions.
-    /// Cached in-memory for 12h; supports <c>?refresh=true</c> to bypass the cache.
+    /// Cached in-memory for a few minutes; supports <c>?refresh=true</c> to bypass the cache.
    /// Authenticated users only (read-only metadata).
    /// </summary>
    public class GetLatestVersionsFunction
@@ -44,15 +44,18 @@ namespace AutopilotMonitor.Functions.Functions.Config

                var response = req.CreateResponse(HttpStatusCode.OK);

-                // Force-refresh responses MUST NOT be browser-cached.
-                // Normal cached responses may be stored for up to 1h (aligns with 12h backend cache).
+                // Force-refresh responses MUST NOT be browser-cached. Normal responses are
+                // held for a minute only: the portal announces this number as "Latest agent
+                // version" right after a release, and a browser cache measured in hours would
+                // keep showing the previous release long after the backend refreshed. The
+                // payload is a few dozen bytes, so revalidating often is free.
                if (forceRefresh)
                {
                    response.Headers.Add("Cache-Control", "no-store");
                }
                else
                {
-                    response.Headers.Add("Cache-Control", "public, max-age=3600");
+                    response.Headers.Add("Cache-Control", "public, max-age=60");
                }

                await response.WriteAsJsonAsync(new GetLatestVersionsResponse
@@ -11,8 +11,14 @@ namespace AutopilotMonitor.Functions.Services
 {
    /// <summary>
    /// Exposes the latest published agent/bootstrap versions as read from the
-    /// public <c>version.json</c> blob. Caches the result in memory for 12h
-    /// (short TTL on transient failures). Admin endpoint can force-refresh.
+    /// public <c>version.json</c> blob. The TTL is deliberately short: this number is
+    /// what the portal announces right after a release ("Latest agent version" in the
+    /// What's new panel), so a long cache shows the previous release for hours — and
+    /// because the cache is per Function instance, different instances would announce
+    /// different versions at the same time. The origin is a 200-byte no-cache blob
+    /// behind the download alias, so refetching it every few minutes costs nothing.
+    /// On a fetch failure the last known good value is kept rather than blanking the
+    /// display. Admin endpoint can force-refresh.
    /// </summary>
    public interface ILatestVersionsService
    {
@@ -33,13 +39,19 @@ namespace AutopilotMonitor.Functions.Services
        // it could silently serve a stale version while the release pipeline is green.
        public const string VersionJsonUrl = Constants.AgentDownloadBaseUrl + "/" + Constants.AgentVersionFileName;
        private const string CacheKey = "latest-versions";
-        private static readonly TimeSpan CacheDuration = TimeSpan.FromHours(12);
-        private static readonly TimeSpan FailureCacheDuration = TimeSpan.FromMinutes(5);
+        private static readonly TimeSpan CacheDuration = TimeSpan.FromMinutes(5);
+        private static readonly TimeSpan FailureCacheDuration = TimeSpan.FromMinutes(1);

        private readonly IHttpClientFactory _httpClientFactory;
        private readonly IMemoryCache _cache;
        private readonly ILogger<LatestVersionsService> _logger;

+        /// <summary>
+        /// Survives cache expiry: served when the blob read fails so a transient hiccup
+        /// hides the version line for at most one request instead of a full failure TTL.
+        /// </summary>
+        private volatile LatestVersions? _lastGood;
+
        public LatestVersionsService(
            IHttpClientFactory httpClientFactory,
            IMemoryCache cache,
@@ -85,15 +97,22 @@ namespace AutopilotMonitor.Functions.Services
                    FromCache: false);

                _cache.Set(CacheKey, result, CacheDuration);
+                _lastGood = result;
                _logger.LogInformation("LatestVersions refreshed: agent={AgentVersion}, bootstrap={BootstrapVersion}", version, bootstrapVersion);
                return result;
            }
            catch (Exception ex)
            {
-                _logger.LogWarning(ex, "Failed to fetch {Url}; caching null for {Minutes}m", VersionJsonUrl, FailureCacheDuration.TotalMinutes);
-                // Cache failure briefly to avoid hammering blob on repeated calls
-                _cache.Set(CacheKey, (LatestVersions?)null, FailureCacheDuration);
-                return null;
+                var lastGood = _lastGood;
+                _logger.LogWarning(
+                    ex,
+                    "Failed to fetch {Url}; serving {Fallback} for {Minutes}m",
+                    VersionJsonUrl,
+                    lastGood == null ? "nothing" : $"the value fetched at {lastGood.FetchedAtUtc:O}",
+                    FailureCacheDuration.TotalMinutes);
+                // Cache the outcome briefly to avoid hammering the blob on repeated calls.
+                _cache.Set(CacheKey, lastGood, FailureCacheDuration);
+                return lastGood == null ? null : lastGood with { FromCache = true };
            }
        }
    }
@@ -127,6 +127,18 @@ namespace AutopilotMonitor.Functions.Services
                });
            }

+            // Field-absence gate: not_exists WITH a dataField matches when no event of the type
+            // carries a non-empty value at that field — including when the type is absent — the
+            // same semantics as the precondition gate. Must run before the "no matching events"
+            // veto and the per-event loop below, whose null short-circuit could never express
+            // "the field is missing" (session 683f1eff: "esp_failure_settle_started.errorCode
+            // not_exists" was silently dead).
+            if (!string.IsNullOrEmpty(condition.DataField)
+                && string.Equals(condition.Operator, "not_exists", StringComparison.OrdinalIgnoreCase))
+            {
+                return EvaluateFieldAbsence(condition, matchingEvents);
+            }
+
            if (!matchingEvents.Any())
                return (false, "no matching events");

@@ -206,6 +218,11 @@ namespace AutopilotMonitor.Functions.Services
        {
            var matchingEvents = ApplyValueFilter(condition, events.Where(e => MatchesEventType(e, condition.EventType)).ToList());

+            // Field-absence gate — see EvaluateEventTypeCondition; here it applies to the
+            // filtered event set, so "no event with filterField=x carries dataField" is expressible.
+            if (string.Equals(condition.Operator, "not_exists", StringComparison.OrdinalIgnoreCase))
+                return EvaluateFieldAbsence(condition, matchingEvents);
+
            foreach (var evt in matchingEvents)
            {
                var fieldValue = GetDataFieldValue(evt, condition.DataField);
@@ -227,6 +244,26 @@ namespace AutopilotMonitor.Functions.Services
            return (false, "no matching data");
        }

+        /// <summary>
+        /// <c>not_exists</c> with a dataField: true when none of <paramref name="matchingEvents"/>
+        /// carries a non-empty value at the field (an empty set counts as absent). A single
+        /// non-empty value disproves it. Evidence names the type, the field and how many events
+        /// of the type were inspected, so a finding can say "0 esp_failure_settle_started events
+        /// carried errorCode" rather than pointing at one event.
+        /// </summary>
+        private static (bool matched, object evidence) EvaluateFieldAbsence(RuleCondition condition, List<EnrollmentEvent> matchingEvents)
+        {
+            if (matchingEvents.Any(e => !string.IsNullOrEmpty(GetDataFieldValue(e, condition.DataField))))
+                return (false, "data field present");
+
+            return (true, new Dictionary<string, object>
+            {
+                ["eventType"] = condition.EventType,
+                ["field"] = condition.DataField,
+                ["count"] = matchingEvents.Count
+            });
+        }
+
        /// <summary>
        /// Evidence values feed the finding UI and {{token}} interpolation, both of which
        /// render via ToString() — a raw List would surface as its .NET type name
@@ -201,8 +201,11 @@ export const RULE_AUTHORING_GUIDE = {
    ],
    operatorNotes:
      'String comparisons are case-insensitive; regex runs case-insensitive with a 1s timeout ' +
-      '(.NET regex syntax); in/not_in take a comma-separated value list. An operator the engine ' +
-      'does not know silently evaluates to FALSE in production — validate_rule catches this.',
+      '(.NET regex syntax); in/not_in take a comma-separated value list. exists/not_exists with a ' +
+      'dataField test whether ANY event of the type carries a non-empty value there — not_exists ' +
+      'matches when none does, also when the event type is absent (e.g. "the ESP failure carried no ' +
+      'errorCode"); without a dataField they test only the presence of the event type. An operator ' +
+      'the engine does not know silently evaluates to FALSE in production — validate_rule catches this.',
    required:
      'required=true conditions are the firing core: ALL of them must match or the rule produces ' +
      'nothing. required=false conditions are optional reinforcers whose evidence feeds ' +
@@ -470,7 +470,7 @@ export const ANALYZE_RULE_SCHEMA: Record<string, unknown> = {
        },
        "operator": {
          "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
          "enum": [
            "equals",
            "not_equals",
@@ -1486,7 +1486,7 @@ export function registerAdminTools(server: McpServer, ga: boolean, strictGa: boo
    {
      title: 'Query Table',
      description:
-        'Query any Azure Table Storage table directly with OData filters. Global Admin only. ' +
+        'Query any Azure Table Storage table directly with OData filters. Table names come from list_tables — a guessed name is a NotFound, not an empty result. Global Admin only. ' +
        'Use list_tables to see available tables. Useful for inspecting TenantConfiguration, RuleResults, or any raw data ' +
        'where no specialized tool exists. ' +
        'For COUNTING / AGGREGATION queries pass `fields=PartitionKey,RowKey,Status,AgentVersion` (or similar lean subset) ' +
@@ -1673,7 +1673,8 @@ export function registerAdminTools(server: McpServer, ga: boolean, strictGa: boo
        tenantId: TenantGuidSchema.describe('Tenant ID (GUID) whose configuration to change.'),
        fields: z.record(z.string(), z.unknown())
          .describe('Object of fieldName → newValue for ONLY the fields to change (e.g. {"dataRetentionDays": 90}). ' +
-                    'Use get_tenant_config for current values and exact field names.'),
+                    'Field names, JSON types and writability come from get_tenant_config_schema; get_tenant_config ' +
+                    'shows the CURRENT values but not the full field set, so it cannot tell you what is writable.'),
        reason: z.string().min(1)
          .describe('REQUIRED: why this change is being made. Stored with the backup snapshot and the audit log entry.'),
      },
@@ -122,7 +122,7 @@ export function registerRuleTools(server: McpServer, ga: boolean): void {
        (ga ? ' Platform-scope callers can target any tenant\'s session — the tenant is resolved from the session automatically.' : ''),
      inputSchema: {
        sessionId: SessionIdSchema.describe('Session UUID to evaluate the draft against'),
-        rule: z.record(z.string(), z.unknown()).describe('The draft analyze rule JSON object'),
+        rule: z.record(z.string(), z.unknown()).describe('The draft analyze rule JSON object. Condition shapes — including the allowed condition `source` values — come from get_resource(name="rule_schemas"); run validate_rule first if the draft has not been validated yet'),
      },
      annotations: READ_ONLY,
    },
@@ -436,7 +436,7 @@ export function registerSessionTools(server: McpServer, ga: boolean, delegated:
      inputSchema: {
        sessionId: SessionIdSchema.describe('Session UUID'),
        tenantId: z.string().optional().describe(tenantIdDescription(ga, delegated, 'Tenant ID. If omitted, auto-resolved from the session.', 'Tenant ID. If omitted, auto-resolved from the session.')),
-        eventType: z.string().optional().describe('Filter to only events of this type'),
+        eventType: z.string().optional().describe('Filter to only events of this type — valid values come from the event_types catalog (call get_resource(name="event_types")); an invented type is rejected, not an empty result'),
        severity: z.enum(EVENT_SEVERITIES).optional(),
        source: z.string().optional().describe('Filter by event source/app name (e.g. "MicrosoftTeams")'),
        fields: z.string().optional()
@@ -262,8 +262,42 @@
    "0x8018002b": {"description":"Automatic MDM enrollment failed: the user's UPN has an unverified or non-routable domain, or the MDM user scope is set to None","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors","category":"mdm-enrollment"},
    "0x80190193": {"description":"Forbidden (403)","confidence":"high","source":"winerror.h","category":"com","symbol":"HTTP_E_STATUS_FORBIDDEN"},
    "0x80190194": {"description":"Not found (404)","confidence":"high","source":"winerror.h","category":"com","symbol":"HTTP_E_STATUS_NOT_FOUND"},
+    "0x801c0001": {"description":"ADRS server response isn't in a valid format","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0002": {"description":"Server failed to authenticate the user","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0003": {"description":"User isn't authorized to enroll","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0006": {"description":"Unhandled exception from server","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000b": {"description":"Redirection is needed and redirected location isn't a well known server","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000c": {"description":"Discovery failed","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000e": {"description":"Registration quota reached","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000f": {"description":"Operation successful, but the device requires a reboot","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0010": {"description":"The AIK certificate isn't valid or trusted","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0011": {"description":"The attestation statement of the transport key is invalid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0012": {"description":"Discovery request isn't in a valid format","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0013": {"description":"Tenant ID isn't found in the token","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0014": {"description":"User SID isn't found in the token","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0015": {"description":"The device is required to be joined to an Active Directory domain","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0016": {"description":"The federation provider configuration is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0017": {"description":"The federation provider domain is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0018": {"description":"The federation provider client configuration URL is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0019": {"description":"The federation provider client configuration is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c001a": {"description":"The DRS endpoint in the federation provider client configuration is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c001b": {"description":"The device certificate isn't found","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c004d": {"description":"NGC provisioning is unable to find the default WAM account to use to request Microsoft Entra token for provisioning. Unable to enroll a device to use a PIN for login","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join","symbol":"DSREG_NO_DEFAULT_ACCOUNT"},
+    "0x801c03e9": {"description":"Server response message is invalid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
    "0x801c03ea": {"description":"Registering the device for mobile management failed: the TPM supports 2.0 but has not been upgraded to 2.0, or the device is in two groups with different Autopilot profiles","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors","category":"entra-join"},
+    "0x801c03eb": {"description":"Server response http status isn't valid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ec": {"description":"Unhandled exception from server","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ed": {"description":"Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed. -or- Token wasn't found in the Authorization header. -or- Failed to read one or more objects. -or- The req…","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ee": {"description":"Attestation failed","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ef": {"description":"The AIK certificate is no longer valid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03f0": {"description":"There's no key registered for the user","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03f1": {"description":"There's no UPN in the token","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03f2": {"description":"Windows Hello key registration failed","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
    "0x801c03f3": {"description":"Microsoft Entra ID has no device object for the device being deployed (the object was deleted); remove the device from Entra ID, Intune and Autopilot and re-register it","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/autopilot/known-issues","category":"entra-join"},
+    "0x801c044c": {"description":"There's no core window for the current thread","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c044d": {"description":"Authorization token doesn't contain device ID","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c044e": {"description":"Failed to receive user credentials input","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0451": {"description":"User token switch account","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
    "0x80240001": {"description":"Windows Update Agent was unable to provide the service","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-error-reference","category":"windows-update","symbol":"WU_E_NO_SERVICE"},
    "0x80240002": {"description":"The maximum capacity of the service was exceeded","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-error-reference","category":"windows-update","symbol":"WU_E_MAX_CAPACITY_REACHED"},
    "0x80240003": {"description":"An ID can't be found","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-error-reference","category":"windows-update","symbol":"WU_E_UNKNOWN_ID"},
@@ -679,8 +679,8 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
        <p className="text-xs text-gray-400 mt-1 ml-6">
          Attaches the Windows/MSI/Intune meaning to <code className="px-1 bg-gray-100 rounded">exitCode</code>,{" "}
          <code className="px-1 bg-gray-100 rounded">errorCode</code> and <code className="px-1 bg-gray-100 rounded">hresult</code> fields
-          in this rule&apos;s output, like on built-in events. Leave off when the source uses its own exit codes
-          (HP Image Assistant, Dell Command Update, custom scripts) — the catalog would explain them wrongly.
+          in this rule&apos;s output, like on built-in events. Leave off when the source uses its own exit codes —
+          the catalog would explain them wrongly.
        </p>
      </div>
    </div>
@@ -22,8 +22,9 @@ export interface UseLatestVersionsResult {

 /**
 * Fetches latest published agent/bootstrap versions from the backend
- * once per mount. The backend caches the upstream blob for 12h, and
- * the browser Cache-Control allows 1h of HTTP caching, so this is cheap.
+ * once per mount. Backend cache and browser Cache-Control are both minutes,
+ * not hours, so a fresh release shows up almost immediately — the What's new
+ * panel announces this number, and the panel mounts on every open.
 *
 * Silently swallows all errors — on failure, returns nulls so callers
 * can gracefully hide "outdated" badges.
@@ -64,16 +64,26 @@ function validate(rawText) {
  return catalog;
 }

-/** The browser-facing shape: same keys, shortened source, no enforcement states. */
+/**
+ * The browser-facing shape: same keys, shortened source, no enforcement states, and the two
+ * dominant field values omitted.
+ *
+ * `confidence: "high"` holds for 562 of 641 rows and `source: "msdoc"` for about half, so
+ * spelling them out costs ~19 KB of the client bundle to repeat two constants. They are
+ * omitted here and restored on read in `utils/errorCodeMap.ts` — the rendered tooltip is
+ * unchanged. Keep the two defaults in sync with that reader.
+ */
+const DEFAULT_CONFIDENCE = "high";
+const DEFAULT_SOURCE = "msdoc";
+
 function transform(catalog) {
  const entries = {};
  for (const [key, e] of Object.entries(catalog.entries)) {
-    const out = {
-      description: e.description,
-      confidence: e.confidence,
-      source: e.source.startsWith("msdoc:") ? "msdoc" : e.source,
-      category: e.category,
-    };
+    const source = e.source.startsWith("msdoc:") ? "msdoc" : e.source;
+    const out = { description: e.description };
+    if (e.confidence !== DEFAULT_CONFIDENCE) out.confidence = e.confidence;
+    if (source !== DEFAULT_SOURCE) out.source = source;
+    out.category = e.category;
    if (e.symbol) out.symbol = e.symbol;
    if (e.imeRetriesDuringEsp) out.imeRetriesDuringEsp = true;
    entries[key] = out;
@@ -31,11 +31,15 @@ describe("errorCodeMap", () => {
    });

    it("uses only the catalog vocabulary", () => {
-      for (const [key, entry] of Object.entries(catalogFile.entries)) {
+      // Asserted on the RESOLVED entry: the synced file omits confidence "high" and source
+      // "msdoc" to save bundle bytes, and getErrorCodeEntry restores them.
+      for (const key of Object.keys(catalogFile.entries)) {
        expect(key, key).toMatch(/^(0x[0-9a-f]{8}|\d+)$/);
-        expect(ERROR_CODE_CATEGORIES, `${key} category`).toContain(entry.category);
-        expect(["high", "medium", "low"], `${key} confidence`).toContain(entry.confidence);
-        expect(entry.source, `${key} source`).toMatch(/^(msdoc|ime:\d+(\.\d+)+|winerror\.h|rule:[A-Z]+-[A-Z]+-\d{3}|legacy-catalog-v1)$/);
+        const entry = getErrorCodeEntry(key);
+        expect(entry, key).not.toBeNull();
+        expect(ERROR_CODE_CATEGORIES, `${key} category`).toContain(entry!.category);
+        expect(["high", "medium", "low"], `${key} confidence`).toContain(entry!.confidence);
+        expect(entry!.source, `${key} source`).toMatch(/^(msdoc|ime:\d+(\.\d+)+|winerror\.h|rule:[A-Z]+-[A-Z]+-\d{3}|legacy-catalog-v1)$/);
      }
    });
  });
@@ -31,7 +31,9 @@ describe("error-codes sync", () => {
    const out = sync.transform(catalog);
    expect(catalog.enforcementStates).toBeDefined();
    expect("enforcementStates" in out).toBe(false);
-    expect(out.entries["0x80070005"].source).toBe("msdoc");
+    // "msdoc" and "high" are the omitted defaults (restored by utils/errorCodeMap.ts).
+    expect(out.entries["0x80070005"]).not.toHaveProperty("source");
+    expect(out.entries["0x80070005"]).not.toHaveProperty("confidence");
    expect(out.entries["0x87d30000"].source).toMatch(/^ime:/);
    expect(out.entries["1603"].symbol).toBe("ERROR_INSTALL_FAILURE");
  });
@@ -56,9 +56,14 @@ export interface ErrorCodeLookup {
  derivedFromWin32?: number;
 }

+/**
+ * The synced file omits the two dominant field values to keep the client bundle small
+ * (`scripts/sync-error-codes.js`): a missing `confidence` means "high", a missing `source`
+ * means "msdoc". Both are restored below, so every consumer still sees a complete entry.
+ */
 interface CatalogFile {
  schemaVersion: number;
-  entries: Record<string, ErrorCodeEntry>;
+  entries: Record<string, Omit<ErrorCodeEntry, "confidence" | "source"> & Partial<Pick<ErrorCodeEntry, "confidence" | "source">>>;
 }

 const typedCatalog = catalogFile as CatalogFile;
@@ -68,7 +73,10 @@ const typedCatalog = catalogFile as CatalogFile;
 * Keys are normalised lowercase hex strings (e.g. "0x80070005") or decimal strings (e.g. "1603").
 */
 const errorCodeMap: Record<string, ErrorCodeEntry> = Object.fromEntries(
-  Object.entries(typedCatalog.entries).map(([k, v]) => [k.toLowerCase(), v])
+  Object.entries(typedCatalog.entries).map(([k, v]) => [
+    k.toLowerCase(),
+    { ...v, confidence: v.confidence ?? "high", source: v.source ?? "msdoc" },
+  ])
 );

 /** Look up a structured entry for a raw code; null when no mapping is found. */
@@ -45,6 +45,7 @@ duplicates are reported on stderr.
 | windows-update / cbs | [Windows Update common errors](https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-errors) | One table per single-code heading; symbol = text before `;` in the Message cell, description = text after it, else the Description cell. `0x800F…` → `cbs`. |
 | intune-mobile / intune-win32 | [Intune app installation error codes](https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/app-install-error-codes) | iOS/iPadOS and Windows tables (Android skipped); description = the message cell. |
 | mdm-enrollment / autopilot / entra-join | [Windows enrollment errors](https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors), [Autopilot known issues](https://learn.microsoft.com/en-us/autopilot/known-issues) | Prose pages: one-sentence paraphrase listed in `PROSE_ENTRIES`; the generator asserts the code appears on the page. Codes only our analysis rules name carry `rule:` and `medium`. |
+| entra-join | [Windows Hello errors during PIN creation](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation) | Both tables parsed (`Hex \| Cause \| Mitigation` and the "unknown mitigation" one); the `Cause` column is the description, `Mitigation` is advice and is not carried. **Only `0x801c*`** — the page also lists NTE crypto codes, a Win32 code the `win32` family owns, and codes with no category here. Runs after `PROSE_ENTRIES` so the Autopilot-specific text for `0x801c03ea` wins. A `SYMBOL: text` cell yields `symbol`. Fails the run below 30 keys, so a reshaped page cannot silently shrink the family. |
 | intune-win32 (`0x87D3xxxx`) | IME `CustomErrorCodes` enum | Member name as symbol, humanised as description, `medium`. Two known sign/digit defects in the enum source are corrected by `IME_ENUM_FIXUPS`; a build that fixes them makes the run fail so the fixup is removed. |
 | delivery-optimization (`0x80D0xxxx`) | IME `DeliveryOptimizationConstants` | Member name as symbol, humanised, `medium`. |
 | legacy | v1 catalog | Entries no primary source covers, `low`. |
@@ -26,6 +26,8 @@
 *   intune-*              MS "Intune app installation error codes" (iOS + Windows tables)
 *   mdm-enrollment/       MS enrollment troubleshooting + Autopilot known-issues pages (prose:
 *   autopilot/entra-join  one-sentence paraphrase, presence-checked against the page)
+ *   entra-join            MS "Windows Hello errors during PIN creation", 0x801Cxxxx only — the
+ *                         DSREG / device-registration family (runs after prose, which wins)
 *   intune-win32          IME CustomErrorCodes enum (0x87D3xxxx), member name paraphrased
 *   delivery-optimization IME DeliveryOptimizationConstants (0x80D0xxxx), member name paraphrased
 *   legacy                v1 entries without a primary source, kept at confidence "low"
@@ -82,6 +84,7 @@ const URL = {
  intuneApps: "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/app-install-error-codes",
  enrollErrors: "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors",
  knownIssues: "https://learn.microsoft.com/en-us/autopilot/known-issues",
+  helloErrors: "https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation",
  winhttp: "https://learn.microsoft.com/en-us/windows/win32/winhttp/error-messages",
  win32: (range) => `https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--${range}-`,
 };
@@ -117,6 +120,10 @@ const ENTITIES = { nbsp: " ", amp: "&", lt: "<", gt: ">", quot: '"', "#39": "'",
 /**
 * Cell markup → plain text. Tags are stripped until none remain (a nested "<scr<b>ipt>" cannot
 * survive), and entities are decoded in ONE pass so "&amp;lt;" yields "&lt;", never "<".
+ *
+ * Zero-width and bidi marks are removed before the whitespace collapse: MS Learn tables carry
+ * stray U+200B in hex and description cells, JS `\s` does not match them, and a hex cell that
+ * keeps one fails every `^0x…$` test — the row would then be skipped with no diagnostic.
 */
 const decode = (s) => {
  let text = s.replace(/<br\s*\/?>/gi, " ").replace(/<\/(p|li|div)>/gi, " ");
@@ -127,6 +134,7 @@ const decode = (s) => {
  } while (text !== previous);
  return text
    .replace(/&(nbsp|amp|lt|gt|quot|#39|#x27);/g, (_, name) => ENTITIES[name])
+    .replace(/[-‏‪-‮⁠]/g, "")
    .replace(/\s+/g, " ")
    .trim();
 };
@@ -409,6 +417,45 @@ async function main() {
    queue("prose", e.key, { symbol: e.symbol, description: e.description, confidence: e.confidence ?? "high", source: e.source ?? msdoc(e.page), category: e.category });
  }

+  // entra-join — the Windows Hello PIN error page is the only MS table that documents the
+  // 0x801Cxxxx (DSREG / device-registration) family, which an enrollment meets during hybrid
+  // join and the ESP account-setup phase. Two tables: "Hex | Cause | Mitigation" and, for the
+  // codes without a documented fix, "Hex | Cause". The `Cause` column is the description in
+  // both — `Mitigation` is advice, and the catalog describes codes rather than advising.
+  //
+  // Runs AFTER the prose entries on purpose: 0x801c03ea is on both, and the Autopilot-specific
+  // prose ("TPM supports 2.0 but has not been upgraded") is the more useful of the two here,
+  // so the earlier family has to win. Scope stays at 0x801c*: the same page also lists NTE
+  // crypto codes, a plain Win32 code that the win32 family already owns, and two codes whose
+  // categories do not exist — none of them get invented here.
+  {
+    const ENTRA_MIN_KEYS = 30; // 35 on 2026-09-09; a drop means the page changed shape
+    let entraKeys = 0;
+    for (const table of parseTables(await fetchPage(URL.helloErrors))) {
+      for (const [value, cause] of table.slice(1)) {
+        if (!/^0x[0-9a-f]{8}$/i.test(value)) continue;
+        const key = normalizeHex(value);
+        if (!key.startsWith("0x801c")) continue;
+        // "DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to …" — the cell leads with the
+        // symbol for the codes that have one.
+        const named = /^([A-Z][A-Z0-9_]{2,}):\s+(.*)$/s.exec(cause);
+        queue("entra-join", key, {
+          symbol: named?.[1],
+          description: named ? named[2] : cause,
+          confidence: "high",
+          source: msdoc(URL.helloErrors),
+          category: "entra-join",
+        });
+        entraKeys += 1;
+      }
+    }
+    // parseTables drops a row whose hex cell does not match; without this the page silently
+    // yielding fewer codes would look like a clean run.
+    if (entraKeys < ENTRA_MIN_KEYS) {
+      throw new Error(`entra-join: only ${entraKeys} 0x801c keys parsed from ${URL.helloErrors} (expected >= ${ENTRA_MIN_KEYS}) — the page shape changed`);
+    }
+  }
+
  // IME CustomErrorCodes (0x87D3xxxx)
  for (const [name, rawValue] of Object.entries(ime.customErrorCodes)) {
    if (name === "Undefined") continue;
Author	SHA1	Message	Date
Oliver Kieselbach	8224c8f1a8	fix(rules,engine,agent): ESP-004 gates on the esp_apps_timeout verdict; not_exists absence gate; Shell-Core failure inherits settle detail (D-234, D-235) ANALYZE-ESP-004 fired on every ESP terminal failure of a Continue-anyway profile and rendered the configured FirstSync limit as elapsed time — the mayHaveContinuedAnyway flag only says the profile has the button. The rule now requires the agent's own verdict (app_install_failed with failureType=esp_apps_timeout), names that app via a same-event filter, reads failedSubcategory from esp_failure_settle_started and words the limit as a limit. Verified with test_analyze_rule: cb7036a6 fires, 683f1eff (0x80070652 after 19 min) stays silent. Rule engine: not_exists with a dataField on event_type/event_data conditions matches when no event of the type carries a non-empty value — including an absent type — instead of being dead behind the fieldValue null short-circuit. Schema and MCP authoring guide say so. Agent: a Shell-Core 62407 failure that lands inside the provisioning tracker's 30-s settle window (a third of all ESP terminal failures) now inherits the pending errorCode / failedSubcategory / category / likelyCulpritApps, so enrollment_failed, Sessions.FailureReason and the termination-time app classification see the HRESULT the registry had already named. failureType stays the Shell-Core value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 17:20:24 +02:00
Oliver Kieselbach	d7f39895f5	fix(web): omit the two default field values from the browser catalog (D-233) The Entra family (D-231) pushed utils/error-codes.json to 123026 bytes against the 120000-byte client-bundle budget, breaking the Web CI job. Raising the cap would have been the wrong repair -- it was set three days ago with the v2 catalog, and a guard that gets widened whenever content grows is not a guard. The bytes were elsewhere: confidence "high" holds for 562 of 641 rows and source "msdoc" for about half, ~19 KB of bundle spent repeating two constants. The sync now omits them and errorCodeMap restores them while building the map, so every consumer still sees a complete entry and errorCodeTooltip renders exactly as before. 123026 -> 102399 bytes, cap unchanged, ~17 KB of headroom left. Dropping the fields outright was rejected: the tooltip renders both, so they are provenance a customer sees. The vocabulary test now asserts on the resolved entry via getErrorCodeEntry rather than the raw file -- a default changed on one side only would otherwise make tooltips lie about provenance silently.	2026-09-09 15:26:29 +02:00
Oliver Kieselbach	790bd35385	small gather rule description change	2026-09-09 14:59:56 +02:00
Oliver Kieselbach	34c9fd42fe	chore: bump internal and .claude/commands gitlinks internal: D-231/D-232, the plan with its review, backlog B-y5d and B-s2y. .claude/commands: the platform-health marker-catalog corrections from the 2026-09-09 health pass (weekday vs weekend ingest baseline, CAS retried scales with load, WhatsNewNotificationSent is not proof of a run).	2026-09-09 14:55:30 +02:00
Oliver Kieselbach	19a336870c	fix(mcp): put the catalog pointer on the parameter, not only the tool (D-232) Seven of 44 tool errors in the 7-day telemetry were invented catalog values, and in every case the tool description already said the right thing while the parameter description was bare or contradicted it. update_tenant_config is the clean proof: its description says "Call get_tenant_config_schema FIRST", but the fields parameter said "Use get_tenant_config for current values and exact field names" -- and over 30 days the model called get_tenant_config 12 times and get_tenant_config_schema once. The text next to the argument wins, and get_tenant_config cannot answer what it was pointed at: it shows only the fields this tenant has set, with no type, writability or nullability. Also: get_session_events.eventType (event_types catalog, matching the pointer search_sessions_by_event.eventType already carries), query_table (list_tables) and test_analyze_rule.rule (rule_schemas, validate_rule first).	2026-09-09 14:55:22 +02:00
Oliver Kieselbach	5ba5942d0b	feat(error-codes): parse the Entra device-registration family (D-231) The catalog held 2 of 607 entries in entra-join, while the 0x801Cxxxx DSREG family is what an enrollment meets during hybrid join and the ESP account-setup phase. The Windows Hello PIN error page is the only MS table that documents it; both of its tables are now parsed, restricted to 0x801c* (607 -> 641 entries). The block runs after PROSE_ENTRIES so the Autopilot-specific text for 0x801c03ea keeps precedence over the generic one. The Mitigation column is not carried -- the catalog describes codes, it does not advise. A "SYMBOL: text" cell yields a symbol (0x801c004d -> DSREG_NO_DEFAULT_ACCOUNT). The run fails below 30 keys, because parseTables drops non-matching rows silently and a reshaped page would otherwise look like a clean run. decode() now strips zero-width and bidi marks: the page carries U+200B in one hex cell and four description cells, JS \s does not match it, and such a hex cell fails every ^0x...$ test. Placed in decode() rather than in the new source so the next parsed page cannot walk into it -- regeneration shows 34 added, 0 changed. 0x801C044F, the zero-hit lookup that started this, is on none of the three MS pages and deliberately stays unknown.	2026-09-09 14:55:11 +02:00
Oliver Kieselbach	aa20d9102c	fix(backend): show the freshly published agent version, not the previous one (D-230) The What's new panel prints "Latest agent version" under the release entries, and the session list draws its outdated badges from the same endpoint — but the value was cached 12h in each Function instance and 1h in the browser, so the panel announced the previous release for up to 13h and two instances could disagree. - LatestVersionsService: TTL 12h -> 5 min; keep the last successful result and serve it when the blob read fails, so the shorter TTL cannot blank the version line on a transient hiccup (failure marker 5 min -> 1 min). - GetLatestVersions: Cache-Control max-age 3600 -> 60. - No refresh callback from build-agent.yml: the cache is per instance, a warm-up request would leave every other instance stale. The origin is a ~200-byte no-cache blob behind the download alias that Front Door does not cache, so a warm instance now reads it at most 12x/h. Backend deploy (workflow_dispatch) pending — B-uq7. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 12:26:03 +02:00
Oliver Kieselbach	097be1700b	chore: bump internal gitlink Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 12:10:52 +02:00