bump pointer: internal (D-320, concept docs, plan oobe-update-outcome-and-late-start)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -30,6 +30,7 @@
 - Stage explicit file lists; never `git add -A` or a directory. Pushing is the user's call.
 - New API responses need a typed DTO plus the parity fact. MCP vocabularies are generated from the wire types, never retyped.
 - Every route belongs in the route policy catalog; every new event type goes into the MCP resource catalog.
+- Workflow files under `.github/` go through zizmor before they are committed (`zizmor .` from the repository root, findings from severity low on): fix every finding or ignore it in `zizmor.yml` with a reason. The `zizmor` job in `action-pins.yml` runs the same check on every push.
 - The about, terms and privacy pages under `src/Web/autopilot-monitor-web/app/` state facts customers rely on: verify every claim against the code before writing it and update them in the same change as the fact they describe.
 
 ## Code Quality

.github/codeql/codeql-config.yml

@@ -1,8 +1,8 @@
 # CodeQL configuration.
 #
-# The default query suites stay active — this file only filters out two C# queries
-# that fire structurally on this codebase, where the flagged behavior is the feature,
-# not a defect:
+# The default query suites stay active — this file only filters out queries that
+# fire structurally on this codebase, where the flagged behavior is the feature
+# or the protection exists in a form the query cannot see:
 #
 #   cs/exposure-of-sensitive-information
 #     Audit and operational logs record WHO performed an action (actor UPN / email)
@@ -15,10 +15,20 @@
 #     key. The IP is an identifier for throttling, not a secret at rest; storing it in
 #     the in-memory / table rate-limit key is by design.
 #
+#   js/missing-rate-limiting
+#     Only the MCP server has Express routes. Every one that does work is throttled by
+#     our own limiters (oauthRateLimit / oauthTokenRateLimit on /oauth/*, accessGuard
+#     on /mcp); /health and the OAuth discovery documents return static JSON.
+#     The query only recognizes limiters from npm packages (express-rate-limit and
+#     similar) and flags a route handler as soon as it calls a function named
+#     like *auth*, *login* or *verify*. So it reports throttled and unthrottled
+#     routes the same way, and every alert it ever raised was a false positive. The
+#     coverage check it stood in for is a test: every OAuth router route must carry
+#     a limiter or be named as exempt (MCP oauth-rate-limit.test.ts).
+#
 # Genuine one-off false positives from OTHER queries (e.g. an open-redirect the taint
-# model can't see is allow-listed, a rate-limited route it doesn't recognize) are
-# dismissed individually in the Security tab so those queries stay sharp — they are
-# NOT suppressed here.
+# model can't see is allow-listed) are dismissed individually in the Security tab so
+# those queries stay sharp — they are NOT suppressed here.
 #
 # Log-injection (cs/log-forging) is deliberately NOT filtered: user-controlled values
 # are sanitized at the sink via Helpers/LogSanitizer, so the query stays useful for
@@ -29,3 +39,5 @@ query-filters:
       id: cs/exposure-of-sensitive-information
   - exclude:
       id: cs/cleartext-storage-of-sensitive-information
+  - exclude:
+      id: js/missing-rate-limiting

.github/dependabot.yml

@@ -1,5 +1,9 @@
 version: 2
 
+# Cooldown: a version is proposed only once it has been public for 7 days, so a
+# release that is yanked or found malicious within its first week never reaches a
+# PR. Security updates are exempt from the cooldown by Dependabot's own rules.
+#
 # Grouping: every ecosystem gets one batched PR for minor/patch version
 # updates and one batched PR for security updates. Groups apply to version
 # updates only by default, so the security-updates groups are declared
@@ -10,6 +14,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     groups:
       dotnet:
@@ -23,6 +29,8 @@ updates:
     directory: /src/Web/autopilot-monitor-web
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     groups:
       web:
@@ -41,6 +49,8 @@ updates:
     directory: /src/McpServer/autopilot-monitor-mcp
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     groups:
       mcp:
@@ -55,6 +65,22 @@ updates:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
 
+  # Validator tooling for rules/ (ajv-cli); combine-rules.yml installs it from this
+  # lockfile with contents:write in hand, so the pins must not go stale.
+  - package-ecosystem: npm
+    directory: /rules/scripts
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      rules-tooling:
+        patterns: ['*']
+      rules-tooling-security:
+        applies-to: security-updates
+        patterns: ['*']
+
   # Every action is referenced by commit SHA with the version in a trailing comment;
   # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
   # is what keeps those pins current: it rewrites the SHA and the comment together, so the
@@ -63,6 +89,8 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns: ['*']

.github/scripts/Get-StorageAuthHeaders.ps1

@@ -11,6 +11,7 @@
     Identity comes from whatever `az login` established: the federated GitHub OIDC principal
     in CI (azure/login, subject repo:okieselbach/AutopilotMonitor:ref:refs/heads/main), the
     operator's own account for the local build. No secret is read, stored or passed around.
+    Under GitHub Actions the token is masked in the run log before it is returned.
 
     x-ms-version is MANDATORY here, not decoration: Entra-authorized requests are rejected
     below 2017-11-09, and Table requests without a SAS must carry the header at all. 2021-08-06
@@ -45,6 +46,15 @@ if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
            'on the table -- a missing role shows up later as HTTP 403 AuthorizationPermissionMismatch.')
 }
 
+# GitHub masks only secrets.* on its own; a token minted at run time is clear text in the
+# (public) run log the moment anything prints it -- an uncaptured call of this script, or
+# Get-Error / Format-List on a failed request, whose TargetObject carries this header.
+# Write-Host, never Write-Output: the output stream is this script's return value. Only
+# under Actions -- anywhere else the line would print the token instead of hiding it.
+if ($env:GITHUB_ACTIONS -eq 'true') {
+    Write-Host "::add-mask::$token"
+}
+
 return @{
     'Authorization' = "Bearer $token"
     'x-ms-version'  = '2021-08-06'

.github/workflows/action-pins.yml

@@ -1,5 +1,13 @@
-name: Action Pin Gate
+name: Workflow gates
 
+# Two checks over the workflow files themselves:
+#   * verify-pins -- every third-party action is referenced by a full commit SHA plus a
+#                    version comment (stricter than zizmor's unpinned-uses audit).
+#   * zizmor      -- static analysis of every workflow (permissions, credential
+#                    persistence, template injection, ...). Configuration and the
+#                    reasoned ignores live in zizmor.yml at the repository root; the
+#                    same run is expected locally before a workflow change is committed.
+#
 # Every third-party action must be referenced by a full commit SHA, never by a tag.
 # Tags are mutable: whoever controls an action repository can repoint v4 at new code,
 # and that code runs inside jobs that hold the code-signing identity, the storage
@@ -8,7 +16,8 @@ name: Action Pin Gate
 #
 # Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
 # the other workflow files, so a guard placed there would stay silent for exactly the
-# commits it needs to inspect.
+# commits it needs to inspect. Dependabot's action-pin PRs are the main customer: they
+# rewrite workflow files without anyone running zizmor locally.
 #
 # Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
 # run is a signal to act on, not a merge barrier. Making it binding means adding
@@ -22,10 +31,10 @@ name: Action Pin Gate
 on:
   push:
     branches: [main]
-    paths: ['.github/workflows/**']
+    paths: ['.github/workflows/**', '.github/dependabot.yml', 'zizmor.yml']
   pull_request:
     branches: [main]
-    paths: ['.github/workflows/**']
+    paths: ['.github/workflows/**', '.github/dependabot.yml', 'zizmor.yml']
   workflow_dispatch:
 
 permissions:
@@ -37,15 +46,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Every third-party action is pinned to a SHA
         run: |
           set -uo pipefail
           failed=0
           while IFS=: read -r file line ref; do
-            # Reusable workflows from this repository move with the commit that calls
-            # them, so there is nothing to pin.
-            case "$ref" in ./*) continue ;; esac
+            # Reusable workflows from this repository (workspace-relative ./ or the
+            # self-repository form $/) move with the commit that calls them, so there is
+            # nothing to pin.
+            case "$ref" in ./*|\$/*) continue ;; esac
 
             if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
               printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
@@ -68,3 +80,24 @@ jobs:
             exit 1
           fi
           echo "All action references are pinned to commit SHAs."
+
+  zizmor:
+    name: zizmor audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # SARIF upload: findings land in the Code scanning tab next to CodeQL
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      # zizmor itself is version-pinned like every other tool here; bump it together with
+      # the local install so the gate and the pre-commit run agree on the finding set.
+      # Informational findings (template expansion of our own step outputs in pwsh) are
+      # visible locally but do not fail the gate.
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          version: 1.30.1
+          min-severity: low

.github/workflows/bootstrap-script-gates.yml

@@ -19,6 +19,8 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install Pester 5+
         shell: powershell

.github/workflows/build-agent.yml

@@ -73,6 +73,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # Every released build is signed; a missing variable stops the run before a build
       # number is burnt.
@@ -91,7 +93,7 @@ jobs:
       # are bound to the ref, so this job must never be given an `environment:` -- that would
       # change the OIDC subject claim and break both logins.
       - name: Login to Azure (code-signing identity)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -114,7 +116,7 @@ jobs:
       # well inside the token lifetime. Only the legacy mirror still needs a SAS: that account
       # lives in the pre-migration tenant, where this principal has no identity.
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/build-msi.yml

@@ -41,6 +41,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # The loader executes as SYSTEM on every enrolling device — a parse error or
       # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
@@ -86,7 +88,7 @@ jobs:
       # are bound to the ref, so this job must never be given an `environment:` -- that would
       # change the OIDC subject claim and break both logins.
       - name: Login to Azure (code-signing identity)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -105,7 +107,7 @@ jobs:
 
       # The blob upload below is authorized by this federated identity, not by a SAS.
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/ci.yml

@@ -24,6 +24,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
+      - 'zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -57,6 +58,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
+      - 'zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -97,6 +99,8 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
@@ -128,6 +132,8 @@ jobs:
         working-directory: src/Web/autopilot-monitor-web
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
@@ -162,6 +168,8 @@ jobs:
         working-directory: src/McpServer/autopilot-monitor-mcp
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
@@ -196,6 +204,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
@@ -217,6 +227,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:

.github/workflows/codeql.yml

@@ -17,6 +17,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
+      - 'zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -48,6 +49,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
+      - 'zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -103,6 +105,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         if: matrix.language == 'csharp'
@@ -110,7 +114,7 @@ jobs:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -121,6 +125,6 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release
 
       - name: Analyze
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: /language:${{ matrix.language }}

.github/workflows/combine-rules.yml

@@ -30,11 +30,16 @@ jobs:
         with:
           node-version: '22'
 
-      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # Lockfile and no lifecycle scripts: this job holds contents:write and pushes to
       # main, so an install-time script from a hijacked package would run with a token that
-      # can rewrite the repository. ajv is pure JS and needs no install hooks.
-      - name: Install ajv-cli
-        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1
+      # can rewrite the repository. rules/scripts/package-lock.json pins ajv-cli, ajv-formats
+      # and every transitive package (Dependabot keeps it current); ajv is pure JS and
+      # needs no install hooks.
+      - name: Install ajv-cli from the lockfile
+        working-directory: rules/scripts
+        run: |
+          npm ci --ignore-scripts
+          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Validate Gather Rules
         run: |

.github/workflows/deploy-backend.yml

@@ -20,9 +20,11 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/deploy-mcp.yml

@@ -27,6 +27,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       # The published customer documentation lives in its own PUBLIC repo and is
       # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -38,6 +40,7 @@ jobs:
       - name: Check out documentation bundle
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: autopilotmonitor/autopilotmonitor-docs
           path: mcp-docs
 
@@ -46,7 +49,7 @@ jobs:
         run: echo "sha=$(git -C mcp-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -77,7 +80,7 @@ jobs:
           "short_sha=$shortSha" >> $env:GITHUB_OUTPUT
 
       - name: Login to ACR
-        run: az acr login --name ${{ env.ACR_NAME }}
+        run: az acr login --name "$ACR_NAME"
 
       - name: Build and push container image
         run: |
@@ -87,17 +90,17 @@ jobs:
             --build-arg BUILD_NUMBER=${{ steps.version.outputs.build_number }} \
             --build-arg BUILD_COMMIT=${{ steps.version.outputs.short_sha }} \
             --build-arg BUILD_UTC=${{ steps.version.outputs.build_utc }} \
-            -t ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }}:${{ env.IMAGE_TAG }} \
-            -t ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }}:latest \
+            -t "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME:$IMAGE_TAG" \
+            -t "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME:latest" \
             .
-          docker push ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }} --all-tags
+          docker push "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME" --all-tags
 
       - name: Deploy to Container App
         run: |
           az containerapp update \
-            --name ${{ env.CONTAINER_APP_NAME }} \
-            --resource-group ${{ env.RESOURCE_GROUP }} \
-            --image ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }}:${{ env.IMAGE_TAG }}
+            --name "$CONTAINER_APP_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --image "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME:$IMAGE_TAG"
 
       # `az containerapp update` returns once the revision is provisioned, not once
       # it serves traffic — and with minReplicas=0 the first request also pays a cold

.github/workflows/deploy-web.yml

@@ -37,13 +37,14 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           lfs: false
           fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
 
       # Only the version manifest at the very end needs Azure; logging in here rather than
       # next to that step keeps a credential problem from surfacing after a live deploy.
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -58,6 +59,7 @@ jobs:
       - name: Check out documentation bundle
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           repository: autopilotmonitor/autopilotmonitor-docs
           path: whats-new-docs
           fetch-depth: 0
@@ -76,6 +78,23 @@ jobs:
         working-directory: ${{ env.WEB_DIR }}
         run: npm ci
 
+      # Star counter for the GitHub star link (utils/githubStars.ts). Baked into the static HTML
+      # so visitors' browsers never call GitHub; stale until the next web deploy. The token stays
+      # in this step, never in the build. Fail-soft: without a number the link has no counter.
+      - name: Read GitHub star count (fail-soft)
+        id: stars
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          count=$(gh api "repos/$REPO" --jq .stargazers_count 2>/dev/null || true)
+          if [[ "$count" =~ ^[0-9]+$ ]]; then
+            echo "count=$count" >> "$GITHUB_OUTPUT"
+            echo "GitHub stars: $count"
+          else
+            echo "::warning::GitHub star count unavailable - the star link renders without a counter"
+          fi
+
       # next.config output:'export' -- `next build` writes the static site to out/
       # (prebuild: sync-error-codes, generate-lastmod, generate-version, whats-new).
       - name: Build
@@ -89,6 +108,8 @@ jobs:
           NEXT_PUBLIC_ENTRA_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_REDIRECT_URI }}
           NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI }}
           NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
+          # Browsers load the live stats through it, and the build reads it once to bake the
+          # numbers of this moment into the landing page's static HTML (lib/platformStats.ts).
           NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL: ${{ vars.NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL }}
           NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING: ${{ secrets.NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING }}
           # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
@@ -96,10 +117,15 @@ jobs:
           GITHUB_SHA: ${{ github.sha }}
           # Docs checkout for public/whats-new.json; the prebuild fails in CI without it.
           WHATS_NEW_DOCS_DIR: ${{ github.workspace }}/whats-new-docs
+          # Star counter from the step above; empty when the lookup failed.
+          NEXT_PUBLIC_GITHUB_STARS: ${{ steps.stars.outputs.count }}
         run: |
           npm run build
           test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }
           test -f out/whats-new.json || { echo "out/whats-new.json missing - whats-new prebuild did not run"; exit 1; }
+          # Fail-soft like the star count: browsers still load the stats live; only crawlers and
+          # LLM fetchers, which run no JS, see no numbers until the next deploy.
+          grep -q 'data-stats-snapshot=' out/index.html || echo "::warning::Platform stats were not baked into the landing page (reason in the build log) - crawlers and LLM fetchers see no numbers until the next deploy"
 
       # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
       - name: Package export

.github/workflows/indexnow-notify.yml

@@ -3,6 +3,9 @@ name: IndexNow Notify (Bing/Yandex)
 on:
   workflow_dispatch:
 
+# The job only talks to public endpoints; it never needs a repository token.
+permissions: {}
+
 jobs:
   notify:
     runs-on: ubuntu-latest

.github/workflows/oidc-login-test.yml

@@ -15,7 +15,7 @@ jobs:
     name: Federated login + read check
     steps:
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/pester.yml

@@ -25,5 +25,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # $/ is the self-repository form: this repository at the running commit.
   gates:
-    uses: ./.github/workflows/bootstrap-script-gates.yml
+    uses: $/.github/workflows/bootstrap-script-gates.yml

.github/workflows/publish-scripts.yml

@@ -26,7 +26,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write   # OIDC federated login for the storage writes (secret-less)
 
 # Shared with build-agent.yml: a script publish and an agent release both touch
 # version.json, and the bootstrapVersion read-modify-write must not interleave with the
@@ -46,15 +45,24 @@ env:
   CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
+  # $/ is the self-repository form: this repository at the running commit, never a
+  # path some earlier step could have written to the workspace.
   gates:
-    uses: ./.github/workflows/bootstrap-script-gates.yml
+    uses: $/.github/workflows/bootstrap-script-gates.yml
 
   publish:
     name: Publish to the download alias
     needs: gates
     runs-on: windows-latest
+    # Job-scoped: only the publish job federates to Azure, the gates job never holds an
+    # OIDC token it does not need.
+    permissions:
+      contents: read
+      id-token: write   # OIDC federated login for the storage writes (secret-less)
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Check code-signing configuration
         shell: pwsh
@@ -70,7 +78,7 @@ jobs:
       # both federated credentials are bound to the ref, so this job must never carry a
       # GitHub `environment:`.
       - name: Login to Azure (code-signing identity)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -91,7 +99,7 @@ jobs:
       # runs the same publisher with -DryRun and deliberately without a login -- a dry run
       # must never need Azure credentials.
       - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

rules/analyze/ANALYZE-DEV-004.json

@@ -2,10 +2,10 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-DEV-004",
   "title": "Windows Update Failed During Enrollment",
-  "description": "Detects a Windows quality/cumulative update that FAILED to install during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 20). A cumulative update failing mid-OOBE is a known cause of enrollment errors and is otherwise invisible in the Intune console.",
+  "description": "Detects a Windows quality/cumulative update that FAILED to install or download during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 20 from the System log, 31 from the Operational channel). A cumulative update failing mid-OOBE is a known cause of enrollment errors and is otherwise invisible in the Intune console.",
   "severity": "high",
   "category": "device",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
   "evaluateOn": [
     "enrollment_end",
@@ -18,10 +18,14 @@
   "conditions": [
     {
       "signal": "wu_install_failed",
-      "source": "event_type",
+      "source": "event_data",
       "eventType": "windows_update_failed",
+      "dataField": "wuEventId",
       "operator": "exists",
       "value": "",
+      "filterField": "wuPhase",
+      "filterOperator": "in",
+      "filterValue": "install,download",
       "required": true
     },
     {
@@ -31,6 +35,9 @@
       "dataField": "updateTitle",
       "operator": "exists",
       "value": "",
+      "filterField": "wuPhase",
+      "filterOperator": "in",
+      "filterValue": "install,download",
       "required": false
     },
     {
@@ -40,6 +47,9 @@
       "dataField": "hresult",
       "operator": "exists",
       "value": "",
+      "filterField": "wuPhase",
+      "filterOperator": "in",
+      "filterValue": "install,download",
       "required": false
     },
     {
@@ -49,6 +59,9 @@
       "dataField": "hresultSymbol",
       "operator": "exists",
       "value": "",
+      "filterField": "wuPhase",
+      "filterOperator": "in",
+      "filterValue": "install,download",
       "required": false
     },
     {

rules/analyze/ANALYZE-DEV-013.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-013",
+  "title": "OOBE Quality Update Failed",
+  "description": "Detects that the Windows quality update page at the end of OOBE (Enrollment Status Page setting \"Install Windows quality updates\") reported a failed download or install and recorded no successful install afterwards — the page's own failure names on the oobe_update_page events. Setup usually continues, so the failure is otherwise invisible: the device finishes OOBE without the monthly security update. An OS build change across a restart (os_build_changed) vetoes the finding, and so does the agent's names_capped marker — once the page's event names were capped, a missing success name proves nothing. A downloadInstallFailureHelper entry alone is no failure: updates that installed fine log it too.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "update_failure",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "in",
+      "value": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+      "required": true
+    },
+    {
+      "signal": "no_install_success",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+      "required": true
+    },
+    {
+      "signal": "os_build_unchanged",
+      "source": "event_type",
+      "eventType": "os_build_changed",
+      "operator": "not_exists",
+      "value": "",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    },
+    {
+      "signal": "update_page_failed",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "result",
+      "operator": "equals",
+      "value": "fail",
+      "filterField": "page",
+      "filterOperator": "equals",
+      "filterValue": "OobeNDUP",
+      "required": false
+    },
+    {
+      "signal": "update_skipped",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "regex",
+      "value": "SkipDownloadInstallButtonClicked$",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "update_page_failed",
+      "condition": "exists",
+      "weight": 10
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE reported `{{update_failure}}`, and no successful install was recorded afterwards. When the download or install of the update fails, the page gives up and setup continues, so the enrollment itself can still succeed — but the device most likely finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. Selecting Skip on the page after the failure leads to the same result.",
+  "remediation": [
+    {
+      "title": "Find out why the update failed",
+      "steps": [
+        "Open the oobe_update_page events around the failure in the session timeline: the download progress before it shows how far the download got, and a Skip after it shows that someone chose to continue.",
+        "Check the network path the device uses during OOBE for Windows Update and Delivery Optimization: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+        "Compare with other devices: the same failure on many devices of one site points at the network path, on one model at the device, and across the fleet at the update itself."
+      ]
+    },
+    {
+      "title": "Make sure the device gets the update",
+      "steps": [
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule.",
+        "Where the OOBE quality update keeps failing for one network or device group, decide per Enrollment Status Page profile whether \"Install Windows quality updates\" should stay on."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}

rules/analyze/ANALYZE-DEV-014.json

@@ -0,0 +1,119 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-014",
+  "title": "OOBE Quality Update Not Offered After an Earlier Failure",
+  "description": "Detects that the Windows quality update page at the end of OOBE found no update to install although the device is out of date, on a device whose update page counts an earlier failed download or install (oobe_update_page: NDUPDownloadInstallPreviousFailureCount above 0, osUpdatesWithNDUPPI false, getDaysOutOfDateSucceeded above 0). No failure and no install success are recorded in this session — a failure in this session is ANALYZE-DEV-013 — and the agent's names_capped marker vetoes the finding, because a missing name proves nothing once the page's names were capped. The device finishes OOBE without the monthly security update.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "previous_failures",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "SdxWebAppCloudNDUP_initialize_NDUPDownloadInstallPreviousFailureCount",
+      "required": true
+    },
+    {
+      "signal": "nothing_offered",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "equals",
+      "value": "false",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "SdxWebAppCloudNDUP_updateManager_processUpdatesMetadata_osUpdatesWithNDUPPI",
+      "required": true
+    },
+    {
+      "signal": "days_out_of_date",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+      "required": true
+    },
+    {
+      "signal": "no_update_failure",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "in",
+      "filterValue": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+      "required": true
+    },
+    {
+      "signal": "no_install_success",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE checked for updates and found none to install, although Windows reports the device as {{days_out_of_date}} days out of date. The page's failure counter for this device stands at {{previous_failures}}: an earlier download or install of an OOBE quality update on this device failed. The device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment.",
+  "remediation": [
+    {
+      "title": "Check the earlier attempt",
+      "steps": [
+        "Look at the device's earlier enrollment sessions — the failed attempt and its ANALYZE-DEV-013 finding are usually there.",
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+      ]
+    },
+    {
+      "title": "Reduce how far behind devices start",
+      "steps": [
+        "Devices that start OOBE many months behind need a long update during setup; a current OS image or factory build shortens it and gives a failed attempt less to repeat."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}

rules/analyze/ANALYZE-DEV-015.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-015",
+  "title": "OOBE Update Check Ended Without a Result",
+  "description": "Detects that the Windows quality update page at the end of OOBE started its Windows Update scan but ended without a scan result (oobe_update_page: startWUScanStartedSuccedded, an OobeNDUP stop and no ExpeditedUpdate_getUpdateResults name), on a device that is out of date and allowed to update. In the observed sessions the page ended two minutes after the scan started, on devices more than a year behind. The device finishes OOBE without the monthly security update. The agent's names_capped marker vetoes the finding: once the page's event names were capped, a missing scan result proves nothing.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "update_allowed",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "equals",
+      "value": "true",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded",
+      "required": true
+    },
+    {
+      "signal": "scan_started",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "equals",
+      "value": "ExpeditedUpdate_startWUScanStartedSuccedded",
+      "required": true
+    },
+    {
+      "signal": "no_scan_result",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "^ExpeditedUpdate_getUpdateResults",
+      "required": true
+    },
+    {
+      "signal": "update_page_ended",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "equals",
+      "value": "page_stopped",
+      "filterField": "page",
+      "filterOperator": "equals",
+      "filterValue": "OobeNDUP",
+      "required": true
+    },
+    {
+      "signal": "days_out_of_date",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE started a Windows Update scan, but no scan result arrived before the page ended. The device is {{days_out_of_date}} days out of date, so an update was due — the device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. The page waits only a short time for the scan (two minutes in the observed sessions): a scan that takes longer, or cannot reach Windows Update, ends the page without an update.",
+  "remediation": [
+    {
+      "title": "Check the path to Windows Update during OOBE",
+      "steps": [
+        "Verify that devices in OOBE reach the Windows Update service: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+        "Check whether an update policy applied during the Enrollment Status Page points the scan at another source, such as WSUS."
+      ]
+    },
+    {
+      "title": "Shorten the scan",
+      "steps": [
+        "Devices far behind scan longer; a current OS image or factory build keeps the OOBE scan short.",
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}

rules/analyze/ANALYZE-OFFICE-001.json

@@ -2,10 +2,10 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-OFFICE-001",
   "title": "Microsoft 365 Apps Install Failed",
-  "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) background install did not reach completion. The V2 OfficeInstallDetector watches the C2R client directly (registry + process) and emits office_install_failed when the install scenario was abandoned (worker gone and streaming never finished) or a C2R failure code was observed. This catches Office failures that the Intune integrated app type hides, because IME reports the app done within 1-2 minutes while C2R keeps installing in the background.",
+  "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) install failed. The V2 OfficeInstallDetector watches the C2R client directly (registry, Delivery Optimization, process) and emits office_install_failed when the C2R INSTALL scenario records an error code. Completion is proven by the core Office binaries on disk; an install window that closes without that proof ends silently, never as a failure. This catches Office failures the deployment status hides: the Intune built-in app type is marked done once the configuration is delivered, and a Win32 or RealmJoin package once its installer exits, while C2R keeps installing in the background.",
   "severity": "warning",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "enabled": true,
   "evaluateOn": [
     "enrollment_end",
@@ -39,12 +39,12 @@
     }
   ],
   "confidenceThreshold": 40,
-  "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install did not finish.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real background install lifecycle. The Intune \"integrated\" Microsoft 365 Apps app type only pushes the configuration XML and starts the C2R bootstrapper, so IME marks the app done within 1-2 minutes while C2R keeps streaming and laying down the product for several more minutes. This event means C2R activity ended (the OfficeC2RClient worker exited and the install scenario cleared) without the StreamingFinished flag being set, or a C2R failure code was observed.\n\nReview the office_install_failed event payload: `products`, `channel`, `phase`, `streamingFinished`, `errorCode` (best-effort — may be empty) and `durationSeconds`.",
+  "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install failed.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real install lifecycle, however it was started. The Intune built-in Microsoft 365 Apps app type delivers the configuration through the Office CSP and lets the device start C2R; a Win32 or RealmJoin package runs the Office Deployment Tool. Either way the deployment is marked done before C2R has finished laying down the product. This event means C2R recorded an error code in its INSTALL scenario before the core Office apps were on disk.\n\nReview the office_install_failed event payload: `products`, `channel`, `errorCode`, `errorSource` (the C2R registry value that carried the code) and `durationSeconds`.",
   "remediation": [
     {
       "title": "Investigate the Office C2R install failure",
       "steps": [
-        "Open the office_install_failed event and review products, channel, phase, streamingFinished and errorCode",
+        "Open the office_install_failed event and review products, channel, errorCode and errorSource",
         "Check the Click-to-Run logs on the device (%windir%\\Temp and %temp%, files named <MachineName>-yyyymmdd-nnnn.log) for the failing operation",
         "Verify the device had network reachability to the Office CDN / Microsoft Connected Cache during the enrollment window",
         "Confirm the Intune Microsoft 365 Apps app configuration (products, channel, architecture) matches what the device can install",

rules/dist/analyze-rules.json

@@ -1385,10 +1385,10 @@
     {
       "ruleId": "ANALYZE-DEV-004",
       "title": "Windows Update Failed During Enrollment",
-      "description": "Detects a Windows quality/cumulative update that FAILED to install during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 20). A cumulative update failing mid-OOBE is a known cause of enrollment errors and is otherwise invisible in the Intune console.",
+      "description": "Detects a Windows quality/cumulative update that FAILED to install or download during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 20 from the System log, 31 from the Operational channel). A cumulative update failing mid-OOBE is a known cause of enrollment errors and is otherwise invisible in the Intune console.",
       "severity": "high",
       "category": "device",
-      "version": "1.1.0",
+      "version": "1.2.0",
       "enabled": true,
       "evaluateOn": [
         "enrollment_end",
@@ -1401,10 +1401,14 @@
       "conditions": [
         {
           "signal": "wu_install_failed",
-          "source": "event_type",
+          "source": "event_data",
           "eventType": "windows_update_failed",
+          "dataField": "wuEventId",
           "operator": "exists",
           "value": "",
+          "filterField": "wuPhase",
+          "filterOperator": "in",
+          "filterValue": "install,download",
           "required": true
         },
         {
@@ -1414,6 +1418,9 @@
           "dataField": "updateTitle",
           "operator": "exists",
           "value": "",
+          "filterField": "wuPhase",
+          "filterOperator": "in",
+          "filterValue": "install,download",
           "required": false
         },
         {
@@ -1423,6 +1430,9 @@
           "dataField": "hresult",
           "operator": "exists",
           "value": "",
+          "filterField": "wuPhase",
+          "filterOperator": "in",
+          "filterValue": "install,download",
           "required": false
         },
         {
@@ -1432,6 +1442,9 @@
           "dataField": "hresultSymbol",
           "operator": "exists",
           "value": "",
+          "filterField": "wuPhase",
+          "filterOperator": "in",
+          "filterValue": "install,download",
           "required": false
         },
         {
@@ -1917,6 +1930,357 @@
         "environment"
       ]
     },
+    {
+      "ruleId": "ANALYZE-DEV-013",
+      "title": "OOBE Quality Update Failed",
+      "description": "Detects that the Windows quality update page at the end of OOBE (Enrollment Status Page setting \"Install Windows quality updates\") reported a failed download or install and recorded no successful install afterwards — the page's own failure names on the oobe_update_page events. Setup usually continues, so the failure is otherwise invisible: the device finishes OOBE without the monthly security update. An OS build change across a restart (os_build_changed) vetoes the finding, and so does the agent's names_capped marker — once the page's event names were capped, a missing success name proves nothing. A downloadInstallFailureHelper entry alone is no failure: updates that installed fine log it too.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "update_failure",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "in",
+          "value": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+          "required": true
+        },
+        {
+          "signal": "no_install_success",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+          "required": true
+        },
+        {
+          "signal": "os_build_unchanged",
+          "source": "event_type",
+          "eventType": "os_build_changed",
+          "operator": "not_exists",
+          "value": "",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        },
+        {
+          "signal": "update_page_failed",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "result",
+          "operator": "equals",
+          "value": "fail",
+          "filterField": "page",
+          "filterOperator": "equals",
+          "filterValue": "OobeNDUP",
+          "required": false
+        },
+        {
+          "signal": "update_skipped",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "regex",
+          "value": "SkipDownloadInstallButtonClicked$",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "update_page_failed",
+          "condition": "exists",
+          "weight": 10
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE reported `{{update_failure}}`, and no successful install was recorded afterwards. When the download or install of the update fails, the page gives up and setup continues, so the enrollment itself can still succeed — but the device most likely finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. Selecting Skip on the page after the failure leads to the same result.",
+      "remediation": [
+        {
+          "title": "Find out why the update failed",
+          "steps": [
+            "Open the oobe_update_page events around the failure in the session timeline: the download progress before it shows how far the download got, and a Skip after it shows that someone chose to continue.",
+            "Check the network path the device uses during OOBE for Windows Update and Delivery Optimization: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+            "Compare with other devices: the same failure on many devices of one site points at the network path, on one model at the device, and across the fleet at the update itself."
+          ]
+        },
+        {
+          "title": "Make sure the device gets the update",
+          "steps": [
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule.",
+            "Where the OOBE quality update keeps failing for one network or device group, decide per Enrollment Status Page profile whether \"Install Windows quality updates\" should stay on."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-014",
+      "title": "OOBE Quality Update Not Offered After an Earlier Failure",
+      "description": "Detects that the Windows quality update page at the end of OOBE found no update to install although the device is out of date, on a device whose update page counts an earlier failed download or install (oobe_update_page: NDUPDownloadInstallPreviousFailureCount above 0, osUpdatesWithNDUPPI false, getDaysOutOfDateSucceeded above 0). No failure and no install success are recorded in this session — a failure in this session is ANALYZE-DEV-013 — and the agent's names_capped marker vetoes the finding, because a missing name proves nothing once the page's names were capped. The device finishes OOBE without the monthly security update.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "previous_failures",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "SdxWebAppCloudNDUP_initialize_NDUPDownloadInstallPreviousFailureCount",
+          "required": true
+        },
+        {
+          "signal": "nothing_offered",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "equals",
+          "value": "false",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "SdxWebAppCloudNDUP_updateManager_processUpdatesMetadata_osUpdatesWithNDUPPI",
+          "required": true
+        },
+        {
+          "signal": "days_out_of_date",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+          "required": true
+        },
+        {
+          "signal": "no_update_failure",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "in",
+          "filterValue": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+          "required": true
+        },
+        {
+          "signal": "no_install_success",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE checked for updates and found none to install, although Windows reports the device as {{days_out_of_date}} days out of date. The page's failure counter for this device stands at {{previous_failures}}: an earlier download or install of an OOBE quality update on this device failed. The device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment.",
+      "remediation": [
+        {
+          "title": "Check the earlier attempt",
+          "steps": [
+            "Look at the device's earlier enrollment sessions — the failed attempt and its ANALYZE-DEV-013 finding are usually there.",
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+          ]
+        },
+        {
+          "title": "Reduce how far behind devices start",
+          "steps": [
+            "Devices that start OOBE many months behind need a long update during setup; a current OS image or factory build shortens it and gives a failed attempt less to repeat."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-015",
+      "title": "OOBE Update Check Ended Without a Result",
+      "description": "Detects that the Windows quality update page at the end of OOBE started its Windows Update scan but ended without a scan result (oobe_update_page: startWUScanStartedSuccedded, an OobeNDUP stop and no ExpeditedUpdate_getUpdateResults name), on a device that is out of date and allowed to update. In the observed sessions the page ended two minutes after the scan started, on devices more than a year behind. The device finishes OOBE without the monthly security update. The agent's names_capped marker vetoes the finding: once the page's event names were capped, a missing scan result proves nothing.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "update_allowed",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "equals",
+          "value": "true",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded",
+          "required": true
+        },
+        {
+          "signal": "scan_started",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "equals",
+          "value": "ExpeditedUpdate_startWUScanStartedSuccedded",
+          "required": true
+        },
+        {
+          "signal": "no_scan_result",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "^ExpeditedUpdate_getUpdateResults",
+          "required": true
+        },
+        {
+          "signal": "update_page_ended",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "equals",
+          "value": "page_stopped",
+          "filterField": "page",
+          "filterOperator": "equals",
+          "filterValue": "OobeNDUP",
+          "required": true
+        },
+        {
+          "signal": "days_out_of_date",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE started a Windows Update scan, but no scan result arrived before the page ended. The device is {{days_out_of_date}} days out of date, so an update was due — the device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. The page waits only a short time for the scan (two minutes in the observed sessions): a scan that takes longer, or cannot reach Windows Update, ends the page without an update.",
+      "remediation": [
+        {
+          "title": "Check the path to Windows Update during OOBE",
+          "steps": [
+            "Verify that devices in OOBE reach the Windows Update service: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+            "Check whether an update policy applied during the Enrollment Status Page points the scan at another source, such as WSUS."
+          ]
+        },
+        {
+          "title": "Shorten the scan",
+          "steps": [
+            "Devices far behind scan longer; a current OS image or factory build keeps the OOBE scan short.",
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
     {
       "ruleId": "ANALYZE-ENRL-001",
       "title": "Enrollment Failed",
@@ -3246,10 +3610,10 @@
     {
       "ruleId": "ANALYZE-OFFICE-001",
       "title": "Microsoft 365 Apps Install Failed",
-      "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) background install did not reach completion. The V2 OfficeInstallDetector watches the C2R client directly (registry + process) and emits office_install_failed when the install scenario was abandoned (worker gone and streaming never finished) or a C2R failure code was observed. This catches Office failures that the Intune integrated app type hides, because IME reports the app done within 1-2 minutes while C2R keeps installing in the background.",
+      "description": "Detects when the Microsoft 365 Apps (Office Click-to-Run) install failed. The V2 OfficeInstallDetector watches the C2R client directly (registry, Delivery Optimization, process) and emits office_install_failed when the C2R INSTALL scenario records an error code. Completion is proven by the core Office binaries on disk; an install window that closes without that proof ends silently, never as a failure. This catches Office failures the deployment status hides: the Intune built-in app type is marked done once the configuration is delivered, and a Win32 or RealmJoin package once its installer exits, while C2R keeps installing in the background.",
       "severity": "warning",
       "category": "apps",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "enabled": true,
       "evaluateOn": [
         "enrollment_end",
@@ -3283,12 +3647,12 @@
         }
       ],
       "confidenceThreshold": 40,
-      "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install did not finish.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real background install lifecycle. The Intune \"integrated\" Microsoft 365 Apps app type only pushes the configuration XML and starts the C2R bootstrapper, so IME marks the app done within 1-2 minutes while C2R keeps streaming and laying down the product for several more minutes. This event means C2R activity ended (the OfficeC2RClient worker exited and the install scenario cleared) without the StreamingFinished flag being set, or a C2R failure code was observed.\n\nReview the office_install_failed event payload: `products`, `channel`, `phase`, `streamingFinished`, `errorCode` (best-effort — may be empty) and `durationSeconds`.",
+      "explanation": "The Microsoft 365 Apps (Office Click-to-Run) install failed.\n\nThe OfficeInstallDetector watches the C2R client directly and reports the real install lifecycle, however it was started. The Intune built-in Microsoft 365 Apps app type delivers the configuration through the Office CSP and lets the device start C2R; a Win32 or RealmJoin package runs the Office Deployment Tool. Either way the deployment is marked done before C2R has finished laying down the product. This event means C2R recorded an error code in its INSTALL scenario before the core Office apps were on disk.\n\nReview the office_install_failed event payload: `products`, `channel`, `errorCode`, `errorSource` (the C2R registry value that carried the code) and `durationSeconds`.",
       "remediation": [
         {
           "title": "Investigate the Office C2R install failure",
           "steps": [
-            "Open the office_install_failed event and review products, channel, phase, streamingFinished and errorCode",
+            "Open the office_install_failed event and review products, channel, errorCode and errorSource",
             "Check the Click-to-Run logs on the device (%windir%\\Temp and %temp%, files named <MachineName>-yyyymmdd-nnnn.log) for the failing operation",
             "Verify the device had network reachability to the Office CDN / Microsoft Connected Cache during the enrollment window",
             "Confirm the Intune Microsoft 365 Apps app configuration (products, channel, architecture) matches what the device can install",

rules/dist/ime-log-patterns.json

@@ -34,6 +34,14 @@
       "description": "Captures the exit code of a health-script execution. Feeds the early-signal slot consumed by HS-COMPLIANCE so the user sees the real exit code (not just the inferred 0/1) before HS-NEW-RESULT arrives.",
       "enabled": true
     },
+    {
+      "patternId": "HS-INVOCATION",
+      "category": "always",
+      "pattern": "^\"[^\"]{0,260}\\\\agentexecutor\\.exe\"\\s+-(?<kind>remediationScript)\\s",
+      "action": "agentInvocationArgument",
+      "description": "The IME service's command line for a health-script executor, written by the health-script worker to IntuneManagementExtension.log and HealthScripts.log right before 'Launch powershell executor in ... session'. Opens an invocation that owns nothing, so the launch line the same worker writes next never sets the context of the platform script whose run is in flight in the IME log. The platform-script command line ('-powershell') does not match.",
+      "enabled": true
+    },
     {
       "patternId": "HS-NEW-RESULT",
       "category": "always",
@@ -195,7 +203,7 @@
       "category": "currentPhase",
       "pattern": "^\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
       "action": "updateDoTelemetry",
-      "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent in 1.104.102.0 and 1.105.103.0 decompiles, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.",
+      "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent from the 1.104.102.0 and 1.105.103.0 builds, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.",
       "enabled": true
     },
     {
@@ -576,7 +584,7 @@
       "category": "always",
       "pattern": "^Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
       "action": "imeTokenFailure",
-      "description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104 decompiled sources.",
+      "description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104.",
       "enabled": true
     },
     {
@@ -646,6 +654,22 @@
       "description": "Detects WinGet app installation progress with Operation Phase = Installing (format variant 2).",
       "enabled": true
     },
+    {
+      "patternId": "PS-AGENT-ARG",
+      "category": "always",
+      "pattern": "^Adding argument (?<kind>[A-Za-z0-9]+) with value ",
+      "action": "agentInvocationArgument",
+      "description": "The first argument line of every AgentExecutor.exe invocation (powershell, remediationScript, detectionScript, requirementScript, ...). Opens the invocation that owns the policyId-less exit/output lines following it in AgentExecutor.log; PS-AGENT-SCRIPT-START upgrades a powershell invocation to its platform script. Also keeps the tracker's overwrite check active while the invocation runs.",
+      "enabled": true
+    },
+    {
+      "patternId": "PS-AGENT-COMPLETED",
+      "category": "always",
+      "pattern": "^Agent executor completed\\.",
+      "action": "agentExecutorCompleted",
+      "description": "Last line of an AgentExecutor.exe invocation. Closes the invocation's ownership of the exit/output lines in AgentExecutor.log and triggers the tracker's overwrite check: the executor wrote its end block at its own stream position, which may lie behind the tracker's bookmark when another process appended meanwhile.",
+      "enabled": true
+    },
     {
       "patternId": "PS-AGENT-ERROR",
       "category": "always",
@@ -708,14 +732,6 @@
       "description": "Captures whether a PowerShell script runs in machine (System) or user session context.",
       "enabled": true
     },
-    {
-      "patternId": "PS-SCRIPT-EXITCODE",
-      "category": "always",
-      "pattern": "^Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
-      "action": "scriptExitCode",
-      "description": "Captures the PowerShell exit code when script execution completes in the IME log.",
-      "enabled": true
-    },
     {
       "patternId": "PS-SCRIPT-GENERATED",
       "category": "always",

rules/guardrails.json

@@ -300,6 +300,7 @@
     "script_completed",
     "script_failed",
     "script_timeout_suspected",
+    "script_recurrence_summary",
     "esp_phase_changed",
     "ime_agent_version",
     "ime_token_failure",

rules/ime-log-patterns/HS-INVOCATION.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "HS-INVOCATION",
+  "category": "always",
+  "pattern": "^\"[^\"]{0,260}\\\\agentexecutor\\.exe\"\\s+-(?<kind>remediationScript)\\s",
+  "action": "agentInvocationArgument",
+  "description": "The IME service's command line for a health-script executor, written by the health-script worker to IntuneManagementExtension.log and HealthScripts.log right before 'Launch powershell executor in ... session'. Opens an invocation that owns nothing, so the launch line the same worker writes next never sets the context of the platform script whose run is in flight in the IME log. The platform-script command line ('-powershell') does not match.",
+  "enabled": true
+}

rules/ime-log-patterns/IME-DO-TEL.json

@@ -4,6 +4,6 @@
   "category": "currentPhase",
   "pattern": "^\\[DO TEL\\] = (?<doTelJson>\\{.*\\})",
   "action": "updateDoTelemetry",
-  "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent in 1.104.102.0 and 1.105.103.0 decompiles, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.",
+  "description": "Captures Delivery Optimization telemetry JSON after a DO download completes. Contains file size, peer caching stats, download mode, and duration. IME removed the [DO TEL] emitter in 1.104 (absent from the 1.104.102.0 and 1.105.103.0 builds, present in 1.97.107.0); kept while 1.101/1.103 devices are in the fleet — retire once those versions are gone.",
   "enabled": true
 }

rules/ime-log-patterns/IME-TOKEN-FAILURE.json

@@ -4,6 +4,6 @@
   "category": "always",
   "pattern": "^Failed to get AAD token\\..*?errorCode = (?<errorCode>.*?)$",
   "action": "imeTokenFailure",
-  "description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104 decompiled sources.",
+  "description": "IME token acquisition failure ('Failed to get AAD token. len = N using client id ... and resource id ..., errorCode = N', IntuneTokenManager, IntuneManagementExtension.log). This line appears ROUTINELY during the device phase (no user token exists yet), so the agent holds the failure pending: any IME-TOKEN-SUCCESS match clears it, and the ime_token_failure Warning fires only when no success follows for the whole 30-min grace window (then deduped to one Warning per distinct errorCode). A genuine auth outage (WAM broken, conditional access, network) runs long enough to hit the window. Verified against IME 1.97 and 1.104.",
   "enabled": true
 }

rules/ime-log-patterns/PS-AGENT-ARG.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "PS-AGENT-ARG",
+  "category": "always",
+  "pattern": "^Adding argument (?<kind>[A-Za-z0-9]+) with value ",
+  "action": "agentInvocationArgument",
+  "description": "The first argument line of every AgentExecutor.exe invocation (powershell, remediationScript, detectionScript, requirementScript, ...). Opens the invocation that owns the policyId-less exit/output lines following it in AgentExecutor.log; PS-AGENT-SCRIPT-START upgrades a powershell invocation to its platform script. Also keeps the tracker's overwrite check active while the invocation runs.",
+  "enabled": true
+}

rules/ime-log-patterns/PS-AGENT-COMPLETED.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "PS-AGENT-COMPLETED",
+  "category": "always",
+  "pattern": "^Agent executor completed\\.",
+  "action": "agentExecutorCompleted",
+  "description": "Last line of an AgentExecutor.exe invocation. Closes the invocation's ownership of the exit/output lines in AgentExecutor.log and triggers the tracker's overwrite check: the executor wrote its end block at its own stream position, which may lie behind the tracker's bookmark when another process appended meanwhile.",
+  "enabled": true
+}

rules/ime-log-patterns/PS-SCRIPT-EXITCODE.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "../schema/ime-log-pattern.schema.json",
-  "patternId": "PS-SCRIPT-EXITCODE",
-  "category": "always",
-  "pattern": "^Powershell execution is done, exitCode = (?<exitCode>-?\\d+)",
-  "action": "scriptExitCode",
-  "description": "Captures the PowerShell exit code when script execution completes in the IME log.",
-  "enabled": true
-}

rules/schema/ime-log-pattern.schema.json

@@ -71,6 +71,8 @@
             "scriptOutput",
             "scriptCompleted",
             "resetPlatformScriptContext",
+            "agentInvocationArgument",
+            "agentExecutorCompleted",
             "healthScriptResult",
             "healthScriptDetectionResult",
             "captureExitCode",

rules/scripts/.npmrc

@@ -0,0 +1,3 @@
+# ajv-cli declares ts-node as a peer dependency it never needs for JSON schemas; do not
+# pull ts-node + typescript into a job that pushes to main.
+legacy-peer-deps=true

rules/scripts/package-lock.json

@@ -0,0 +1,315 @@
+{
+  "name": "autopilot-monitor-rules-tooling",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "autopilot-monitor-rules-tooling",
+      "devDependencies": {
+        "ajv-cli": "5.0.0",
+        "ajv-formats": "3.0.1"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-cli": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/ajv-cli/-/ajv-cli-5.0.0.tgz",
+      "integrity": "sha512-LY4m6dUv44HTyhV+u2z5uX4EhPYTM38Iv1jdgDJJJCyOOuqB8KtZEGjPZ2T+sh5ZIJrXUfgErYx/j3gLd3+PlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0",
+        "fast-json-patch": "^2.0.0",
+        "glob": "^7.1.0",
+        "js-yaml": "^3.14.0",
+        "json-schema-migrate": "^2.0.0",
+        "json5": "^2.1.3",
+        "minimist": "^1.2.0"
+      },
+      "bin": {
+        "ajv": "dist/index.js"
+      },
+      "peerDependencies": {
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ts-node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-json-patch": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz",
+      "integrity": "sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/js-yaml": {
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/json-schema-migrate": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-migrate/-/json-schema-migrate-2.0.0.tgz",
+      "integrity": "sha512-r38SVTtojDRp4eD6WsCqiE0eNDt4v1WalBXb9cyZYw9ai5cGtBwzRNWjHzJl38w6TxFkXAIA7h+fyX3tnrAFhQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      }
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true,
+      "license": "ISC"
+    }
+  }
+}

rules/scripts/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "autopilot-monitor-rules-tooling",
+  "private": true,
+  "description": "Validator tooling for rules/ - combine-rules.yml installs from the lockfile so nothing unpinned reaches a job that pushes to main.",
+  "devDependencies": {
+    "ajv-cli": "5.0.0",
+    "ajv-formats": "3.0.1"
+  },
+  "overrides": {
+    "fast-json-patch": "3.1.1"
+  }
+}

scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1

@@ -29,10 +29,9 @@
          Cloud PCs are never Autopilot-registered, so this enables agent monitoring
          of Cloud PC first-connect enrollment)
       - IntuneDeviceBinding     -> DeviceManagementManagedDevices.Read.All
-        (cert-to-device binding: verifies that the Intune device id carried in the
-         agent's client certificate is a device THIS tenant actually enrolled --
-         currently a Global-Admin-only preview that records telemetry and does not
-         block enrollment)
+        (Intune Enrollment Validation: accepts devices enrolled in THIS tenant's
+         Intune, matched by the Intune device id in the agent's client certificate,
+         without Autopilot registration, corporate identifier or device association)
       - All                    -> every optional permission above, in one run
         (also works with -Revoke to remove all optional grants at once)
 
@@ -76,15 +75,17 @@
 .NOTES
     Requires:
       - Microsoft.Graph.Authentication PowerShell module (auto-installs if missing).
-      - Sign-in as Global Administrator OR Privileged Role Administrator OR Cloud Application Administrator.
+      - Sign-in as Global Administrator OR Privileged Role Administrator (with PIM, activate the
+        role first). Only these roles may assign Microsoft Graph application permissions;
+        Application Administrator and Cloud Application Administrator are not enough.
+      - The Autopilot Monitor app must be admin-consented in your tenant first
+        (its service principal must exist before grants can be added).
 
     Sign-in behaviour:
       In Azure Cloud Shell the script signs in via the ambient identity endpoint (a delegated
       token for the already-signed-in user) - no device-code prompt, which Conditional Access
       policies commonly block. Outside Cloud Shell it falls back to a normal interactive
       Microsoft Graph sign-in. -TenantId only applies to the interactive fallback.
-      - The Autopilot Monitor app must be admin-consented in your tenant first
-        (its service principal must exist before grants can be added).
 
     After granting:
       The Autopilot Monitor backend may cache an older token for up to ~1 hour. Use the
@@ -140,6 +141,36 @@ if ($PSCmdlet.ParameterSetName -eq 'ByFeatures') {
 # ---- Constants ----
 $MicrosoftGraphAppId = '00000003-0000-0000-c000-000000000000'
 
+# ---- Graph failure details ----
+# Invoke-MgGraphRequest puts only "Response status code does not indicate success: ..." into the
+# exception message. Graph's own error (code + message) is the response body in ErrorDetails,
+# behind the request line, the status line and the headers. Some headers carry JSON themselves
+# (x-ms-ags-diagnostic), so the body is taken from behind the blank line that ends the headers.
+function Get-GraphFailure {
+    param([System.Management.Automation.ErrorRecord]$ErrorRecord)
+
+    $status = 0
+    if ($ErrorRecord.Exception.PSObject.Properties['Response'] -and $ErrorRecord.Exception.Response) {
+        $status = [int]$ErrorRecord.Exception.Response.StatusCode
+    }
+
+    $text = $ErrorRecord.Exception.Message
+    if ($ErrorRecord.ErrorDetails -and $ErrorRecord.ErrorDetails.Message) {
+        $body = ($ErrorRecord.ErrorDetails.Message -split '\r?\n\r?\n', 2)[-1].Trim()
+        if ($body.StartsWith('{')) {
+            try {
+                $graphError = ($body | ConvertFrom-Json).error
+                if ($graphError.code) { $text = "$($graphError.code): $($graphError.message)" }
+            }
+            catch {
+                # Not a Graph JSON body - keep the exception message.
+            }
+        }
+    }
+
+    [pscustomobject]@{ Status = $status; Text = $text }
+}
+
 # ---- Pre-flight: module ----
 if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
     Write-Host "[Setup] Microsoft.Graph.Authentication not installed. Installing for current user..." -ForegroundColor Yellow
@@ -189,7 +220,7 @@ Write-Host "[Auth] Granted scopes: $($ctx.Scopes -join ', ')"
 # carries a fixed scope set (incl. Directory.AccessAsUser.All) instead of the requested scopes,
 # and its effective rights follow the signed-in user's directory role.
 if (-not $identityConnected -and -not ($ctx.Scopes -contains 'AppRoleAssignment.ReadWrite.All')) {
-    Write-Warning "Scope 'AppRoleAssignment.ReadWrite.All' was NOT granted. The signed-in user likely lacks the required role (Global Admin / Privileged Role Admin / Cloud App Admin)."
+    Write-Warning "Scope 'AppRoleAssignment.ReadWrite.All' was NOT granted. The signed-in user likely lacks the required role (Global Administrator or Privileged Role Administrator)."
     if (-not $VerifyOnly) { return }
 }
 
@@ -263,6 +294,7 @@ $action = if ($Revoke) { 'Revoke' } else { 'Grant' }
 Write-Host "[4/4] $action mode - processing $($Permissions.Count) permission(s)..." -ForegroundColor Cyan
 
 $results = @()
+$graphForbidden = $false
 foreach ($permName in $Permissions) {
     $appRole = $graphSp.appRoles | Where-Object {
         $_.value -eq $permName -and $_.allowedMemberTypes -contains 'Application'
@@ -289,7 +321,9 @@ foreach ($permName in $Permissions) {
                 $results += [pscustomobject]@{ Permission = $permName; Status = 'Revoked' }
             }
             catch {
-                Write-Warning "  [FAIL]  '$permName' revoke failed: $($_.Exception.Message)"
+                $failure = Get-GraphFailure $_
+                if ($failure.Status -eq 403) { $graphForbidden = $true }
+                Write-Warning "  [FAIL]  '$permName' revoke failed: $($failure.Text)"
                 $results += [pscustomobject]@{ Permission = $permName; Status = 'Failed' }
             }
         }
@@ -316,7 +350,9 @@ foreach ($permName in $Permissions) {
             $results += [pscustomobject]@{ Permission = $permName; Status = 'Granted' }
         }
         catch {
-            Write-Warning "  [FAIL]  '$permName' grant failed: $($_.Exception.Message)"
+            $failure = Get-GraphFailure $_
+            if ($failure.Status -eq 403) { $graphForbidden = $true }
+            Write-Warning "  [FAIL]  '$permName' grant failed: $($failure.Text)"
             $results += [pscustomobject]@{ Permission = $permName; Status = 'Failed' }
         }
     }
@@ -325,6 +361,9 @@ foreach ($permName in $Permissions) {
 Write-Host ""
 Write-Host "=========== Summary ===========" -ForegroundColor Cyan
 $results | Format-Table -AutoSize | Out-Host
+if ($graphForbidden) {
+    Write-Warning "Microsoft Graph refused the change (403): the signed-in account may not manage Microsoft Graph application permissions. Sign in as Global Administrator or Privileged Role Administrator (with PIM, activate the role first) and run the script again."
+}
 Write-Host ""
 Write-Host "Note: token-cached backends may need up to ~1h to see the new permission set." -ForegroundColor Yellow
 Write-Host "      Use 'Refresh permission status' in the admin UI to apply changes immediately." -ForegroundColor Yellow

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/DiagnosticsPathGuardsTests.cs

@@ -0,0 +1,193 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// A configured diagnostics entry is resolved to the folder and pattern that get
+    /// enumerated, and the guard judges exactly that folder. The cases below pin the
+    /// property that matters: no spelling of an allowed entry ever selects its parent.
+    /// </summary>
+    public sealed class DiagnosticsPathGuardsTests
+    {
+        private const string TestProfile = @"C:\Users\TestUser";
+
+        private static readonly Func<string, bool> IsDirectory = _ => true;
+        private static readonly Func<string, bool> IsNotDirectory = _ => false;
+
+        private static DiagnosticsPathGuards.CollectionTarget Resolve(
+            string path,
+            bool includeSubfolders = false,
+            bool unrestrictedMode = false,
+            string? userProfilePath = null,
+            Func<string, bool>? directoryExists = null)
+        {
+            Assert.True(DiagnosticsPathGuards.TryResolveCollectionTarget(
+                path, includeSubfolders, unrestrictedMode, userProfilePath!, directoryExists ?? IsDirectory, out var target));
+            return target;
+        }
+
+        private static void AssertRefused(
+            string path,
+            bool unrestrictedMode = false,
+            string? userProfilePath = null,
+            Func<string, bool>? directoryExists = null)
+        {
+            Assert.False(DiagnosticsPathGuards.TryResolveCollectionTarget(
+                path, true, unrestrictedMode, userProfilePath!, directoryExists ?? IsDirectory, out var target));
+            Assert.Null(target);
+        }
+
+        // ------------------------------------------------------------ folder entries
+
+        [Theory]
+        [InlineData(@"C:\Windows\Logs")]
+        [InlineData(@"C:\Windows\Logs\")]
+        [InlineData(@"C:\Windows\SetupDiag")]
+        [InlineData(@"C:\ProgramData\AutopilotMonitor")]
+        [InlineData(@"C:\ProgramData\Microsoft\DiagnosticLogCSP")]
+        public void Folder_entry_collects_from_itself_never_from_its_parent(string configured)
+        {
+            var target = Resolve(configured, includeSubfolders: true);
+
+            Assert.Equal(configured.TrimEnd('\\'), target.Folder, ignoreCase: true);
+            Assert.Equal("*", target.Pattern);
+            Assert.True(target.Recurse);
+        }
+
+        [Fact]
+        public void Trailing_separator_means_folder_even_when_the_folder_does_not_exist_yet()
+        {
+            var target = Resolve(@"C:\Windows\Logs\NotThereYet\", directoryExists: IsNotDirectory);
+
+            Assert.Equal(@"C:\Windows\Logs\NotThereYet", target.Folder, ignoreCase: true);
+            Assert.Equal("*", target.Pattern);
+        }
+
+        [Fact]
+        public void Folder_name_with_a_dot_is_still_a_folder()
+        {
+            var target = Resolve(@"C:\Windows\Logs\vendor.v2");
+
+            Assert.Equal(@"C:\Windows\Logs\vendor.v2", target.Folder, ignoreCase: true);
+            Assert.Equal("*", target.Pattern);
+        }
+
+        // ------------------------------------------------------------ wildcard entries
+
+        [Fact]
+        public void Wildcard_entry_collects_the_pattern_from_its_validated_parent()
+        {
+            var target = Resolve(@"C:\Windows\Panther\*.log", includeSubfolders: true);
+
+            Assert.Equal(@"C:\Windows\Panther", target.Folder, ignoreCase: true);
+            Assert.Equal("*.log", target.Pattern);
+            Assert.True(target.Recurse);
+        }
+
+        [Fact]
+        public void Wildcard_beside_an_allowlisted_file_is_refused()
+        {
+            // Only ReportingEvents.log is on the allowlist, not the folder it lives in.
+            AssertRefused(@"C:\Windows\SoftwareDistribution\*.log");
+        }
+
+        // ------------------------------------------------------------ file entries
+
+        [Fact]
+        public void File_entry_never_recurses_because_its_folder_was_not_validated()
+        {
+            var target = Resolve(
+                @"C:\Windows\SoftwareDistribution\ReportingEvents.log",
+                includeSubfolders: true,
+                directoryExists: IsNotDirectory);
+
+            Assert.Equal(@"C:\Windows\SoftwareDistribution", target.Folder, ignoreCase: true);
+            Assert.Equal("ReportingEvents.log", target.Pattern);
+            Assert.False(target.Recurse);
+        }
+
+        [Fact]
+        public void Missing_path_without_a_dot_is_one_file_name_not_a_wildcard_on_the_parent()
+        {
+            var target = Resolve(@"C:\Windows\Logs\nodot", includeSubfolders: true, directoryExists: IsNotDirectory);
+
+            Assert.Equal(@"C:\Windows\Logs", target.Folder, ignoreCase: true);
+            Assert.Equal("nodot", target.Pattern);
+            Assert.False(target.Recurse);
+        }
+
+        // ------------------------------------------------------------ refusals
+
+        [Theory]
+        [InlineData(@"C:\Windows")]
+        [InlineData(@"C:\ProgramData")]
+        [InlineData(@"C:\ProgramData\Microsoft")]
+        [InlineData(@"C:\Windows\Logs\..\System32")]
+        [InlineData(@"C:\Windows\LogsEvil")]
+        [InlineData("")]
+        public void Paths_outside_the_allowlist_are_refused(string configured)
+        {
+            AssertRefused(configured);
+        }
+
+        [Theory]
+        [InlineData(@"C:\Users")]
+        [InlineData(@"C:\Users\TestUser\Documents")]
+        [InlineData(@"C:\Windows\System32\config")]
+        [InlineData(@"C:\Windows\System32\config\*")]
+        public void Hard_blocks_hold_in_unrestricted_mode(string configured)
+        {
+            AssertRefused(configured, unrestrictedMode: true);
+        }
+
+        // ------------------------------------------------------------ user-profile token
+
+        [Fact]
+        public void Expanded_token_path_outside_AppData_is_refused_even_in_unrestricted_mode()
+        {
+            // The service expands %LOGGED_ON_USER_PROFILE% before the guard sees the path; an
+            // unexpanded token is not under C:\Users lexically and used to slip past the block.
+            AssertRefused(TestProfile + @"\Documents", unrestrictedMode: true, userProfilePath: TestProfile);
+            AssertRefused(TestProfile + @"\Documents\*.txt", unrestrictedMode: true, userProfilePath: TestProfile);
+        }
+
+        [Fact]
+        public void Expanded_token_path_on_the_profile_allowlist_is_admitted_in_restricted_mode()
+        {
+            var target = Resolve(
+                TestProfile + @"\AppData\Local\RealmJoin\Logs\*.log",
+                userProfilePath: TestProfile);
+
+            Assert.Equal(TestProfile + @"\AppData\Local\RealmJoin\Logs", target.Folder, ignoreCase: true);
+            Assert.Equal("*.log", target.Pattern);
+        }
+
+        [Fact]
+        public void Profile_path_without_the_token_stays_blocked()
+        {
+            AssertRefused(TestProfile + @"\AppData\Local\RealmJoin\Logs\*.log", userProfilePath: null);
+        }
+
+        // ------------------------------------------------------------ recursion guard
+
+        [Theory]
+        [InlineData(@"C:\Users")]
+        [InlineData(@"C:\Users\TestUser")]
+        [InlineData(@"C:\Windows\System32\config")]
+        [InlineData(@"C:\Windows\System32\config\RegBack")]
+        public void Recursion_never_enters_a_hard_blocked_subtree_in_unrestricted_mode(string directory)
+        {
+            Assert.False(DiagnosticsPathGuards.IsDirectoryEnterable(directory, unrestrictedMode: true, userProfilePath: null));
+        }
+
+        [Fact]
+        public void Recursion_enters_ordinary_subfolders()
+        {
+            Assert.True(DiagnosticsPathGuards.IsDirectoryEnterable(@"C:\Windows\System32\drivers", unrestrictedMode: true, userProfilePath: null));
+            Assert.True(DiagnosticsPathGuards.IsDirectoryEnterable(@"C:\Windows\Logs\CBS", unrestrictedMode: false, userProfilePath: null));
+            Assert.False(DiagnosticsPathGuards.IsDirectoryEnterable(@"C:\Windows\System32\drivers", unrestrictedMode: false, userProfilePath: null));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleCollectorGuardTests.cs

@@ -41,15 +41,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
         }
 
         private GatherRuleContext Context(bool unrestricted = false, string? imeLogPathOverride = null)
-            => new GatherRuleContext(
-                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            return new GatherRuleContext(
+                logger,
                 "sess", "tenant",
                 evt => _events.Add(evt),
                 imeLogPathOverride,
-                new LogFilePositionTracker())
+                new GatherRuleSessionState("sess", null, logger))
             {
                 UnrestrictedMode = unrestricted
             };
+        }
 
         private static GatherRule Rule(string collectorType, string target,
             Dictionary<string, string>? parameters = null) => new GatherRule

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleDebugLogTests.cs

@@ -94,7 +94,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
         public void Context_DebugLog_is_noop_without_writer()
         {
             var context = new GatherRuleContext(
-                _logger, "sess", "tenant", _ => { }, null, new LogFilePositionTracker());
+                _logger, "sess", "tenant", _ => { }, null, new GatherRuleSessionState("sess", null, _logger));
 
             context.DebugLog("RULE-1", GatherRuleDebugLog.StageScope, "should not throw, should not write");
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorRestartTests.cs

@@ -0,0 +1,220 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// An agent restart inside one enrollment session — a new <see cref="GatherRuleExecutor"/> on the
+    /// same state directory — continues where the previous run stopped: logparser rules do not
+    /// replay their log, on_change rules do not re-emit an unchanged result. Regression anchor:
+    /// session c8106021, where every restart replayed the whole HP Image Assistant log (70 events).
+    /// </summary>
+    [Collection("SerialThreading")] // startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorRestartTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly TempDirectory _stateDir = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly List<GatherRuleExecutor> _executors = new List<GatherRuleExecutor>();
+
+        // %TEMP% lives under C:\Users (hard-blocked) — log targets sit beside the test assembly.
+        private readonly string _logDir = Path.Combine(
+            AppContext.BaseDirectory, "gather-restart-tests-" + Guid.NewGuid().ToString("N"));
+
+        public GatherRuleExecutorRestartTests()
+        {
+            Directory.CreateDirectory(_logDir);
+        }
+
+        public void Dispose()
+        {
+            foreach (var executor in _executors)
+                executor.Dispose();
+            _tmp.Dispose();
+            _stateDir.Dispose();
+            try { Directory.Delete(_logDir, recursive: true); } catch { /* best effort */ }
+        }
+
+        private string StateFile => Path.Combine(_stateDir.Path, GatherRuleStatePersistence.FileName);
+
+        private List<EnrollmentEvent> Events
+        {
+            get { lock (_eventsGate) return _events.ToList(); }
+        }
+
+        /// <summary>One agent run: a fresh executor whose startup rules run once. Not disposed — a hard kill.</summary>
+        private GatherRuleExecutor AgentRun(GatherRule rule, string sessionId = "session-a", string? stateDirectory = "default",
+            Action<EnrollmentEvent>? onEvent = null, string? debugLogPath = null)
+        {
+            var executor = new GatherRuleExecutor(
+                sessionId, "tenant",
+                evt =>
+                {
+                    onEvent?.Invoke(evt);
+                    lock (_eventsGate) _events.Add(evt);
+                },
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                debugLogPath: debugLogPath,
+                stateDirectory: stateDirectory == "default" ? _stateDir.Path : stateDirectory)
+            {
+                UnrestrictedMode = true
+            };
+            _executors.Add(executor);
+            executor.UpdateRules(new List<GatherRule> { rule });
+            Assert.True(executor.WaitForStartupRules(30));
+            return executor;
+        }
+
+        private static GatherRule LogRule(string path, string id = "hpia-log-collect") => new GatherRule
+        {
+            RuleId = id,
+            Title = id,
+            CollectorType = "logparser",
+            Target = path,
+            Parameters = new Dictionary<string, string> { ["pattern"] = "^(?<status>Update .+)$", ["format"] = "text" },
+            Trigger = "startup",
+            OutputEventType = "HPiA-UpdateStatus",
+            Enabled = true,
+        };
+
+        private static GatherRule OnChangeFileRule(string path) => new GatherRule
+        {
+            RuleId = "GATHER-OC-FILE",
+            Title = "file presence",
+            CollectorType = "file",
+            Target = path,
+            Trigger = "startup",
+            OutputEventType = "gather_file_presence",
+            Enabled = true,
+            EmitMode = "on_change",
+        };
+
+        private string WriteLog(string name, string content)
+        {
+            var path = Path.Combine(_logDir, name);
+            File.WriteAllText(path, content);
+            return path;
+        }
+
+        private int StatusEvents => Events.Count(e => e.EventType == "HPiA-UpdateStatus");
+
+        [Fact]
+        public void Restart_does_not_replay_the_log_and_new_lines_arrive_once()
+        {
+            var path = WriteLog("HP Image Assistant.log", "Update one\nUpdate two\nnoise\n");
+
+            AgentRun(LogRule(path));
+            Assert.Equal(2, StatusEvents);
+
+            AgentRun(LogRule(path));                      // reboot, nothing new
+            Assert.Equal(2, StatusEvents);
+
+            File.AppendAllText(path, "Update three\n");
+            AgentRun(LogRule(path));                      // next restart picks up only the new line
+            Assert.Equal(3, StatusEvents);
+            Assert.Equal("Update three", Events.Last(e => e.EventType == "HPiA-UpdateStatus").Data["status"]);
+        }
+
+        [Fact]
+        public void Position_is_on_disk_right_after_the_run_without_a_clean_shutdown()
+        {
+            var path = WriteLog("hardkill.log", "Update one\n");
+
+            AgentRun(LogRule(path));                      // never disposed
+
+            var saved = JsonConvert.DeserializeObject<GatherRuleStateData>(File.ReadAllText(StateFile))!;
+            var position = Assert.Single(saved.LogPositions!);
+            Assert.Equal(new FileInfo(path).Length, position.Position);
+            Assert.Equal("session-a", saved.SessionId);
+        }
+
+        [Fact]
+        public void Position_is_saved_only_after_the_events_went_out()
+        {
+            var path = WriteLog("ordering.log", "Update one\n");
+            var savedDuringEmit = new List<bool>();
+
+            AgentRun(LogRule(path), onEvent: _ => savedDuringEmit.Add(File.Exists(StateFile)));
+
+            Assert.Equal(new[] { false }, savedDuringEmit);
+            Assert.True(File.Exists(StateFile));
+        }
+
+        [Fact]
+        public void A_new_session_reads_the_log_from_the_beginning()
+        {
+            var path = WriteLog("rotated.log", "Update one\nUpdate two\n");
+            AgentRun(LogRule(path), sessionId: "session-a");
+
+            AgentRun(LogRule(path), sessionId: "session-b");   // session rotated on the same device
+
+            Assert.Equal(4, StatusEvents);
+        }
+
+        [Fact]
+        public void A_log_replaced_during_the_reboot_is_read_from_the_beginning()
+        {
+            var path = WriteLog("replaced.log", "Update one\n");
+            AgentRun(LogRule(path, "replaced"));
+
+            // The tool writes a new log after the reboot; it is already longer than the old position.
+            File.WriteAllText(path, "Update fresh A\nUpdate fresh B\nUpdate fresh C\n");
+            AgentRun(LogRule(path, "replaced"));
+
+            Assert.Equal(new[] { "Update one", "Update fresh A", "Update fresh B", "Update fresh C" },
+                Events.Where(e => e.EventType == "HPiA-UpdateStatus").Select(e => (string)e.Data["status"]).ToArray());
+        }
+
+        [Fact]
+        public void An_unchanged_on_change_result_stays_silent_after_a_restart()
+        {
+            var watched = Path.Combine(_logDir, "marker.txt");
+
+            AgentRun(OnChangeFileRule(watched));          // absent → first result emits
+            AgentRun(OnChangeFileRule(watched));          // reboot, still absent → silent
+            Assert.Single(Events, e => e.EventType == "gather_file_presence");
+
+            File.WriteAllText(watched, "present");
+            AgentRun(OnChangeFileRule(watched));          // changed → emits
+
+            Assert.Equal(2, Events.Count(e => e.EventType == "gather_file_presence"));
+        }
+
+        [Fact]
+        public void Without_a_state_directory_every_run_starts_over_and_writes_nothing()
+        {
+            var path = WriteLog("diagnostic.log", "Update one\n");
+
+            AgentRun(LogRule(path), stateDirectory: null);
+            AgentRun(LogRule(path), stateDirectory: null);
+
+            Assert.Equal(2, StatusEvents);
+            Assert.False(File.Exists(StateFile));
+        }
+
+        [Fact]
+        public void Debug_trace_says_what_was_restored_and_where_reading_continues()
+        {
+            var path = WriteLog("traced.log", "Update one\n");
+            var trace = Path.Combine(_tmp.Path, "gather-rules-debug.log");
+            AgentRun(LogRule(path));
+            File.AppendAllText(path, "Update two\n");
+
+            AgentRun(LogRule(path), debugLogPath: trace);
+
+            var text = File.ReadAllText(trace);
+            Assert.Contains("gather state: restored 1 logparser position(s) for 1 rule(s)", text);
+            Assert.Contains("hpia-log-collect | config | logparser position restored: traced.log", text);
+            Assert.Contains("traced.log: continuing at position", text);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleSessionStateTests.cs

@@ -0,0 +1,278 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// <see cref="GatherRuleSessionState"/> and <see cref="GatherRuleStatePersistence"/>: what is
+    /// written, what a restart restores, what it refuses, and when the file is (not) written.
+    /// </summary>
+    public sealed class GatherRuleSessionStateTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly TempDirectory _stateDir = new TempDirectory();
+        private readonly AgentLogger _logger;
+
+        public GatherRuleSessionStateTests()
+        {
+            _logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+        }
+
+        public void Dispose()
+        {
+            _tmp.Dispose();
+            _stateDir.Dispose();
+        }
+
+        private string StateFile => Path.Combine(_stateDir.Path, GatherRuleStatePersistence.FileName);
+
+        private GatherRuleSessionState NewState(string sessionId = "session-a") =>
+            new GatherRuleSessionState(sessionId, new GatherRuleStatePersistence(_stateDir.Path, _logger), _logger);
+
+        private static LogFileHead Head(string text) => LogFileHead.FromBytes(Encoding.UTF8.GetBytes(text));
+
+        // ── restore ─────────────────────────────────────────────────────────
+
+        [Fact]
+        public void Positions_and_emitted_hashes_survive_a_restart_of_the_same_session()
+        {
+            var first = NewState();
+            first.CommitLogPosition("RULE-1", @"C:\Logs\a.log", 120, 7, Head("2026-09-28 a.log start"), heldTailStart: -1);
+            first.CommitEmittedHash("RULE-2", "hash-value");
+
+            var second = NewState();
+
+            var position = second.PeekLogPosition("RULE-1", @"C:\Logs\a.log");
+            Assert.NotNull(position);
+            Assert.Equal(120, position!.Position);
+            Assert.Equal(7, position.LineNumber);
+            Assert.True(position.FromPreviousRun);
+            Assert.Equal("hash-value", second.GetEmittedHashes()["RULE-2"]);
+            Assert.StartsWith("restored 1 logparser position(s) for 1 rule(s) and 1 on_change value(s)", second.RestoreSummary);
+        }
+
+        [Fact]
+        public void State_of_another_session_is_ignored()
+        {
+            NewState("session-a").CommitLogPosition("RULE-1", @"C:\Logs\a.log", 120, 7, Head("start"), -1);
+
+            var rotated = NewState("session-b");
+
+            Assert.Null(rotated.PeekLogPosition("RULE-1", @"C:\Logs\a.log"));
+            Assert.Contains("saved for session session-a, current session is session-b", rotated.RestoreSummary);
+        }
+
+        [Fact]
+        public void Missing_file_is_a_first_run_and_corrupt_file_a_fresh_start()
+        {
+            Assert.StartsWith("no saved state", NewState().RestoreSummary);
+
+            File.WriteAllText(StateFile, "not json {{{");
+            var afterCorruption = NewState();
+
+            Assert.StartsWith("saved state discarded", afterCorruption.RestoreSummary);
+            Assert.Empty(afterCorruption.GetEmittedHashes());
+        }
+
+        [Fact]
+        public void Tampered_entries_are_dropped_and_the_rest_restored()
+        {
+            var data = new GatherRuleStateData
+            {
+                SessionId = "session-a",
+                SavedAtUtc = DateTime.UtcNow,
+                LogPositions = new List<GatherLogPositionData>
+                {
+                    new GatherLogPositionData { RuleId = "OK", Path = @"C:\a.log", Position = 10, LineNumber = 1, HeadLength = 10, HeadHash = "h" },
+                    new GatherLogPositionData { RuleId = "NEG", Path = @"C:\b.log", Position = -5, HeadLength = 10, HeadHash = "h" },
+                    new GatherLogPositionData { RuleId = "", Path = @"C:\c.log", Position = 1, HeadLength = 1, HeadHash = "h" },
+                    new GatherLogPositionData { RuleId = "BIGHEAD", Path = @"C:\d.log", Position = 1, HeadLength = 5000, HeadHash = "h" },
+                    new GatherLogPositionData { RuleId = "NOHEAD", Path = @"C:\e.log", Position = 50, HeadLength = 0 },
+                },
+                OnChangeHashes = new Dictionary<string, string> { ["GOOD"] = "x", ["EMPTY"] = "" },
+            };
+            File.WriteAllText(StateFile, JsonConvert.SerializeObject(data));
+
+            var state = NewState();
+
+            Assert.NotNull(state.PeekLogPosition("OK", @"C:\a.log"));
+            Assert.Null(state.PeekLogPosition("NEG", @"C:\b.log"));
+            Assert.Null(state.PeekLogPosition("BIGHEAD", @"C:\d.log"));
+            Assert.Null(state.PeekLogPosition("NOHEAD", @"C:\e.log"));
+            Assert.Equal(new[] { "GOOD" }, state.GetEmittedHashes().Keys.ToArray());
+            Assert.Contains("5 invalid entries dropped", state.RestoreSummary);
+        }
+
+        [Fact]
+        public void A_path_no_real_file_can_have_is_dropped_and_never_stops_the_executor()
+        {
+            // Path APIs throw on these characters under .NET Framework; a throw here would keep
+            // every collector host down at every restart of the session.
+            var data = new GatherRuleStateData
+            {
+                SessionId = "session-a",
+                LogPositions = new List<GatherLogPositionData>
+                {
+                    new GatherLogPositionData { RuleId = "BAD", Path = "C:\\Logs\\x.|og", Position = 1, HeadLength = 1, HeadHash = "h" },
+                    new GatherLogPositionData { RuleId = "WILD", Path = "C:\\Logs\\*.log", Position = 1, HeadLength = 1, HeadHash = "h" },
+                    new GatherLogPositionData { RuleId = "OK", Path = "C:\\Logs\\ok.log", Position = 1, HeadLength = 1, HeadHash = "h" },
+                },
+            };
+            File.WriteAllText(StateFile, JsonConvert.SerializeObject(data));
+
+            var state = NewState();
+
+            Assert.NotNull(state.PeekLogPosition("OK", "C:\\Logs\\ok.log"));
+            Assert.Null(state.PeekLogPosition("BAD", "C:\\Logs\\x.|og"));
+            Assert.Contains("2 invalid entries dropped", state.RestoreSummary);
+        }
+
+        // ── where reading starts ────────────────────────────────────────────
+
+        [Fact]
+        public void Reading_continues_while_the_file_head_still_matches()
+        {
+            var state = NewState();
+            state.CommitLogPosition("R", @"C:\a.log", 30, 3, Head("2026-09-28 first line\n"), -1);
+
+            var start = GatherRuleSessionState.ResolveStart(state.PeekLogPosition("R", @"C:\a.log"), 200,
+                Head("2026-09-28 first line\nsecond line\nthird"), out var how);
+
+            Assert.Equal(30, start);
+            Assert.Equal(LogReadStart.Continue, how);
+        }
+
+        [Fact]
+        public void A_shrunk_file_and_a_replaced_file_are_read_from_the_beginning()
+        {
+            var state = NewState();
+            state.CommitLogPosition("R", @"C:\a.log", 30, 3, Head("2026-09-28 first line\n"), -1);
+            var known = state.PeekLogPosition("R", @"C:\a.log");
+
+            Assert.Equal(0, GatherRuleSessionState.ResolveStart(known, 20, Head("2026-09-28 fir"), out var shrunk));
+            Assert.Equal(LogReadStart.Shrunk, shrunk);
+
+            // Replaced and already longer than the old position: only the head tells.
+            Assert.Equal(0, GatherRuleSessionState.ResolveStart(known, 500, Head("2026-09-30 a new log entirely, much longer"), out var replaced));
+            Assert.Equal(LogReadStart.Replaced, replaced);
+
+            // Shorter than the recorded head although not shorter than the position.
+            state.CommitLogPosition("S", @"C:\b.log", 5, 1, Head("0123456789abcdef"), -1);
+            Assert.Equal(0, GatherRuleSessionState.ResolveStart(state.PeekLogPosition("S", @"C:\b.log"), 8, Head("01234567"), out var cut));
+            Assert.Equal(LogReadStart.Replaced, cut);
+        }
+
+        [Fact]
+        public void Positions_are_kept_per_rule_for_the_same_file()
+        {
+            var state = NewState();
+            state.CommitLogPosition("RULE-A", @"C:\shared.log", 100, 10, Head("x"), -1);
+
+            Assert.Null(state.PeekLogPosition("RULE-B", @"C:\shared.log"));
+            Assert.NotNull(state.PeekLogPosition("RULE-A", @"C:\SHARED.LOG")); // paths compare case-insensitively
+        }
+
+        // ── when the file is written ────────────────────────────────────────
+
+        [Fact]
+        public void An_unchanged_commit_does_not_write_the_file()
+        {
+            var state = NewState();
+            state.CommitLogPosition("R", @"C:\a.log", 10, 1, Head("head"), -1);
+            File.Delete(StateFile);
+
+            state.CommitLogPosition("R", @"C:\a.log", 10, 1, Head("head"), -1);
+            state.CommitEmittedHash("H", "v");
+            File.Delete(StateFile);
+            state.CommitEmittedHash("H", "v");
+
+            Assert.False(File.Exists(StateFile));
+        }
+
+        [Fact]
+        public void A_failed_save_is_retried_at_the_next_commit()
+        {
+            var blocked = Path.Combine(_stateDir.Path, "blocked");
+            File.WriteAllText(blocked, "a file where the state directory should be");
+            var state = new GatherRuleSessionState("session-a", new GatherRuleStatePersistence(blocked, _logger), _logger);
+
+            state.CommitEmittedHash("H", "v");   // Directory.CreateDirectory fails
+            File.Delete(blocked);
+            state.CommitEmittedHash("H", "v");   // unchanged, but the earlier save is still owed
+
+            Assert.True(File.Exists(Path.Combine(blocked, GatherRuleStatePersistence.FileName)));
+        }
+
+        [Fact]
+        public void A_closed_state_no_longer_writes()
+        {
+            var state = NewState();
+            state.Close();
+
+            state.CommitEmittedHash("H", "v");
+
+            Assert.False(File.Exists(StateFile));
+        }
+
+        [Fact]
+        public void Without_persistence_nothing_is_written()
+        {
+            var state = new GatherRuleSessionState("session-a", null, _logger);
+
+            state.CommitLogPosition("R", @"C:\a.log", 10, 1, Head("head"), -1);
+
+            Assert.StartsWith("persistence off", state.RestoreSummary);
+            Assert.Empty(Directory.GetFiles(_stateDir.Path));
+        }
+
+        // ── bounds and concurrency ──────────────────────────────────────────
+
+        [Fact]
+        public void A_rule_forgets_its_least_recently_touched_file_beyond_the_cap()
+        {
+            var state = NewState();
+            for (var i = 0; i < GatherRuleSessionState.MaxLogFilesPerRule; i++)
+                state.CommitLogPosition("R", $@"C:\logs\{i}.log", 1, 1, Head("h"), -1);
+            state.PeekLogPosition("R", @"C:\logs\0.log");   // touched again — survives
+
+            state.CommitLogPosition("R", @"C:\logs\new.log", 1, 1, Head("h"), -1);
+
+            Assert.NotNull(state.PeekLogPosition("R", @"C:\logs\0.log"));
+            Assert.Null(state.PeekLogPosition("R", @"C:\logs\1.log"));
+            Assert.NotNull(state.PeekLogPosition("R", @"C:\logs\new.log"));
+        }
+
+        [Fact]
+        public void Parallel_commits_leave_a_consistent_file()
+        {
+            var state = NewState();
+
+            Parallel.For(0, 8, worker =>
+            {
+                for (var i = 0; i < 50; i++)
+                {
+                    state.CommitLogPosition($"RULE-{worker}", $@"C:\logs\{worker}.log", i + 1, i, Head("h"), -1);
+                    state.PeekLogPosition($"RULE-{worker}", $@"C:\logs\{worker}.log");
+                    state.CommitEmittedHash($"RULE-{worker}", "hash-" + i);
+                }
+            });
+
+            var restored = NewState();
+            for (var worker = 0; worker < 8; worker++)
+            {
+                Assert.Equal(50, restored.PeekLogPosition($"RULE-{worker}", $@"C:\logs\{worker}.log")!.Position);
+                Assert.Equal("hash-49", restored.GetEmittedHashes()[$"RULE-{worker}"]);
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/LogLineReaderTests.cs

@@ -0,0 +1,188 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// <see cref="LogLineReader"/>, <see cref="LogTextEncoding"/> and <see cref="LogFileHead"/>:
+    /// exact byte positions, StreamReader-compatible line ends, byte order marks only at offset 0,
+    /// and the code-unit view of UTF-16/UTF-32 files.
+    /// </summary>
+    public sealed class LogLineReaderTests
+    {
+        private static byte[] Bytes(Encoding encoding, string text, bool withBom = true)
+        {
+            var body = encoding.GetBytes(text);
+            return withBom ? encoding.GetPreamble().Concat(body).ToArray() : body;
+        }
+
+        private static (List<string> Lines, List<long> EndPositions, List<bool> Terminated) ReadAll(
+            byte[] file, long start = 0, int maxLineBytes = 1024)
+        {
+            var encoding = LogFileHead.FromBytes(file.Take(LogFileHead.MaxBytes).ToArray()).Encoding;
+            using (var stream = new MemoryStream(file))
+            {
+                stream.Seek(start, SeekOrigin.Begin);
+                var reader = new LogLineReader(stream, encoding, maxLineBytes);
+                var lines = new List<string>();
+                var ends = new List<long>();
+                var terminated = new List<bool>();
+                string line;
+                while ((line = reader.ReadLine()) != null)
+                {
+                    lines.Add(line);
+                    ends.Add(reader.Position);
+                    terminated.Add(reader.LastLineTerminated);
+                }
+                return (lines, ends, terminated);
+            }
+        }
+
+        [Fact]
+        public void Line_ends_match_StreamReader_including_a_lone_carriage_return()
+        {
+            var file = Encoding.UTF8.GetBytes("one\ntwo\r\nthree\rfour");
+
+            var result = ReadAll(file);
+
+            Assert.Equal(new[] { "one", "two", "three", "four" }, result.Lines);
+            Assert.Equal(new long[] { 4, 9, 15, 19 }, result.EndPositions);
+            Assert.Equal(new[] { true, true, true, false }, result.Terminated);
+        }
+
+        [Fact]
+        public void Position_after_each_line_is_the_offset_to_resume_from()
+        {
+            var file = Encoding.UTF8.GetBytes("alpha\nbeta\ngamma\n");
+
+            var first = ReadAll(file);
+            var resumed = ReadAll(file, start: first.EndPositions[0]);
+
+            Assert.Equal(new[] { "beta", "gamma" }, resumed.Lines);
+            Assert.Equal(file.Length, resumed.EndPositions.Last());
+        }
+
+        [Fact]
+        public void Utf8_byte_order_mark_is_skipped_only_at_offset_0()
+        {
+            var file = Bytes(Encoding.UTF8, "first\nsecond\n");
+
+            var result = ReadAll(file);
+
+            Assert.Equal(new[] { "first", "second" }, result.Lines);
+            Assert.Equal(LogTextEncoding.Utf8WithBom, LogFileHead.FromBytes(file).Encoding);
+        }
+
+        [Theory]
+        [InlineData("utf-16le")]
+        [InlineData("utf-16be")]
+        [InlineData("utf-32le")]
+        [InlineData("utf-32be")]
+        public void Unicode_files_are_read_in_their_code_units_from_any_resume_point(string name)
+        {
+            var encoding = name == "utf-16le" ? Encoding.Unicode
+                : name == "utf-16be" ? Encoding.BigEndianUnicode
+                : name == "utf-32le" ? Encoding.UTF32
+                : new UTF32Encoding(bigEndian: true, byteOrderMark: true);
+            var file = Bytes(encoding, "ERROR first\r\nERROR zweite Zeile mit Umlaut äöü\r\n");
+
+            var whole = ReadAll(file);
+            var resumed = ReadAll(file, start: whole.EndPositions[0]);
+
+            Assert.Equal(name, LogFileHead.FromBytes(file).Encoding.Name);
+            Assert.Equal(new[] { "ERROR first", "ERROR zweite Zeile mit Umlaut äöü" }, whole.Lines);
+            Assert.Equal(new[] { "ERROR zweite Zeile mit Umlaut äöü" }, resumed.Lines);
+            Assert.Equal(file.Length, whole.EndPositions.Last());
+        }
+
+        [Fact]
+        public void File_without_byte_order_mark_is_utf8_and_ansi_bytes_decode_as_before()
+        {
+            var file = new byte[] { (byte)'M', (byte)'a', (byte)'n', 0xFC, (byte)'\n' }; // "Man" + Windows-1252 'ü'
+
+            var result = ReadAll(file);
+
+            Assert.Equal(LogTextEncoding.Utf8, LogFileHead.FromBytes(file).Encoding);
+            Assert.Equal(new StreamReader(new MemoryStream(file), Encoding.UTF8).ReadLine(), result.Lines.Single());
+        }
+
+        [Fact]
+        public void Carriage_return_at_end_of_file_ends_the_line_and_its_late_line_feed_is_skipped()
+        {
+            var firstWrite = Encoding.UTF8.GetBytes("done\r");
+            var later = Encoding.UTF8.GetBytes("done\r\nnext\n");
+
+            var first = ReadAll(firstWrite);
+            var resumed = ReadAll(later, start: first.EndPositions.Last());
+
+            Assert.Equal(new[] { "done" }, first.Lines);
+            Assert.True(first.Terminated.Single());
+            Assert.Equal(new[] { "next" }, resumed.Lines);
+        }
+
+        [Fact]
+        public void Overlong_line_is_consumed_without_being_kept_and_reading_continues_behind_it()
+        {
+            var file = Encoding.UTF8.GetBytes(new string('x', 50) + "\nshort\n");
+            using (var stream = new MemoryStream(file))
+            {
+                var reader = new LogLineReader(stream, LogTextEncoding.Utf8, maxLineBytes: 10);
+
+                Assert.Equal(string.Empty, reader.ReadLine());
+                Assert.True(reader.LastLineTruncated);
+                Assert.Equal(51, reader.Position);
+                Assert.Equal("short", reader.ReadLine());
+                Assert.False(reader.LastLineTruncated);
+                Assert.Null(reader.ReadLine());
+            }
+        }
+
+        [Fact]
+        public void Line_spanning_many_read_buffers_is_returned_whole()
+        {
+            var longLine = new string('y', 200_000);
+            var file = Encoding.UTF8.GetBytes(longLine + "\nend\n");
+
+            var result = ReadAll(file, maxLineBytes: 1_000_000);
+
+            Assert.Equal(new[] { longLine, "end" }, result.Lines);
+        }
+
+        [Fact]
+        public void Half_written_utf16_character_at_end_of_file_stays_in_the_unterminated_line()
+        {
+            var full = Bytes(Encoding.Unicode, "ok\r\nhalf");
+            var file = full.Concat(new byte[] { 0x41 }).ToArray(); // first byte of the next UTF-16 unit
+
+            var result = ReadAll(file);
+
+            Assert.Equal("ok", result.Lines[0]);
+            Assert.False(result.Terminated.Last());
+            Assert.Equal(file.Length, result.EndPositions.Last());
+        }
+
+        [Fact]
+        public void AlignDown_snaps_to_code_units_behind_the_byte_order_mark()
+        {
+            Assert.Equal(0, LogTextEncoding.Utf16LittleEndian.AlignDown(1));
+            Assert.Equal(2, LogTextEncoding.Utf16LittleEndian.AlignDown(3));
+            Assert.Equal(6, LogTextEncoding.Utf16LittleEndian.AlignDown(7));
+            Assert.Equal(8, LogTextEncoding.Utf32LittleEndian.AlignDown(11));
+            Assert.Equal(7, LogTextEncoding.Utf8.AlignDown(7));
+        }
+
+        [Fact]
+        public void Head_hash_of_a_prefix_matches_the_hash_of_the_shorter_file()
+        {
+            var shortFile = LogFileHead.FromBytes(Encoding.UTF8.GetBytes("2026-09-28 start"));
+            var grown = LogFileHead.FromBytes(Encoding.UTF8.GetBytes("2026-09-28 start\nmore lines"));
+
+            Assert.Equal(shortFile.Hash(shortFile.Length), grown.Hash(shortFile.Length));
+            Assert.NotEqual(shortFile.Hash(shortFile.Length), grown.Hash(grown.Length));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/LogParserCollectorDebugLogTests.cs

@@ -37,7 +37,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
                 logger, "sess", "tenant",
                 evt => _events.Add(evt),
                 null,
-                new LogFilePositionTracker(),
+                new GatherRuleSessionState("sess", null, logger),
                 new GatherRuleDebugLog(_debugLogPath, logger))
             {
                 UnrestrictedMode = true

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/LogParserCollectorReadingTests.cs

@@ -0,0 +1,225 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// Reading semantics of <see cref="LogParserCollector"/> across runs on one context: every
+    /// line of a growing log is matched exactly once — no line lost at a maxLines cut, no line
+    /// split by a writer that is mid-line, UTF-16 logs readable after the first run, positions
+    /// kept per rule, line numbers counted from the start of the file.
+    /// </summary>
+    public sealed class LogParserCollectorReadingTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly GatherRuleContext _context;
+
+        // %TEMP% lives under C:\Users (hard-blocked) — parse targets sit beside the
+        // test assembly instead, admitted via UnrestrictedMode.
+        private readonly string _logDir = Path.Combine(
+            AppContext.BaseDirectory, "gather-reading-tests-" + Guid.NewGuid().ToString("N"));
+
+        public LogParserCollectorReadingTests()
+        {
+            Directory.CreateDirectory(_logDir);
+            _context = NewContext();
+        }
+
+        public void Dispose()
+        {
+            _tmp.Dispose();
+            try { Directory.Delete(_logDir, recursive: true); } catch { /* best effort */ }
+        }
+
+        private GatherRuleContext NewContext()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            return new GatherRuleContext(logger, "sess", "tenant",
+                evt => _events.Add(evt), null, new GatherRuleSessionState("sess", null, logger))
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        private string LogPath(string name) => Path.Combine(_logDir, name);
+
+        private static GatherRule TextRule(string ruleId, string target, string pattern,
+            string trigger = "interval", int? maxLines = null)
+        {
+            var parameters = new Dictionary<string, string> { ["pattern"] = pattern, ["format"] = "text" };
+            if (maxLines.HasValue) parameters["maxLines"] = maxLines.Value.ToString();
+            return new GatherRule
+            {
+                RuleId = ruleId,
+                Title = ruleId,
+                CollectorType = "logparser",
+                Target = target,
+                Parameters = parameters,
+                Trigger = trigger,
+                IntervalSeconds = trigger == "interval" ? 30 : (int?)null,
+                OutputEventType = "logparser_reading_test",
+            };
+        }
+
+        private List<string> Captured(string group) =>
+            _events.Select(e => e.Data.TryGetValue(group, out var v) ? (string)v : "<missing>").ToList();
+
+        [Fact]
+        public void Two_rules_on_one_file_each_read_the_whole_file()
+        {
+            var path = LogPath("shared.log");
+            File.WriteAllText(path, "ERROR one\nWARN two\nERROR three\n");
+            var collector = new LogParserCollector();
+
+            collector.Execute(TextRule("RULE-ERRORS", path, "^ERROR (?<what>\\w+)"), _context);
+            collector.Execute(TextRule("RULE-WARNINGS", path, "^WARN (?<what>\\w+)"), _context);
+
+            Assert.Equal(2, _events.Count(e => (string)e.Data["ruleId"] == "RULE-ERRORS"));
+            Assert.Single(_events, e => (string)e.Data["ruleId"] == "RULE-WARNINGS");
+        }
+
+        [Fact]
+        public void MaxLines_cut_loses_no_line_across_runs()
+        {
+            var path = LogPath("long.log");
+            var sb = new StringBuilder();
+            for (var i = 1; i <= 30; i++)
+                sb.Append("hit ").Append(i.ToString("D3")).Append(' ').Append('x', 90).Append('\n');
+            File.WriteAllText(path, sb.ToString());
+            var rule = TextRule("RULE-LONG", path, "^hit (?<n>\\d{3})", maxLines: 10);
+            var collector = new LogParserCollector();
+
+            for (var run = 0; run < 6; run++)
+                collector.Execute(rule, _context);
+
+            var expected = Enumerable.Range(1, 30).Select(i => i.ToString("D3")).ToList();
+            Assert.Equal(expected, Captured("n"));
+        }
+
+        [Fact]
+        public void Line_written_in_two_parts_is_matched_once_and_whole()
+        {
+            var path = LogPath("partial.log");
+            File.WriteAllText(path, "ERR");
+            var rule = TextRule("RULE-PARTIAL", path, "^ERROR (?<code>0x[0-9A-F]+)$");
+            var collector = new LogParserCollector();
+
+            collector.Execute(rule, _context);          // the writer is mid-line
+            File.AppendAllText(path, "OR 0x1F\n");
+            collector.Execute(rule, _context);
+
+            Assert.Equal(new List<string> { "0x1F" }, Captured("code"));
+        }
+
+        [Fact]
+        public void Interval_rule_reads_a_line_still_unfinished_on_its_second_run_once()
+        {
+            var path = LogPath("never-terminated.log");
+            File.WriteAllText(path, "ERROR 0x2A");
+            var rule = TextRule("RULE-UNFINISHED", path, "^ERROR (?<code>0x[0-9A-F]+)$");
+            var collector = new LogParserCollector();
+
+            collector.Execute(rule, _context);   // held: the writer may still be in the line
+            collector.Execute(rule, _context);   // still unfinished — taken as it is
+            collector.Execute(rule, _context);   // nothing new
+
+            Assert.Equal(new List<string> { "0x2A" }, Captured("code"));
+        }
+
+        [Fact]
+        public void One_shot_rule_reads_an_unfinished_line_now_and_whole_on_its_next_run()
+        {
+            var path = LogPath("startup.log");
+            File.WriteAllText(path, "ok\nERR");
+            var rule = TextRule("RULE-STARTUP", path, "^ERR(?<rest>.*)$", trigger: "startup");
+            var collector = new LogParserCollector();
+
+            collector.Execute(rule, _context);   // agent start: the writer is mid-line
+            File.AppendAllText(path, "OR 0x1F\n");
+            collector.Execute(rule, _context);   // next agent start
+
+            // Read twice, never split: the second read sees the whole line.
+            Assert.Equal(new List<string> { "", "OR 0x1F" }, Captured("rest"));
+            Assert.Equal(new long[] { 2, 2 }, _events.Select(e => Convert.ToInt64(e.Data["logLineNumber"])).ToArray());
+        }
+
+        [Fact]
+        public void Line_feed_written_after_a_trailing_carriage_return_is_consumed_without_a_line()
+        {
+            var path = LogPath("cr-at-end.log");
+            File.WriteAllText(path, "hit\r");
+            var rule = TextRule("RULE-CR", path, "^hit$");
+            var collector = new LogParserCollector();
+
+            collector.Execute(rule, _context);
+            File.AppendAllText(path, "\n");
+            collector.Execute(rule, _context);
+
+            Assert.Single(_events);
+            var position = _context.SessionState.PeekLogPosition("RULE-CR", path);
+            Assert.Equal(new FileInfo(path).Length, position!.Position);
+            Assert.Equal(1, position.LineNumber);
+        }
+
+        [Fact]
+        public void Utf16_log_appended_after_the_first_run_is_still_matched()
+        {
+            var path = LogPath("transcript.log");
+            File.WriteAllText(path, "ERROR first\r\n", Encoding.Unicode);   // UTF-16 LE with BOM
+            var rule = TextRule("RULE-UTF16", path, "^ERROR (?<what>\\w+)$");
+            var collector = new LogParserCollector();
+
+            collector.Execute(rule, _context);
+            using (var stream = new FileStream(path, FileMode.Append, FileAccess.Write))
+            {
+                var bytes = new UnicodeEncoding(bigEndian: false, byteOrderMark: false).GetBytes("ERROR second\r\n");
+                stream.Write(bytes, 0, bytes.Length);
+            }
+            collector.Execute(rule, _context);
+
+            Assert.Equal(new List<string> { "first", "second" }, Captured("what"));
+        }
+
+        [Theory]
+        [InlineData("abc")]
+        [InlineData("0")]
+        [InlineData("-5")]
+        public void MaxLines_that_is_no_positive_number_falls_back_to_the_default(string maxLines)
+        {
+            var path = LogPath("misconfigured.log");
+            File.WriteAllText(path, "hit 1\nhit 2\n");
+            var rule = TextRule("RULE-MISCONFIGURED", path, "^hit (?<n>\\d)$");
+            rule.Parameters["maxLines"] = maxLines;
+
+            new LogParserCollector().Execute(rule, _context);
+
+            Assert.Equal(new List<string> { "1", "2" }, Captured("n"));
+        }
+
+        [Fact]
+        public void Line_numbers_count_from_the_start_of_the_file()
+        {
+            var path = LogPath("numbers.log");
+            File.WriteAllText(path, "a\nhit\nb\n");
+            var rule = TextRule("RULE-NUMBERS", path, "^hit$");
+            var collector = new LogParserCollector();
+
+            collector.Execute(rule, _context);
+            File.AppendAllText(path, "c\nhit\n");
+            collector.Execute(rule, _context);
+
+            Assert.Equal(new long[] { 2, 5 }, _events.Select(e => Convert.ToInt64(e.Data["logLineNumber"])).ToArray());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/RegistryCollectorEmitOnlyIfExistsTests.cs

@@ -35,7 +35,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
                 tenantId: "tenant",
                 onEventCollected: _ => { },
                 imeLogPathOverride: null,
-                filePositionTracker: new LogFilePositionTracker())
+                sessionState: new GatherRuleSessionState("sess", null, logger))
             {
                 // Bypass the registry allowlist guard for the synthetic test path.
                 UnrestrictedMode = true

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/HelloTrackerCompletionBudgetTests.cs

@@ -0,0 +1,71 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// The completion timer a started Hello wizard runs against is the tenant's Hello wait
+    /// (<c>HelloWaitTimeoutSeconds</c>), resolved to 300..3600 s — the same budget the engine's
+    /// hello_safety window spends from the ESP exit, so a tenant allowing an hour is not cut off
+    /// by a fixed 5-min tracker timer while the user is still inside the wizard.
+    /// </summary>
+    public sealed class HelloTrackerCompletionBudgetTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 29, 8, 0, 0, DateTimeKind.Utc);
+
+        [Theory]
+        [InlineData(30, 300)]     // the old default, still stored for many tenants → the built-in window
+        [InlineData(0, 300)]
+        [InlineData(300, 300)]
+        [InlineData(1800, 1800)]
+        [InlineData(3600, 3600)]
+        [InlineData(86400, 3600)] // clamped to the ceiling
+        public void Completion_budget_is_the_resolved_tenant_hello_wait(int configured, int expected)
+        {
+            using var tmp = new TempDirectory();
+            using var tracker = NewTracker(tmp, new FakeSignalIngressSink(), configured);
+
+            Assert.Equal(expected, tracker.CompletionTimeoutSecondsForTest);
+        }
+
+        [Fact]
+        public void Completion_timeout_event_reports_the_tenant_budget()
+        {
+            using var tmp = new TempDirectory();
+            var ingress = new FakeSignalIngressSink();
+            using var tracker = NewTracker(tmp, ingress, helloWaitTimeoutSeconds: 2400);
+
+            tracker.NotifyHelloWizardStarted();
+            Assert.True(tracker.IsCompletionTimerActiveForTest);
+            tracker.TriggerCompletionTimeoutForTest();
+
+            var timeout = ingress.Posted.Single(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == Constants.EventTypes.HelloCompletionTimeout);
+            var data = Assert.IsAssignableFrom<IDictionary<string, object>>(timeout.TypedPayload);
+            Assert.Equal(2400, data["timeoutSeconds"]);
+            Assert.Equal("timeout", tracker.HelloOutcome);
+        }
+
+        private static HelloTracker NewTracker(TempDirectory tmp, FakeSignalIngressSink ingress, int helloWaitTimeoutSeconds) =>
+            new HelloTracker(
+                sessionId: "S1",
+                tenantId: "T1",
+                post: new InformationalEventPost(ingress, new VirtualClock(Fixed)),
+                logger: new AgentLogger(tmp.Path, AgentLogLevel.Info),
+                helloWaitTimeoutSeconds: helloWaitTimeoutSeconds);
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/CmTraceOffsetCalibratorTests.cs

@@ -186,5 +186,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             DateTime resolved;
             Assert.False(sut.TryResolveUtc(Source, UtcNow, out resolved));
         }
+
+        [Theory]
+        [InlineData(3610.39, true, 4)]     // session 4377911b: +1 h on a 10 s script
+        [InlineData(61203.0, true, 68)]    // 17 h on a 3 s script
+        [InlineData(7205.66, true, 8)]     // session cbaed57b: +2 h
+        [InlineData(-3596.0, true, 4)]     // the same error on the start end
+        [InlineData(26.4, false, 0)]       // a run time below one grid step
+        [InlineData(1030.0, false, 1)]     // 17 min 10 s: residual past the tolerance
+        [InlineData(900.0, true, 1)]       // exactly one step — a genuine 15-minute run reads the same, the caller needs mixed provenance too
+        public void A_grid_sized_span_is_the_signature_of_an_offset_error(double seconds, bool onGrid, int expectedSteps)
+        {
+            int steps;
+            Assert.Equal(onGrid, CmTraceOffsetCalibrator.IsOnOffsetGrid(TimeSpan.FromSeconds(seconds), out steps));
+            if (onGrid) Assert.Equal(expectedSteps, steps);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs

@@ -337,7 +337,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
                 "Launch powershell executor in machine session",
                 new[] { "context=machine" }
             };
-            // Wording from the IME decompile (ContentDownloaderDeliveryOptimization, identical 1.97–1.105).
+            // IME wording, identical from 1.97 to 1.105.
             yield return new object[]
             {
                 "IME-DO-TIMEOUT-2",

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerHealthTests.cs

@@ -140,6 +140,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Equal(1, fired); // the persisted flag suppressed the second emission
         }
 
+        [Fact]
+        public void Registry_reconciliation_counters_survive_a_restart()
+        {
+            using var h = new Harness();
+            h.Tracker.ScriptRuns.CountVerified();
+            h.Tracker.ScriptRuns.CountVerified();
+            h.Tracker.ScriptRuns.CountCorrected();
+            h.Tracker.SaveStateForTest();
+
+            h.Restart();
+
+            var health = h.Tracker.GetHealthSnapshot();
+            Assert.Equal(2, health.PlatformOutputVerified);
+            Assert.Equal(1, health.PlatformOutputCorrected);
+        }
+
         [Fact]
         public async Task Handler_time_does_not_count_against_the_line_budget()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.RetryPairing.cs

@@ -0,0 +1,336 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// B-96m: IME re-runs a failed platform script on later check-ins, so AgentExecutor.log can hold several runs of one
+    /// policy before the tracker has read IME's result of the first — always on the agent's first pass (the agent starts
+    /// mid-enrollment and reads all of AgentExecutor.log before IntuneManagementExtension.log), after a restart, and
+    /// whenever a result line surfaces late. With one slot per policy the second executor start reused the first run's
+    /// slot and its end block overwrote the first one: the first IME result went out with the LAST run's exit code and
+    /// output (session eff1b413: the bootstrap script "Failed (exit 0)" with the stdout of its successful retry), every
+    /// later result without an end block. These tests pin one run per executor start, each IME result paired with the
+    /// run of its policy that started last before it, each run carrying its own end block.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private const string RetryPolicyId = "4c2d8e1a-7b3f-4a9e-8d21-6f0b5c3e9a74";
+        private const string RetryUser = "00000000-0000-0000-0000-000000000000";
+
+        private static string ImeEntryAt(string time, string message)
+            => $"<![LOG[{message}]LOG]!><time=\"{time}\" date=\"9-10-2026\" component=\"IntuneManagementExtension\" context=\"\" type=\"1\" thread=\"12\" file=\"\">\r\n";
+
+        /// <summary>One executor run's start block: banner, the platform argument line, paths, launch.</summary>
+        private static string RunStart(string time, string pid, string policyId = RetryPolicyId, string userId = RetryUser)
+        {
+            var path = $@"{ImeDir}\Policies\Scripts\{userId}_{policyId}.ps1";
+            var results = $@"{ImeDir}\Policies\Results\{userId}_{policyId}";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershell with value {path} to the named argument list.")
+                + EntryAt(time, "Powershell option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, results + ".output")
+                + EntryAt(time, results + ".error")
+                + EntryAt(time, results + ".timeout")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        /// <summary>
+        /// One executor run's end block in AgentExecutor's order. "error from script =" logs the stderr buffer before the
+        /// output readers finished (<paramref name="stderrSnapshot"/>); "write output done" logs the final texts, the
+        /// error part being exactly the error file IME judges.
+        /// </summary>
+        private static string RunEnd(string time, int exitCode, string stdout, string stderr, string? stderrSnapshot = null)
+            => EntryAt(time, $"Powershell exit code is {exitCode}")
+            + EntryAt(time, $"length of out={stdout.Length}")
+            + EntryAt(time, $"length of error={stderr.Length}")
+            + EntryAt(time, "error from script =" + (stderrSnapshot ?? stderr))
+            + EntryAt(time, exitCode == 0 ? "Powershell script is successfully executed." : "Powershell script is failed to execute")
+            + EntryAt(time, $"write output done. output = {stdout}, error = {stderr}")
+            + EntryAt(time, "Revert Wow64FsRedirection")
+            + EntryAt(time, "Agent executor completed.");
+
+        private static string ImeRunStart(string time, string policyId = RetryPolicyId, string userId = RetryUser)
+            => ImeEntryAt(time, $@"Script file {ImeDir}\Policies\Scripts\{userId}_{policyId}.ps1 is generated.");
+
+        private static string ImeRunResult(string time, string result, string policyId = RetryPolicyId, string userId = RetryUser)
+            => ImeEntryAt(time, $"[PowerShell] User Id = {userId}, Policy id = {policyId}, policy result = {result}");
+
+        private static void AppendImeLog(Harness h, string text)
+            => File.AppendAllText(Path.Combine(Path.GetDirectoryName(h.LogPath)!, "IntuneManagementExtension.log"), text, new UTF8Encoding(false));
+
+        /// <summary>Result | exit | stdout | stderr — readable in an assertion failure; "-" no exit code, "~" never read.</summary>
+        private static string Shape(ScriptExecutionState s)
+            => $"{s.Result}|{(s.ExitCode.HasValue ? s.ExitCode.Value.ToString() : "-")}|{s.Stdout ?? "~"}|{s.Stderr ?? "~"}";
+
+        /// <summary>
+        /// Two poll passes as the agent runs them (read the files, then the flushes), the second past the result hold:
+        /// a result missing its end block goes out by then.
+        /// </summary>
+        private static async Task PassAndSettle(Harness h)
+        {
+            await h.Tracker.RunPollPassAsync(default);
+            h.Now = h.Now.AddSeconds(6);
+            await h.Tracker.RunPollPassAsync(default);
+        }
+
+        [Fact]
+        public async Task First_pass_pairs_each_ime_result_with_the_end_block_of_its_own_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // IME's first run and two retries on later check-ins, all written before the agent started.
+            h.Append(RunStart("12:00:10.0000000", "1001") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "1002") + RunEnd("12:10:12.0000000", 1, "Run B output", "")
+                + RunStart("12:20:10.0000000", "1003") + RunEnd("12:20:12.0000000", 0, "Run C output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success")
+                + ImeRunStart("12:20:08.0000000") + ImeRunResult("12:20:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|1||Run A failed", "Success|1|Run B output|", "Success|0|Run C output|" },
+                h.Completed.Select(Shape).ToArray());
+            Assert.All(h.Completed, s => Assert.Equal("ime_policy_result", s.ResultSource));
+            Assert.True(h.Completed[0].StartedAtUtc < h.Completed[1].StartedAtUtc && h.Completed[1].StartedAtUtc < h.Completed[2].StartedAtUtc);
+            Assert.Equal(3, h.Completed.Select(s => s.RunId).Distinct().Count());
+        }
+
+        [Fact]
+        public async Task Retry_of_the_bootstrap_script_never_lends_its_success_output_to_the_failed_first_attempt()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "2001") + RunEnd("12:00:20.0000000", 1, "attempt 1: download failed", "Invoke-WebRequest : The remote name could not be resolved")
+                + RunStart("12:10:10.0000000", "2002") + RunEnd("12:10:20.0000000", 0, "===== Bootstrap Completed Successfully =====", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:20.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:20.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[]
+            {
+                "Failed|1|attempt 1: download failed|Invoke-WebRequest : The remote name could not be resolved",
+                "Success|0|===== Bootstrap Completed Successfully =====|",
+            }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_killed_at_the_timeout_reports_failed_without_the_next_runs_end_block()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // IME killed the first executor after 1800 s: its start block is all AgentExecutor.log holds of it.
+            h.Append(RunStart("12:00:10.0000000", "3001")
+                + RunStart("12:40:10.0000000", "3002") + RunEnd("12:40:12.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:30:10.5000000", "Failed")
+                + ImeRunStart("12:40:08.0000000") + ImeRunResult("12:40:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|-|~|~", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_whose_result_never_surfaced_falls_back_on_imes_rule_before_the_next_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "4001") + RunEnd("12:00:12.0000000", 0, "Run A output", "Run A wrote an error")
+                + RunStart("12:10:10.0000000", "4002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // Run A's result line was lost; run B's is there.
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|0|Run A output|Run A wrote an error", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.Equal(new[] { "agentexecutor_fallback", "ime_policy_result" }, h.Completed.Select(s => s.ResultSource).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_in_flight_survives_the_emit_of_the_run_before_it()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "5001") + RunEnd("12:00:12.0000000", 0, "Run A output", "")
+                + RunStart("12:10:10.0000000", "5002"));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Success") + ImeRunStart("12:10:08.0000000"));
+            await PassAndSettle(h);
+            h.Now = h.Now.AddSeconds(30);
+            await h.Pass();
+
+            // Run B ends minutes later.
+            h.Append(RunEnd("12:10:40.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunResult("12:10:40.1000000", "Success"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Success|0|Run A output|", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Shutdown_between_the_two_logs_flushes_each_run_with_its_own_end_block()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "6001") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "6002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // The pass is cancelled after AgentExecutor.log; the shutdown flush follows.
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now, force: true);
+
+            h.Restart();
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+            await PassAndSettle(h);
+
+            // Each run went out with its own block and IME's verdict on it; the results read after the restart are
+            // the same runs and change nothing.
+            Assert.Equal(new[] { "Failed|1||Run A failed", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.All(h.Completed, s => Assert.Equal("agentexecutor_fallback", s.ResultSource));
+        }
+
+        [Fact]
+        public async Task End_block_line_recovered_after_the_next_run_started_stays_with_its_own_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "7001"));
+            var exitLineAt = h.Length;
+            h.Append(RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "7002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            await h.Pass();
+
+            // A stale writer rewrites run A's exit line in place: the ledger check re-reads it behind run B's start.
+            h.Overwrite(exitLineAt, EntryAt("12:00:12.0000000", "Powershell exit code is 7"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|7||Run A failed", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_without_result_or_end_block_is_dropped_once_a_later_run_has_its_result()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9001")
+                + RunStart("12:10:10.0000000", "9002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.Equal(0, h.Tracker.ParkedPlatformScriptCountForTest);
+        }
+
+        [Fact]
+        public void Reading_the_same_executor_start_line_again_never_parks_its_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            var line = $@"Adding argument powershell with value {ImeDir}\Policies\Scripts\{RetryUser}_{RetryPolicyId}.ps1 to the named argument list.";
+            var at = T0.AddMinutes(-30);
+
+            h.Tracker.ProcessLogMessageForTest(line, at, "AgentExecutor.log");
+            h.Tracker.ProcessLogMessageForTest(line, at, "AgentExecutor.log");
+            Assert.Equal(0, h.Tracker.ParkedPlatformScriptCountForTest);
+
+            h.Tracker.ProcessLogMessageForTest(line, at.AddMinutes(10), "AgentExecutor.log");
+            Assert.Equal(1, h.Tracker.ParkedPlatformScriptCountForTest);
+        }
+
+        [Fact]
+        public async Task Run_without_end_block_keeps_waiting_for_its_result_across_a_shutdown()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9101") + RunStart("12:40:10.0000000", "9102"));
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now, force: true);
+            Assert.Empty(h.Completed);
+
+            h.Restart();
+            Assert.Equal(1, h.Tracker.ParkedPlatformScriptCountForTest);
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:30:10.5000000", "Failed"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|-|~|~" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Earlier_run_emitted_while_a_later_one_runs_never_takes_the_later_runs_register_entry()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9201") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "9202"));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed") + ImeRunStart("12:10:08.0000000"));
+            await PassAndSettle(h);
+            Assert.Single(h.Completed);
+
+            // A save of this key is the latest run's, and that one is still running.
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+            Assert.Equal(PlatformRunClaim.Wait, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out _));
+
+            h.Append(RunEnd("12:10:40.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunResult("12:10:40.1000000", "Success"));
+            await PassAndSettle(h);
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out var run));
+            Assert.Equal(h.Completed[1].RunId, run!.RunId);
+            Assert.Equal("Run B output", run.Stdout);
+        }
+
+        [Fact]
+        public async Task Run_of_another_user_keeps_its_own_register_entry_when_it_waited_for_its_result()
+        {
+            const string otherUser = "2b7e5c91-3d4a-4f80-b6e2-9a1c7d3f5e08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9301") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "9302", userId: otherUser));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000", userId: otherUser));
+            await PassAndSettle(h);
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out var run));
+            Assert.Equal(h.Completed[0].RunId, run!.RunId);
+            Assert.Equal(PlatformRunClaim.Wait, h.Tracker.ScriptRuns.TryClaim(otherUser, RetryPolicyId, h.Now.AddSeconds(-10), out _));
+        }
+
+        [Fact]
+        public async Task Start_line_read_again_stays_a_late_line_after_an_earlier_run_of_another_user_went_out()
+        {
+            const string otherUser = "2b7e5c91-3d4a-4f80-b6e2-9a1c7d3f5e08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9401") + RunEnd("12:00:12.0000000", 0, "Run A output", "")
+                + RunStart("12:10:10.0000000", "9402", userId: otherUser) + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // Run A's result surfaces after run B's (its line was hidden by a concurrent writer).
+            AppendImeLog(h, ImeRunResult("12:10:12.1000000", "Success", userId: otherUser) + ImeRunResult("12:00:12.1000000", "Success"));
+            await PassAndSettle(h);
+            Assert.Equal(new[] { "Success|0|Run B output|", "Success|0|Run A output|" }, h.Completed.Select(Shape).ToArray());
+
+            // Run B's executor start line read again (a rewind): a late line of the emitted run B, never a new run.
+            var started = 0;
+            h.Tracker.OnScriptStarted = _ => started++;
+            h.Tracker.ProcessLogMessageForTest(
+                $@"Adding argument powershell with value {ImeDir}\Policies\Scripts\{otherUser}_{RetryPolicyId}.ps1 to the named argument list.",
+                h.Completed[0].StartedAtUtc, "AgentExecutor.log");
+            Assert.Equal(0, started);
+        }
+
+        [Fact]
+        public async Task Final_stderr_of_the_end_block_replaces_the_early_snapshot_even_without_stdout()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // The snapshot was taken before the error reader finished; IME judged the full error file.
+            h.Append(RunStart("12:00:10.0000000", "8001") + RunEnd("12:00:12.0000000", 0, "", "Remove-AppxPackage : Cannot process argument", stderrSnapshot: ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|0||Remove-AppxPackage : Cannot process argument" }, h.Completed.Select(Shape).ToArray());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.RewindFreshness.cs

@@ -0,0 +1,139 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Sessions d29e27e3 and 4377911b: a concurrent IME writer overwrote the result line of a platform script, and the
+    /// overwrite check recovered it one pass later. Recovered lines were never fresh, so they resolved in the agent's own
+    /// cached zone (+60) instead of anchoring themselves (+120): the end stamp landed an hour ahead of the clock and the
+    /// run duration was omitted. Bytes that read differently at a position than at the last look were written after that
+    /// look, so when the replaced bytes were confirmed seconds ago the new line's age is bounded like an appended line's —
+    /// these tests pin that it anchors itself then, and only then.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private static void AppendExecutorLog(Harness h, string text)
+            => File.AppendAllText(Path.Combine(Path.GetDirectoryName(h.LogPath)!, "AgentExecutor.log"), text, new UTF8Encoding(false));
+
+        /// <summary>An IME log entry with the byte length of <paramref name="sameLengthAs"/>: what a stale writer's line replaces exactly.</summary>
+        private static string FillerLike(string time, string sameLengthAs)
+        {
+            var bare = ImeEntryAt(time, "[Win32App] checking ");
+            Assert.True(sameLengthAs.Length > bare.Length);
+            return ImeEntryAt(time, "[Win32App] checking " + new string('x', sameLengthAs.Length - bare.Length));
+        }
+
+        /// <summary>
+        /// A platform run whose IME writer lives in +120 (local = UTC + 2 h; the harness clock is 19:30Z): both logs are
+        /// observed empty first, so what follows is read fresh. Returns the IME log position where the filler line sits.
+        /// </summary>
+        private static async Task<long> StartRunAndReadFiller(Harness h, string fillerTime, string resultEntry)
+        {
+            h.Append(string.Empty);
+            AppendExecutorLog(h, string.Empty);
+            await h.Tracker.RunPollPassAsync(default);
+
+            AppendExecutorLog(h, RunStart("21:29:50.0000000", "1001"));
+            h.Append(ImeRunStart("21:29:48.0000000"));
+            await h.Tracker.RunPollPassAsync(default);
+
+            // Another IME writer appends a line; the tracker reads it.
+            var at = h.Length;
+            h.Append(FillerLike(fillerTime, resultEntry));
+            h.Now = h.Now.AddSeconds(1);
+            await h.Tracker.RunPollPassAsync(default);
+            return at;
+        }
+
+        [Fact]
+        public async Task Result_line_recovered_seconds_after_its_bytes_were_read_anchors_itself_like_a_fresh_line()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:01.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+
+            // The script ends: its end block, then the stale IME service writes the result over the filler.
+            AppendExecutorLog(h, RunEnd("21:30:01.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.ResultProvenance!.Origin);
+            Assert.Equal(120, script.ResultProvenance.OffsetMinutes);
+            Assert.Equal(ImeLogTrackerAdapter.DurationPairVerdict.Verified, ImeLogTrackerAdapter.JudgeDurationPair(
+                script.StartedAtProvenance, script.ResultProvenance, false, script.ResultObservedAtUtc!.Value - script.StartedAtUtc!.Value, out _));
+        }
+
+        [Fact]
+        public async Task Verification_passes_keep_the_replaced_bytes_current_for_a_script_that_runs_longer()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:41.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+
+            // The script runs 40 s; the cadence check verifies the ledger every 10 s while the run is in flight.
+            for (var i = 0; i < 4; i++)
+            {
+                h.Now = h.Now.AddSeconds(10);
+                await h.Tracker.RunPollPassAsync(default);
+            }
+
+            AppendExecutorLog(h, RunEnd("21:30:41.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.ResultProvenance!.Origin);
+            Assert.Equal(120, script.ResultProvenance.OffsetMinutes);
+        }
+
+        [Fact]
+        public async Task Overwrite_does_not_move_the_files_measured_writer_offset()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:01.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out var before));
+
+            AppendExecutorLog(h, RunEnd("21:30:01.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out var after));
+            Assert.Equal(before, after);
+        }
+
+        [Theory]
+        // Replaced bytes confirmed 1 s / 30 s ago: written since, age bounded like an appended line's.
+        [InlineData(true, true, 1, true)]
+        [InlineData(true, true, 30, true)]
+        // Confirmed longer ago: the new bytes could be minutes old — their age may round onto the 15-minute grid.
+        [InlineData(true, true, 31, false)]
+        // The clock stepped back since the confirmation: the age is unknown.
+        [InlineData(true, true, -1, false)]
+        // The divergence lies in bytes the ledger never held (dropped by a cap): nothing dates them.
+        [InlineData(true, false, 1, false)]
+        // The pass itself is not fresh — the first pass after a restart never anchors.
+        [InlineData(false, true, 1, false)]
+        // Nothing was replaced.
+        [InlineData(true, true, null, false)]
+        public void Rewound_entry_is_fresh_only_when_the_bytes_it_replaced_were_confirmed_within_the_fresh_window(
+            bool passLinesAreFresh, bool entryAtRewindPointReplaced, int? secondsSinceConfirmed, bool expected)
+        {
+            var now = new DateTime(2026, 10, 4, 19, 2, 0, DateTimeKind.Utc);
+            DateTime? confirmed = secondsSinceConfirmed.HasValue ? now.AddSeconds(-secondsSinceConfirmed.Value) : (DateTime?)null;
+            Assert.Equal(expected, ImeLogTracker.RewoundEntryIsFresh(passLinesAreFresh, entryAtRewindPointReplaced, confirmed, now));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.WriterBoundary.cs

@@ -0,0 +1,368 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Session 756970cf: IME launched a Win32 detection executor and a platform-script executor 15 ms apart, and both
+    /// opened AgentExecutor.log at the same end-of-file offset. The platform executor's shorter start block overwrote
+    /// the detection executor's, whose identity line the tracker never saw; the detection's end block (exit 1 and its
+    /// stdout), written at its own position behind its own start block, then sat behind the PLATFORM start block, and
+    /// "the nearest preceding marker owns the line" handed another script's output and exit code to the platform
+    /// script. These tests pin the writer boundary: an entry that is not exactly one CMTrace record is where one
+    /// writer's bytes end and another's begin, and nothing behind it belongs to the invocation in front of it.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private const string RaceUserId = "00000000-0000-0000-0000-000000000000";
+        private const string RacePlatformId = "1d6f0a52-3c4e-4b7a-9e21-5f8c7d2b9a10";
+        private const string RaceDetectionAppId = "8b2e4c71-6a9d-4f03-b5e8-2c7a1d9f4e36";
+        private const string RaceFillerAppId = "5e1c2b7d-0a4f-4c8e-9d36-7b2f1e8a4c50";
+        private const string ImeDir = @"C:\Program Files (x86)\Microsoft Intune Management Extension";
+        private const string DetectionStdout = "VERBOSE: === Sample Suite Detection Started ===\r\nWARNING: === DETECTION FAILED: Sample Suite is not installed ===";
+        private const string PlatformStdout = "=== bootstrap loader started ===\r\nInstaller finished (exit code 0).";
+
+        private static string EntryAt(string time, string message)
+            => $"<![LOG[{message}]LOG]!><time=\"{time}\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n";
+
+        /// <summary>The four lines every AgentExecutor invocation starts with — identical length for every executor.</summary>
+        private static string ExecutorBanner(string time)
+            => EntryAt(time, "ExecutorLog AgentExecutor gets invoked")
+            + EntryAt(time, "Creating command line parser, name delimiter is - and value separator is  .")
+            + EntryAt(time, "Getting Ordered Parameters")
+            + EntryAt(time, "Parsing Ordered Parameters.");
+
+        private static string ExecutorLaunch(string time, string scriptPath, string pid)
+            => EntryAt(time, "Prepare to run Powershell Script ..")
+            + EntryAt(time, $"cmd line for running powershell is -NoProfile -executionPolicy bypass -file  \"{scriptPath}\" ")
+            + EntryAt(time, "runAs32BitOn64 = False, so Disable Wow64FsRedirection")
+            + EntryAt(time, @"PowerShell path is C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe")
+            + EntryAt(time, $"[Executor] created powershell with process id {pid}");
+
+        private static string PlatformStartBlock(string time, string policyId, string pid)
+        {
+            var path = $@"{ImeDir}\Policies\Scripts\{RaceUserId}_{policyId}.ps1";
+            var results = $@"{ImeDir}\Policies\Results\{RaceUserId}_{policyId}";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershell with value {path} to the named argument list.")
+                + EntryAt(time, "Powershell option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, results + ".output")
+                + EntryAt(time, results + ".error")
+                + EntryAt(time, results + ".timeout")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        private static string DetectionStartBlock(string time, string appId, string pid)
+        {
+            var path = $@"{ImeDir}\Content\DetectionScripts\{appId}_2.ps1";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershellDetection with value {path} to the named argument list.")
+                + EntryAt(time, "PowershellDetection option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, path + "quotedResultFilePath.txt")
+                + EntryAt(time, path + "quotedErrorFilePath.txt")
+                + EntryAt(time, path + "quotedTimeoutFilePath.txt")
+                + EntryAt(time, path + "quotedExitCodeFilePath.txt")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        private static string ExecutorEndBlock(string time, int exitCode, string stdout)
+            => EntryAt(time, $"Powershell exit code is {exitCode}")
+            + EntryAt(time, $"length of out={stdout.Length}")
+            + EntryAt(time, "length of error=0")
+            + EntryAt(time, "error from script =")
+            + EntryAt(time, exitCode == 0 ? "Powershell script is successfully executed." : "Powershell script is failed to execute")
+            + EntryAt(time, $"write output done. output = {stdout}, error = ")
+            + EntryAt(time, "Revert Wow64FsRedirection")
+            + EntryAt(time, "Agent executor completed.");
+
+        private static string PlatformResultLine(string policyId)
+            => $"[PowerShell] User Id = {RaceUserId}, Policy id = {policyId}, policy result = Success";
+
+        /// <summary>The file offsets at which the entries of an ASCII <paramref name="block"/> start when it is written at <paramref name="at"/>.</summary>
+        private static HashSet<long> EntryStarts(string block, long at)
+        {
+            Assert.True(block.All(c => c < 128), "offset arithmetic assumes ASCII test content");
+            var starts = new HashSet<long>();
+            for (var i = block.IndexOf("<![LOG[", StringComparison.Ordinal); i >= 0; i = block.IndexOf("<![LOG[", i + 1, StringComparison.Ordinal))
+                starts.Add(at + i);
+            return starts;
+        }
+
+        [Fact]
+        public async Task Executor_that_opened_at_the_same_offset_never_lends_its_end_block_to_the_platform_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // An earlier, finished detection run: the race starts mid-file like in the field log.
+            h.Append(DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1548") + ExecutorEndBlock("12:00:00.5000000", 0, "detected"));
+            await h.Pass();
+            var x = h.Length;
+
+            // Detection executor C and platform executor D open the file at the same end x. C writes first; the tracker
+            // reads C's banner, then D writes its own start block over C's.
+            var cStart = DetectionStartBlock("12:00:01.0000000", RaceDetectionAppId, "6416");
+            var dStart = PlatformStartBlock("12:00:01.2000000", RacePlatformId, "2524");
+            var cHead = cStart.Substring(0, cStart.IndexOf("<![LOG[Getting Ordered Parameters", StringComparison.Ordinal));
+            h.Append(cHead);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Append(cStart.Substring(cHead.Length));
+            h.Overwrite(x, dStart);
+
+            // The field geometry: D's start block is shorter and ends inside one of C's lines, so the tail of that line
+            // sits between D's start block and C's remaining bytes.
+            Assert.True(dStart.Length < cStart.Length);
+            Assert.DoesNotContain(x + dStart.Length, EntryStarts(cStart, x));
+            h.Now = h.Now.AddMilliseconds(150);
+            await h.Pass();
+            Assert.True(h.Health.OverwriteRewinds >= 1);
+
+            // C ends: its end block lands at its own position, right behind its own (overwritten) start block.
+            Assert.Equal(x + cStart.Length, h.Length);
+            var cEnd = ExecutorEndBlock("12:00:07.0000000", 1, DetectionStdout);
+            h.Append(cEnd);
+            h.Now = h.Now.AddSeconds(6);
+            await h.Pass();
+
+            // IME's result for D reaches the tracker before D's own end block: the completion must wait for it.
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            Assert.Empty(h.Completed);
+
+            // D ends: its end block lands at ITS position, over the fragment and C's bytes; C's last line survives.
+            var dEnd = ExecutorEndBlock("12:00:09.5000000", 0, PlatformStdout);
+            Assert.True(dEnd.Length < cStart.Length - dStart.Length + cEnd.Length);
+            h.Overwrite(x + dStart.Length, dEnd);
+            h.Now = h.Now.AddMilliseconds(130);
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(RacePlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal(PlatformStdout.Replace("\r\n", "\n"), script.Stdout);
+            Assert.DoesNotContain(h.Completed, s => (s.Stdout ?? string.Empty).Contains("Detection"));
+
+            // The run is known to the registry reconciliation under the user id of its own lines (D-316).
+            Assert.Equal(RaceUserId, script.UserId);
+            Assert.False(string.IsNullOrEmpty(script.RunId));
+            h.Tracker.ScriptRuns.NotePassCompleted(DateTime.MaxValue.AddDays(-1));
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RaceUserId, RacePlatformId, h.Now, out var run));
+            Assert.Equal(script.RunId, run!.RunId);
+        }
+
+        /// <summary>
+        /// The mirror image: a foreign executor whose stream position lies inside the platform start block (it opened
+        /// at the same end with a shorter start block) writes its end block there. Its first line merges with the head of
+        /// a platform line — cut inside the message or inside the trailer, which the parser would otherwise read up to
+        /// the foreign trailer — and its output line follows without any marker in between.
+        /// </summary>
+        [Theory]
+        [InlineData(15)]
+        [InlineData(-30)]
+        public async Task Foreign_end_block_merged_into_the_platform_start_block_never_reaches_the_platform_script(int cut)
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1548") + ExecutorEndBlock("12:00:00.5000000", 0, "detected"));
+            await h.Pass();
+            var x = h.Length;
+
+            var dStart = PlatformStartBlock("12:00:01.0000000", RacePlatformId, "2524");
+            h.Append(dStart);
+            await h.Pass();
+
+            // The foreign end block starts inside the line after D's argument line.
+            var lineAfterArgument = x + dStart.IndexOf("<![LOG[Powershell option gets invoked", StringComparison.Ordinal);
+            var lineLength = EntryAt("12:00:01.0000000", "Powershell option gets invoked").Length;
+            var at = lineAfterArgument + (cut > 0 ? cut : lineLength + cut);
+            var foreignEnd = ExecutorEndBlock("12:00:03.0000000", 1, "foreign output");
+            Assert.True(at + foreignEnd.Length < x + dStart.Length, "the foreign block must end inside D's start block");
+            h.Overwrite(at, foreignEnd);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            // No owner is provable behind the cut: the completion goes out without end-block data, never with the foreign one.
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Success", script.Result);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Entry_read_unchanged_after_a_rewind_keeps_its_platform_marker()
+        {
+            const string platformId = "2b7d9e41-8c3a-4f60-a5d2-9e1b7c4f3a08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Detection W waits for its script; detection X runs completely behind it; platform F starts behind X.
+            var wStart = DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1111");
+            var xRun = DetectionStartBlock("12:00:00.2000000", RaceDetectionAppId, "2222") + ExecutorEndBlock("12:00:00.4000000", 0, "x detected");
+            h.Append(wStart + xRun + PlatformStartBlock("12:00:01.0000000", platformId, "3333"));
+            await h.Pass();
+
+            // W ends at its own position, over the head of X's run; F's start block keeps its bytes and offset.
+            var wEnd = ExecutorEndBlock("12:00:02.0000000", 0, "w detected");
+            Assert.True(wEnd.Length < xRun.Length);
+            h.Overwrite(wStart.Length, wEnd);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // F's end block lands behind its start block: still F's, because F's marker survived with its bytes.
+            h.Append(ExecutorEndBlock("12:00:05.0000000", 7, "Hello from F"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(platformId), sourceFileName: "IntuneManagementExtension.log");
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(platformId, script.PolicyId);
+            Assert.Equal(7, script.ExitCode);
+            Assert.Equal("Hello from F", script.Stdout);
+        }
+
+        [Fact]
+        public async Task Writer_boundary_read_unchanged_after_a_rewind_still_closes_the_platform_invocation()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Detection Q waits for its script while detection R runs completely behind it.
+            var qStart = DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1111");
+            var rRun = DetectionStartBlock("12:00:00.2000000", "6c3f8a20-1d5e-4b97-8f4a-0e2d6b9c7a13", "2222") + ExecutorEndBlock("12:00:00.4000000", 0, "r detected");
+            h.Append(qStart + rRun);
+            await h.Pass();
+            var x = h.Length;
+
+            // The race of the field case behind them: the boundary closes D.
+            var cStart = DetectionStartBlock("12:00:01.0000000", RaceDetectionAppId, "6416");
+            var dStart = PlatformStartBlock("12:00:01.2000000", RacePlatformId, "2524");
+            h.Append(cStart);
+            h.Overwrite(x, dStart);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // Q ends at its own position, over R's run: the rewind starts in front of the race, whose bytes read unchanged.
+            var qEnd = ExecutorEndBlock("12:00:02.0000000", 0, "q detected");
+            Assert.True(qEnd.Length < rRun.Length);
+            h.Overwrite(qStart.Length, qEnd);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // C's end block behind the boundary stays unowned; D's own end block completes D.
+            var cEnd = ExecutorEndBlock("12:00:07.0000000", 1, DetectionStdout);
+            h.Append(cEnd);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            Assert.Empty(h.Completed);
+
+            h.Overwrite(x + dStart.Length, ExecutorEndBlock("12:00:09.5000000", 0, PlatformStdout));
+            h.Now = h.Now.AddMilliseconds(130);
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal(PlatformStdout.Replace("\r\n", "\n"), script.Stdout);
+        }
+
+        [Fact]
+        public async Task Raw_text_in_the_executor_log_is_never_matched_and_closes_the_platform_invocation()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(PlatformStartBlock("12:00:00.0000000", RacePlatformId, "2524"));
+            await h.Pass();
+
+            // The tail of a cut line that happens to read like an exit line, then a foreign end block.
+            h.Append("Powershell exit code is 5\r\n" + ExecutorEndBlock("12:00:02.0000000", 6, "foreign output"));
+            // A fragment right at the bookmark stops the first pass for a check; the second one reads it.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Fragment_in_the_ime_log_does_not_close_the_platform_run_context()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            // In the IME log the service writes the platform marker and the context line itself; the fragment in
+            // between is the tail of an executor's telemetry line and separates nothing.
+            h.Append(Entry(@"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\" + RaceUserId + "_" + RacePlatformId + ".ps1 is generated.", "17")
+                + "ing mananger...]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n"
+                + Entry("Launch powershell executor in user session", "17"));
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId));
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("User", script.RunContext);
+        }
+
+        [Fact]
+        public async Task Cut_multi_line_output_adds_one_boundary_not_one_per_line()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(PlatformStartBlock("12:00:00.0000000", RacePlatformId, "2524"));
+            await h.Pass();
+            var markersBefore = h.Tracker.InvocationMarkerCountForTest("AgentExecutor.log");
+
+            var lines = string.Concat(Enumerable.Range(1, 600).Select(i => $"orphaned output line {i}\r\n"));
+            h.Append(lines);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(markersBefore + 1, h.Tracker.InvocationMarkerCountForTest("AgentExecutor.log"));
+        }
+
+        [Theory]
+        [InlineData("<![LOG[Powershell exit code is 0]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", true)]
+        [InlineData("<![LOG[write output done. output = line one\nline two, error = ]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", true)]
+        [InlineData("\uFEFF<![LOG[ExecutorLog AgentExecutor gets invoked]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", true)]
+        [InlineData("t code is 3]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        [InlineData("", false)]
+        [InlineData("<![LOG[Powe<![LOG[Powershell exit code is 1]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        [InlineData("<![LOG[Powershell option gets invoked]LOG]!><time=\"12:00:00.0000000\" da<![LOG[Powershell exit code is 1]LOG]!><time=\"12:00:01.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        [InlineData("<![LOG[write output done. output = line one\nline<![LOG[Agent executor completed.]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        public void Single_cmtrace_record_is_told_apart_from_the_cut_of_two_writers(string text, bool expected)
+        {
+            Assert.Equal(expected, ImeLogTracker.IsSingleCmTraceRecord(text));
+        }
+
+        [Theory]
+        [InlineData("AgentExecutor.log", true)]
+        [InlineData("AgentExecutor-20261003-233348.log", true)]
+        [InlineData("IntuneManagementExtension.log", false)]
+        [InlineData("IntuneManagementExtension-20261003-233348.log", false)]
+        [InlineData("HealthScripts.log", false)]
+        [InlineData("AppWorkload.log", false)]
+        public void Writer_boundaries_apply_to_the_executor_log_live_and_rotated(string fileName, bool expected)
+        {
+            Assert.Equal(expected, ImeLogTracker.IsWriterBoundaryLogFile(fileName));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.cs

@@ -0,0 +1,541 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Session 46749560: IME's trace listener writes every log through one FileMode.Append
+    /// stream per process, so a process that resumes logging after another one appended
+    /// overwrites those bytes at its own stale position. The tracker had read the first version
+    /// and never saw the second — 6 of 16 script results and 4 of 16 executor end blocks were
+    /// lost while the final files looked intact. These tests drive that exact write pattern
+    /// (positional overwrite behind the bookmark) against the two multi-writer logs and pin the
+    /// contract: unchanged bytes never rewind, changed bytes are processed exactly once, and the
+    /// executor lines a rewind uncovers belong to the invocation that owns their file position.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 10, 19, 30, 0, DateTimeKind.Utc);
+
+        private static List<ImeLogPattern> MarkerPatterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-MARK", Category = "always", Enabled = true,
+                Pattern = @"^marker (?<n>\d+)", Action = "noop",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private static readonly string[] ScriptPatternIds =
+        {
+            "PS-AGENT-INVOCATION", "PS-AGENT-ARG", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
+            "PS-AGENT-OUTPUT", "PS-AGENT-ERROR", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT", "PS-SCRIPT-RESULT",
+        };
+
+        /// <summary>The shipped pattern JSON — the same source combine.js embeds — so the contract is the real one.</summary>
+        private static List<ImeLogPattern> ScriptPatterns()
+        {
+            DirectoryInfo? dir = new DirectoryInfo(AppContext.BaseDirectory);
+            string? patternDir = null;
+            while (dir != null)
+            {
+                var candidate = Path.Combine(dir.FullName, "rules", "ime-log-patterns");
+                if (Directory.Exists(candidate)) { patternDir = candidate; break; }
+                dir = dir.Parent;
+            }
+            Assert.NotNull(patternDir);
+
+            var byId = new Dictionary<string, ImeLogPattern>(StringComparer.OrdinalIgnoreCase);
+            foreach (var file in Directory.GetFiles(patternDir, "*.json"))
+            {
+                var pattern = JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(file));
+                if (pattern?.PatternId != null) byId[pattern.PatternId] = pattern;
+            }
+            return ScriptPatternIds.Select(id =>
+            {
+                Assert.True(byId.TryGetValue(id, out var p), $"Shipped IME pattern '{id}' not found under {patternDir}.");
+                return p!;
+            }).ToList();
+        }
+
+        private static string Entry(string message, string thread = "1")
+            => $"<![LOG[{message}]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"X\" context=\"\" type=\"1\" thread=\"{thread}\" file=\"\">\r\n";
+
+        private const string PlatformId = "d39eeef3-e88e-41a0-82d7-5e28ee7b5acf";
+        private const string PlatformStartLine =
+            @"Adding argument powershell with value C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\73d664e4-0886-4a73-b745-c694da45ddb4_d39eeef3-e88e-41a0-82d7-5e28ee7b5acf.ps1 to the named argument list.";
+        private const string DetectionStartLine =
+            @"Adding argument detectionScript with value C:\Windows\IMECache\DetectionScripts\App_cc46aa62-e93a-41a1-bdd0-44f57e92a66d.ps1 to the named argument list.";
+        private const string GeneratedLine =
+            @"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\73d664e4-0886-4a73-b745-c694da45ddb4_d39eeef3-e88e-41a0-82d7-5e28ee7b5acf.ps1 is generated.";
+        private const string ResultLine =
+            "[PowerShell] User Id = 73d664e4-0886-4a73-b745-c694da45ddb4, Policy id = " + PlatformId + ", policy result = Success";
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            private readonly string _matchLog;
+            private readonly List<ImeLogPattern> _patterns;
+            public ImeLogTracker Tracker { get; private set; }
+            public DateTime Now { get; set; } = T0;
+            public string LogName { get; }
+            public string LogPath => Path.Combine(_tmp.Path, LogName);
+            public string StateDir { get; }
+            public List<ScriptExecutionState> Completed { get; } = new List<ScriptExecutionState>();
+
+            public Harness(string logName, List<ImeLogPattern> patterns)
+            {
+                LogName = logName;
+                _patterns = patterns;
+                var logDir = Path.Combine(_tmp.Path, "agent");
+                Directory.CreateDirectory(logDir);
+                _matchLog = Path.Combine(logDir, "ime-pattern-matches.log");
+                StateDir = Path.Combine(_tmp.Path, "state");
+                Tracker = Build();
+            }
+
+            private ImeLogTracker Build()
+            {
+                var t = new ImeLogTracker(_tmp.Path, _patterns, new AgentLogger(Path.Combine(_tmp.Path, "agent"), AgentLogLevel.Debug),
+                    matchLogPath: _matchLog, stateDirectory: StateDir);
+                t.UtcNowProvider = () => Now;
+                t.OnScriptCompleted = s => Completed.Add(s);
+                return t;
+            }
+
+            /// <summary>Agent restart: dispose, rebuild over the same state directory, restore the bookmark.</summary>
+            public void Restart()
+            {
+                Tracker.SaveStateForTest();
+                Tracker.Dispose();
+                Tracker = Build();
+                Tracker.LoadStateForTest();
+            }
+
+            public void Append(string text) => File.AppendAllText(LogPath, text, new UTF8Encoding(false));
+
+            /// <summary>What IME's stale writer does: write at its own position, over whatever is there.</summary>
+            public void Overwrite(long offset, string text)
+            {
+                using (var fs = new FileStream(LogPath, FileMode.Open, FileAccess.Write, FileShare.ReadWrite))
+                {
+                    fs.Seek(offset, SeekOrigin.Begin);
+                    var bytes = new UTF8Encoding(false).GetBytes(text);
+                    fs.Write(bytes, 0, bytes.Length);
+                }
+            }
+
+            public long Length => new FileInfo(LogPath).Length;
+
+            public Task Pass(CancellationToken token = default) => Tracker.CheckLogFilesAsync(token);
+
+            /// <summary>Marker numbers matched so far, in match order.</summary>
+            public List<int> Matched()
+            {
+                if (!File.Exists(_matchLog)) return new List<int>();
+                return File.ReadAllLines(_matchLog)
+                    .Select(l => Regex.Match(l, @"\[T-MARK\] <!\[LOG\[marker (\d+)"))
+                    .Where(m => m.Success).Select(m => int.Parse(m.Groups[1].Value)).ToList();
+            }
+
+            public ImeTrackerHealth Health => Tracker.GetHealthSnapshot();
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        // -----------------------------------------------------------------------
+        // Marker-level contract on AgentExecutor.log
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public async Task Unchanged_bytes_never_rewind_however_often_they_are_verified()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + "<![LOG[marker 2\nsecond line\n]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"X\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n" + Entry("marker 3"));
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+
+            for (var i = 0; i < 5; i++)
+            {
+                h.Tracker.RequestOverwriteCheckForTest();
+                h.Now = h.Now.AddSeconds(2);
+                await h.Pass();
+            }
+
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+            Assert.Equal(5, h.Health.VerifyPasses);
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+        }
+
+        [Fact]
+        public async Task Non_multi_writer_files_keep_no_ledger_and_are_never_verified()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+            Assert.Equal(0, h.Tracker.LedgerEntryCountForTest("AppWorkload.log"));
+            Assert.Equal(0, h.Health.VerifyPasses);
+            Assert.Equal(0, h.Health.VerifiedBytes);
+        }
+
+        [Fact]
+        public async Task Block_written_over_read_bytes_is_processed_once_and_the_surviving_tail_is_not_repeated()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            var one = Entry("marker 1");
+            h.Append(one + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+
+            // A stale writer lays two entries over the first two (same length: marker 3 survives
+            // intact at its old offset). No growth, no fragment — only the end signal finds it.
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8"));
+            Assert.Equal(3 * one.Length, h.Length);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            Assert.Equal(3 * one.Length, h.Health.OverwriteBytesReprocessed);
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            // Nothing left to find.
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Block_that_cuts_an_old_entry_leaves_a_fragment_that_is_never_matched()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // Longer than two old entries, shorter than three: the tail of marker 3's line survives
+            // as a fragment behind the new block.
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8 is a little longer"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Guard_zone_catches_a_short_block_when_the_file_grows_without_any_signal()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // Same-length replacement of marker 1 (no fragment), then an ordinary append by
+            // another writer: the growth pass re-checks the last 4 KB and finds the change.
+            h.Overwrite(0, Entry("marker 7"));
+            h.Append(Entry("marker 4"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7, 4 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            Assert.Equal(1, h.Health.VerifyPasses); // the full check that follows a guard hit
+            Assert.True(h.Health.VerifiedBytes > 0);
+        }
+
+        [Fact]
+        public async Task Guard_hit_rewinds_to_the_true_start_of_the_block_not_the_guard_zone()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            // ~6 KB of entries so the guard zone covers only the last few.
+            var sb = new StringBuilder();
+            for (var i = 1; i <= 60; i++) sb.Append(Entry($"marker {i}"));
+            h.Append(sb.ToString());
+            await h.Pass();
+            Assert.Equal(60, h.Matched().Count);
+
+            // A block over everything plus one more entry: the guard sees a change at its
+            // zone start, the full check must place the rewind at offset 0.
+            var block = new StringBuilder();
+            for (var i = 101; i <= 161; i++) block.Append(Entry($"marker {i}"));
+            h.Overwrite(0, block.ToString());
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            var matched = h.Matched();
+            Assert.Equal(60 + 61, matched.Count);
+            Assert.Equal(Enumerable.Range(101, 61), matched.Skip(60));
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Fragment_at_the_bookmark_triggers_the_check_when_no_ledger_entry_starts_in_the_guard_zone()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            var one = Entry("marker 1");
+            var big = Entry("marker 2 " + new string('x', 6000));
+            h.Append(one + big);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+
+            // The 6 KB entry is the last ledger entry and starts before the 4 KB guard zone, so
+            // the guard has nothing to check. The stale writer's block is longer than that entry:
+            // the pass after it starts mid-line — a fragment — and must not match it raw.
+            h.Overwrite(one.Length, Entry("marker 7 " + new string('y', 3000)) + Entry("marker 8 " + new string('z', 3100)));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2 }, h.Matched());
+
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 7, 8 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Hidden_block_is_found_by_the_cadence_while_a_script_is_in_flight_and_the_cadence_is_throttled()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            // A platform script is pending → contention. First pass in contention verifies at once.
+            h.Tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: null, exitObservedAtUtc: null, startedAtUtc: T0);
+            h.Now = T0.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.VerifyPasses);
+
+            // Same-length replacement, no growth, no signal: only the cadence can find it —
+            // and not before a second has passed since the last verification.
+            h.Overwrite(0, Entry("marker 7"));
+            h.Now = T0.AddMilliseconds(500);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+            Assert.Equal(1, h.Health.VerifyPasses);
+
+            h.Now = T0.AddMilliseconds(1200);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7 }, h.Matched());
+            Assert.Equal(2, h.Health.VerifyPasses);
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Without_contention_or_signal_nothing_is_verified()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+
+            for (var i = 0; i < 20; i++)
+            {
+                h.Now = h.Now.AddSeconds(1);
+                await h.Pass();
+            }
+
+            Assert.Equal(0, h.Health.VerifyPasses);
+            Assert.Equal(0, h.Health.VerifiedBytes);
+        }
+
+        [Fact]
+        public async Task Restart_seeds_the_ledger_so_an_overwrite_after_the_restart_is_still_found()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            h.Restart();
+            Assert.Equal(0, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            // First pass after the restart: nothing new to read, but the ledger is seeded from
+            // the bytes behind the persisted bookmark.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(3, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+
+            h.Overwrite(0, Entry("marker 7"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 7 }, h.Matched());
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // The counter is part of the persisted health.
+            h.Restart();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Rollover_clears_the_ledger_and_the_new_file_is_read_without_a_false_rewind()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            File.WriteAllText(h.LogPath, Entry("marker 7") + Entry("marker 8"), new UTF8Encoding(false));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+            Assert.Equal(2, h.Tracker.LedgerEntryCountForTest("AgentExecutor.log"));
+        }
+
+        [Fact]
+        public async Task Cancelled_pass_does_not_lose_a_pending_check()
+        {
+            using var h = new Harness("AgentExecutor.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+            h.Overwrite(0, Entry("marker 7") + Entry("marker 8"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+
+            using (var cts = new CancellationTokenSource())
+            {
+                cts.Cancel();
+                await h.Pass(cts.Token);
+            }
+
+            // The cancelled pass touched nothing after the rewind; the next one reads it all.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 7, 8 }, h.Matched());
+        }
+
+        // -----------------------------------------------------------------------
+        // The field scenario with the shipped patterns
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public async Task Executor_end_block_written_over_a_detection_invocation_belongs_to_its_own_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Executor E starts its platform script and waits for PowerShell.
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 12708"));
+            await h.Pass();
+            var executorPosition = h.Length;
+
+            // Detection executor D appends its whole run while E waits — the tracker reads it.
+            var detectionBlock = Entry("ExecutorLog AgentExecutor gets invoked") + Entry(DetectionStartLine)
+                + Entry("Powershell exit code is 3") + Entry("write output done. output = detected nothing, error = ")
+                + Entry("Agent executor completed.") + Entry(@"Writing result: False to resultFilePath: C:\x\App_cc46aa62.txt");
+            h.Append(detectionBlock);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // E ends: its end block lands at its own stale position, over D's lines.
+            var endBlock = Entry("Powershell exit code is 0") + Entry("write output done. output = Hello from E, error = ") + Entry("Agent executor completed.");
+            Assert.True(endBlock.Length < detectionBlock.Length);
+            h.Overwrite(executorPosition, endBlock);
+
+            // Nothing visible signalled the end; the cadence (E is pending) finds the block.
+            h.Now = h.Now.AddSeconds(1.5);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // IME's result line (in the other file) completes the script with E's own data.
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal("Hello from E", script.Stdout);
+        }
+
+        [Fact]
+        public async Task Detection_exit_lines_read_before_the_overwrite_never_reach_the_platform_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 1"));
+            await h.Pass();
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(DetectionStartLine)
+                + Entry("Powershell exit code is 3") + Entry("write output done. output = detected nothing, error = ") + Entry("Agent executor completed."));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // The platform result arrives without any end block ever becoming visible: held for
+            // the grace, then emitted — the detection's exit code 3 must not stand in.
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            Assert.Empty(h.Completed);
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Success", script.Result);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Ime_result_line_hidden_by_an_executor_start_line_is_recovered_from_the_ime_log()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            // Seen empty first: the start lines are fresh and anchor themselves like the recovered result line will,
+            // so start and result sit on one timeline whatever the host's own zone is.
+            h.Append(string.Empty);
+            await h.Pass();
+            h.Append(Entry(GeneratedLine, "17") + Entry("Launch powershell executor in user session", "17") + Entry("process id = 10608", "17"));
+            await h.Pass();
+            var servicePosition = h.Length;
+
+            // The executor process appends its telemetry start line at the true end of file.
+            h.Append(Entry("[Telemetry] Telemetry is enabled. Starting mananger...", "1"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Empty(h.Completed);
+
+            // The service's first write after the script wait lands at ITS position — over the
+            // executor's line; the block is longer, so the pass sees a fragment at the bookmark.
+            h.Overwrite(servicePosition, Entry("Execution is done, collecting result", "17") + Entry(ResultLine, "17") + Entry("[PowerShell] Success, Result details length: 315", "17"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // Recovered on the IME side alone (this harness has no AgentExecutor.log): held for
+            // the end block, emitted without an exit code after the grace.
+            Assert.Empty(h.Completed);
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal("User", script.RunContext);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerPlatformScriptContaminationTests.cs

@@ -36,8 +36,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         // silently passing against a stale inline copy.
         private static readonly string[] RequiredPatternIds =
         {
-            "PS-AGENT-INVOCATION", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
-            "PS-AGENT-OUTPUT", "PS-SCRIPT-RESULT",
+            "PS-AGENT-INVOCATION", "PS-AGENT-ARG", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
+            "PS-AGENT-OUTPUT", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT",
+            "PS-SCRIPT-RESULT", "HS-INVOCATION",
         };
 
         private static List<ImeLogPattern> ScriptPatterns()
@@ -83,6 +84,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         private const string RemediationStartLine =
             @"Adding argument remediationScript with value C:\Windows\IMECache\HealthScripts\446f0450-d0ee-404c-8dc0-a74123bde31f_1\detect.ps1 to the named argument list.";
 
+        private const string ImeLog = "IntuneManagementExtension.log";
+        private const string HealthLog = "HealthScripts.log";
+        private const string ExecutorLog = "AgentExecutor.log";
+
+        private const string PlatformGeneratedLine =
+            @"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_c3e0124c-4936-4bfd-afcc-c7fe1d84d104.ps1 is generated";
+
+        private static readonly string PlatformResultLine =
+            $"[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = {PlatformId}, policy result = Success";
+
+        // The health-script worker (IME AgentCommon ScriptWorker) writes its command line, the launch
+        // line and the exit line to IntuneManagementExtension.log AND HealthScripts.log — session
+        // 24dc69d1 (IME 1.105.152.0), where the exit line pre-filled a pending platform script's exit
+        // code and the launch line its context.
+        private const string HealthScriptCommandLine =
+            @"""C:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe""  -remediationScript  """"C:\WINDOWS\IMECache\HealthScripts\446f0450-d0ee-404c-8dc0-a74123bde31f_1\detect.ps1"""" ""C:\WINDOWS\IMECache\HealthScripts\446f0450-d0ee-404c-8dc0-a74123bde31f_1\detect.ps1.result"" 60";
+        private const string HealthScriptExitLine = "Powershell execution is done, exitCode = 5";
+
         private static ImeLogTracker BuildTracker(TempDirectory tmp, out List<ScriptExecutionState> emitted)
         {
             var captured = new List<ScriptExecutionState>();
@@ -111,9 +130,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.ProcessLogMessageForTest("Powershell exit code is 0");
             tracker.ProcessLogMessageForTest("write output done. output = [Compliant] No Classic Teams found, error = ");
 
-            // Authoritative IME result for the PLATFORM script (keyed by policyId).
+            // Authoritative IME result for the PLATFORM script (keyed by policyId). Its own end
+            // block never comes here, so the result is held until the shutdown flush — which must
+            // not pick up the remediation's exit/output either.
             tracker.ProcessLogMessageForTest(
                 $"[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = {PlatformId}, policy result = Failed");
+            Assert.Empty(emitted);
+            tracker.FlushPendingPlatformScriptResults(System.DateTime.UtcNow, force: true);
 
             var script = Assert.Single(emitted);
             Assert.Equal(PlatformId, script.PolicyId);
@@ -145,5 +168,100 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Equal(0, script.ExitCode);
             Assert.Equal("Hello from c3e0124c", script.Stdout);
         }
+
+        // -----------------------------------------------------------------------
+        // Health-script lines never feed a platform slot (session 24dc69d1)
+        // -----------------------------------------------------------------------
+
+        [Fact]
+        public void No_shipped_pattern_reads_the_health_script_workers_exit_line()
+        {
+            // "Powershell execution is done, exitCode = N" is the health-script worker's line only;
+            // as PS-SCRIPT-EXITCODE (no scriptType) it pre-filled the exit code of whichever platform
+            // script was pending, which then emitted without waiting for its own end block.
+            foreach (var file in Directory.GetFiles(FindRulesPatternDir(), "*.json"))
+            {
+                var pattern = JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(file))!;
+                Assert.False(System.Text.RegularExpressions.Regex.IsMatch(HealthScriptExitLine, pattern.Pattern),
+                    $"{pattern.PatternId} matches the health-script worker's exit line");
+            }
+        }
+
+        [Fact]
+        public void Health_script_exit_line_in_the_ime_log_never_pre_fills_the_platform_slot()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest(PlatformGeneratedLine, sourceFileName: ImeLog);
+            // A health script that ran in parallel finishes: its exit line lands inside the platform
+            // run's window (c81b8053 had "exit code 0" before its executor even started).
+            tracker.ProcessLogMessageForTest(HealthScriptExitLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+
+            // No exit code of its own → held for the end block, never emitted with the health script's 5.
+            Assert.Empty(emitted);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+            var script = Assert.Single(emitted);
+            Assert.Null(script.ExitCode);
+            Assert.Equal("Success", script.Result);
+        }
+
+        [Fact]
+        public void Health_script_launch_line_in_the_ime_log_does_not_flip_the_platform_context()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest(PlatformGeneratedLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest("Launch powershell executor in user session", sourceFileName: ImeLog);
+            // The health-script worker launches its executor while the platform script runs: its
+            // command line opens an invocation that owns nothing, so its launch line stays there.
+            tracker.ProcessLogMessageForTest(HealthScriptCommandLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest("Launch powershell executor in machine session", sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("User", script.RunContext);
+        }
+
+        [Fact]
+        public void Lines_from_the_health_scripts_log_never_resolve_to_a_platform_script()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest("ExecutorLog AgentExecutor gets invoked", sourceFileName: ExecutorLog);
+            tracker.ProcessLogMessageForTest(PlatformStartLine, sourceFileName: ExecutorLog);
+            // HealthScripts.log never carries a platform marker — the run in flight is not the
+            // fallback owner of the lines there.
+            tracker.ProcessLogMessageForTest("Launch powershell executor in machine session", sourceFileName: HealthLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+
+            var script = Assert.Single(emitted);
+            Assert.Null(script.RunContext);
+        }
+
+        [Fact]
+        public void Context_line_after_an_ime_log_rollover_still_finds_the_run_in_flight()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+
+            tracker.ProcessLogMessageForTest(PlatformGeneratedLine, sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest("ExecutorLog AgentExecutor gets invoked", sourceFileName: ExecutorLog);
+            tracker.ProcessLogMessageForTest(PlatformStartLine, sourceFileName: ExecutorLog);
+            // IME rolls the log over between its two lines: the fresh file has no markers, but
+            // platform runs open there — the run in flight still owns the context line.
+            tracker.ClearInvocationMarkersForTest(ImeLog);
+            tracker.ProcessLogMessageForTest("Launch powershell executor in user session", sourceFileName: ImeLog);
+            tracker.ProcessLogMessageForTest(PlatformResultLine, sourceFileName: ImeLog);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("User", script.RunContext);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerPlatformScriptFallbackTests.cs

@@ -39,7 +39,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.SeedPendingPlatformScriptForTesting("dece354a", exitCode: 0, exitObservedAtUtc: observedAt, stdout: "Script start.\nScript end.");
 
             // Well past the grace window — should emit.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             var script = Assert.Single(emitted);
             Assert.Equal("dece354a", script.PolicyId);
@@ -60,11 +60,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.SeedPendingPlatformScriptForTesting("60b43a2e", exitCode: 0, exitObservedAtUtc: observedAt);
 
             // Inside the grace window — IME might still log its result; do not emit yet.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(5));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(5));
             Assert.Empty(emitted);
 
             // Past the grace window — emit.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
             Assert.Single(emitted);
         }
 
@@ -78,13 +78,38 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.SeedPendingPlatformScriptForTesting("846cea22", exitCode: 0, exitObservedAtUtc: observedAt);
 
             // Shutdown flush right after exit — grace not elapsed, but force emits anyway.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(1), force: true);
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(1), force: true);
 
             Assert.Single(emitted);
         }
 
+        [Theory]
+        // IME's verdict is Success exactly when the error file is empty, whatever the exit code. Judged by the exit
+        // code, session 67ae751c showed exit 0 with the script's own stderr as Success, and 46a41a0a an exit 1 without
+        // stderr as Failed, a run IME reported as Success one cycle earlier.
+        [InlineData(0, "Invoke-WebRequest : The remote name could not be resolved", "Failed")]
+        [InlineData(1, "", "Success")]
+        [InlineData(1, "  \n", "Success")]
+        [InlineData(0, "", "Success")]
+        [InlineData(1, null, "Failed")]
+        [InlineData(0, null, "Success")]
+        public void Fallback_judges_like_ime_by_the_stderr_it_read(int exitCode, string? stderr, string expected)
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+            var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
+
+            tracker.SeedPendingPlatformScriptForTesting("0d2294bf", exitCode: exitCode, exitObservedAtUtc: observedAt, stderr: stderr);
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
+
+            var script = Assert.Single(emitted);
+            Assert.Equal(expected, script.Result);
+            Assert.Equal(exitCode, script.ExitCode);
+            Assert.Equal("agentexecutor_fallback", script.ResultSource);
+        }
+
         [Fact]
-        public void Nonzero_exit_code_emits_failed_result()
+        public void Nonzero_exit_code_without_a_stderr_line_emits_failed_result()
         {
             using var tmp = new TempDirectory();
             var tracker = BuildTracker(tmp, out var emitted);
@@ -92,7 +117,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             tracker.SeedPendingPlatformScriptForTesting("bad5c0de", exitCode: 1, exitObservedAtUtc: observedAt);
 
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             var script = Assert.Single(emitted);
             Assert.Equal(1, script.ExitCode);
@@ -109,7 +134,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             // Started but no exit code yet → still running, must not be emitted even on force flush.
             tracker.SeedPendingPlatformScriptForTesting("running", exitCode: null, exitObservedAtUtc: null);
 
-            tracker.FlushStalePlatformScriptResults(DateTime.UtcNow, force: true);
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
 
             Assert.Empty(emitted);
         }
@@ -122,7 +147,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
 
             tracker.SeedPendingPlatformScriptForTesting("dece354a", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
             Assert.Single(emitted);
 
             // IME finally logs its PS-SCRIPT-RESULT line — must NOT produce a second event.
@@ -138,7 +163,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
 
             tracker.SeedPendingPlatformScriptForTesting("dece354a", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             // The exit-observed timestamp must travel on the emitted state so the adapter can bind
             // the event to it instead of an unrelated "last matched" line parsed during the grace.
@@ -156,14 +181,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             // Run 1 of policy X — fallback emits.
             tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: 0, exitObservedAtUtc: firstRun);
-            tracker.FlushStalePlatformScriptResults(firstRun.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(firstRun.AddSeconds(20));
             Assert.Single(emitted);
 
             // Run 2 of the SAME policy later in the same agent lifetime (IME re-evaluation / retry)
             // must NOT be deduped away — the fresh start clears the prior emitted-marker.
             var secondRun = firstRun.AddMinutes(30);
             tracker.SeedPendingPlatformScriptForTesting("policyX", exitCode: 0, exitObservedAtUtc: secondRun);
-            tracker.FlushStalePlatformScriptResults(secondRun.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(secondRun.AddSeconds(20));
             Assert.Equal(2, emitted.Count);
         }
 
@@ -182,7 +207,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Equal("ime_policy_result", script.ResultSource);
 
             // Later fallback pass must find nothing pending → no duplicate.
-            tracker.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
             Assert.Single(emitted);
         }
     }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerPollTimingTests.cs

@@ -0,0 +1,95 @@
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// The poll loop's timing maxima (session c3ecb568: the loop was not scheduled for 26 s at
+    /// 100 % VM CPU and nothing in the telemetry could show it): the longest pass and the
+    /// longest pause between two passes, on a monotonic clock, restart-safe like the other
+    /// health counters.
+    /// </summary>
+    public sealed class ImeLogTrackerPollTimingTests
+    {
+        /// <summary>Monotonic readings the tracker takes at the start and the end of every pass.</summary>
+        private sealed class Clock
+        {
+            private readonly Queue<long> _readings = new Queue<long>();
+            public void Enqueue(params long[] ms) { foreach (var m in ms) _readings.Enqueue(m); }
+            public long Next() => _readings.Dequeue();
+        }
+
+        private static ImeLogTracker Build(TempDirectory tmp, Clock clock)
+        {
+            var tracker = new ImeLogTracker(tmp.Path, new List<ImeLogPattern>(), new AgentLogger(tmp.Path, AgentLogLevel.Info), stateDirectory: tmp.Path);
+            tracker.MonotonicMillisProvider = clock.Next;
+            return tracker;
+        }
+
+        [Fact]
+        public async Task Longest_pass_and_longest_pause_are_kept_as_session_maxima()
+        {
+            using var tmp = new TempDirectory();
+            var clock = new Clock();
+            var tracker = Build(tmp, clock);
+
+            // Pass 1 takes 30 ms; the loop is not scheduled again for 26.1 s; pass 2 takes 10 ms,
+            // pass 3 follows after the normal 100 ms.
+            clock.Enqueue(0, 30, 26130, 26140, 26240, 26245);
+            await tracker.RunPollPassAsync(CancellationToken.None);
+            await tracker.RunPollPassAsync(CancellationToken.None);
+            await tracker.RunPollPassAsync(CancellationToken.None);
+
+            var health = tracker.GetHealthSnapshot();
+            Assert.Equal(30, health.PassMaxMs);
+            Assert.Equal(26100, health.PassGapMaxMs);
+            tracker.Dispose();
+        }
+
+        [Fact]
+        public void A_fresh_tracker_reports_zero()
+        {
+            using var tmp = new TempDirectory();
+            var tracker = Build(tmp, new Clock());
+
+            var health = tracker.GetHealthSnapshot();
+            Assert.Equal(0, health.PassMaxMs);
+            Assert.Equal(0, health.PassGapMaxMs);
+            tracker.Dispose();
+        }
+
+        [Fact]
+        public async Task Maxima_survive_a_restart_and_are_never_lowered()
+        {
+            using var tmp = new TempDirectory();
+            var clock = new Clock();
+            var tracker1 = Build(tmp, clock);
+            clock.Enqueue(0, 40, 5140, 5150);
+            await tracker1.RunPollPassAsync(CancellationToken.None);
+            await tracker1.RunPollPassAsync(CancellationToken.None);
+            tracker1.SaveStateForTest();
+            tracker1.Dispose();
+
+            var tracker2 = Build(tmp, clock);
+            tracker2.LoadStateForTest();
+            Assert.Equal(40, tracker2.GetHealthSnapshot().PassMaxMs);
+            Assert.Equal(5100, tracker2.GetHealthSnapshot().PassGapMaxMs);
+
+            // The first pass after a restart has no pause to measure; a calmer session afterwards
+            // never lowers what the session already saw.
+            clock.Enqueue(6000, 6010, 6110, 6115);
+            await tracker2.RunPollPassAsync(CancellationToken.None);
+            await tracker2.RunPollPassAsync(CancellationToken.None);
+            var health = tracker2.GetHealthSnapshot();
+            Assert.Equal(40, health.PassMaxMs);
+            Assert.Equal(5100, health.PassGapMaxMs);
+            tracker2.Dispose();
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerResultHoldTests.cs

@@ -0,0 +1,332 @@
+using System;
+using System.Collections.Generic;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// The IME result waits for its executor end block (session e7f3c910): PS-SCRIPT-RESULT can
+    /// reach the tracker before the AgentExecutor.log end block of the same run — an overwritten
+    /// block is recovered one pass after the result that triggers the ledger check, the
+    /// AgentExecutor.log read of a pass may precede the exit line by milliseconds, or the poll
+    /// loop stalled. Emitting at once lost the exit code and, when the late start line reopened
+    /// the slot, produced a fallback duplicate 15 s later.
+    /// </summary>
+    public sealed class ImeLogTrackerResultHoldTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 10, 22, 13, 35, DateTimeKind.Utc);
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public ImeLogTracker Tracker { get; private set; }
+            public DateTime Now { get; set; } = T0;
+            public List<ScriptExecutionState> Completed { get; } = new List<ScriptExecutionState>();
+            public List<ScriptStartedInfo> Started { get; } = new List<ScriptStartedInfo>();
+
+            public Harness() { Tracker = Build(); }
+
+            private ImeLogTracker Build()
+            {
+                var t = new ImeLogTracker(_tmp.Path, new List<ImeLogPattern>(), new AgentLogger(_tmp.Path, AgentLogLevel.Info), stateDirectory: _tmp.Path);
+                t.UtcNowProvider = () => Now;
+                t.OnScriptCompleted = s => Completed.Add(s);
+                t.OnScriptStarted = s => Started.Add(s);
+                return t;
+            }
+
+            /// <summary>Agent restart over the same state directory.</summary>
+            public void Restart()
+            {
+                Tracker.SaveStateForTest();
+                Tracker.Dispose();
+                Tracker = Build();
+                Tracker.LoadStateForTest();
+            }
+
+            /// <summary>A start line (IME "Script file … is generated" or the executor's argument line) with its source timestamp.</summary>
+            public void Start(string id, DateTime lineTs)
+            {
+                Tracker.LastMatchedLogTimestamp = lineTs;
+                Tracker.NextTestEntry();
+                Tracker.HandlePlatformScriptStarted(id);
+            }
+
+            public void Result(string id, DateTime lineTs, string result = "Success")
+                => Tracker.CompletePlatformScriptFromImeResultForTesting(id, result, lineTs);
+
+            public void Exit(string id, DateTime lineTs, int exitCode = 0)
+                => Tracker.RecordPlatformScriptExitCodeForTesting(id, exitCode, lineTs);
+
+            /// <summary>The end-of-pass flush at the harness clock.</summary>
+            public void Flush(bool force = false) => Tracker.FlushPendingPlatformScriptResults(Now, force);
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Result_before_the_end_block_is_held_and_emits_once_with_the_exit_code()
+        {
+            using var h = new Harness();
+            h.Start("376ee51a", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("376ee51a", T0.AddSeconds(2));
+            Assert.Empty(h.Completed);
+            h.Now = T0.AddSeconds(2.1);
+            h.Flush();
+            Assert.Empty(h.Completed);
+
+            // The end block surfaces on the next pass (ledger rewind or plain read lag).
+            h.Exit("376ee51a", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2.2);
+            h.Flush();
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+            Assert.Equal(T0.AddSeconds(2), script.ResultObservedAtUtc);
+            Assert.Equal("PS-SCRIPT-RESULT", script.ResultPatternId);
+            Assert.Equal(T0, script.StartedAtUtc);
+
+            // Nothing fires twice: later passes, a repeated result line, the 15 s fallback window.
+            h.Now = T0.AddSeconds(30);
+            h.Flush();
+            h.Result("376ee51a", T0.AddSeconds(2));
+            Assert.Single(h.Completed);
+        }
+
+        [Fact]
+        public void Result_with_the_end_block_already_read_emits_at_once()
+        {
+            using var h = new Harness();
+            h.Start("847da54e", T0);
+            h.Exit("847da54e", T0.AddSeconds(2.3));
+            h.Now = T0.AddSeconds(2.31);
+            h.Result("847da54e", T0.AddSeconds(2.31));
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Null(script.ResultHeldSinceUtc);
+            Assert.Equal(T0.AddSeconds(2.31), script.ResultObservedAtUtc);
+        }
+
+        [Fact]
+        public void Held_result_emits_without_exit_code_after_the_grace()
+        {
+            using var h = new Harness();
+            h.Start("784fcaf5", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("784fcaf5", T0.AddSeconds(2));
+
+            h.Now = T0.AddSeconds(2).Add(ImeLogTracker.PlatformScriptEndBlockGrace).AddMilliseconds(-100);
+            h.Flush();
+            Assert.Empty(h.Completed);
+
+            h.Now = T0.AddSeconds(2).Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Flush();
+            var script = Assert.Single(h.Completed);
+            Assert.Null(script.ExitCode);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal("ime_policy_result", script.ResultSource);
+
+            // An exit line surfacing after the emit is dropped — no second event, no fallback.
+            h.Exit("784fcaf5", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(40);
+            h.Flush();
+            Assert.Single(h.Completed);
+        }
+
+        [Fact]
+        public void Shutdown_flush_emits_a_held_result_at_once()
+        {
+            using var h = new Harness();
+            h.Start("a52e4f47", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("a52e4f47", T0.AddSeconds(2), "Failed");
+            Assert.Empty(h.Completed);
+
+            h.Flush(force: true);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Failed", script.Result);
+            Assert.Null(script.ExitCode);
+        }
+
+        [Fact]
+        public void Late_start_line_of_an_emitted_run_opens_no_new_run()
+        {
+            // Session e7f3c910, 376ee51a: the result was emitted, THEN the executor's start and
+            // exit lines of the same run were read (a 2 s poll stall) — the start opened a second
+            // slot and the exit code became a fallback duplicate 15 s later.
+            using var h = new Harness();
+            h.Start("376ee51a", T0);
+            h.Exit("376ee51a", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2);
+            h.Result("376ee51a", T0.AddSeconds(2));
+            Assert.Single(h.Completed);
+            Assert.Single(h.Started);
+
+            h.Start("376ee51a", T0.AddMilliseconds(300));
+            Assert.Single(h.Started);
+            h.Exit("376ee51a", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(30);
+            h.Flush();
+            Assert.Single(h.Completed);
+        }
+
+        [Fact]
+        public void Start_line_newer_than_the_emitted_result_is_the_next_run()
+        {
+            using var h = new Harness();
+            h.Start("338d9434", T0);
+            h.Exit("338d9434", T0.AddSeconds(1));
+            h.Now = T0.AddSeconds(1);
+            h.Result("338d9434", T0.AddSeconds(1));
+            Assert.Single(h.Completed);
+
+            // IME re-runs the policy after the user signed in.
+            h.Start("338d9434", T0.AddMinutes(7));
+            Assert.Equal(2, h.Started.Count);
+            h.Exit("338d9434", T0.AddMinutes(7).AddSeconds(3));
+            h.Now = T0.AddMinutes(7).AddSeconds(3);
+            h.Result("338d9434", T0.AddMinutes(7).AddSeconds(3));
+            Assert.Equal(2, h.Completed.Count);
+            Assert.Equal(T0.AddMinutes(7), h.Completed[1].StartedAtUtc);
+        }
+
+        [Fact]
+        public void Newer_start_line_closes_a_held_result_and_starts_the_next_run()
+        {
+            using var h = new Harness();
+            h.Start("c81b8053", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("c81b8053", T0.AddSeconds(2));
+            Assert.Empty(h.Completed);
+
+            // The end block never surfaced before the policy ran again.
+            h.Start("c81b8053", T0.AddSeconds(4));
+            var first = Assert.Single(h.Completed);
+            Assert.Null(first.ExitCode);
+            Assert.Equal(T0, first.StartedAtUtc);
+            Assert.Equal(2, h.Started.Count);
+
+            h.Exit("c81b8053", T0.AddSeconds(6));
+            h.Now = T0.AddSeconds(6);
+            h.Result("c81b8053", T0.AddSeconds(6));
+            Assert.Equal(2, h.Completed.Count);
+            Assert.Equal(0, h.Completed[1].ExitCode);
+            Assert.Equal(T0.AddSeconds(4), h.Completed[1].StartedAtUtc);
+        }
+
+        [Fact]
+        public void Result_without_a_start_takes_the_recovered_start_line_and_end_block()
+        {
+            // Both the start block and the end block were hidden when the result arrived; the
+            // ledger rewind the result triggers brings both back on the next pass.
+            using var h = new Harness();
+            h.Now = T0.AddSeconds(2);
+            h.Result("d39eeef3", T0.AddSeconds(2));
+            Assert.Empty(h.Completed);
+
+            h.Start("d39eeef3", T0);
+            Assert.Empty(h.Started);
+            h.Exit("d39eeef3", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2.2);
+            h.Flush();
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(T0, script.StartedAtUtc);
+            Assert.Equal(0, script.ExitCode);
+        }
+
+        [Fact]
+        public void Held_result_survives_a_restart()
+        {
+            using var h = new Harness();
+            h.Start("832e27bc", T0);
+            h.Now = T0.AddSeconds(2);
+            h.Result("832e27bc", T0.AddSeconds(2));
+            h.Restart();
+            Assert.Empty(h.Completed);
+
+            h.Exit("832e27bc", T0.AddSeconds(1.99));
+            h.Now = T0.AddSeconds(2.5);
+            h.Flush();
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal(T0.AddSeconds(2), script.ResultObservedAtUtc);
+            Assert.Equal("PS-SCRIPT-RESULT", script.ResultPatternId);
+        }
+
+        [Fact]
+        public void Emitted_marker_keeps_the_run_timestamp_across_a_restart()
+        {
+            using var h = new Harness();
+            h.Start("89b3cbcd", T0);
+            h.Exit("89b3cbcd", T0.AddSeconds(1));
+            h.Now = T0.AddSeconds(1);
+            h.Result("89b3cbcd", T0.AddSeconds(1));
+            h.Restart();
+
+            h.Start("89b3cbcd", T0.AddMilliseconds(500)); // late line of the emitted run
+            Assert.Single(h.Started);
+            h.Start("89b3cbcd", T0.AddMinutes(5));        // the next run
+            Assert.Equal(2, h.Started.Count);
+        }
+
+        [Fact]
+        public void Marker_list_from_an_older_state_file_still_dedups()
+        {
+            using var tmp = new TempDirectory();
+            var persistence = new ImeTrackerStatePersistence(tmp.Path, new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            persistence.Save(new ImeTrackerStateData { PlatformScriptResultEmitted = new List<string> { "policyZ" } });
+
+            var completed = new List<ScriptExecutionState>();
+            var started = new List<ScriptStartedInfo>();
+            var tracker = new ImeLogTracker(tmp.Path, new List<ImeLogPattern>(), new AgentLogger(tmp.Path, AgentLogLevel.Info), stateDirectory: tmp.Path);
+            tracker.OnScriptCompleted = s => completed.Add(s);
+            tracker.OnScriptStarted = s => started.Add(s);
+            tracker.LoadStateForTest();
+
+            tracker.CompletePlatformScriptFromImeResultForTesting("policyZ", "Success", T0);
+            Assert.Empty(completed);
+
+            // Without a timestamp on the marker every start line is a new run, as before.
+            tracker.LastMatchedLogTimestamp = T0;
+            tracker.HandlePlatformScriptStarted("policyZ");
+            Assert.Single(started);
+        }
+
+        [Fact]
+        public void Emitted_marker_is_capped_at_the_clock_so_the_next_run_still_opens_a_slot()
+        {
+            // Session 4377911b: the result line was re-read after an overwrite rewind and resolved
+            // in the reader's zone, one hour ahead of the clock. Stored uncapped, that stamp made
+            // the genuine second run's start line read as a late line of the first run and its
+            // result a duplicate.
+            using var h = new Harness();
+            h.Start("d94468af", T0.AddSeconds(-10));
+            h.Result("d94468af", T0.AddHours(1));
+            h.Exit("d94468af", T0.AddSeconds(-1));
+            h.Flush();
+            Assert.Single(h.Completed);
+
+            // The second run, two minutes later on the clock — still "before" the uncapped stamp.
+            h.Now = T0.AddMinutes(2);
+            h.Start("d94468af", h.Now.AddSeconds(-5));
+            h.Result("d94468af", h.Now.AddSeconds(-1));
+            h.Exit("d94468af", h.Now.AddSeconds(-2));
+            h.Flush();
+
+            Assert.Equal(2, h.Completed.Count);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerScriptStatePersistenceTests.cs

@@ -41,7 +41,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             // Run 1: exit code seen, shutdown force-flush emits the fallback completion.
             var tracker1 = BuildTracker(tmp, out var emitted1);
             tracker1.SeedPendingPlatformScriptForTesting("policyA", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker1.FlushStalePlatformScriptResults(observedAt.AddSeconds(1), force: true);
+            tracker1.FlushPendingPlatformScriptResults(observedAt.AddSeconds(1), force: true);
             Assert.Single(emitted1);
             tracker1.SaveStateForTest();
 
@@ -68,7 +68,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             // Restarted tracker continues the grace window instead of dropping the script.
             var tracker2 = BuildTracker(tmp, out var emitted2);
             tracker2.LoadStateForTest();
-            tracker2.FlushStalePlatformScriptResults(observedAt.AddSeconds(20));
+            tracker2.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
 
             var script = Assert.Single(emitted2);
             Assert.Equal("policyB", script.PolicyId);
@@ -84,7 +84,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             var tracker1 = BuildTracker(tmp, out _);
             tracker1.SeedPendingPlatformScriptForTesting("policyC", exitCode: 0, exitObservedAtUtc: observedAt);
-            tracker1.FlushStalePlatformScriptResults(observedAt.AddSeconds(1), force: true);
+            tracker1.FlushPendingPlatformScriptResults(observedAt.AddSeconds(1), force: true);
             tracker1.SaveStateForTest();
 
             // Restart, then a genuine RE-RUN of the same policy (fresh start clears the marker).
@@ -108,12 +108,41 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             var tracker = BuildTracker(tmp, out var emitted);
             tracker.LoadStateForTest(); // must not throw
+            Assert.Equal(0, tracker.ParkedPlatformScriptCountForTest);
 
-            // Degrades to pre-fix behavior: no markers restored, normal emission works.
+            // Degrades to pre-fix behavior: no markers restored, normal emission works (the
+            // result waits for its end block until the shutdown flush).
             tracker.CompletePlatformScriptFromImeResultForTesting("policyD", "Success");
+            tracker.FlushPendingPlatformScriptResults(DateTime.UtcNow, force: true);
             Assert.Single(emitted);
         }
 
+        [Fact]
+        public void Pending_slot_from_a_state_file_without_executor_start_loads_and_completes()
+        {
+            using var tmp = new TempDirectory();
+            var started = new DateTime(2026, 10, 4, 9, 0, 0, DateTimeKind.Utc);
+
+            // A pending slot written by an agent before runs carried their executor start and run id.
+            var persistence = new ImeTrackerStatePersistence(tmp.Path, new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            persistence.Save(new ImeTrackerStateData
+            {
+                PendingPlatformScripts = new List<ScriptExecutionState>
+                {
+                    new ScriptExecutionState { PolicyId = "policyF", ScriptType = "platform", StartedAtUtc = started, ExitCode = 0, ExitObservedAtUtc = started.AddSeconds(5), Stdout = "done", Stderr = "" },
+                },
+            });
+
+            var tracker = BuildTracker(tmp, out var emitted);
+            tracker.LoadStateForTest();
+            tracker.CompletePlatformScriptFromImeResultForTesting("policyF", "Success", started.AddSeconds(6));
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal(0, script.ExitCode);
+            Assert.False(string.IsNullOrEmpty(script.RunId));
+        }
+
         [Fact]
         public void Stale_result_older_than_current_run_start_is_dropped()
         {
@@ -128,8 +157,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             tracker.CompletePlatformScriptFromImeResultForTesting("policyE", "Failed", run2Start.AddMinutes(-5));
             Assert.Empty(emitted);
 
-            // Run 2's own result (newer than its start) still emits normally.
+            // Run 2's own result (newer than its start) still emits normally — held for the end
+            // block until the shutdown flush, since none is seeded here.
             tracker.CompletePlatformScriptFromImeResultForTesting("policyE", "Success", run2Start.AddMinutes(2));
+            tracker.FlushPendingPlatformScriptResults(run2Start.AddMinutes(2), force: true);
             var script = Assert.Single(emitted);
             Assert.Equal("Success", script.Result);
             Assert.Equal(run2Start, script.StartedAtUtc);
@@ -150,5 +181,45 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.False(tracker2.TryClaimScriptTimeoutSuspected("policyF")); // cross-restart dedup
             Assert.True(tracker2.TryClaimScriptTimeoutSuspected("policyG"));  // other policies unaffected
         }
+
+        [Fact]
+        public void Line_provenance_of_a_pending_script_survives_restart()
+        {
+            using var tmp = new TempDirectory();
+            var observedAt = new DateTime(2026, 9, 17, 13, 20, 7, DateTimeKind.Utc);
+            var start = new CmTraceLineProvenance
+            {
+                SourceLocalTs = new DateTime(2026, 9, 17, 15, 19, 57, DateTimeKind.Unspecified),
+                Origin = CmTraceOffsetOrigin.LineAnchored,
+                OffsetMinutes = 120,
+                MeasuredWriterOffsetMinutes = 120,
+                SourceFileName = "IntuneManagementExtension.log",
+            };
+            var exit = new CmTraceLineProvenance
+            {
+                SourceLocalTs = new DateTime(2026, 9, 17, 15, 20, 7, DateTimeKind.Unspecified),
+                Origin = CmTraceOffsetOrigin.None,
+                OffsetMinutes = 60,
+                SourceFileName = "AgentExecutor.log",
+            };
+
+            var tracker1 = BuildTracker(tmp, out _);
+            tracker1.SeedPendingPlatformScriptForTesting("policyH", exitCode: 0, exitObservedAtUtc: observedAt,
+                startedAtUtc: observedAt.AddSeconds(-10), startedAtProvenance: start, exitProvenance: exit);
+            tracker1.SaveStateForTest();
+
+            var tracker2 = BuildTracker(tmp, out var emitted2);
+            tracker2.LoadStateForTest();
+            tracker2.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
+
+            var script = Assert.Single(emitted2);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.StartedAtProvenance.Origin);
+            Assert.Equal(120, script.StartedAtProvenance.OffsetMinutes);
+            Assert.Equal(start.SourceLocalTs, script.StartedAtProvenance.SourceLocalTs);
+            Assert.Equal(DateTimeKind.Unspecified, script.StartedAtProvenance.SourceLocalTs!.Value.Kind); // no zone was ever attached
+            Assert.Equal("AgentExecutor.log", script.ExitProvenance.SourceFileName);
+            Assert.Equal(60, script.ExitProvenance.OffsetMinutes);
+            Assert.Null(script.ResultProvenance);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/RecurringScriptGateTests.cs

@@ -0,0 +1,267 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// IME re-runs health-script policies on its own schedule for as long as the device is up.
+    /// A session that waited days for its user reported every hourly run of every policy
+    /// (field: 9 policies × 94 runs in one session). The gate emits the first run and every
+    /// changed result, counts the rest, and keeps the start/result pairing intact that the
+    /// running indicators rely on.
+    /// </summary>
+    public sealed class RecurringScriptGateTests
+    {
+        private const string Policy = "11111111-2222-3333-4444-555555555555";
+        private static readonly DateTime T0 = new DateTime(2026, 9, 16, 20, 0, 0, DateTimeKind.Utc);
+
+        private static ScriptExecutionState Early(string compliance, int exit = 0, string? stderr = null) =>
+            new ScriptExecutionState
+            {
+                PolicyId = Policy, ScriptType = "remediation", ScriptPart = "detection",
+                ComplianceResult = compliance, ExitCode = exit, Stderr = stderr, DurationBasis = "script_runtime",
+            };
+
+        private static ScriptExecutionState Consolidated(string compliance, int exit = 0, int status = 1) =>
+            new ScriptExecutionState
+            {
+                PolicyId = Policy, ScriptType = "remediation", ScriptPart = "detection",
+                ComplianceResult = compliance, ExitCode = exit, RemediationStatus = status,
+                DurationBasis = "cycle_including_reporting_latency",
+            };
+
+        [Fact]
+        public void First_run_emits_start_and_result()
+        {
+            var gate = new RecurringScriptGate();
+
+            Assert.True(gate.OnStart(Policy, T0, "6", "HS-SCRIPT-START"));
+            Assert.True(gate.OnResult(Early("True"), T0.AddSeconds(5), out var released));
+            Assert.Null(released);
+        }
+
+        [Fact]
+        public void Repeated_result_is_counted_and_its_start_stays_held()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "HS-SCRIPT-START");
+            gate.OnResult(Early("True"), T0.AddSeconds(5), out _);
+
+            Assert.False(gate.OnStart(Policy, T0.AddHours(1), "6", "HS-SCRIPT-START"));
+            Assert.False(gate.OnResult(Early("True"), T0.AddHours(1).AddSeconds(5), out var released));
+            Assert.Null(released);
+
+            var summary = Assert.Single(gate.TakeSummaries());
+            Assert.Equal(2, summary.RunsObserved);
+            Assert.Equal(1, summary.RunsCollapsed);
+            Assert.Equal(1, summary.CollapsedResults);
+            Assert.Equal(T0.AddHours(1).AddSeconds(5), summary.LastCollapsedAtUtc);
+        }
+
+        [Fact]
+        public void Changed_result_releases_the_held_start_with_its_own_timestamp()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "HS-SCRIPT-START");
+            gate.OnResult(Early("True"), T0.AddSeconds(5), out _);
+
+            var secondStart = T0.AddHours(1);
+            gate.OnStart(Policy, secondStart, "6", "HS-SCRIPT-START");
+            Assert.True(gate.OnResult(Early("False", exit: 1), secondStart.AddSeconds(5), out var released));
+
+            Assert.NotNull(released);
+            Assert.Equal(Policy, released.PolicyId);
+            Assert.Equal(secondStart, released.SourceTimestampUtc);
+            Assert.Equal("HS-SCRIPT-START", released.PatternId);
+            Assert.Equal("6", released.PolicyType);
+            Assert.Empty(gate.TakeSummaries());
+        }
+
+        [Fact]
+        public void New_stderr_counts_as_a_changed_result()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            Assert.True(gate.OnResult(Early("True", stderr: "Get-ChildItem : path not found"), T0.AddHours(1), out _));
+        }
+
+        [Fact]
+        public void Early_signal_and_consolidated_result_do_not_overwrite_each_other()
+        {
+            // Both describe the detection phase, but only the consolidated one knows
+            // RemediationStatus. Sharing one signature slot would make every run look changed.
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            Assert.True(gate.OnResult(Early("True"), T0, out _));
+            Assert.True(gate.OnResult(Consolidated("True"), T0.AddMinutes(1), out _));
+
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            Assert.False(gate.OnResult(Early("True"), T0.AddHours(1), out _));
+            Assert.False(gate.OnResult(Consolidated("True"), T0.AddHours(1).AddMinutes(1), out _));
+        }
+
+        [Fact]
+        public void Held_start_without_result_is_released_only_after_the_grace()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            var heldAt = T0.AddHours(1);
+            gate.OnStart(Policy, heldAt, "6", "p");
+
+            Assert.Empty(gate.ReleaseStartsWithoutResult(heldAt.AddMinutes(29), TimeSpan.FromMinutes(30)));
+
+            var released = Assert.Single(gate.ReleaseStartsWithoutResult(heldAt.AddMinutes(31), TimeSpan.FromMinutes(30)));
+            Assert.Equal(heldAt, released.SourceTimestampUtc);
+            Assert.Empty(gate.ReleaseStartsWithoutResult(heldAt.AddHours(2), TimeSpan.FromMinutes(30)));
+        }
+
+        [Fact]
+        public void Held_start_whose_result_was_collapsed_is_never_released_as_unfinished()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(1), out _);
+
+            Assert.Empty(gate.ReleaseStartsWithoutResult(T0.AddDays(1), TimeSpan.FromMinutes(30)));
+        }
+
+        [Fact]
+        public void Run_superseded_by_the_next_start_counts_as_without_result()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");   // no result
+            gate.OnStart(Policy, T0.AddHours(2), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(2), out _);
+
+            var summary = Assert.Single(gate.TakeSummaries());
+            Assert.Equal(3, summary.RunsObserved);
+            Assert.Equal(1, summary.RunsWithoutResult);
+            Assert.Equal(1, summary.RunsCollapsed);
+        }
+
+        [Fact]
+        public void Summary_reports_growth_only()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(1), out _);
+
+            Assert.Single(gate.TakeSummaries());
+            Assert.Empty(gate.TakeSummaries());
+
+            gate.OnStart(Policy, T0.AddHours(2), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(2), out _);
+            Assert.Equal(2, Assert.Single(gate.TakeSummaries()).RunsCollapsed);
+        }
+
+        [Fact]
+        public void State_round_trips_through_json()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+
+            var json = JsonConvert.SerializeObject(gate.ToPersisted());
+            var restored = new RecurringScriptGate();
+            restored.Restore(JsonConvert.DeserializeObject<Dictionary<string, RecurringScriptPolicyState>>(json));
+
+            // The restored gate still knows the last report and still holds the second start.
+            Assert.True(restored.OnResult(Early("False", exit: 1), T0.AddHours(1).AddSeconds(5), out var released));
+            Assert.Equal(T0.AddHours(1), released.SourceTimestampUtc);
+        }
+
+        // ── Through the tracker ───────────────────────────────────────────────────
+
+        private sealed class Rig
+        {
+            public readonly List<ScriptStartedInfo> Started = new List<ScriptStartedInfo>();
+            public readonly List<ScriptExecutionState> Completed = new List<ScriptExecutionState>();
+            public readonly List<ScriptRecurrenceSummary> Summaries = new List<ScriptRecurrenceSummary>();
+            public readonly ImeLogTracker Tracker;
+
+            public Rig(TempDirectory tmp)
+            {
+                Tracker = new ImeLogTracker(
+                    logFolder: tmp.Path,
+                    patterns: new List<ImeLogPattern>(),
+                    logger: new AgentLogger(tmp.Path, AgentLogLevel.Info),
+                    stateDirectory: tmp.Path);
+                Tracker.OnScriptStarted = Started.Add;
+                Tracker.OnScriptCompleted = Completed.Add;
+                Tracker.OnScriptRecurrenceSummary = Summaries.Add;
+            }
+
+            public void Run(DateTime startedAtUtc, string compliance)
+            {
+                Tracker.HandleHealthScriptStartForTest(Policy, startedAtUtc);
+                Tracker.HandleHealthScriptDetectionResultForTest(Policy, compliance, "pre", exitCode: compliance == "True" ? 0 : 1);
+            }
+        }
+
+        [Fact]
+        public void Tracker_collapses_repeats_across_a_restart_and_reports_them_on_stop()
+        {
+            using var tmp = new TempDirectory();
+
+            var first = new Rig(tmp);
+            first.Run(T0, "True");
+            first.Run(T0.AddHours(1), "True");
+            Assert.Single(first.Started);
+            Assert.Single(first.Completed);
+            first.Tracker.SaveStateForTest();
+
+            // Restart (reboot kill, WhiteGlove Part 2): the last report and the counter are back.
+            var second = new Rig(tmp);
+            second.Tracker.LoadStateForTest();
+            second.Run(T0.AddHours(2), "True");
+            Assert.Empty(second.Started);
+            Assert.Empty(second.Completed);
+
+            second.Run(T0.AddHours(3), "False");
+            var start = Assert.Single(second.Started);
+            Assert.Equal(T0.AddHours(3), start.SourceTimestampUtc);
+            Assert.Equal("False", Assert.Single(second.Completed).ComplianceResult);
+
+            second.Tracker.FlushRecurringScripts(T0.AddHours(4), shuttingDown: true);
+            var summary = Assert.Single(second.Summaries);
+            Assert.Equal(4, summary.RunsObserved);
+            Assert.Equal(2, summary.RunsCollapsed);
+        }
+
+        [Fact]
+        public void Tracker_leaves_platform_scripts_alone()
+        {
+            using var tmp = new TempDirectory();
+            var rig = new Rig(tmp);
+            var observedAt = T0;
+
+            for (var run = 0; run < 2; run++)
+            {
+                rig.Tracker.SeedPendingPlatformScriptForTesting("platformA", exitCode: 0, exitObservedAtUtc: observedAt.AddMinutes(run * 10));
+                rig.Tracker.CompletePlatformScriptFromImeResultForTesting("platformA", "Success", observedAt.AddMinutes(run * 10 + 1));
+            }
+
+            Assert.Equal(2, rig.Completed.Count(s => s.ScriptType == "platform"));
+            rig.Tracker.FlushRecurringScripts(T0.AddDays(1), shuttingDown: true);
+            Assert.Empty(rig.Summaries);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/DiagnosticsEventLogBlockTests.cs

@@ -0,0 +1,204 @@
+#nullable enable
+using System.Collections.Generic;
+using System.IO;
+using System.IO.Compression;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Configuration;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
+{
+    /// <summary>
+    /// The hard-blocked event-log channels (Security, PowerShell, Sysmon) are unreadable through
+    /// the diagnostics package as well — by path, by wildcard, by resolved channel, and in
+    /// unrestricted mode. Before this the block held only in the event-log collector.
+    /// </summary>
+    public sealed class DiagnosticsEventLogBlockTests
+    {
+        private const string WinevtLogs = @"C:\Windows\System32\winevt\Logs";
+
+        // A channel no machine has: the export fails and the packager falls back to the raw copy.
+        private const string HarmlessChannel = "AutopilotMonitor-Tests-NoSuchChannel/Operational";
+
+        [Theory]
+        [InlineData("Security.evtx")]
+        [InlineData("security.EVTX")]
+        [InlineData("Microsoft-Windows-PowerShell%4Operational.evtx")]
+        [InlineData("Microsoft-Windows-PowerShell%4Admin.evtx")]
+        [InlineData("Windows PowerShell.evtx")]
+        [InlineData("Microsoft-Windows-Sysmon%4Operational.evtx")]
+        [InlineData("Archive-Security-2026-09-21-10-15-30-123.evtx")]
+        [InlineData("Archive-Microsoft-Windows-PowerShell%4Operational-2026-09-21-10-15-30-123.evtx")]
+        public void Hard_blocked_channel_files_are_recognised_by_name(string fileName)
+        {
+            Assert.True(DiagnosticsPathGuards.IsHardBlockedEventLogFile(Path.Combine(WinevtLogs, fileName)));
+        }
+
+        [Theory]
+        [InlineData("System.evtx")]
+        [InlineData("Application.evtx")]
+        [InlineData("SecurityAudit.evtx")]
+        [InlineData("Security.log")]
+        [InlineData("Microsoft-Windows-Security-Mitigations%4KernelMode.evtx")]
+        // Same boundary as the collector: only '/' continues a blocked channel name.
+        [InlineData("Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager%4Operational.evtx")]
+        [InlineData("Archive-System-2026-09-21-10-15-30-123.evtx")]
+        public void Other_files_are_not_mistaken_for_a_blocked_channel(string fileName)
+        {
+            Assert.False(DiagnosticsPathGuards.IsHardBlockedEventLogFile(Path.Combine(WinevtLogs, fileName)));
+        }
+
+        [Theory]
+        [InlineData(false)]
+        [InlineData(true)]
+        public void Path_guard_refuses_a_blocked_channel_file_in_every_mode(bool unrestrictedMode)
+        {
+            Assert.False(DiagnosticsPathGuards.IsDiagnosticsPathAllowed(
+                WinevtLogs + @"\Security.evtx", unrestrictedMode));
+            Assert.False(DiagnosticsPathGuards.IsDiagnosticsPathAllowed(
+                WinevtLogs + @"\Microsoft-Windows-PowerShell%4Operational.evtx", unrestrictedMode));
+        }
+
+        [Fact]
+        public void Path_guard_still_admits_other_channels_and_wildcards()
+        {
+            Assert.True(DiagnosticsPathGuards.IsDiagnosticsPathAllowed(WinevtLogs + @"\System.evtx"));
+            // Undecidable on the string — the packager filters per file (tests below).
+            Assert.True(DiagnosticsPathGuards.IsDiagnosticsPathAllowed(WinevtLogs + @"\*.evtx"));
+        }
+
+        [Theory]
+        [InlineData("Security", true)]
+        [InlineData("Microsoft-Windows-PowerShell/Operational", true)]
+        [InlineData(" Windows PowerShell ", true)]
+        [InlineData("Microsoft-Windows-Sysmon/Operational", true)]
+        [InlineData("System", false)]
+        [InlineData("", false)]
+        [InlineData(null, false)]
+        public void Channel_block_is_one_matcher_for_collector_and_package(string? channel, bool blocked)
+        {
+            Assert.Equal(blocked, GatherRuleGuards.IsHardBlockedEventLogChannel(channel!));
+        }
+
+        // ------------------------------------------------------------ packager ----
+
+        // %TEMP% lives under C:\Users, which the path guard blocks in every mode, so the
+        // configured folder sits beside the test assembly and the run is unrestricted — which
+        // is also the strongest form of the claim: not even unrestricted mode collects these.
+        private sealed class EvtxFolder : System.IDisposable
+        {
+            public string Path { get; } = System.IO.Path.Combine(
+                System.AppContext.BaseDirectory, "diag-evtx-" + System.Guid.NewGuid().ToString("N"));
+
+            public EvtxFolder(params string[] fileNames)
+            {
+                Directory.CreateDirectory(Path);
+                foreach (var name in fileNames)
+                    File.WriteAllBytes(System.IO.Path.Combine(Path, name), new byte[] { 1, 2, 3 });
+            }
+
+            public void Dispose()
+            {
+                try { Directory.Delete(Path, recursive: true); } catch { }
+            }
+        }
+
+        private static DiagnosticsPackageService BuildService(
+            TempDirectory scratch, string configuredPath, System.Func<string, string> channelResolver)
+        {
+            var logger = new AgentLogger(Directory.CreateDirectory(Path.Combine(scratch.Path, "logs")).FullName);
+            var apiClient = new BackendApiClient(
+                httpClient: new System.Net.Http.HttpClient(),
+                baseUrl: "http://localhost",
+                manufacturer: string.Empty,
+                model: string.Empty,
+                serialNumber: string.Empty,
+                useBootstrapTokenAuth: false,
+                bootstrapToken: null,
+                agentVersion: "0.0.0",
+                logger: logger);
+
+            var cfg = new AgentConfiguration
+            {
+                SessionId = "S1",
+                TenantId = "T1",
+                ApiBaseUrl = "http://localhost",
+                UnrestrictedMode = true,
+            };
+            cfg.DiagnosticsLogPaths.Add(new DiagnosticsLogPath { Path = configuredPath });
+
+            string Sub(string name) => Directory.CreateDirectory(Path.Combine(scratch.Path, name)).FullName;
+            return new DiagnosticsPackageService(
+                cfg,
+                logger,
+                apiClient,
+                agentLogFolderOverride: Sub("agentlogs"),
+                imeLogFolderOverride: Sub("ime"),
+                agentStateFolderOverride: Sub("state"),
+                agentSpoolFolderOverride: Sub("spool"),
+                agentDataFolderOverride: Sub("data"),
+                sectionFolderOverrides: null,
+                devicePreparationProbe: () => false)
+            {
+                EventLogChannelResolver = channelResolver,
+            };
+        }
+
+        private static List<string> ZipEntryNames(byte[] bytes)
+        {
+            using var ms = new MemoryStream(bytes);
+            using var archive = new ZipArchive(ms, ZipArchiveMode.Read);
+            return archive.Entries.Select(e => e.FullName).ToList();
+        }
+
+        private static string ReadManifest(byte[] bytes)
+        {
+            using var ms = new MemoryStream(bytes);
+            using var archive = new ZipArchive(ms, ZipArchiveMode.Read);
+            using var reader = new StreamReader(archive.GetEntry("package-manifest.txt")!.Open());
+            return reader.ReadToEnd();
+        }
+
+        [Fact]
+        public void Wildcard_entry_skips_blocked_channel_files_and_keeps_the_rest()
+        {
+            using var scratch = new TempDirectory();
+            using var folder = new EvtxFolder(
+                "Security.evtx", "Microsoft-Windows-PowerShell%4Operational.evtx", "Setup.evtx");
+
+            var service = BuildService(scratch, Path.Combine(folder.Path, "*.evtx"), _ => HarmlessChannel);
+            var bytes = service.BuildArchiveBytes(enrollmentSucceeded: false);
+
+            var entries = ZipEntryNames(bytes);
+            Assert.Contains(entries, e => e.EndsWith("/Setup.evtx"));
+            Assert.DoesNotContain(entries, e => e.EndsWith("Security.evtx"));
+            Assert.DoesNotContain(entries, e => e.Contains("PowerShell"));
+
+            var manifest = ReadManifest(bytes);
+            Assert.Contains("BLOCKED (event-log channel guard", manifest);
+            Assert.Contains("Security.evtx", manifest);
+            Assert.Equal(2, service.LastPackaging!.ProblemsByKind["path-guard"]);
+        }
+
+        [Fact]
+        public void File_with_a_harmless_name_is_blocked_when_it_resolves_to_a_blocked_channel()
+        {
+            // A channel is free to write to any file name; and the resolver's naming fallback
+            // maps a stray file onto a live channel. The export must never read that channel.
+            using var scratch = new TempDirectory();
+            using var folder = new EvtxFolder("Harmless.evtx");
+
+            var service = BuildService(scratch, Path.Combine(folder.Path, "Harmless.evtx"), _ => "Security");
+            var bytes = service.BuildArchiveBytes(enrollmentSucceeded: false);
+
+            Assert.DoesNotContain(ZipEntryNames(bytes), e => e.EndsWith("Harmless.evtx"));
+            Assert.Contains("BLOCKED (event-log channel guard, channel 'Security')", ReadManifest(bytes));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/DiagnosticsPackageServiceTests.cs

@@ -19,6 +19,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
     /// completion markers (whiteglove.complete, clean-exit) — V1 sessions had only AgentLogs/
     /// and ImeLogs/, which left forensics blind to decision-engine state and pending uploads.
     /// </summary>
+    [Collection(UserProfileResolverCollection.Name)] // replaces UserProfileResolver's static state
     public sealed class DiagnosticsPackageServiceTests
     {
         private static AgentConfiguration Cfg(string sessionId = "S1") => new AgentConfiguration
@@ -206,6 +207,91 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
             Assert.Contains($"BLOCKED (path guard): {configuredPath}", manifest);
         }
 
+        // %TEMP% lives under C:\Users, which the guard blocks in every mode — the positive
+        // configured-path cases run beside the test assembly, in unrestricted mode.
+        private sealed class ConfiguredPathTree : System.IDisposable
+        {
+            public string Root { get; } = Path.Combine(
+                System.AppContext.BaseDirectory, "diag-paths-" + System.Guid.NewGuid().ToString("N"));
+            public string Logs => Path.Combine(Root, "Logs");
+
+            public ConfiguredPathTree()
+            {
+                Directory.CreateDirectory(Path.Combine(Logs, "sub"));
+                File.WriteAllText(Path.Combine(Root, "parent-only.txt"), "not configured");
+                File.WriteAllText(Path.Combine(Logs, "app.log"), "configured");
+                File.WriteAllText(Path.Combine(Logs, "sub", "app.log"), "below");
+            }
+
+            public void Dispose()
+            {
+                try { Directory.Delete(Root, recursive: true); } catch { /* best effort */ }
+            }
+        }
+
+        [Theory]
+        [InlineData("")]
+        [InlineData("\\")]
+        public void BuildArchiveBytes_folder_entry_collects_the_folder_not_its_parent(string trailing)
+        {
+            using var rig = new Rig();
+            using var tree = new ConfiguredPathTree();
+
+            var bytes = rig.Build(cfg =>
+                {
+                    cfg.UnrestrictedMode = true;
+                    cfg.DiagnosticsLogPaths.Add(new AutopilotMonitor.Shared.Models.DiagnosticsLogPath
+                    {
+                        Path = tree.Logs + trailing,
+                        IncludeSubfolders = true,
+                    });
+                })
+                .BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var entries = ZipEntryNames(bytes);
+            Assert.Contains("AdditionalLogs/Logs/app.log", entries);
+            Assert.Contains("AdditionalLogs/Logs/sub/app.log", entries);
+            Assert.DoesNotContain(entries, e => e.EndsWith("parent-only.txt"));
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_file_entry_ignores_include_subfolders()
+        {
+            using var rig = new Rig();
+            using var tree = new ConfiguredPathTree();
+
+            var bytes = rig.Build(cfg =>
+                {
+                    cfg.UnrestrictedMode = true;
+                    cfg.DiagnosticsLogPaths.Add(new AutopilotMonitor.Shared.Models.DiagnosticsLogPath
+                    {
+                        Path = Path.Combine(tree.Logs, "app.log"),
+                        IncludeSubfolders = true,
+                    });
+                })
+                .BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var entries = ZipEntryNames(bytes);
+            Assert.Contains("AdditionalLogs/Logs/app.log", entries);
+            Assert.DoesNotContain("AdditionalLogs/Logs/sub/app.log", entries);
+        }
+
+        [Fact]
+        public void EnumerateFilesNoReparseDirs_asks_the_guard_before_entering_a_subfolder()
+        {
+            using var tree = new ConfiguredPathTree();
+            var refused = new List<string>();
+
+            var files = DiagnosticsPackageService.EnumerateFilesNoReparseDirs(
+                tree.Root, "*", recurse: true,
+                mayEnterDirectory: dir => !dir.EndsWith("sub"),
+                refusedDirectories: refused);
+
+            Assert.Contains(Path.Combine(tree.Logs, "app.log"), files);
+            Assert.DoesNotContain(Path.Combine(tree.Logs, "sub", "app.log"), files);
+            Assert.Equal(new[] { Path.Combine(tree.Logs, "sub") }, refused);
+        }
+
         [Fact]
         public void BuildArchiveBytes_excludes_top_level_session_id_and_bootstrap_config()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/UserProfileResolverTests.cs

@@ -0,0 +1,96 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
+{
+    /// <summary>
+    /// Serialises the test classes that replace <see cref="UserProfileResolver"/>'s static state.
+    /// </summary>
+    [CollectionDefinition(Name)]
+    public sealed class UserProfileResolverCollection
+    {
+        public const string Name = "UserProfileResolver";
+    }
+
+    /// <summary>
+    /// The agent starts before anyone has signed in. A lookup in that window must not pin
+    /// "no user" for the rest of the process — the %LOGGED_ON_USER_PROFILE% gather rules and the
+    /// RealmJoin user logs of the diagnostics package would never resolve.
+    /// </summary>
+    [Collection(UserProfileResolverCollection.Name)]
+    public sealed class UserProfileResolverTests : IDisposable
+    {
+        private static readonly DateTime Start = new DateTime(2026, 9, 28, 12, 0, 0, DateTimeKind.Utc);
+
+        public void Dispose() => UserProfileResolver.Reset();
+
+        [Fact]
+        public void User_who_signs_in_after_the_first_lookup_is_found_later()
+        {
+            string? signedIn = null;
+            var now = Start;
+            UserProfileResolver.SetDetectorForTesting(() => signedIn, () => now);
+
+            Assert.Null(UserProfileResolver.GetLoggedOnUserProfilePath());
+
+            signedIn = @"C:\Users\enduser";
+            now += UserProfileResolver.RetryInterval;
+
+            Assert.Equal(@"C:\Users\enduser", UserProfileResolver.GetLoggedOnUserProfilePath());
+        }
+
+        [Fact]
+        public void No_user_is_detected_again_only_after_the_retry_interval()
+        {
+            var detections = 0;
+            var now = Start;
+            UserProfileResolver.SetDetectorForTesting(() => { detections++; return null; }, () => now);
+
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+            now += TimeSpan.FromSeconds(10);
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+            Assert.Equal(1, detections);
+
+            now += UserProfileResolver.RetryInterval;
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+            Assert.Equal(2, detections);
+        }
+
+        [Fact]
+        public void A_clock_stepping_backwards_does_not_delay_the_next_detection()
+        {
+            var detections = 0;
+            var now = Start;
+            UserProfileResolver.SetDetectorForTesting(() => { detections++; return null; }, () => now);
+
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+            now -= TimeSpan.FromHours(1);   // OOBE time sync
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+
+            Assert.Equal(2, detections);
+        }
+
+        [Fact]
+        public void A_found_user_is_kept_without_detecting_again()
+        {
+            var detections = 0;
+            UserProfileResolver.SetDetectorForTesting(() => { detections++; return @"C:\Users\enduser"; }, () => Start);
+
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+            UserProfileResolver.GetLoggedOnUserProfilePath();
+
+            Assert.Equal(1, detections);
+        }
+
+        [Fact]
+        public void Pinned_no_user_stays_null_without_real_detection()
+        {
+            UserProfileResolver.SetForTesting(null!);
+
+            Assert.Null(UserProfileResolver.GetLoggedOnUserProfilePath());
+            Assert.Null(UserProfileResolver.ExpandCustomTokens(@"%LOGGED_ON_USER_PROFILE%\AppData\Local\x.log"));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/ShellCoreTrackerBreadcrumbTests.cs

@@ -0,0 +1,445 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// CloudExperienceHost navigation (D-310): one agent.log line per page start/stop and per
+    /// update-page event name, and for the OOBE update page itself (<c>OobeNDUP</c>,
+    /// <c>RebootNDUP</c>) the <c>oobe_update_page</c> telemetry plus the registry state at its live
+    /// start and stop. Descriptions follow the Shell-Core manifest templates; a 62407 value
+    /// (URLs with tenant ids) leaves the tracker only as a boolean, an integer or an HRESULT.
+    /// </summary>
+    public sealed class ShellCoreTrackerBreadcrumbTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 10, 2, 9, 0, 0, DateTimeKind.Utc);
+
+        private const string NdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'OobeNDUP'.";
+        private const string EspPageStarted = "CloudExperienceHost Web App Activity started. CXID: 'MDMProgressAfterAADRefactored'.";
+        private const string PageStopped = "CloudExperienceHost Web App Activity stopped. Result: 'success'.";
+        private const string ScanStartedName = "CloudExperienceHost Web App Event 1. Name: 'ExpeditedUpdate_startWUScanStarted'.";
+        private const string NavigateWithTenantUrl =
+            "CloudExperienceHost Web App Event 2. Name: 'Navigate', Value: '{\"httpMethod\":\"GET\",\"url\":\"https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/authorize\"}'.";
+        private const string DownloadSucceededWithValue =
+            "CloudExperienceHost Web App Event 2. Name: 'ExpeditedUpdate_commitExpeditionDownloadInstallAsyncSucceeded', Value: '{\"url\":\"https://login.microsoftonline.com/x\"}'.";
+        private const string CspGateTrue =
+            "CloudExperienceHost Web App Event 2. Name: 'ExpeditedUpdate_isNDUPAllowedByCSPSucceeded', Value: 'true'.";
+
+        // A French Windows labels the same fields "Résultat", "Nom" and "valeur" and quotes them
+        // in guillemets; the event properties carry the values unchanged in every language.
+        private const string FrenchNdupStarted = "Activité d’application web CloudExperienceHost démarrée. CXID : « OobeNDUP ».";
+        private const string FrenchPageStopped = "Activité d’application web CloudExperienceHost arrêtée. Résultat : « success ».";
+        private const string FrenchCspGate =
+            "Événement d’application web CloudExperienceHost 2. Nom : « ExpeditedUpdate_isNDUPAllowedByCSPSucceeded », valeur : « true ».";
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private IReadOnlyList<OobeUpdateRegistrySnapshot.KeyState> _registry = Array.Empty<OobeUpdateRegistrySnapshot.KeyState>();
+
+        public void Dispose() => _tmp.Dispose();
+
+        private ShellCoreTracker Build(string? stateDirectory = null) =>
+            new ShellCoreTracker("S1", "T1",
+                new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                helloTracker: null,
+                oobeUpdateRegistryReader: () => _registry,
+                stateDirectory: stateDirectory);
+
+        private string StateDirectory => Path.Combine(_tmp.Path, "state");
+
+        private static void Live(ShellCoreTracker tracker, int eventId, string description, DateTime at, long recordId) =>
+            tracker.ProcessEvent(eventId, description, at, "Microsoft-Windows-Shell-Core", isBackfill: false, recordId: recordId);
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> ByType(string eventType) =>
+            _sink.Posted.Where(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == eventType).ToList();
+
+        private static IReadOnlyDictionary<string, object> Data(FakeSignalIngressSink.PostedSignal posted) =>
+            (IReadOnlyDictionary<string, object>)posted.TypedPayload!;
+
+        private static OobeUpdateRegistrySnapshot.KeyState NdupKey(string line) =>
+            new OobeUpdateRegistrySnapshot.KeyState("setupOobeNdup", @"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE\NDUP",
+                exists: true, hasValues: true, line: line);
+
+        // ------------------------------------------------------------- breadcrumbs ----
+
+        [Fact]
+        public void PageStart_NamesTheCxid()
+        {
+            Assert.Equal("CXH page started: OobeNDUP",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, lastPage: null));
+        }
+
+        [Fact]
+        public void PageStop_IsAttributedToTheLastStartedPage()
+        {
+            // 62405 names no page — it ends the one started last.
+            Assert.Equal("CXH page stopped: OobeNDUP (result=success)",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, lastPage: "OobeNDUP"));
+            Assert.Equal("CXH page stopped: ? (result=success)",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, lastPage: null));
+        }
+
+        [Fact]
+        public void UpdatePageEventNames_AreLogged_FromBothEventIds()
+        {
+            Assert.Equal("CXH event: ExpeditedUpdate_startWUScanStarted",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, lastPage: null));
+            Assert.Equal("CXH event: ExpeditedUpdate_commitExpeditionDownloadInstallAsyncSucceeded",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppEvent, DownloadSucceededWithValue, lastPage: null));
+        }
+
+        [Fact]
+        public void UnsafeEventValues_NeverReachTheLog()
+        {
+            var crumb = ShellCoreTracker.FormatCxhBreadcrumb(
+                ShellCoreTracker.EventId_ShellCore_WebAppEvent, DownloadSucceededWithValue, lastPage: null);
+
+            Assert.NotNull(crumb);
+            Assert.DoesNotContain("microsoftonline", crumb);
+            Assert.DoesNotContain("url", crumb!, StringComparison.OrdinalIgnoreCase);
+        }
+
+        [Fact]
+        public void SafeEventValues_AreLogged()
+        {
+            Assert.Equal("CXH event: ExpeditedUpdate_isNDUPAllowedByCSPSucceeded (value=true)",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppEvent, CspGateTrue, lastPage: null));
+        }
+
+        [Fact]
+        public void OtherEventNames_AreNotLogged()
+        {
+            // Ordinary page traffic (Navigate, Visible, ESP progress) stays out of the log.
+            Assert.Null(ShellCoreTracker.FormatCxhBreadcrumb(
+                ShellCoreTracker.EventId_ShellCore_WebAppEvent, NavigateWithTenantUrl, lastPage: "OobeNDUP"));
+            Assert.Null(ShellCoreTracker.FormatCxhBreadcrumb(
+                ShellCoreTracker.EventId_ShellCore_WebAppEvent, "CommercialOOBE_ESPProgress_Page_Exiting", lastPage: null));
+        }
+
+        [Theory]
+        [InlineData("")]
+        [InlineData("CloudExperienceHost Web App Activity started.")]
+        public void PageStartWithoutCxid_IsNoBreadcrumb(string description)
+        {
+            Assert.Null(ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppStarted, description, lastPage: null));
+        }
+
+        [Fact]
+        public void LongTokens_AreBounded()
+        {
+            var longCxid = new string('X', 500);
+            var crumb = ShellCoreTracker.FormatCxhBreadcrumb(
+                ShellCoreTracker.EventId_ShellCore_WebAppStarted, $"CloudExperienceHost Web App Activity started. CXID: '{longCxid}'.", lastPage: null);
+
+            Assert.NotNull(crumb);
+            Assert.True(crumb!.Length < 200, crumb);
+            Assert.EndsWith("…", crumb);
+        }
+
+        [Theory]
+        [InlineData("OobeNDUP", true)]
+        [InlineData("RebootNDUP", true)]
+        [InlineData("EarlyRebootNDUP", true)]
+        [InlineData("ExpeditedUpdate_startWUScanStarted", true)]
+        [InlineData("AADHello", false)]
+        [InlineData("MDMProgressAfterAADRefactored", false)]
+        [InlineData(null, false)]
+        public void UpdatePageTokens_AreRecognized(string? token, bool expected)
+        {
+            Assert.Equal(expected, ShellCoreTracker.IsUpdatePageToken(token!));
+        }
+
+        // ------------------------------------------------------ update page records ----
+
+        [Fact]
+        public void UpdatePageRecords_ArePageStartsStopsAndNames_OfTheUpdatePageOnly()
+        {
+            var start = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, lastPage: null);
+            Assert.Equal(OobeUpdatePageRecord.PageStarted, start!.CxhEvent);
+            Assert.Equal("OobeNDUP", start.Page);
+
+            var stop = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, lastPage: "RebootNDUP");
+            Assert.Equal(OobeUpdatePageRecord.PageStopped, stop!.CxhEvent);
+            Assert.Equal("RebootNDUP", stop.Page);
+            Assert.Equal("success", stop.Result);
+
+            var name = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, lastPage: null);
+            Assert.Equal(OobeUpdatePageRecord.EventName, name!.CxhEvent);
+            Assert.Equal("ExpeditedUpdate_startWUScanStarted", name.Name);
+            Assert.Null(name.Value);
+
+            // Other pages and names are no update-page records.
+            Assert.Null(ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted, EspPageStarted, lastPage: null));
+            Assert.Null(ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, lastPage: "MDMProgressAfterAADRefactored"));
+            Assert.Null(ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEvent, NavigateWithTenantUrl, lastPage: "OobeNDUP"));
+        }
+
+        [Fact]
+        public void UpdatePageRecord_CarriesOnlyASafeValue()
+        {
+            var unsafeValue = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEvent, DownloadSucceededWithValue, lastPage: null);
+            Assert.Null(unsafeValue!.Value);
+
+            var gate = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEvent, CspGateTrue, lastPage: null);
+            Assert.Equal("true", gate!.Value);
+        }
+
+        [Theory]
+        [InlineData("true", "true")]
+        [InlineData("FALSE", "FALSE")]
+        [InlineData("0", "0")]
+        [InlineData("-2147024891", "-2147024891")]
+        [InlineData("0x80240022", "0x80240022")]
+        [InlineData("12345678901", null)]          // more than ten digits
+        [InlineData("0x123456789", null)]          // more than eight hex digits
+        [InlineData("https://login.microsoftonline.com/x", null)]
+        [InlineData("{\"result\":0}", null)]
+        [InlineData("true and more", null)]
+        [InlineData("", null)]
+        public void SafeValues_AreBooleansIntegersAndHresults(string value, string? expected)
+        {
+            var description = $"CloudExperienceHost Web App Event 2. Name: 'ExpeditedUpdate_x', Value: '{value}'.";
+
+            Assert.Equal(expected, ShellCoreTracker.ExtractSafeValue(description));
+        }
+
+        [Fact]
+        public void LiveUpdatePage_IsReported_WithTheRegistryState_AndRaisesNothing()
+        {
+            _registry = new[] { NdupKey("EnableExpeditedUpdate=1") };
+            using var tracker = Build();
+            var raised = 0;
+            tracker.EspExited += (_, _) => raised++;
+            tracker.EspFailureDetected += (_, _) => raised++;
+            tracker.FinalizingSetupPhaseTriggered += (_, _) => raised++;
+
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, "Microsoft-Windows-Shell-Core", isBackfill: false);
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, At.AddMinutes(1), "Microsoft-Windows-Shell-Core", isBackfill: false);
+            _registry = new[] { NdupKey("EnableExpeditedUpdate=1, EnableExpeditedUpdateSyncInstallCompleted=1") };
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(30), "Microsoft-Windows-Shell-Core", isBackfill: false);
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(new object[] { "page_started", "event_name", "page_stopped" }, pages.Select(p => Data(p)["cxhEvent"]).ToArray());
+            Assert.All(pages, p => Assert.Equal(false, Data(p)["backfill"]));
+
+            var states = ByType(Constants.EventTypes.OobeUpdateState);
+            Assert.Equal(new object[] { "update_page_started", "update_page_stopped" }, states.Select(s => Data(s)["moment"]).ToArray());
+            Assert.All(states, s => Assert.Equal("OobeNDUP", Data(s)["page"]));
+
+            // Telemetry only — no ESP signal, no other event.
+            Assert.Equal(0, raised);
+            Assert.False(tracker.IsEspExitedForTest);
+            Assert.Equal(pages.Count + states.Count, _sink.Posted.Count);
+        }
+
+        [Fact]
+        public void OtherPages_AreNotReported()
+        {
+            _registry = new[] { NdupKey("EnableExpeditedUpdate=1") };
+            using var tracker = Build();
+
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppStarted, EspPageStarted, At, "Microsoft-Windows-Shell-Core", isBackfill: false);
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), "Microsoft-Windows-Shell-Core", isBackfill: false);
+
+            Assert.Empty(_sink.Posted);
+        }
+
+        [Fact]
+        public void Backfill_ReportsTheUpdatePage_WithItsEventTimes_ButReadsNoRegistry()
+        {
+            // The registry shows the state now, not at the record's time.
+            var reads = 0;
+            using var tracker = new ShellCoreTracker("S1", "T1",
+                new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                helloTracker: null,
+                oobeUpdateRegistryReader: () => { reads++; return new[] { NdupKey("EnableExpeditedUpdate=1") }; });
+
+            tracker.ReplayBackfillRecords(new[]
+            {
+                (ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-4)),
+                (ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, At.AddMinutes(-3)),
+                (ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-2)),
+            });
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(3, pages.Count);
+            Assert.All(pages, p => Assert.Equal(true, Data(p)["backfill"]));
+            Assert.Equal(At.AddMinutes(-4), pages[0].OccurredAtUtc);
+            Assert.Equal(0, reads);
+            // Nothing else: no ESP exit or failure was in the window, so no skipped-records trace.
+            Assert.Equal(3, _sink.Posted.Count);
+        }
+
+        // ------------------------------------------------------------ localization ----
+
+        [Fact]
+        public void LocalizedRecords_AreReadFromTheirProperties()
+        {
+            using var tracker = Build();
+
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppStarted, FrenchNdupStarted, At, "Microsoft-Windows-Shell-Core",
+                isBackfill: false, properties: new[] { "OobeNDUP" });
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppEvent, FrenchCspGate, At.AddSeconds(5), "Microsoft-Windows-Shell-Core",
+                isBackfill: false, properties: new[] { "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", "true" });
+            tracker.ProcessEvent(ShellCoreTracker.EventId_ShellCore_WebAppStopped, FrenchPageStopped, At.AddMinutes(1), "Microsoft-Windows-Shell-Core",
+                isBackfill: false, properties: new[] { "success" });
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage).Select(Data).ToList();
+            Assert.Equal(new object[] { "page_started", "event_name", "page_stopped" }, pages.Select(d => d["cxhEvent"]).ToArray());
+            Assert.Equal("OobeNDUP", pages[0]["page"]);
+            Assert.Equal("ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", pages[1]["name"]);
+            Assert.Equal("true", pages[1]["value"]);
+            Assert.Equal("OobeNDUP", pages[2]["page"]);
+            Assert.Equal("success", pages[2]["result"]);
+        }
+
+        [Fact]
+        public void LocalizedMessage_WithoutProperties_DoesNotYieldItsLabelledFields()
+        {
+            // Why the properties are read: the French labels are not the manifest's.
+            Assert.Null(ShellCoreTracker.ReadCxhFields(ShellCoreTracker.EventId_ShellCore_WebAppStopped, FrenchPageStopped, properties: null).Primary);
+            Assert.Null(ShellCoreTracker.ReadCxhFields(ShellCoreTracker.EventId_ShellCore_WebAppEvent, FrenchCspGate, properties: null).Primary);
+
+            Assert.Equal("success",
+                ShellCoreTracker.ReadCxhFields(ShellCoreTracker.EventId_ShellCore_WebAppStopped, FrenchPageStopped, new[] { "success" }).Primary);
+        }
+
+        [Theory]
+        [InlineData("CloudExperienceHost Web App Event 2. Name: 'ExpeditedUpdate_x', Value: 'true'.")]
+        [InlineData("CloudExperienceHost Web App Event 2. Name : « ExpeditedUpdate_x », Value : « true ».")]
+        [InlineData("CloudExperienceHost Web App Event 2. Name\u00A0: «\u202FExpeditedUpdate_x\u202F», Value\u00A0: «\u00A0true\u00A0».")]
+        public void MessageFallback_AcceptsQuotesAndGuillemets(string description)
+        {
+            var fields = ShellCoreTracker.ReadCxhFields(ShellCoreTracker.EventId_ShellCore_WebAppEvent, description, properties: null);
+
+            Assert.Equal("ExpeditedUpdate_x", fields.Primary);
+            Assert.Equal("true", fields.Value);
+        }
+
+        [Fact]
+        public void PropertyValue_LeavesTheTrackerOnlyInASafeForm()
+        {
+            var fields = ShellCoreTracker.ReadCxhFields(ShellCoreTracker.EventId_ShellCore_WebAppEvent, "",
+                new[] { "ExpeditedUpdate_commitExpeditionDownloadInstallAsyncSucceeded", "{\"url\":\"https://login.microsoftonline.com/x\"}" });
+
+            var record = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEvent, fields, lastPage: null);
+            Assert.Equal("ExpeditedUpdate_commitExpeditionDownloadInstallAsyncSucceeded", record!.Name);
+            Assert.Null(record.Value);
+            Assert.DoesNotContain("microsoftonline",
+                ShellCoreTracker.FormatCxhBreadcrumb(ShellCoreTracker.EventId_ShellCore_WebAppEvent, fields, lastPage: null));
+        }
+
+        // ------------------------------------------------------- restart watermark ----
+
+        [Fact]
+        public void RestartBackfill_SkipsUpdatePageRecords_AnEarlierRunReported()
+        {
+            using (var first = Build(StateDirectory))
+            {
+                Live(first, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, recordId: 500);
+                Live(first, ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, At.AddMinutes(1), recordId: 501);
+            }
+
+            // The restart reads the minutes before it again — plus the stop the first run missed.
+            using var second = Build(StateDirectory);
+            second.LoadPageWatermark();
+            second.ReplayBackfillRecords(new[]
+            {
+                new ShellCoreRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, recordId: 500),
+                new ShellCoreRecord(ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, At.AddMinutes(1), recordId: 501),
+                new ShellCoreRecord(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(2), recordId: 502),
+            });
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage).Select(Data).ToList();
+            Assert.Equal(new object[] { "page_started", "event_name", "page_stopped" }, pages.Select(d => d["cxhEvent"]).ToArray());
+            Assert.Equal(new object[] { false, false, true }, pages.Select(d => d["backfill"]).ToArray());
+            // The skipped start still names the page the stop belongs to.
+            Assert.Equal("OobeNDUP", pages[2]["page"]);
+        }
+
+        [Fact]
+        public void SameRecord_FromTheLiveWatcherAndTheBackfill_IsReportedOnce()
+        {
+            // The live watcher is armed before the backfill runs, so both can deliver a record.
+            using var tracker = Build(StateDirectory);
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, recordId: 700);
+            tracker.ReplayBackfillRecords(new[]
+            {
+                new ShellCoreRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, recordId: 700),
+            });
+
+            Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage));
+        }
+
+        [Fact]
+        public void Watermark_FollowsReportedRecordsOnly()
+        {
+            using var tracker = Build(StateDirectory);
+            for (var i = 0; i <= OobeUpdateTelemetry.MaxPageEventsPerKey; i++)
+                Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, At.AddSeconds(i), recordId: 800 + i);
+
+            // The repeat over the per-name cap is claimed for this run, not written down.
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey, ByType(Constants.EventTypes.OobeUpdatePage).Count);
+            var state = JsonConvert.DeserializeObject<EventRecordWatermark.WatermarkState>(
+                File.ReadAllText(Path.Combine(StateDirectory, ShellCoreTracker.PageWatermarkStateFileName)));
+            Assert.Equal(800 + OobeUpdateTelemetry.MaxPageEventsPerKey - 1, state!.LastRecordId);
+        }
+
+        [Fact]
+        public void RecordsWithoutARecordId_AreNotDeduplicated()
+        {
+            using var tracker = Build(StateDirectory);
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, recordId: -1);
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(5), recordId: -1);
+
+            Assert.Equal(2, ByType(Constants.EventTypes.OobeUpdatePage).Count);
+            Assert.False(File.Exists(Path.Combine(StateDirectory, ShellCoreTracker.PageWatermarkStateFileName)));
+        }
+
+        [Fact]
+        public void AgentStartAndStop_ReportTheRegistryState_StopOnce()
+        {
+            _registry = new[] { NdupKey("EnableExpeditedUpdate=1") };
+            var tracker = Build();
+
+            tracker.Start();
+            _registry = new[] { NdupKey("EnableExpeditedUpdate=1, ExpeditedUpdateStatus=2") };
+            tracker.Stop();
+            tracker.Stop();
+            tracker.Dispose();
+
+            var states = ByType(Constants.EventTypes.OobeUpdateState);
+            Assert.Equal(new object[] { "agent_start", "agent_stop" }, states.Select(s => Data(s)["moment"]).ToArray());
+        }
+
+        [Fact]
+        public void TrackerThatNeverStarted_ReportsNothingAtStop()
+        {
+            _registry = new[] { NdupKey("EnableExpeditedUpdate=1") };
+            var tracker = Build();
+
+            tracker.Dispose();
+
+            Assert.Empty(_sink.Posted);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/ShellCoreTrackerHelloWizardTests.cs

@@ -84,6 +84,55 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
             Assert.False(raised);
         }
 
+        [Fact]
+        public void ProcessEvent_62404_NGC_in_a_localized_message_is_read_from_the_cxid_property()
+        {
+            // A French Windows quotes the CXID in guillemets — the "'NGC'" substring never matched.
+            using var tmp = new TempDirectory();
+            using var tracker = MakeTracker(tmp, new VirtualClock(ClockNow));
+            var raised = 0;
+            tracker.HelloWizardStarted += (_, _) => raised++;
+
+            tracker.ProcessEvent(
+                eventId: ShellCoreTracker.EventId_ShellCore_WebAppStarted,
+                description: "Activité d’application web CloudExperienceHost démarrée. CXID : « NGC ».",
+                timestamp: ClockNow,
+                providerName: "Microsoft-Windows-Shell-Core",
+                isBackfill: false,
+                properties: new[] { "NGC" });
+
+            Assert.Equal(1, raised);
+        }
+
+        [Theory]
+        [InlineData("AADHello", true)]
+        [InlineData("NGC", true)]
+        [InlineData("NGCPin", false)]
+        [InlineData("OobeNDUP", false)]
+        public void HelloWizardStart_is_decided_by_the_cxid(string cxid, bool expected)
+        {
+            Assert.Equal(expected, ShellCoreTracker.IsHelloWizardStart(cxid, description: "CXID: 'AADHello'"));
+        }
+
+        [Fact]
+        public void Backfill_62404_reads_the_cxid_property()
+        {
+            using var tmp = new TempDirectory();
+            using var tracker = MakeTracker(tmp, new VirtualClock(ClockNow));
+            var captured = new List<HelloWizardStartedEventArgs>();
+            tracker.HelloWizardStarted += (_, args) => captured.Add(args);
+
+            var historical = ClockNow.AddMinutes(-3);
+            tracker.ReplayBackfillRecords(new[]
+            {
+                new ShellCoreRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted,
+                    "Activité d’application web CloudExperienceHost démarrée. CXID : « NGC ».", historical,
+                    recordId: 42, properties: new[] { "NGC" }),
+            });
+
+            Assert.Equal(historical, Assert.Single(captured).OccurredAtUtc);
+        }
+
         [Fact]
         public void Backfill_62404_raises_once_with_historical_timestamp()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/ShellCoreTrackerUpdatePageBackfillTests.cs

@@ -0,0 +1,225 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// The first run's update page backfill (<see cref="ShellCoreTracker.BackfillUpdatePageTelemetry"/>)
+    /// and the page a stop belongs to across backfill and live records. The first run has no
+    /// replay — its backfill is telemetry and nothing else, so a Hello-wizard start, an ESP exit
+    /// or an ESP failure in the window must not leave the tracker on any rail.
+    /// </summary>
+    public sealed class ShellCoreTrackerUpdatePageBackfillTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 10, 5, 13, 10, 0, DateTimeKind.Utc);
+
+        private const string NdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'OobeNDUP'.";
+        private const string RebootNdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'RebootNDUP'.";
+        private const string AadHelloStarted = "CloudExperienceHost Web App Activity started. CXID: 'AADHello'.";
+        private const string PageStopped = "CloudExperienceHost Web App Activity stopped. Result: 'success'.";
+        private const string DownloadSucceeded =
+            "CloudExperienceHost Web App Event 1. Name: 'SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadSucceeded'.";
+        private const string EspExit = "CommercialOOBE_ESPProgress_Page_Exiting";
+        private const string EspFailure = "CommercialOOBE_ESPProgress_Failure";
+        private const string WhiteGloveSuccess = "CommercialOOBE_ESPProgress_WhiteGlove_Success";
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private int _registryReads;
+
+        public void Dispose() => _tmp.Dispose();
+
+        private ShellCoreTracker Build() =>
+            new ShellCoreTracker("S1", "T1",
+                new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                helloTracker: null,
+                oobeUpdateRegistryReader: () => { _registryReads++; return Array.Empty<OobeUpdateRegistrySnapshot.KeyState>(); },
+                stateDirectory: Path.Combine(_tmp.Path, "state"));
+
+        private static void Live(ShellCoreTracker tracker, int eventId, string description, DateTime at, long recordId) =>
+            tracker.ProcessEvent(eventId, description, at, "Microsoft-Windows-Shell-Core", isBackfill: false, recordId: recordId);
+
+        private static ShellCoreRecord Record(int eventId, string description, DateTime at, long recordId) =>
+            new ShellCoreRecord(eventId, description, at, recordId);
+
+        private IReadOnlyList<IReadOnlyDictionary<string, object>> Pages() =>
+            _sink.Posted
+                .Where(p => p.Kind == DecisionSignalKind.InformationalEvent
+                    && p.Payload != null
+                    && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                    && et == Constants.EventTypes.OobeUpdatePage)
+                .Select(p => (IReadOnlyDictionary<string, object>)p.TypedPayload!)
+                .ToList();
+
+        // ------------------------------------------------------------ first run ----
+
+        [Fact]
+        public void FirstRunBackfill_ReportsTheUpdatePage_AndNothingElse()
+        {
+            using var tracker = Build();
+            var raised = new List<string>();
+            tracker.HelloWizardStarted += (_, _) => raised.Add("hello");
+            tracker.FinalizingSetupPhaseTriggered += (_, reason) => raised.Add($"finalizing:{reason}");
+            tracker.EspExited += (_, _) => raised.Add("exit");
+            tracker.EspFailureDetected += (_, _) => raised.Add("failure");
+            tracker.WhiteGloveCompleted += (_, _) => raised.Add("whiteglove");
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, EspExit, At.AddMinutes(-41), 95),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, EspFailure, At.AddSeconds(-2430), 96),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, WhiteGloveSuccess, At.AddSeconds(-2420), 97),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEventName, DownloadSucceeded, At.AddMinutes(-30), 101),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, AadHelloStarted, At.AddMinutes(-2), 110),
+            });
+
+            Assert.Empty(raised);
+            Assert.False(tracker.IsEspExitedForTest);
+            Assert.False(tracker.IsWhiteGloveDetectedForTest);
+            var pages = Pages();
+            Assert.Equal(new object[] { "page_started", "event_name" }, pages.Select(d => d["cxhEvent"]).ToArray());
+            Assert.All(pages, d => Assert.Equal(true, d["backfill"]));
+            // No agent_trace, no ESP or Hello event — only the two page rows.
+            Assert.Equal(2, _sink.Posted.Count);
+            // The registry shows the state now, not at the records' time.
+            Assert.Equal(0, _registryReads);
+        }
+
+        [Fact]
+        public void FirstRunBackfill_KeepsTheEventTimes()
+        {
+            using var tracker = Build();
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+            });
+
+            var posted = Assert.Single(_sink.Posted);
+            Assert.Equal(At.AddMinutes(-40), posted.OccurredAtUtc);
+        }
+
+        [Fact]
+        public void LiveStop_FindsThePageThatStartedBeforeTheAgent()
+        {
+            using var tracker = Build();
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(5), 120);
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("OobeNDUP", stop["page"]);
+            Assert.Equal(false, stop["backfill"]);
+        }
+
+        [Fact]
+        public void SameRecord_FromTheLiveWatcherAndTheFirstRunBackfill_IsReportedOnce()
+        {
+            // The live watcher is armed before the backfill reads, so both can deliver a record.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 700);
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 700),
+            });
+
+            Assert.Single(Pages(), d => (string)d["cxhEvent"] == "page_started");
+        }
+
+        // ---------------------------------------------------- the page of a stop ----
+
+        [Fact]
+        public void ReplayedOlderStart_DoesNotTakeOverTheNextLiveStop()
+        {
+            // A restart replay reads records older than the live watcher's; before, its page start
+            // overwrote the live page and the next live stop was attributed to the old page.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At, 900);
+            tracker.ReplayBackfillRecords(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-20), 850),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEventName, DownloadSucceeded, At.AddMinutes(-19), 851),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), 901);
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("RebootNDUP", stop["page"]);
+        }
+
+        [Fact]
+        public void BackfilledStop_BelongsToTheStartOfItsOwnBatch()
+        {
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At, 900);
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-20), 850),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-18), 852),
+            });
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("OobeNDUP", stop["page"]);
+            Assert.Equal(true, stop["backfill"]);
+        }
+
+        [Fact]
+        public void BackfilledStopWithoutItsStart_IsNotGivenTheLivePage()
+        {
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 900);
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-18), 852),
+            });
+
+            Assert.DoesNotContain(Pages(), d => (string)d["cxhEvent"] == "page_stopped");
+        }
+
+        [Fact]
+        public void NewerBackfilledStart_MovesTheLivePageForward()
+        {
+            // Records written between arming the watcher and the backfill's read are newer than
+            // the last live start the watcher delivered before them.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 900);
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At.AddSeconds(30), 905),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), 906);
+
+            Assert.Equal("RebootNDUP", Pages().Last()["page"]);
+        }
+
+        [Fact]
+        public void UpdatePageLookback_IsInsideTheReplayClamp()
+        {
+            Assert.Equal(ShellCoreTracker.UpdatePageBackfillLookbackMinutes,
+                ShellCoreTracker.ClampLookbackMinutes(ShellCoreTracker.UpdatePageBackfillLookbackMinutes));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ImeRegistryAppStateObserverTests.cs

@@ -59,9 +59,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         public void ClassifyEnforcementState_bands(int state, string expected)
             => Assert.Equal(expected, ImeRegistryAppStateObserver.ClassifyEnforcementState(state));
 
+        // IME AppInstallStatus values (StatusServiceReports\..\Status), stable IME 1.50 .. 1.106.
+        // 1001/1003 sit inside the 1000 band but are NOT terminal — IME maps every InProgress
+        // enforcement state to 1001 (verified against IME 1.106).
         [Theory]
         [InlineData(1000, "installed")]
-        [InlineData(1999, "installed")]
+        [InlineData(1002, "installed")]
+        [InlineData(1004, "installed")]
+        [InlineData(1001, "installing")]
+        [InlineData(1003, "installing")]
+        [InlineData(1005, null)]
+        [InlineData(1999, null)]
         [InlineData(3000, "failed")]
         [InlineData(2000, "notApplicable")]
         [InlineData(2999, "notApplicable")]
@@ -72,6 +80,35 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         public void ClassifyStatusServiceStatus_bands(int status, string? expected)
             => Assert.Equal(expected, ImeRegistryAppStateObserver.ClassifyStatusServiceStatus(status));
 
+        [Fact]
+        public void TryParseRegistryDateTime_reads_both_ime_shapes_as_utc()
+        {
+            // ExecutionDeadlineTime: DateTime.ToString(InvariantCulture), UTC without a kind marker.
+            var deadline = ImeRegistryAppStateObserver.TryParseRegistryDateTime("09/23/2026 18:00:00");
+            Assert.Equal(new DateTime(2026, 9, 23, 18, 0, 0, DateTimeKind.Utc), deadline);
+            Assert.Equal(DateTimeKind.Utc, deadline!.Value.Kind);
+
+            // DeferUntilTime: round-trip "o" with trailing Z.
+            var until = ImeRegistryAppStateObserver.TryParseRegistryDateTime("2026-09-23T10:30:00.0000000Z");
+            Assert.Equal(new DateTime(2026, 9, 23, 10, 30, 0, DateTimeKind.Utc), until);
+            Assert.Equal(DateTimeKind.Utc, until!.Value.Kind);
+
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime(null));
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime(""));
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime("not a date"));
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime(42));
+        }
+
+        [Fact]
+        public void TryReadBool_parses_registry_strings_only()
+        {
+            Assert.True(ImeRegistryAppStateObserver.TryReadBool("True"));
+            Assert.False(ImeRegistryAppStateObserver.TryReadBool("false"));
+            Assert.Null(ImeRegistryAppStateObserver.TryReadBool("yes"));
+            Assert.Null(ImeRegistryAppStateObserver.TryReadBool(1));
+            Assert.Null(ImeRegistryAppStateObserver.TryReadBool(null));
+        }
+
         [Fact]
         public void TerminalOutcome_prefers_enforcement_state_then_status_service()
         {
@@ -88,6 +125,49 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(enforcementState: 3000)));
             Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(statusServiceStatus: 2500)));
             Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry()));
+            // Installing (1001) / InstallingPendingReboot (1003) share the 1000 band but are not terminal.
+            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(statusServiceStatus: 1001)));
+            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(enforcementState: 2009, statusServiceStatus: 1003)));
+        }
+
+        [Fact]
+        public void ChangedFields_reports_wait_state_triggers_only()
+        {
+            var prev = Entry(enforcementState: 2009);
+            var next = Entry(enforcementState: 2009,
+                installDeadlineUtc: T0.AddHours(2),
+                deferralsUsed: 1, deferralMaxDeferrals: 3, deferUntilUtc: T0.AddMinutes(30), deferralAutoDeferred: false);
+
+            Assert.Equal(new[] { "installDeadline", "deferralsUsed", "deferUntil" },
+                ImeRegistryAppStateObserver.ChangedFields(prev, next));
+
+            // MaxDeferrals / AutoDeferred alone are data, not a transition.
+            var sameCounters = Entry(enforcementState: 2009,
+                installDeadlineUtc: T0.AddHours(2),
+                deferralsUsed: 1, deferralMaxDeferrals: 5, deferUntilUtc: T0.AddMinutes(30), deferralAutoDeferred: true);
+            Assert.Empty(ImeRegistryAppStateObserver.ChangedFields(next, sameCounters));
+
+            // A cleared deadline is a transition too (IME clears it when the next download starts).
+            Assert.Equal(new[] { "installDeadline" },
+                ImeRegistryAppStateObserver.ChangedFields(
+                    Entry(installDeadlineUtc: T0.AddHours(2)), Entry()));
+        }
+
+        [Fact]
+        public void DescribeWaitState_texts()
+        {
+            Assert.Equal(string.Empty, ImeRegistryAppStateObserver.DescribeWaitState(Entry(enforcementState: 2009)));
+            Assert.Equal(", downloaded, install deadline 2026-08-18 10:00 UTC",
+                ImeRegistryAppStateObserver.DescribeWaitState(Entry(installDeadlineUtc: T0.AddHours(2))));
+            Assert.Equal(", deferred by user 1/3 until 2026-08-18 08:30 UTC",
+                ImeRegistryAppStateObserver.DescribeWaitState(Entry(
+                    deferralsUsed: 1, deferralMaxDeferrals: 3, deferUntilUtc: T0.AddMinutes(30), deferralAutoDeferred: false)));
+            Assert.Equal(", auto-deferred 2/3",
+                ImeRegistryAppStateObserver.DescribeWaitState(Entry(
+                    deferralsUsed: 2, deferralMaxDeferrals: 3, deferralAutoDeferred: true)));
+            // Zero deferrals used is not a deferral; a missing max falls back to the bare count.
+            Assert.Equal(string.Empty, ImeRegistryAppStateObserver.DescribeWaitState(Entry(deferralsUsed: 0, deferralMaxDeferrals: 3)));
+            Assert.Equal(", deferred by user 1", ImeRegistryAppStateObserver.DescribeWaitState(Entry(deferralsUsed: 1)));
         }
 
         [Fact]
@@ -184,6 +264,54 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             Assert.Equal("success", evt.Payload["enforcementClass"]);
         }
 
+        [Fact]
+        public void Wait_state_changes_emit_state_events_with_data_and_text()
+        {
+            var (sink, clock, observer) = CreateObserver(trackerApps: null);
+            var current = Snapshot((App1, 2009, null));
+
+            using (new ImeRegistryAppStateObserver.ScopedSnapshotOverride(() => current))
+            {
+                observer.Tick("baseline");
+
+                // Download finished, IME parks the app until its install deadline (1.106 ExecutionDeadlineTime).
+                var withDeadline = Snapshot((App1, 2009, null));
+                withDeadline.Entries.Values.Single().InstallDeadlineUtc = T0.AddHours(2);
+                current = withDeadline;
+                observer.Tick("registry_change");
+
+                // A required app hits a running process and the user defers (1.105 app-in-use deferral).
+                var deferred = Snapshot((App1, 2014, null));
+                var entry = deferred.Entries.Values.Single();
+                entry.InstallDeadlineUtc = T0.AddHours(2);
+                entry.DeferralsUsed = 1;
+                entry.DeferralMaxDeferrals = 3;
+                entry.DeferUntilUtc = T0.AddMinutes(30);
+                entry.DeferralAutoDeferred = false;
+                current = deferred;
+                observer.Tick("registry_change");
+            }
+
+            var events = Events(sink, SharedEventTypes.RegistryAppState);
+            Assert.Equal(2, events.Count);
+
+            var deadlineEvent = events[0];
+            Assert.Equal("installDeadline", deadlineEvent.Payload!["changedFields"]);
+            Assert.Equal("2026-08-18T10:00:00.0000000Z", deadlineEvent.Payload["installDeadlineUtc"]);
+            Assert.DoesNotContain("deferralsUsed", deadlineEvent.Payload.Keys);
+            Assert.Contains("-> inProgress, downloaded, install deadline 2026-08-18 10:00 UTC",
+                deadlineEvent.Payload[SignalPayloadKeys.Message]);
+
+            var deferralEvent = events[1];
+            Assert.Equal("enforcementState,deferralsUsed,deferUntil", deferralEvent.Payload!["changedFields"]);
+            Assert.Equal("2014", deferralEvent.Payload["enforcementState"]);
+            Assert.Equal("1", deferralEvent.Payload["deferralsUsed"]);
+            Assert.Equal("3", deferralEvent.Payload["deferralMaxDeferrals"]);
+            Assert.Equal("2026-08-18T08:30:00.0000000Z", deferralEvent.Payload["deferUntilUtc"]);
+            Assert.Equal("false", deferralEvent.Payload["deferralAutoDeferred"]);
+            Assert.Contains("deferred by user 1/3 until 2026-08-18 08:30 UTC", deferralEvent.Payload[SignalPayloadKeys.Message]);
+        }
+
         [Fact]
         public void NonEmpty_baseline_emits_one_summary_with_counts()
         {
@@ -331,7 +459,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
 
         private static AppRegistryEntry Entry(
             int? enforcementState = null, long? errorCode = null, int? exitCode = null,
-            int? statusServiceStatus = null, bool espTracked = false, string? espPhase = null)
+            int? statusServiceStatus = null, bool espTracked = false, string? espPhase = null,
+            DateTime? installDeadlineUtc = null, int? deferralsUsed = null, int? deferralMaxDeferrals = null,
+            DateTime? deferUntilUtc = null, bool? deferralAutoDeferred = null)
         {
             var entry = new AppRegistryEntry($"{ImeRegistrySnapshot.DeviceContext}|{App1}", ImeRegistrySnapshot.DeviceContext, App1);
             entry.EnforcementState = enforcementState;
@@ -340,6 +470,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             entry.StatusServiceStatus = statusServiceStatus;
             entry.EspTracked = espTracked;
             entry.EspPhase = espPhase;
+            entry.InstallDeadlineUtc = installDeadlineUtc;
+            entry.DeferralsUsed = deferralsUsed;
+            entry.DeferralMaxDeferrals = deferralMaxDeferrals;
+            entry.DeferUntilUtc = deferUntilUtc;
+            entry.DeferralAutoDeferred = deferralAutoDeferred;
             return entry;
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ImeRegistryScriptResultObserverTests.cs

@@ -0,0 +1,411 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using Xunit;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// D-316: IME saves every platform script's result under Policies\&lt;user&gt;\&lt;policy&gt; after reporting the
+    /// batch; the observer checks the tracker's emitted run against it. The field case (session 756970cf): the run
+    /// had been given a Win32 detection script's end block — exit 1 and "Detection Started" output — while IME saved
+    /// the bootstrap output of the platform script itself.
+    /// </summary>
+    public sealed class ImeRegistryScriptResultObserverTests
+    {
+        private const string DeviceUser = "00000000-0000-0000-0000-000000000000";
+        private const string PolicyA = "1d6f0a52-3c4e-4b7a-9e21-5f8c7d2b9a10";
+        private const string PolicyB = "2b7d9e41-8c3a-4f60-a5d2-9e1b7c4f3a08";
+        private const string OwnStdout = "=== bootstrap loader started ===\nInstaller finished (exit code 0).";
+        private const string ForeignStdout = "VERBOSE: === Sample Suite Detection Started ===\nWARNING: === DETECTION FAILED ===";
+        private static readonly DateTime T0 = new DateTime(2026, 10, 3, 20, 59, 0, DateTimeKind.Utc);
+
+        // ── PlatformOutputJudge ─────────────────────────────────────────────────
+
+        private static PlatformScriptRun Run(string? stdout, string? stderr = null, int? exitCode = 0, string result = "Success", string resultSource = "ime_policy_result")
+            => new PlatformScriptRun { PolicyId = PolicyA, UserId = DeviceUser, RunId = "run-1", Emitted = true, Result = result, ResultSource = resultSource, ExitCode = exitCode, Stdout = stdout, Stderr = stderr };
+
+        private static string Details(string executionMessage)
+            => "{\"Version\":1,\"SigningCode\":15,\"EncryptionCode\":19,\"ExecutionMsg\":" + System.Text.Json.JsonSerializer.Serialize(executionMessage) + "}";
+
+        private static SavedScriptResult Saved(string? executionMessage, string result = "Success", int errorCode = 0, string user = DeviceUser, string policy = PolicyA, string stamp = "10/3/2026 9:00:00 PM")
+            => new SavedScriptResult
+            {
+                UserId = user,
+                PolicyId = policy,
+                Result = result,
+                ErrorCode = errorCode,
+                ResultDetails = executionMessage == null ? null : Details(executionMessage),
+                LastUpdatedTimeUtc = stamp,
+            };
+
+        [Fact]
+        public void Field_case_detection_output_on_the_platform_run_is_foreign_and_the_saved_stdout_replaces_it()
+        {
+            var judgement = PlatformOutputJudge.Judge(Run(ForeignStdout, string.Empty, exitCode: 1), Saved(OwnStdout.Replace("\n", "\r\n")));
+            Assert.Equal(PlatformOutputVerdict.Foreign, judgement.Verdict);
+            Assert.Equal("stdout_differs", judgement.Reason);
+            Assert.Equal(OwnStdout, judgement.Stdout);
+            Assert.Equal(string.Empty, judgement.Stderr);
+        }
+
+        [Fact]
+        public void Matching_output_is_verified_across_line_ending_and_trim_differences()
+        {
+            var judgement = PlatformOutputJudge.Judge(Run(OwnStdout, string.Empty), Saved("  " + OwnStdout.Replace("\n", "\r\n") + "\r\n"));
+            Assert.Equal(PlatformOutputVerdict.Verified, judgement.Verdict);
+        }
+
+        [Fact]
+        public void Output_cut_by_the_tracker_is_verified_against_the_longer_saved_text()
+        {
+            var full = string.Concat(Enumerable.Repeat("line of output\n", 1000)).TrimEnd();
+            var emitted = ImeLogTracker.TruncateOutput(full);
+            Assert.EndsWith(ImeLogTracker.OutputTruncationMarker, emitted);
+            Assert.Equal(PlatformOutputVerdict.Verified, PlatformOutputJudge.Judge(Run(emitted), Saved(full)).Verdict);
+        }
+
+        [Fact]
+        public void Both_empty_is_verified_but_stderr_on_a_success_is_another_executors()
+        {
+            Assert.Equal(PlatformOutputVerdict.Verified, PlatformOutputJudge.Judge(Run(string.Empty), Saved(string.Empty)).Verdict);
+            var judgement = PlatformOutputJudge.Judge(Run(string.Empty, "Get-Item : not found"), Saved(string.Empty));
+            Assert.Equal(PlatformOutputVerdict.Foreign, judgement.Verdict);
+            Assert.Equal("stderr_on_success", judgement.Reason);
+        }
+
+        [Fact]
+        public void Explicitly_empty_emitted_output_against_saved_text_is_foreign()
+        {
+            Assert.Equal(PlatformOutputVerdict.Foreign, PlatformOutputJudge.Judge(Run(string.Empty), Saved(OwnStdout)).Verdict);
+            Assert.Equal(PlatformOutputVerdict.Foreign, PlatformOutputJudge.Judge(Run(OwnStdout), Saved(string.Empty)).Verdict);
+        }
+
+        [Fact]
+        public void Output_never_read_is_completed_from_the_saved_text_and_the_exit_code_stands()
+        {
+            var judgement = PlatformOutputJudge.Judge(Run(null), Saved(OwnStdout));
+            Assert.Equal(PlatformOutputVerdict.Repaired, judgement.Verdict);
+            Assert.Equal("stdout_missing", judgement.Reason);
+            Assert.Equal(OwnStdout, judgement.Stdout);
+            Assert.Equal(PlatformOutputVerdict.NotComparable, PlatformOutputJudge.Judge(Run(null), Saved(string.Empty)).Verdict);
+        }
+
+        [Fact]
+        public void Stdout_containing_the_output_error_separator_is_repaired_not_foreign()
+        {
+            // "write output done. output = X, error = " with X = "Copying files, error = 0 errors\nDone": the
+            // lazy split leaves "Copying files" as stdout and the rest as stderr.
+            var judgement = PlatformOutputJudge.Judge(
+                Run("Copying files", "0 errors\nDone, error ="),
+                Saved("Copying files, error = 0 errors\r\nDone"));
+            Assert.Equal(PlatformOutputVerdict.Repaired, judgement.Verdict);
+            Assert.Equal("stdout_split", judgement.Reason);
+            Assert.Equal("Copying files, error = 0 errors\nDone", judgement.Stdout);
+            Assert.Equal(string.Empty, judgement.Stderr);
+        }
+
+        [Fact]
+        public void A_prefix_without_the_split_explanation_is_foreign()
+        {
+            Assert.Equal(PlatformOutputVerdict.Foreign, PlatformOutputJudge.Judge(Run("Detected"), Saved("Detected and repaired")).Verdict);
+        }
+
+        [Fact]
+        public void Failed_with_stderr_is_judged_on_stderr()
+        {
+            Assert.Equal(PlatformOutputVerdict.Verified,
+                PlatformOutputJudge.Judge(Run("partial", "Access denied", 1, "Failed"), Saved("Access denied\r\n", "Failed", 99)).Verdict);
+
+            var missing = PlatformOutputJudge.Judge(Run(null, null, 1, "Failed"), Saved("Access denied", "Failed", 99));
+            Assert.Equal(PlatformOutputVerdict.Repaired, missing.Verdict);
+            Assert.Null(missing.Stdout);
+            Assert.Equal("Access denied", missing.Stderr);
+
+            var foreign = PlatformOutputJudge.Judge(Run("Detected", string.Empty, 0, "Failed"), Saved("Access denied", "Failed", 99));
+            Assert.Equal(PlatformOutputVerdict.Foreign, foreign.Verdict);
+            Assert.Equal(string.Empty, foreign.Stdout);
+            Assert.Equal("Access denied", foreign.Stderr);
+        }
+
+        [Fact]
+        public void Results_without_saved_output_or_from_another_run_are_not_compared()
+        {
+            Assert.Equal("no_saved_output", PlatformOutputJudge.Judge(Run(OwnStdout, null, 1, "Failed"), Saved("1", "Failed", 1)).Reason);
+            var hashMismatch = new SavedScriptResult { UserId = DeviceUser, PolicyId = PolicyA, Result = "Failed", ErrorCode = 2, ResultDetails = "Hash mismatch" };
+            Assert.Equal("no_execution_message", PlatformOutputJudge.Judge(Run(OwnStdout, null, 1, "Failed"), hashMismatch).Reason);
+            Assert.Equal("result_differs", PlatformOutputJudge.Judge(Run(OwnStdout), Saved("Access denied", "Failed", 99)).Reason);
+            // A result derived from the exit code (fallback) is not IME's — the saved one is.
+            Assert.Equal(PlatformOutputVerdict.Verified,
+                PlatformOutputJudge.Judge(Run(OwnStdout, null, 1, "Failed", "agentexecutor_fallback"), Saved(OwnStdout)).Verdict);
+        }
+
+        // ── PlatformScriptRunRegister ───────────────────────────────────────────
+
+        private static ScriptExecutionState Emitted(string policyId, string? stdout, int? exitCode = 0, string? userId = DeviceUser, string runId = "run-1")
+            => new ScriptExecutionState { PolicyId = policyId, ScriptType = "platform", UserId = userId, RunId = runId, Result = "Success", ResultSource = "ime_policy_result", ExitCode = exitCode, Stdout = stdout };
+
+        [Fact]
+        public void A_save_is_paired_only_after_the_tracker_read_past_it_and_the_run_was_emitted()
+        {
+            var runs = new PlatformScriptRunRegister();
+            runs.NoteStarted(DeviceUser, PolicyA, T0);
+            var seen = T0.AddSeconds(30);
+
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(DeviceUser, PolicyA, seen, out _));
+            runs.NotePassCompleted(seen.AddSeconds(1));
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(DeviceUser, PolicyA, seen, out _)); // pass started too early
+            runs.NotePassCompleted(seen + PlatformScriptRunRegister.TrackerCatchUp);
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(DeviceUser, PolicyA, seen, out _)); // run not emitted yet
+
+            runs.NoteEmitted(Emitted(PolicyA, OwnStdout), T0.AddSeconds(40));
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, seen, out var run));
+            Assert.Equal("run-1", run!.RunId);
+            Assert.Equal(OwnStdout, run.Stdout);
+            Assert.Equal(PlatformRunClaim.None, runs.TryClaim(DeviceUser, PolicyA, seen, out _)); // never twice
+        }
+
+        [Fact]
+        public void A_new_start_replaces_the_latest_run_of_its_key_and_other_users_stay_apart()
+        {
+            var runs = new PlatformScriptRunRegister();
+            runs.NoteStarted(DeviceUser, PolicyA, T0);
+            runs.NoteEmitted(Emitted(PolicyA, "first run"), T0.AddSeconds(5));
+            runs.NoteStarted(DeviceUser, PolicyA, T0.AddMinutes(30));
+            runs.NoteEmitted(Emitted(PolicyA, "second run", runId: "run-2"), T0.AddMinutes(30).AddSeconds(5));
+            const string user = "6c3f8a20-1d5e-4b97-8f4a-0e2d6b9c7a13";
+            runs.NoteStarted(user, PolicyA, T0.AddMinutes(31));
+            runs.NotePassCompleted(T0.AddHours(1));
+
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, T0.AddMinutes(31), out var run));
+            Assert.Equal("second run", run!.Stdout);
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(user, PolicyA, T0.AddMinutes(32), out _));
+            Assert.Equal(PlatformRunClaim.None, runs.TryClaim(DeviceUser, PolicyB, T0.AddMinutes(32), out _));
+        }
+
+        [Fact]
+        public void A_run_without_a_readable_user_id_is_claimed_by_its_policy()
+        {
+            var runs = new PlatformScriptRunRegister();
+            runs.NoteStarted(null, PolicyA, T0);
+            runs.NoteEmitted(Emitted(PolicyA, OwnStdout, userId: null), T0.AddSeconds(5));
+            runs.NotePassCompleted(T0.AddMinutes(5));
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, T0.AddMinutes(1), out _));
+        }
+
+        [Fact]
+        public void Register_keeps_the_newest_runs_and_its_counters_report_each_change_once()
+        {
+            var runs = new PlatformScriptRunRegister();
+            for (var i = 0; i <= PlatformScriptRunRegister.MaxRuns; i++)
+                runs.NoteStarted(DeviceUser, Guid.NewGuid().ToString("D"), T0.AddSeconds(i));
+            runs.NoteStarted(DeviceUser, PolicyA, T0.AddHours(1));
+            runs.NoteEmitted(Emitted(PolicyA, OwnStdout), T0.AddHours(1));
+            runs.NotePassCompleted(T0.AddHours(2));
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, T0.AddHours(1), out _));
+
+            Assert.False(runs.ConsumeCountersChanged());
+            runs.CountVerified();
+            runs.CountCorrected();
+            Assert.True(runs.ConsumeCountersChanged());
+            Assert.False(runs.ConsumeCountersChanged());
+            Assert.Equal(1, runs.Verified);
+            runs.RestoreCounters(7, 3);
+            Assert.Equal(7, runs.Verified);
+            Assert.Equal(3, runs.Corrected);
+        }
+
+        // ── observer flow ───────────────────────────────────────────────────────
+
+        private sealed class Fixture
+        {
+            public readonly FakeSignalIngressSink Sink = new FakeSignalIngressSink();
+            public readonly VirtualClock Clock = new VirtualClock(T0);
+            public readonly PlatformScriptRunRegister Runs = new PlatformScriptRunRegister();
+            public Dictionary<string, SavedScriptResult> Registry = new Dictionary<string, SavedScriptResult>(StringComparer.OrdinalIgnoreCase);
+            public readonly ImeRegistryScriptResultObserver Observer;
+
+            public Fixture()
+            {
+                Observer = new ImeRegistryScriptResultObserver(Runs, new InformationalEventPost(Sink, Clock), null, Clock,
+                    () => new Dictionary<string, SavedScriptResult>(Registry, StringComparer.OrdinalIgnoreCase));
+            }
+
+            public void Save(SavedScriptResult saved) => Registry[ImeRegistryScriptResultObserver.KeyOf(saved.UserId, saved.PolicyId)] = saved;
+
+            /// <summary>The tracker emitted a run, then kept polling past the save.</summary>
+            public void EmitRun(string policyId, string? stdout, int? exitCode, string runId)
+            {
+                Runs.NoteStarted(DeviceUser, policyId, Clock.UtcNow);
+                Runs.NoteEmitted(Emitted(policyId, stdout, exitCode, runId: runId), Clock.UtcNow);
+            }
+
+            public void TrackerCaughtUp() => Runs.NotePassCompleted(Clock.UtcNow);
+
+            public IReadOnlyList<FakeSignalIngressSink.PostedSignal> Corrections()
+                => Sink.Posted.Where(p => p.Payload != null
+                    && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                    && et == SharedEventTypes.ScriptOutputReconciliation).ToList();
+        }
+
+        [Fact]
+        public void Field_case_end_to_end_the_save_corrects_the_run_with_a_warning_naming_it()
+        {
+            var f = new Fixture();
+            f.Save(Saved("an older run of another policy", policy: PolicyB, stamp: "10/2/2026 8:00:00 AM"));
+            f.Observer.Tick("baseline");
+
+            f.EmitRun(PolicyA, ForeignStdout, 1, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.Clock.Advance(TimeSpan.FromSeconds(1));
+            f.Observer.Tick("registry_change");
+            Assert.Empty(f.Corrections()); // the tracker has not read past the save yet
+
+            f.Clock.Advance(PlatformScriptRunRegister.TrackerCatchUp);
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            var correction = Assert.Single(f.Corrections());
+            var data = correction.Payload!;
+            Assert.Equal(PolicyA, data["policyId"]);
+            Assert.Equal("platform", data["scriptType"]);
+            Assert.Equal("run-a", data["runId"]);
+            Assert.Equal("foreign", data["outcome"]);
+            Assert.Equal("stdout_differs", data["reason"]);
+            Assert.Equal("Success", data["result"]);
+            Assert.Equal(OwnStdout, data["stdout"]);
+            Assert.Equal(string.Empty, data["stderr"]);
+            Assert.Equal("1", data["previousExitCode"]);
+            Assert.Equal("0", data["registryErrorCode"]);
+            Assert.Equal("Warning", data[SignalPayloadKeys.Severity]);
+            Assert.Equal("true", data[SignalPayloadKeys.ImmediateUpload]);
+            Assert.DoesNotContain("exitCode", data.Keys);
+            Assert.Equal(1, f.Runs.Corrected);
+            Assert.Equal(0, f.Runs.Verified);
+
+            // The same save read again changes nothing.
+            f.Clock.Advance(TimeSpan.FromMinutes(1));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+            Assert.Single(f.Corrections());
+        }
+
+        [Fact]
+        public void Confirmed_output_is_counted_and_emits_nothing()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.EmitRun(PolicyA, OwnStdout, 0, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.Clock.Advance(TimeSpan.FromSeconds(1));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            Assert.Empty(f.Corrections());
+            Assert.Equal(1, f.Runs.Verified);
+        }
+
+        [Fact]
+        public void Completed_output_is_an_info_event_that_keeps_the_exit_code()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.EmitRun(PolicyA, null, 0, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.Clock.Advance(TimeSpan.FromSeconds(1));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            var data = Assert.Single(f.Corrections()).Payload!;
+            Assert.Equal("repaired", data["outcome"]);
+            Assert.Equal("Info", data[SignalPayloadKeys.Severity]);
+            Assert.DoesNotContain("previousExitCode", data.Keys);
+        }
+
+        [Fact]
+        public void A_save_seen_before_its_run_was_emitted_waits_for_the_emit()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.Runs.NoteStarted(DeviceUser, PolicyA, f.Clock.UtcNow); // result held for its end block
+            f.Save(Saved(OwnStdout));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+            Assert.Equal(0, f.Runs.Verified + f.Runs.Corrected);
+
+            f.Runs.NoteEmitted(Emitted(PolicyA, ForeignStdout, 1, runId: "run-a"), f.Clock.UtcNow);
+            f.Clock.Advance(TimeSpan.FromSeconds(60));
+            f.Observer.Tick("periodic");
+            Assert.Equal("foreign", Assert.Single(f.Corrections()).Payload!["outcome"]);
+        }
+
+        [Fact]
+        public void A_save_no_run_claims_within_the_expiry_is_dropped()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.Save(Saved(OwnStdout));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(ImeRegistryScriptResultObserver.PendingExpiry);
+            f.TrackerCaughtUp();
+            f.Runs.NoteStarted(DeviceUser, PolicyA, f.Clock.UtcNow);
+            f.Observer.Tick("periodic"); // waits for the emit — and expires
+
+            f.Runs.NoteEmitted(Emitted(PolicyA, ForeignStdout, 1, runId: "run-a"), f.Clock.UtcNow);
+            f.Clock.Advance(TimeSpan.FromSeconds(60));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+            Assert.Empty(f.Corrections());
+        }
+
+        [Fact]
+        public void Saves_from_before_the_agent_started_are_the_silent_baseline()
+        {
+            var f = new Fixture();
+            f.EmitRun(PolicyA, ForeignStdout, 1, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("baseline");
+            f.Clock.Advance(TimeSpan.FromMinutes(1));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            Assert.Empty(f.Corrections());
+            Assert.Equal(0, f.Runs.Verified + f.Runs.Corrected);
+        }
+
+        [Fact]
+        public void Corrections_beyond_the_cap_are_counted_but_not_emitted()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            var policies = Enumerable.Range(0, ImeRegistryScriptResultObserver.MaxCorrectionsPerSession + 3).Select(_ => Guid.NewGuid().ToString("D")).ToList();
+            foreach (var policy in policies)
+            {
+                f.EmitRun(policy, ForeignStdout, 1, "run-" + policy);
+                f.Save(Saved(OwnStdout, policy: policy));
+            }
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            Assert.Equal(ImeRegistryScriptResultObserver.MaxCorrectionsPerSession, f.Corrections().Count);
+            Assert.Equal(policies.Count, f.Runs.Corrected);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/OobeUpdateRegistrySnapshotTests.cs

@@ -0,0 +1,128 @@
+#nullable enable
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// The OOBE update registry snapshot (D-310, S4/S5): one readable, bounded line per key, for
+    /// agent.log and the <c>oobe_update_state</c> event. The registry read itself is a thin wrapper.
+    /// </summary>
+    public sealed class OobeUpdateRegistrySnapshotTests
+    {
+        private static KeyValuePair<string, object> Entry(string name, object value) => new KeyValuePair<string, object>(name, value);
+
+        [Fact]
+        public void Values_AreFormattedByType()
+        {
+            Assert.Equal("1", OobeUpdateRegistrySnapshot.FormatValue(1));
+            Assert.Equal("5000000000", OobeUpdateRegistrySnapshot.FormatValue(5000000000L));
+            Assert.Equal("Succeeded", OobeUpdateRegistrySnapshot.FormatValue("Succeeded"));
+            Assert.Equal("a|b", OobeUpdateRegistrySnapshot.FormatValue(new[] { "a", "b" }));
+            Assert.Equal("(binary 3 bytes)", OobeUpdateRegistrySnapshot.FormatValue(new byte[] { 1, 2, 3 }));
+            Assert.Equal("(null)", OobeUpdateRegistrySnapshot.FormatValue(null!));
+        }
+
+        [Fact]
+        public void LongValues_AreTruncated()
+        {
+            var formatted = OobeUpdateRegistrySnapshot.FormatValue(new string('x', 500));
+            Assert.Equal(OobeUpdateRegistrySnapshot.MaxValueLength + 1, formatted.Length);
+            Assert.EndsWith("…", formatted);
+        }
+
+        [Fact]
+        public void Entries_AreOrderedByName()
+        {
+            var line = OobeUpdateRegistrySnapshot.FormatEntries(new[]
+            {
+                Entry("ExpeditedUpdateStatus", 2),
+                Entry("EnableExpeditedUpdate", 1),
+                Entry("", "default"),
+            }, oobeOnly: false);
+
+            Assert.Equal("(default)=default, EnableExpeditedUpdate=1, ExpeditedUpdateStatus=2", line);
+        }
+
+        [Fact]
+        public void PolicyManagerSystemKey_KeepsOnlyOobeValues()
+        {
+            // That key holds every System policy of the device; only the OOBE ones matter here.
+            var line = OobeUpdateRegistrySnapshot.FormatEntries(new[]
+            {
+                Entry("AllowTelemetry", 1),
+                Entry("AllowOOBEUpdates", 1),
+                Entry("AllowOOBEUpdates_ProviderSet", 1),
+            }, oobeOnly: true);
+
+            Assert.Equal("AllowOOBEUpdates=1, AllowOOBEUpdates_ProviderSet=1", line);
+            Assert.Equal("(no OOBE values)", OobeUpdateRegistrySnapshot.FormatEntries(new[] { Entry("AllowTelemetry", 1) }, oobeOnly: true));
+            Assert.Equal("(no values)", OobeUpdateRegistrySnapshot.FormatEntries(new KeyValuePair<string, object>[0], oobeOnly: false));
+        }
+
+        [Fact]
+        public void ManyEntries_AreCapped_AndSaySo()
+        {
+            var entries = Enumerable.Range(0, OobeUpdateRegistrySnapshot.MaxEntries + 5)
+                .Select(i => Entry($"Value{i:000}", i));
+
+            var line = OobeUpdateRegistrySnapshot.FormatEntries(entries, oobeOnly: false);
+
+            Assert.EndsWith("… (+5 more)", line);
+        }
+
+        [Fact]
+        public void Describe_CountsOnlyOobeValues_OfThePolicyManagerSystemKey()
+        {
+            var policy = OobeUpdateRegistrySnapshot.Describe("policyManagerSystem", OobeUpdateRegistrySnapshot.PolicyManagerSystemKey,
+                new[] { Entry("AllowTelemetry", 1) }, new string[0]);
+            Assert.True(policy.Exists);
+            Assert.False(policy.HasValues);
+
+            var oobe = OobeUpdateRegistrySnapshot.Describe("policyManagerSystem", OobeUpdateRegistrySnapshot.PolicyManagerSystemKey,
+                new[] { Entry("AllowTelemetry", 1), Entry("AllowOOBEUpdates", 1) }, new string[0]);
+            Assert.True(oobe.HasValues);
+            Assert.Equal("AllowOOBEUpdates=1", oobe.Line);
+        }
+
+        [Fact]
+        public void Describe_SubkeysAlone_AreNoValues()
+        {
+            var state = OobeUpdateRegistrySnapshot.Describe("ndup", @"SOFTWARE\Microsoft\Windows\CurrentVersion\NDUP",
+                new KeyValuePair<string, object>[0], new[] { "Updates" });
+
+            Assert.False(state.HasValues);
+            Assert.Equal("(no values) | subkeys: Updates", state.Line);
+        }
+
+        [Fact]
+        public void Keys_HaveDistinctAliases()
+        {
+            // The aliases are the data keys of oobe_update_state.
+            Assert.Equal(OobeUpdateRegistrySnapshot.Keys.Length,
+                OobeUpdateRegistrySnapshot.Keys.Select(k => k.Alias).Distinct().Count());
+        }
+
+        [Fact]
+        public void Read_ReturnsEveryKey_FromTheRealRegistry()
+        {
+            var states = OobeUpdateRegistrySnapshot.Read();
+
+            Assert.Equal(OobeUpdateRegistrySnapshot.Keys.Select(k => k.Path), states.Select(s => s.Path));
+            Assert.All(states.Where(s => !s.Exists), s => Assert.False(s.HasValues));
+        }
+
+        [Fact]
+        public void Log_ToleratesMissingLoggerOrStates()
+        {
+            using var tmp = new TempDirectory();
+            OobeUpdateRegistrySnapshot.Log(new AgentLogger(tmp.Path, AgentLogLevel.Info), "test", OobeUpdateRegistrySnapshot.Read());
+            OobeUpdateRegistrySnapshot.Log(null!, "test", OobeUpdateRegistrySnapshot.Read());
+            OobeUpdateRegistrySnapshot.Log(new AgentLogger(tmp.Path, AgentLogLevel.Info), "test", null!);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/OobeUpdateTelemetryTests.cs

@@ -0,0 +1,259 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// Measurement telemetry of the OOBE update page (D-310): <c>oobe_update_page</c> per
+    /// update-page record and <c>oobe_update_state</c> for the registry behind it — Debug, bounded
+    /// per run, the state only when a key holds values and the content changed.
+    /// </summary>
+    public sealed class OobeUpdateTelemetryTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 10, 2, 9, 0, 0, DateTimeKind.Utc);
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private IReadOnlyList<OobeUpdateRegistrySnapshot.KeyState> _registry = Array.Empty<OobeUpdateRegistrySnapshot.KeyState>();
+
+        public void Dispose() => _tmp.Dispose();
+
+        private OobeUpdateTelemetry Build(Func<IReadOnlyList<OobeUpdateRegistrySnapshot.KeyState>>? reader = null) =>
+            new OobeUpdateTelemetry("sess-oobe", "tenant-oobe",
+                new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                reader ?? (() => _registry));
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> ByType(string eventType) =>
+            _sink.Posted.Where(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == eventType).ToList();
+
+        private static IReadOnlyDictionary<string, object> Data(FakeSignalIngressSink.PostedSignal posted) =>
+            (IReadOnlyDictionary<string, object>)posted.TypedPayload!;
+
+        private static OobeUpdateRegistrySnapshot.KeyState Key(string alias, string? line) =>
+            line == null
+                ? new OobeUpdateRegistrySnapshot.KeyState(alias, $@"SOFTWARE\{alias}", exists: false, hasValues: false, line: null)
+                : new OobeUpdateRegistrySnapshot.KeyState(alias, $@"SOFTWARE\{alias}", exists: true, hasValues: true, line: line);
+
+        // ------------------------------------------------------------- oobe_update_page ----
+
+        [Fact]
+        public void Page_IsReported_WithItsEventTime_AndFields()
+        {
+            Build().ReportPage(
+                new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "OobeNDUP", result: "success"),
+                At.AddMinutes(-3), isBackfill: true);
+
+            var page = Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage));
+            Assert.Equal(At.AddMinutes(-3), page.OccurredAtUtc);
+            Assert.Equal("Debug", page.Payload![SignalPayloadKeys.Severity]);
+            var data = Data(page);
+            Assert.Equal("page_stopped", data["cxhEvent"]);
+            Assert.Equal("OobeNDUP", data["page"]);
+            Assert.Equal("success", data["result"]);
+            Assert.Equal(true, data["backfill"]);
+            Assert.Equal(1, data["occurrence"]);
+            Assert.False(data.ContainsKey("value"));
+        }
+
+        [Fact]
+        public void EventName_CarriesItsSafeValue()
+        {
+            Build().ReportPage(
+                new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62407, name: "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", value: "true"),
+                At, isBackfill: false);
+
+            var data = Data(Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage)));
+            Assert.Equal("ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", data["name"]);
+            Assert.Equal("true", data["value"]);
+        }
+
+        [Fact]
+        public void SamePageOrName_IsReportedAtMostThreeTimes()
+        {
+            var telemetry = Build();
+            for (var i = 0; i < 10; i++)
+            {
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_progress"), At.AddSeconds(i), isBackfill: false);
+            }
+            telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "OobeNDUP", result: "success"), At.AddMinutes(1), isBackfill: false);
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey + 1, pages.Count);
+            Assert.Equal(new object[] { 1, 2, 3 }, pages.Take(3).Select(p => Data(p)["occurrence"]).ToArray());
+            // The repeats do not crowd out the page end.
+            Assert.Equal("page_stopped", Data(pages.Last())["cxhEvent"]);
+        }
+
+        [Fact]
+        public void PageEvents_AreCappedPerRun_AndTheCapIsMarkedOnce()
+        {
+            var telemetry = Build();
+            for (var i = 0; i < OobeUpdateTelemetry.MaxPageEventsPerRun + 20; i++)
+            {
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At.AddSeconds(i), isBackfill: false);
+            }
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 1, pages.Count);
+            // A name missing after the marker proves nothing — the rules check for it.
+            var marker = Data(pages.Last());
+            Assert.Equal(OobeUpdatePageRecord.NamesCapped, marker["cxhEvent"]);
+            Assert.Equal(false, marker["backfill"]);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun, marker["limit"]);
+            Assert.Equal(At.AddSeconds(OobeUpdateTelemetry.MaxPageEventsPerRun), pages.Last().OccurredAtUtc); // the first name over the budget
+        }
+
+        [Fact]
+        public void BackfilledNames_HaveTheirOwnBudget()
+        {
+            // The records from before the agent started cannot spend the live page's budget.
+            var telemetry = Build();
+            for (var i = 0; i < OobeUpdateTelemetry.MaxBackfillPageEventsPerRun + 5; i++)
+            {
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_old{i}"), At.AddMinutes(-30), isBackfill: true);
+            }
+
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_live"), At, isBackfill: false));
+
+            var markers = ByType(Constants.EventTypes.OobeUpdatePage)
+                .Where(p => (string)Data(p)["cxhEvent"] == OobeUpdatePageRecord.NamesCapped).ToList();
+            var marker = Assert.Single(markers);
+            Assert.Equal(true, Data(marker)["backfill"]);
+            Assert.Equal(OobeUpdateTelemetry.MaxBackfillPageEventsPerRun, Data(marker)["limit"]);
+        }
+
+        [Fact]
+        public void PageStartAndStop_AreReported_AfterTheNameBudgetIsSpent()
+        {
+            // The time attribution reads the update's span from the page start and stop.
+            var telemetry = Build();
+            for (var i = 0; i < OobeUpdateTelemetry.MaxPageEventsPerRun; i++)
+            {
+                Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false));
+            }
+
+            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_late"), At, isBackfill: false));
+            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_later"), At, isBackfill: false));
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, 62404, page: "RebootNDUP"), At.AddMinutes(1), isBackfill: false));
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "RebootNDUP", result: "success"), At.AddMinutes(2), isBackfill: false));
+
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 3, pages.Count);
+            Assert.Equal(new object[] { OobeUpdatePageRecord.NamesCapped, "page_started", "page_stopped" },
+                pages.Skip(OobeUpdateTelemetry.MaxPageEventsPerRun).Select(p => Data(p)["cxhEvent"]).ToArray());
+        }
+
+        [Fact]
+        public void SamePageStart_IsReportedAtMostThreeTimes()
+        {
+            // Outside the run budget, but a page that restarts in a loop still cannot flood.
+            var telemetry = Build();
+            var reported = Enumerable.Range(0, 10)
+                .Count(i => telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, 62404, page: "OobeNDUP"), At.AddMinutes(i), isBackfill: false));
+
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey, reported);
+        }
+
+        // ------------------------------------------------------------ oobe_update_state ----
+
+        [Fact]
+        public void State_WithoutValues_IsNotReported()
+        {
+            _registry = new[] { Key("setupOobeNdup", null), Key("policiesOobe", null) };
+
+            Build().ReportState(OobeUpdateTelemetry.Moments.AgentStart);
+
+            Assert.Empty(ByType(Constants.EventTypes.OobeUpdateState));
+        }
+
+        [Fact]
+        public void State_ReportsOnlyKeysWithValues_UnderTheirAlias()
+        {
+            _registry = new[]
+            {
+                Key("setupOobeNdup", "EnableExpeditedUpdate=1, EnableExpeditedUpdateSyncDownloadCompleted=1"),
+                Key("ndup", null),
+                new OobeUpdateRegistrySnapshot.KeyState("policyManagerSystem", "x", exists: true, hasValues: false, line: "(no OOBE values)"),
+                Key("espSetupPolicy", "InstallQualityUpdates=1"),
+            };
+
+            Build().ReportState(OobeUpdateTelemetry.Moments.UpdatePageStopped, "OobeNDUP");
+
+            var state = Assert.Single(ByType(Constants.EventTypes.OobeUpdateState));
+            Assert.Equal("Debug", state.Payload![SignalPayloadKeys.Severity]);
+            var data = Data(state);
+            Assert.Equal("update_page_stopped", data["moment"]);
+            Assert.Equal("OobeNDUP", data["page"]);
+            Assert.Equal(2, data["keysWithValues"]);
+            Assert.Equal("EnableExpeditedUpdate=1, EnableExpeditedUpdateSyncDownloadCompleted=1", data["setupOobeNdup"]);
+            Assert.Equal("InstallQualityUpdates=1", data["espSetupPolicy"]);
+            Assert.False(data.ContainsKey("ndup"));
+            Assert.False(data.ContainsKey("policyManagerSystem"));
+        }
+
+        [Fact]
+        public void UnchangedState_IsReportedOnce_AChangeAgain()
+        {
+            var telemetry = Build();
+            _registry = new[] { Key("espSetupPolicy", "InstallQualityUpdates=1") };
+
+            telemetry.ReportState(OobeUpdateTelemetry.Moments.AgentStart);
+            telemetry.ReportState(OobeUpdateTelemetry.Moments.UpdatePageStarted, "OobeNDUP");
+            _registry = new[] { Key("espSetupPolicy", "InstallQualityUpdates=1"), Key("setupOobeNdup", "EnableExpeditedUpdate=1") };
+            telemetry.ReportState(OobeUpdateTelemetry.Moments.UpdatePageStopped, "OobeNDUP");
+            telemetry.ReportState(OobeUpdateTelemetry.Moments.AgentStop);
+
+            var states = ByType(Constants.EventTypes.OobeUpdateState);
+            Assert.Equal(new object[] { "agent_start", "update_page_stopped" }, states.Select(s => Data(s)["moment"]).ToArray());
+        }
+
+        [Fact]
+        public void StateEvents_AreCappedPerRun()
+        {
+            var telemetry = Build();
+            for (var i = 0; i < OobeUpdateTelemetry.MaxStateEventsPerRun + 4; i++)
+            {
+                _registry = new[] { Key("setupOobeNdup", $"ExpeditedUpdateStatus={i}") };
+                telemetry.ReportState(OobeUpdateTelemetry.Moments.UpdatePageStarted, "OobeNDUP");
+            }
+
+            Assert.Equal(OobeUpdateTelemetry.MaxStateEventsPerRun, ByType(Constants.EventTypes.OobeUpdateState).Count);
+        }
+
+        [Fact]
+        public void LongLines_AreTruncated()
+        {
+            _registry = new[] { Key("ndupUpdates", new string('x', 3000)) };
+
+            Build().ReportState(OobeUpdateTelemetry.Moments.AgentStart);
+
+            var line = (string)Data(Assert.Single(ByType(Constants.EventTypes.OobeUpdateState)))["ndupUpdates"];
+            Assert.Equal(OobeUpdateTelemetry.MaxStateLineLength + 1, line.Length);
+            Assert.EndsWith("…", line);
+        }
+
+        [Fact]
+        public void FailingRegistryRead_ReportsNothing_AndDoesNotThrow()
+        {
+            Build(() => throw new UnauthorizedAccessException("denied")).ReportState(OobeUpdateTelemetry.Moments.AgentStart);
+
+            Assert.Empty(_sink.Posted);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ProvisioningStatusTrackerAccountSetupActivityTests.cs

@@ -83,6 +83,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             using var f = new Fixture();
             Assert.False(f.Tracker.HasAccountSetupActivity);
             Assert.False(f.Tracker.HasAccountSetupProgress);
+            Assert.Null(f.Tracker.AccountSetupProgressIfRead);
         }
 
         [Fact]
@@ -97,6 +98,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
 
             Assert.True(f.Tracker.HasAccountSetupActivity);
             Assert.False(f.Tracker.HasAccountSetupProgress);
+            // Read and untouched — the only state the WhiteGlove sealing gate treats as "false".
+            Assert.False(f.Tracker.AccountSetupProgressIfRead);
         }
 
         [Fact]
@@ -108,6 +111,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
 
             Assert.True(f.Tracker.HasAccountSetupActivity);
             Assert.True(f.Tracker.HasAccountSetupProgress);
+            Assert.True(f.Tracker.AccountSetupProgressIfRead);
         }
 
         [Theory]
@@ -138,5 +142,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
 
             Assert.False(f.Tracker.HasAccountSetupProgress);
         }
+
+        [Fact]
+        public void OnlyDeviceSetupRead_AccountSetupProgressIsUnknown()
+        {
+            // Adversarial for the WhiteGlove sealing gate: the tracker holds DeviceSetup data but
+            // has not read the AccountSetup category — that must be "unknown", never "untouched".
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status",
+                "{\"categoryState\":\"inProgress\",\"DeviceSetup.AppsSubcategory\":{\"subcategoryState\":\"inProgress\"}}");
+
+            Assert.Null(f.Tracker.AccountSetupProgressIfRead);
+            Assert.False(f.Tracker.HasAccountSetupProgress);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ServicingTrackerTests.cs

@@ -0,0 +1,289 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// ServicingTracker (D-310) — the CBS servicing steps of OS updates from the Setup log. The
+    /// sequence and XML shapes are those Windows 11 writes for a cumulative update installed by
+    /// <c>UpdateAgentLCU</c>: initiate Absent → Staged, Staged reached, initiate Staged → Installed,
+    /// restart required, Installed reached after the restart.
+    /// </summary>
+    public sealed class ServicingTrackerTests : IDisposable
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 25, 18, 52, 37, DateTimeKind.Utc);
+        private const string Kb = "KB5099999";
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private readonly UpdateActivityTally _tally = new UpdateActivityTally();
+        private readonly List<(string Step, string Update, DateTime At)> _osActivity = new List<(string, string, DateTime)>();
+        private readonly ServicingTracker _tracker;
+        private long _nextRecordId = 1200;
+
+        public ServicingTrackerTests()
+        {
+            _tracker = NewTracker(stateDirectory: null);
+        }
+
+        public void Dispose() => _tmp.Dispose();
+
+        private ServicingTracker NewTracker(string? stateDirectory) =>
+            new ServicingTracker(
+                sessionId: "sess-cbs",
+                tenantId: "tenant-cbs",
+                post: new InformationalEventPost(_sink, new VirtualClock(T0)),
+                logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                backfillEnabled: false,
+                stateDirectory: stateDirectory,
+                tally: _tally,
+                onOsUpdateActivity: (step, update, at) => _osActivity.Add((step, update, at)));
+
+        private void Process(
+            int eventId,
+            DateTime at,
+            string? initialState = null,
+            string? targetState = "Installed",
+            string? errorCode = null,
+            string? client = "UpdateAgentLCU",
+            string? package = Kb,
+            long? recordId = null,
+            ServicingTracker? tracker = null,
+            bool isBackfill = false)
+        {
+            (tracker ?? _tracker).ProcessEvent(
+                eventId: eventId,
+                recordId: recordId ?? _nextRecordId++,
+                timeCreatedUtc: at,
+                package: package,
+                initialState: initialState,
+                targetState: targetState,
+                errorCode: errorCode,
+                client: client,
+                isBackfill: isBackfill);
+        }
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> Servicing() =>
+            _sink.Posted.Where(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == Constants.EventTypes.WindowsUpdateServicing).ToList();
+
+        private static IReadOnlyDictionary<string, object> Data(FakeSignalIngressSink.PostedSignal s) =>
+            (IReadOnlyDictionary<string, object>)s.TypedPayload!;
+
+        [Fact]
+        public void CumulativeUpdateSequence_ListsEveryStep_AndReportsTheEngineSteps()
+        {
+            Process(ServicingTracker.EventId_InitiatingChanges, T0, initialState: "Absent", targetState: "Staged");
+            Process(ServicingTracker.EventId_StateReached, T0.AddMinutes(4), targetState: "Staged", errorCode: "0x0");
+            Process(ServicingTracker.EventId_InitiatingChanges, T0.AddMinutes(29), initialState: "Staged", targetState: "Installed");
+            Process(ServicingTracker.EventId_RebootRequired, T0.AddMinutes(33), targetState: "Installed", errorCode: "0x0");
+            // Written after the restart.
+            Process(ServicingTracker.EventId_StateReached, T0.AddMinutes(41), targetState: "Installed", errorCode: "0x0");
+
+            var rows = Servicing();
+            Assert.Equal(
+                new[] { "initiating", "state_reached", "initiating", "reboot_required", "state_reached" },
+                rows.Select(s => (string)Data(s)["step"]).ToArray());
+            Assert.All(rows, s => Assert.Equal("Info", s.Payload![SignalPayloadKeys.Severity]));
+            Assert.All(rows, s => Assert.Equal("ServicingWatcher", s.Payload![SignalPayloadKeys.Source]));
+            Assert.All(rows, s => Assert.Equal(Kb, Data(s)["package"]));
+            Assert.All(rows, s => Assert.Equal("UpdateAgentLCU", Data(s)["client"]));
+            // ErrorCode 0x0 is success, not a decoded HRESULT.
+            Assert.All(rows, s => Assert.False(Data(s).ContainsKey("hresult")));
+            Assert.Equal("Absent", Data(rows[0])["initialState"]);
+            Assert.Equal("Staged", Data(rows[0])["targetState"]);
+            Assert.Equal(T0.AddMinutes(33), rows[3].OccurredAtUtc);
+            Assert.Contains("needs a restart", rows[3].Payload![SignalPayloadKeys.Message]);
+
+            Assert.Equal(
+                new[]
+                {
+                    OsUpdateSteps.StagingStarted, OsUpdateSteps.Staged, OsUpdateSteps.InstallStarted,
+                    OsUpdateSteps.RebootRequired, OsUpdateSteps.Installed,
+                },
+                _osActivity.Select(a => a.Step).ToArray());
+            Assert.All(_osActivity, a => Assert.Equal(Kb, a.Update));
+            Assert.Equal(T0.AddMinutes(29), _osActivity[2].At);
+        }
+
+        [Theory]
+        [InlineData("CbsTask")]
+        [InlineData("DISM Package Manager Provider")]
+        [InlineData("")]
+        [InlineData(null)]
+        public void NonOsClients_AreCountedNotListed(string? client)
+        {
+            // CBS maintenance writes hundreds of these in seconds; language packs and features on
+            // demand installed by apps are not the OOBE update either.
+            Process(ServicingTracker.EventId_InitiatingChanges, T0, initialState: "Staged", targetState: "Installed",
+                client: client, package: "Microsoft-Windows-Telnet-Client-FOD-en-US");
+            Process(ServicingTracker.EventId_StateReached, T0, targetState: "Installed", errorCode: "0x0",
+                client: client, package: "Microsoft-Windows-Telnet-Client-FOD-en-US");
+
+            Assert.Empty(_sink.Posted);
+            Assert.Empty(_osActivity);
+            var counts = _tally.Snapshot().ToDictionary(kv => kv.Key, kv => kv.Value);
+            Assert.Equal(1, counts["servicing_other_1"]);
+            Assert.Equal(1, counts["servicing_other_2"]);
+        }
+
+        [Fact]
+        public void WindowsUpdateAgentClient_IsAnOsClient()
+        {
+            Process(ServicingTracker.EventId_RebootRequired, T0, client: "WindowsUpdateAgent", errorCode: "0x0");
+
+            Assert.Single(Servicing());
+            Assert.Equal(OsUpdateSteps.RebootRequired, Assert.Single(_osActivity).Step);
+        }
+
+        [Fact]
+        public void ChangeFailed_EmitsWarning_WithDecodedHResult()
+        {
+            Process(ServicingTracker.EventId_ChangeFailed, T0, targetState: "Installed", errorCode: "0x800f0922");
+
+            var s = Assert.Single(Servicing());
+            Assert.Equal("Warning", s.Payload![SignalPayloadKeys.Severity]);
+            var data = Data(s);
+            Assert.Equal("failed", data["step"]);
+            Assert.Equal("0x800F0922", data["hresult"]);
+            Assert.Equal("CBS_E_INSTALLERS_FAILED", data["hresultSymbol"]);
+            Assert.Contains("FAILED", s.Payload![SignalPayloadKeys.Message]);
+            Assert.Equal(OsUpdateSteps.Failed, Assert.Single(_osActivity).Step);
+        }
+
+        [Fact]
+        public void PartiallyInstalled_IsAFailure_AndSaysSo()
+        {
+            Process(ServicingTracker.EventId_PartiallyInstalled, T0, targetState: "Installed", errorCode: "0x800f0922");
+
+            var s = Assert.Single(Servicing());
+            Assert.Equal("failed", Data(s)["step"]);
+            Assert.Contains("partially installed", s.Payload![SignalPayloadKeys.Message]);
+            Assert.Equal(OsUpdateSteps.Failed, Assert.Single(_osActivity).Step);
+        }
+
+        [Fact]
+        public void ChangeTowardsAnotherState_IsListed_ButIsNoEngineStep()
+        {
+            // Removing a superseded package is servicing, not progress of the update install.
+            Process(ServicingTracker.EventId_InitiatingChanges, T0, initialState: "Installed", targetState: "Absent");
+
+            Assert.Single(Servicing());
+            Assert.Empty(_osActivity);
+        }
+
+        [Fact]
+        public void BackfilledRecord_KeepsItsEventTime()
+        {
+            var earlier = T0.AddMinutes(-20);
+            Process(ServicingTracker.EventId_InitiatingChanges, earlier, initialState: "Absent", targetState: "Staged", isBackfill: true);
+
+            var s = Assert.Single(Servicing());
+            Assert.Equal(earlier, s.OccurredAtUtc);
+            Assert.Equal(true, Data(s)["backfilled"]);
+            Assert.Equal(earlier, Assert.Single(_osActivity).At);
+        }
+
+        [Fact]
+        public void Watermark_SkipsEmittedRecordsAfterRestart()
+        {
+            var first = NewTracker(_tmp.Path);
+            Process(ServicingTracker.EventId_RebootRequired, T0, errorCode: "0x0", recordId: 1205, tracker: first);
+
+            var second = NewTracker(_tmp.Path);
+            second.LoadWatermark();
+            Process(ServicingTracker.EventId_RebootRequired, T0, errorCode: "0x0", recordId: 1205, tracker: second, isBackfill: true);
+            Process(ServicingTracker.EventId_StateReached, T0.AddMinutes(8), errorCode: "0x0", recordId: 1207, tracker: second);
+
+            Assert.Equal(new[] { "reboot_required", "state_reached" }, Servicing().Select(s => (string)Data(s)["step"]).ToArray());
+        }
+
+        [Fact]
+        public void SameRecordDeliveredTwice_IsListedOnce()
+        {
+            Process(ServicingTracker.EventId_RebootRequired, T0, errorCode: "0x0", recordId: 1205);
+            Process(ServicingTracker.EventId_RebootRequired, T0, errorCode: "0x0", recordId: 1205);
+
+            Assert.Single(Servicing());
+            Assert.Single(_osActivity);
+        }
+
+        [Fact]
+        public void ParseUserData_ReadsBothCbsPayloadShapes()
+        {
+            const string initiate =
+                "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Servicing' Guid='{bd12f3b8-fc40-4a61-a307-b7a013a069c1}'/>" +
+                "<EventID>1</EventID><Version>0</Version><Level>0</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords>" +
+                "<TimeCreated SystemTime='2026-09-25T19:21:42.4486782Z'/><EventRecordID>1203</EventRecordID><Channel>Setup</Channel><Computer>DESKTOP-TEST</Computer>" +
+                "<Security UserID='S-1-5-18'/></System><UserData><CbsPackageInitiateChanges xmlns='http://manifests.microsoft.com/win/2004/08/windows/setup_provider'>" +
+                "<PackageIdentifier>KB5099999</PackageIdentifier><InitialPackageState>5064</InitialPackageState><InitialPackageStateTextized>Staged</InitialPackageStateTextized>" +
+                "<IntendedPackageState>5112</IntendedPackageState><IntendedPackageStateTextized>Installed</IntendedPackageStateTextized><Client>UpdateAgentLCU</Client>" +
+                "</CbsPackageInitiateChanges></UserData></Event>";
+            const string changeState =
+                "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Servicing' Guid='{bd12f3b8-fc40-4a61-a307-b7a013a069c1}'/>" +
+                "<EventID>4</EventID><TimeCreated SystemTime='2026-09-25T19:26:07.1381462Z'/><EventRecordID>1205</EventRecordID><Channel>Setup</Channel></System>" +
+                "<UserData><CbsPackageChangeState xmlns='http://manifests.microsoft.com/win/2004/08/windows/setup_provider'><PackageIdentifier>KB5099999</PackageIdentifier>" +
+                "<IntendedPackageState>5112</IntendedPackageState><IntendedPackageStateTextized>Installed</IntendedPackageStateTextized><ErrorCode>0x0</ErrorCode>" +
+                "<Client>UpdateAgentLCU</Client></CbsPackageChangeState></UserData></Event>";
+
+            var a = ServicingTracker.ParseUserData(initiate);
+            Assert.Equal("KB5099999", a["PackageIdentifier"]);
+            Assert.Equal("Staged", a["InitialPackageStateTextized"]);
+            Assert.Equal("Installed", a["IntendedPackageStateTextized"]);
+            Assert.Equal("UpdateAgentLCU", a["client"]); // case-insensitive
+            Assert.False(a.ContainsKey("ErrorCode"));
+
+            var b = ServicingTracker.ParseUserData(changeState);
+            Assert.Equal("Installed", b["IntendedPackageStateTextized"]);
+            Assert.Equal("0x0", b["ErrorCode"]);
+            Assert.False(b.ContainsKey("InitialPackageStateTextized"));
+        }
+
+        [Fact]
+        public void ParseUserData_MalformedOrWithoutUserData_ReturnsEmpty_NeverThrows()
+        {
+            Assert.Empty(ServicingTracker.ParseUserData(null));
+            Assert.Empty(ServicingTracker.ParseUserData(""));
+            Assert.Empty(ServicingTracker.ParseUserData("<not-xml"));
+            Assert.Empty(ServicingTracker.ParseUserData("<Event><System><EventID>1</EventID></System></Event>"));
+        }
+
+        [Fact]
+        public void Watermark_PersistsOnlyAfterTheEngineSignalWasHandedOver()
+        {
+            // "Reboot required" is written right before the update's restart: its engine signal
+            // must be on its way before the watermark tells the next run's backfill to skip it.
+            var path = System.IO.Path.Combine(_tmp.Path, ServicingTracker.WatermarkStateFileName);
+            bool? watermarkOnDiskAtSignal = null;
+            var tracker = new ServicingTracker(
+                sessionId: "sess-cbs",
+                tenantId: "tenant-cbs",
+                post: new InformationalEventPost(_sink, new VirtualClock(T0)),
+                logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                backfillEnabled: false,
+                stateDirectory: _tmp.Path,
+                tally: _tally,
+                onOsUpdateActivity: (step, update, at) => watermarkOnDiskAtSignal = System.IO.File.Exists(path));
+
+            Process(ServicingTracker.EventId_RebootRequired, T0, errorCode: "0x0", tracker: tracker);
+
+            Assert.False(watermarkOnDiskAtSignal);
+            Assert.True(System.IO.File.Exists(path));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/StallProbeHelloWaitGuardTests.cs

@@ -0,0 +1,123 @@
+#nullable enable
+using System;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// A tenant-extended Hello wait runs up to 60 min — the default session_stalled threshold. While
+    /// it is pending the session waits on a bounded timer that resolves it either way, so the stall
+    /// probe holds the report back instead of flagging the session Stalled; once the wait is over
+    /// and the session is still idle the report fires, and real activity drops it. The collector
+    /// runs with no scan sources, so only the session_stalled decision is exercised.
+    /// </summary>
+    public sealed class StallProbeHelloWaitGuardTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 29, 8, 0, 0, DateTimeKind.Utc);
+        private const double IdleAtStallThreshold = 60;
+
+        [Fact]
+        public void Session_stalled_is_held_back_while_the_hello_wait_is_pending()
+        {
+            using var tmp = new TempDirectory();
+            var ingress = new FakeSignalIngressSink();
+            var collector = NewCollector(tmp, ingress, helloWaitPending: () => true);
+
+            collector.CheckAndRunProbes(IdleAtStallThreshold);
+            collector.CheckAndRunProbes(IdleAtStallThreshold + 1);
+
+            Assert.Equal(0, StalledCount(ingress));
+        }
+
+        [Fact]
+        public void Held_back_report_fires_once_the_hello_wait_is_over_and_the_session_is_still_idle()
+        {
+            using var tmp = new TempDirectory();
+            var ingress = new FakeSignalIngressSink();
+            var pending = true;
+            var collector = NewCollector(tmp, ingress, helloWaitPending: () => pending);
+
+            collector.CheckAndRunProbes(IdleAtStallThreshold);
+            Assert.Equal(0, StalledCount(ingress));
+
+            // hello_safety resolved (a deadline fire is no activity, so no ResetProbes): the next
+            // tick emits the held-back report — once.
+            pending = false;
+            collector.CheckAndRunProbes(IdleAtStallThreshold + 1);
+            collector.CheckAndRunProbes(IdleAtStallThreshold + 2);
+
+            Assert.Equal(1, StalledCount(ingress));
+        }
+
+        [Fact]
+        public void Real_activity_drops_the_held_back_report()
+        {
+            using var tmp = new TempDirectory();
+            var ingress = new FakeSignalIngressSink();
+            var pending = true;
+            var collector = NewCollector(tmp, ingress, helloWaitPending: () => pending);
+
+            collector.CheckAndRunProbes(IdleAtStallThreshold);
+            pending = false;
+            collector.ResetProbes();
+            collector.CheckAndRunProbes(1);
+            Assert.Equal(0, StalledCount(ingress));
+
+            // A new idle window reaches the threshold again — the fire-once report is still unused.
+            collector.CheckAndRunProbes(IdleAtStallThreshold);
+            Assert.Equal(1, StalledCount(ingress));
+        }
+
+        [Fact]
+        public void Without_a_hello_wait_probe_session_stalled_fires_as_before()
+        {
+            using var tmp = new TempDirectory();
+            var ingress = new FakeSignalIngressSink();
+            var collector = NewCollector(tmp, ingress, helloWaitPending: null);
+
+            collector.CheckAndRunProbes(IdleAtStallThreshold);
+
+            Assert.Equal(1, StalledCount(ingress));
+        }
+
+        [Fact]
+        public void A_throwing_hello_wait_probe_never_costs_the_stall_report()
+        {
+            using var tmp = new TempDirectory();
+            var ingress = new FakeSignalIngressSink();
+            var collector = NewCollector(tmp, ingress, helloWaitPending: () => throw new InvalidOperationException("probe down"));
+
+            collector.CheckAndRunProbes(IdleAtStallThreshold);
+
+            Assert.Equal(1, StalledCount(ingress));
+        }
+
+        private static StallProbeCollector NewCollector(TempDirectory tmp, FakeSignalIngressSink ingress, Func<bool>? helloWaitPending) =>
+            new StallProbeCollector(
+                sessionId: "S1",
+                tenantId: "T1",
+                post: new InformationalEventPost(ingress, new VirtualClock(Fixed)),
+                logger: new AgentLogger(tmp.Path, AgentLogLevel.Info),
+                thresholdsMinutes: new[] { 60 },
+                traceIndices: Array.Empty<int>(),
+                sources: Array.Empty<string>(),
+                sessionStalledAfterProbeIndex: 1,
+                helloWaitPending: helloWaitPending);
+
+        private static int StalledCount(FakeSignalIngressSink ingress) =>
+            ingress.Posted.Count(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == Constants.EventTypes.SessionStalled);
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/WindowsUpdateClassifierTests.cs

@@ -0,0 +1,85 @@
+#nullable enable
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// WindowsUpdateClassifier (D-310) — decides which Windows Update client events are listed one
+    /// by one (OS updates) and which are only counted (Store, Defender, everything else). The
+    /// titles are the shapes the WU client writes on Windows 11 GA and Insider builds.
+    /// </summary>
+    public sealed class WindowsUpdateClassifierTests
+    {
+        [Theory]
+        [InlineData("2026-09 Cumulative Update for Windows 11, version 25H2 for x64-based Systems (KB5099999)")]
+        [InlineData("2026-09 Cumulative Update Preview for Windows 11, version 24H2 for x64-based Systems (KB5099998)")]
+        [InlineData("2026-09 Dynamic Update for Windows 11, version 25H2 for x64-based Systems (KB5099997)")]
+        [InlineData("2026-09 Servicing Stack Update for Windows 11, version 25H2 for x64-based Systems (KB5099996)")]
+        [InlineData("Windows 11 Insider Preview Quality Update (26220.9568)")]
+        [InlineData("Windows 11 Insider Preview Feature Update (26220.9022)")]
+        [InlineData("Windows 11, version 25H2 Upgrade")]
+        [InlineData("2026-09 .NET Framework Security Update (KB5099995)")]
+        [InlineData("2026-08 .NET Framework Preview Update (KB5099994)")]
+        [InlineData("Windows Malicious Software Removal Tool x64 - v5.145 (KB890830)")]
+        public void WindowsAndDotNetFrameworkUpdates_AreOs(string title)
+        {
+            Assert.Equal(WindowsUpdateClassifier.Os, WindowsUpdateClassifier.Classify(title, serviceGuid: null));
+        }
+
+        [Theory]
+        [InlineData("Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.459.505.0) - Current Channel (Broad)")]
+        [InlineData("Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.26080.4) - Current Channel (Staged)")]
+        // Names "Windows" and "Update" — Defender must still win.
+        [InlineData("Windows 10/11 - Update for Microsoft Defender for Endpoint - KB5005292 (Version 10.8838.26060.15013) - Current Channel (Staged)")]
+        public void DefenderUpdates_AreDefender(string title)
+        {
+            Assert.Equal(WindowsUpdateClassifier.Defender, WindowsUpdateClassifier.Classify(title, serviceGuid: null));
+        }
+
+        [Theory]
+        [InlineData("9NSTH9KHZDLQ-Microsoft.UI.Xaml.2.8")]
+        [InlineData("9NBLGGH4NNS1-Microsoft.DesktopAppInstaller")]
+        // Upper-case "WINDOWS" inside the package name must not make it an OS update.
+        [InlineData("9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR")]
+        [InlineData("9WZDNCRFHWKN-MICROSOFT.WINDOWSSOUNDRECORDER")]
+        [InlineData("ApplicationSet-9WZDNCRFJ3Q2-Microsoft.BingWeather")]
+        public void StoreProductTitles_AreStore(string title)
+        {
+            Assert.Equal(WindowsUpdateClassifier.Store, WindowsUpdateClassifier.Classify(title, serviceGuid: null));
+        }
+
+        [Theory]
+        [InlineData("{855e8a7c-ecb4-4ca3-b045-1dfa50104289}")]
+        [InlineData("{855E8A7C-ECB4-4CA3-B045-1DFA50104289}")]
+        [InlineData("855e8a7c-ecb4-4ca3-b045-1dfa50104289")]
+        public void StoreServiceGuid_IsStore_WhateverTheTitle(string serviceGuid)
+        {
+            Assert.Equal(WindowsUpdateClassifier.Store,
+                WindowsUpdateClassifier.Classify("2026-09 Cumulative Update for Windows 11 (KB5099999)", serviceGuid));
+        }
+
+        [Fact]
+        public void OtherServiceGuid_LeavesTheTitleInCharge()
+        {
+            Assert.Equal(WindowsUpdateClassifier.Os,
+                WindowsUpdateClassifier.Classify("2026-09 Cumulative Update for Windows 11 (KB5099999)", "{7971f918-a847-4430-9279-4a52d1efe18d}"));
+        }
+
+        [Theory]
+        [InlineData("Intel net Driver Update (24.50.0.4)")]
+        [InlineData("PowerShell v7.6.6 (x64)")]
+        [InlineData("Remote help 5.2.1040.0")]
+        [InlineData("Microsoft Edge-Stable Channel Version 140 Update for x64 based Edge-Chromium (Build 140.0.3485.54)")]
+        [InlineData("Microsoft .NET 8.0.20 Security Update for x64 Client (KB5099993)")]
+        [InlineData("Windows Feature Experience Pack 1000.26100.234.0")]
+        [InlineData("KB5099999")]
+        [InlineData("")]
+        [InlineData("   ")]
+        [InlineData(null)]
+        public void EverythingElse_IsOther(string? title)
+        {
+            Assert.Equal(WindowsUpdateClassifier.Other, WindowsUpdateClassifier.Classify(title!, serviceGuid: null));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/WindowsUpdateTrackerTests.cs

@@ -1,6 +1,7 @@
 #nullable enable
 using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
@@ -9,55 +10,81 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
 using AutopilotMonitor.Shared;
+using Newtonsoft.Json.Linq;
 using Xunit;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
 {
     /// <summary>
     /// WindowsUpdateTracker — surfaces quality/cumulative update activity during OOBE from the
-    /// WindowsUpdateClient/Operational channel. Drives the primitive <see cref="WindowsUpdateTracker.ProcessEvent"/>
+    /// WindowsUpdateClient provider: install events from the System log, scan/download events from
+    /// the Operational channel (D-310). Drives the primitive <see cref="WindowsUpdateTracker.ProcessEvent"/>
     /// test seam (no real EventRecord, which is abstract + Windows-only), mirroring the
-    /// ModernDeploymentTracker test pattern.
+    /// ModernDeploymentTracker test pattern. Update titles are the shapes the provider writes.
     /// </summary>
     public sealed class WindowsUpdateTrackerTests : IDisposable
     {
         private static readonly DateTime At = new DateTime(2026, 7, 8, 10, 15, 0, DateTimeKind.Utc);
 
+        private const string Lcu = "2026-09 Cumulative Update for Windows 11, version 25H2 for x64-based Systems (KB5099999)";
+        private const string StoreApp = "9WZDNCRFHVN5-MICROSOFT.WINDOWSCALCULATOR";
+        private const string DefenderIntelligence = "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.459.505.0) - Current Channel (Broad)";
+
         private readonly TempDirectory _tmp = new TempDirectory();
-        private readonly FakeSignalIngressSink _sink;
-        private readonly WindowsUpdateTracker _tracker;
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private readonly UpdateActivityTally _tally = new UpdateActivityTally();
+        private readonly List<(string Step, string Update, DateTime At)> _osActivity = new List<(string, string, DateTime)>();
+        private readonly WindowsUpdateTracker _system;
+        private readonly WindowsUpdateTracker _operational;
         private long _nextRecordId = 1;
 
         public WindowsUpdateTrackerTests()
         {
-            _sink = new FakeSignalIngressSink();
-            var post = new InformationalEventPost(_sink, new VirtualClock(At));
-            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
-            _tracker = new WindowsUpdateTracker(
-                sessionId: "sess-wu",
-                tenantId: "tenant-wu",
-                post: post,
-                logger: logger,
-                backfillEnabled: false,
-                stateDirectory: null); // in-memory dedup for most tests
+            // In-memory dedup for most tests.
+            _system = NewTracker(WindowsUpdateTracker.SystemChannel, stateDirectory: null);
+            _operational = NewTracker(channel: null, stateDirectory: null);
         }
 
         public void Dispose() => _tmp.Dispose();
 
-        private void Emit(int eventId, string? errorCode = null, string? updateTitle = "Cumulative Update KB5099999", long? recordId = null)
+        private WindowsUpdateTracker NewTracker(string? channel, string? stateDirectory) =>
+            new WindowsUpdateTracker(
+                sessionId: "sess-wu",
+                tenantId: "tenant-wu",
+                post: new InformationalEventPost(_sink, new VirtualClock(At)),
+                logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                backfillEnabled: false,
+                stateDirectory: stateDirectory,
+                channel: channel,
+                tally: _tally,
+                onOsUpdateActivity: (step, update, at) => _osActivity.Add((step, update, at)));
+
+        private void Emit(
+            WindowsUpdateTracker tracker,
+            int eventId,
+            string? updateTitle = Lcu,
+            string? errorCode = null,
+            long? recordId = null,
+            string? serviceGuid = null,
+            string? updateCount = null,
+            DateTime? at = null,
+            bool isBackfill = false)
         {
-            _tracker.ProcessEvent(
+            tracker.ProcessEvent(
                 eventId: eventId,
                 level: 4,
                 recordId: recordId ?? _nextRecordId++,
-                timeCreatedUtc: At,
+                timeCreatedUtc: at ?? At,
                 updateTitle: updateTitle,
                 updateGuid: "{8b1c8726-1111-2222-3333-444455556666}",
                 updateRevisionNumber: "200",
                 errorCode: errorCode,
                 formattedDescription: null,
-                isBackfill: false);
+                isBackfill: isBackfill,
+                serviceGuid: serviceGuid,
+                updateCount: updateCount);
         }
 
         private IReadOnlyList<FakeSignalIngressSink.PostedSignal> ByType(string eventType) =>
@@ -70,10 +97,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         private static IReadOnlyDictionary<string, object> Data(FakeSignalIngressSink.PostedSignal s) =>
             (IReadOnlyDictionary<string, object>)s.TypedPayload!;
 
+        private int Counted(string key) =>
+            _tally.Snapshot().Where(kv => kv.Key == key).Select(kv => kv.Value).SingleOrDefault();
+
+        // ---------------------------------------------------------------------------
+        // Install events (System log)
+        // ---------------------------------------------------------------------------
+
         [Fact]
         public void FailureEvent_EmitsWindowsUpdateFailed_WithDecodedHResult_AndImmediateUpload()
         {
-            Emit(WindowsUpdateTracker.EventId_InstallFailure, errorCode: "0x80240022");
+            Emit(_system, WindowsUpdateTracker.EventId_InstallFailure, errorCode: "0x80240022");
 
             var failed = ByType(Constants.EventTypes.WindowsUpdateFailed);
             var s = Assert.Single(failed);
@@ -83,37 +117,44 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             var data = Data(s);
             Assert.Equal("0x80240022", data["hresult"]);
             Assert.Equal("WU_E_ALL_UPDATES_FAILED", data["hresultSymbol"]);
-            Assert.Equal("Cumulative Update KB5099999", data["updateTitle"]);
+            Assert.Equal(Lcu, data["updateTitle"]);
             Assert.Equal(20, data["wuEventId"]);
+            Assert.Equal("system", data["wuChannel"]);
+            Assert.Equal("install", data["wuPhase"]);
+            Assert.Equal(WindowsUpdateClassifier.Os, data["updateClass"]);
         }
 
         [Fact]
         public void SuccessEvent_EmitsWindowsUpdateSucceeded_InfoSeverity()
         {
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess);
 
             var ok = ByType(Constants.EventTypes.WindowsUpdateSucceeded);
             var s = Assert.Single(ok);
             Assert.Equal("Info", s.Payload![SignalPayloadKeys.Severity]);
             Assert.Equal("false", s.Payload![SignalPayloadKeys.ImmediateUpload]);
+            Assert.Equal("installed", Data(s)["wuPhase"]);
         }
 
         [Fact]
-        public void StartedAndDownloadEvents_EmitDebugStarted()
+        public void StartedAndDownloadEvents_EmitInfoStarted_WithTheirPhase()
         {
-            Emit(WindowsUpdateTracker.EventId_InstallStarted);
-            Emit(WindowsUpdateTracker.EventId_DownloadStarted);
+            // Info, not Debug: with only OS updates listed they are the visible progress of a
+            // long OOBE update.
+            Emit(_system, WindowsUpdateTracker.EventId_InstallStarted);
+            Emit(_system, WindowsUpdateTracker.EventId_DownloadStarted);
 
             var started = ByType(Constants.EventTypes.WindowsUpdateStarted);
             Assert.Equal(2, started.Count);
-            Assert.All(started, s => Assert.Equal("Debug", s.Payload![SignalPayloadKeys.Severity]));
+            Assert.All(started, s => Assert.Equal("Info", s.Payload![SignalPayloadKeys.Severity]));
+            Assert.Equal(new[] { "install", "download" }, started.Select(s => (string)Data(s)["wuPhase"]).ToArray());
         }
 
         [Fact]
         public void SameRecordId_ProcessedTwice_EmitsOnce()
         {
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess, recordId: 42);
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess, recordId: 42);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 42);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 42);
 
             Assert.Single(ByType(Constants.EventTypes.WindowsUpdateSucceeded));
         }
@@ -125,8 +166,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             // with a higher RecordId can be processed first. An older, never-emitted backfill event
             // (lower RecordId) must NOT be suppressed as "already processed" — these early pre-agent
             // OOBE updates are the whole point of the feature. A high-water-mark dedup dropped them.
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess, recordId: 100); // live, high RecordId
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess, recordId: 50);  // backfill, older, never seen
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 100); // live, high RecordId
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 50);  // backfill, older, never seen
 
             Assert.Equal(2, ByType(Constants.EventTypes.WindowsUpdateSucceeded).Count);
         }
@@ -138,53 +179,212 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             // time, not at agent start (the ctor's default UtcNow). InformationalEventPost forwards
             // EnrollmentEvent.Timestamp as the signal's OccurredAtUtc, which drives the timeline entry.
             var eventTime = new DateTime(2026, 7, 8, 7, 5, 0, DateTimeKind.Utc); // well before `At`
-            _tracker.ProcessEvent(
-                eventId: WindowsUpdateTracker.EventId_InstallFailure,
-                level: 4,
-                recordId: 7,
-                timeCreatedUtc: eventTime,
-                updateTitle: "KB5099999",
-                updateGuid: null,
-                updateRevisionNumber: null,
-                errorCode: "0x80240022",
-                formattedDescription: null,
-                isBackfill: true);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallFailure, errorCode: "0x80240022",
+                recordId: 7, at: eventTime, isBackfill: true);
 
             var s = Assert.Single(ByType(Constants.EventTypes.WindowsUpdateFailed));
             Assert.Equal(eventTime, s.OccurredAtUtc);
+            Assert.Equal(true, Data(s)["backfilled"]);
         }
 
         [Fact]
         public void NegativeRecordId_IsNeverDeduped()
         {
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess, recordId: -1);
-            Emit(WindowsUpdateTracker.EventId_InstallSuccess, recordId: -1);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: -1);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: -1);
 
             Assert.Equal(2, ByType(Constants.EventTypes.WindowsUpdateSucceeded).Count);
         }
 
+        // ---------------------------------------------------------------------------
+        // Scan/download events (Operational channel)
+        // ---------------------------------------------------------------------------
+
         [Fact]
-        public void Watermark_PersistsAcrossTrackerInstances()
+        public void Downloaded_EmitsInfoStarted_WithDownloadedPhase()
         {
-            var post = new InformationalEventPost(_sink, new VirtualClock(At));
-            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            Emit(_operational, WindowsUpdateTracker.EventId_Downloaded);
 
-            var first = new WindowsUpdateTracker("s", "t", post, logger, backfillEnabled: false, stateDirectory: _tmp.Path);
-            first.ProcessEvent(WindowsUpdateTracker.EventId_InstallSuccess, 4, recordId: 500, timeCreatedUtc: At,
-                updateTitle: "KB1", updateGuid: null, updateRevisionNumber: null, errorCode: null,
-                formattedDescription: null, isBackfill: false);
+            var s = Assert.Single(ByType(Constants.EventTypes.WindowsUpdateStarted));
+            Assert.Equal("Info", s.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("downloaded", Data(s)["wuPhase"]);
+            Assert.Equal("operational", Data(s)["wuChannel"]);
+        }
 
-            // A fresh tracker (simulating an agent restart) must load the watermark and skip the
-            // already-emitted record when the OOBE backfill re-reads it.
-            var second = new WindowsUpdateTracker("s", "t", post, logger, backfillEnabled: false, stateDirectory: _tmp.Path);
-            second.LoadWatermark();
-            second.ProcessEvent(WindowsUpdateTracker.EventId_InstallSuccess, 4, recordId: 500, timeCreatedUtc: At,
-                updateTitle: "KB1", updateGuid: null, updateRevisionNumber: null, errorCode: null,
-                formattedDescription: null, isBackfill: true);
+        [Fact]
+        public void DownloadFailure_OfAnOsUpdate_EmitsWarning_WithDownloadPhase()
+        {
+            Emit(_operational, WindowsUpdateTracker.EventId_DownloadFailed, errorCode: "0x80248007");
+
+            var s = Assert.Single(ByType(Constants.EventTypes.WindowsUpdateFailed));
+            Assert.Equal("Warning", s.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("false", s.Payload![SignalPayloadKeys.ImmediateUpload]);
+            var data = Data(s);
+            Assert.Equal("download", data["wuPhase"]);
+            Assert.Equal("0x80248007", data["hresult"]);
+        }
+
+        [Fact]
+        public void ScanFound_EmitsOnlyChangedCounts_AndCountsTheRepeats()
+        {
+            foreach (var count in new[] { "3", "3", "5", "5", "0" })
+                Emit(_operational, WindowsUpdateTracker.EventId_ScanFound, updateTitle: null, updateCount: count);
+
+            var found = ByType(Constants.EventTypes.WindowsUpdateStarted);
+            Assert.Equal(new[] { "3", "5", "0" }, found.Select(s => (string)Data(s)["updateCount"]).ToArray());
+            Assert.All(found, s => Assert.Equal("Debug", s.Payload![SignalPayloadKeys.Severity]));
+            Assert.All(found, s => Assert.Equal("scan", Data(s)["wuPhase"]));
+            Assert.All(found, s => Assert.False(Data(s).ContainsKey("updateClass")));
+            Assert.Contains("scan found 3 update(s)", found[0].Payload![SignalPayloadKeys.Message]);
+            Assert.Equal(2, Counted("scan_found_repeat"));
+            Assert.Empty(_osActivity); // a scan result is not an update step
+        }
+
+        [Fact]
+        public void ScanFound_IsCappedPerRun()
+        {
+            for (var i = 0; i < WindowsUpdateTracker.MaxScanFoundEmissions + 2; i++)
+                Emit(_operational, WindowsUpdateTracker.EventId_ScanFound, updateTitle: null, updateCount: i.ToString());
+
+            Assert.Equal(WindowsUpdateTracker.MaxScanFoundEmissions, ByType(Constants.EventTypes.WindowsUpdateStarted).Count);
+            Assert.Equal(2, Counted("scan_found_repeat"));
+        }
+
+        [Fact]
+        public void ScanFailed_EmitsEachErrorCodeOnce()
+        {
+            Emit(_operational, WindowsUpdateTracker.EventId_ScanFailed, updateTitle: null, errorCode: "0x8024401c");
+            Emit(_operational, WindowsUpdateTracker.EventId_ScanFailed, updateTitle: null, errorCode: "0x8024401c");
+            Emit(_operational, WindowsUpdateTracker.EventId_ScanFailed, updateTitle: null, errorCode: "0x80072EE2");
+            Emit(_operational, WindowsUpdateTracker.EventId_ScanFailed, updateTitle: null, errorCode: "0x8024401C");
+
+            var failed = ByType(Constants.EventTypes.WindowsUpdateFailed);
+            Assert.Equal(2, failed.Count);
+            Assert.All(failed, s => Assert.Equal("Warning", s.Payload![SignalPayloadKeys.Severity]));
+            Assert.All(failed, s => Assert.Equal("scan", Data(s)["wuPhase"]));
+            Assert.Equal(2, Counted("scan_failed_repeat"));
+            Assert.Empty(_osActivity);
+        }
+
+        [Fact]
+        public void ScanFailed_IsCappedPerRun()
+        {
+            for (var i = 0; i < WindowsUpdateTracker.MaxScanFailedEmissions + 2; i++)
+                Emit(_operational, WindowsUpdateTracker.EventId_ScanFailed, updateTitle: null, errorCode: $"0x8024000{i}");
+
+            Assert.Equal(WindowsUpdateTracker.MaxScanFailedEmissions, ByType(Constants.EventTypes.WindowsUpdateFailed).Count);
+            Assert.Equal(2, Counted("scan_failed_repeat"));
+        }
+
+        // ---------------------------------------------------------------------------
+        // Classification — only OS updates are listed, the rest is counted
+        // ---------------------------------------------------------------------------
+
+        [Theory]
+        [InlineData(StoreApp, null, WindowsUpdateTracker.EventId_InstallSuccess, "store_19")]
+        [InlineData("Some App", "{855e8a7c-ecb4-4ca3-b045-1dfa50104289}", WindowsUpdateTracker.EventId_Downloaded, "store_41")]
+        [InlineData(DefenderIntelligence, null, WindowsUpdateTracker.EventId_InstallStarted, "defender_43")]
+        [InlineData("Intel net Driver Update (24.50.0.4)", null, WindowsUpdateTracker.EventId_DownloadStarted, "other_44")]
+        // A real download failure names no update at all; it must not reach ANALYZE-DEV-004 as
+        // a failed OS update.
+        [InlineData("", null, WindowsUpdateTracker.EventId_DownloadFailed, "other_31")]
+        [InlineData("Some App", "{855e8a7c-ecb4-4ca3-b045-1dfa50104289}", WindowsUpdateTracker.EventId_InstallFailure, "store_20")]
+        public void NonOsUpdates_AreCountedNotEmitted(string title, string? serviceGuid, int eventId, string expectedKey)
+        {
+            var tracker = WindowsUpdateTracker.IsSystemChannelEventId(eventId) ? _system : _operational;
+            Emit(tracker, eventId, updateTitle: title, serviceGuid: serviceGuid, errorCode: "0x80248007");
+
+            Assert.Empty(_sink.Posted);
+            Assert.Empty(_osActivity);
+            Assert.Equal(1, Counted(expectedKey));
+            // The census still sees the channel working.
+            Assert.Equal(1, tracker.EmittedThisRun);
+        }
+
+        [Fact]
+        public void CountedRecord_DeliveredTwice_IsCountedOnce()
+        {
+            // Live watcher and backfill overlap: the seen-set dedups counted records too.
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, updateTitle: StoreApp, recordId: 7);
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, updateTitle: StoreApp, recordId: 7);
+
+            Assert.Equal(1, Counted("store_19"));
+        }
+
+        [Fact]
+        public void OsUpdateSteps_AreReportedToTheEngineCallback()
+        {
+            var t0 = At;
+            Emit(_system, WindowsUpdateTracker.EventId_DownloadStarted, at: t0);
+            Emit(_operational, WindowsUpdateTracker.EventId_Downloaded, at: t0.AddMinutes(4));
+            Emit(_system, WindowsUpdateTracker.EventId_InstallStarted, at: t0.AddMinutes(5));
+            Emit(_system, WindowsUpdateTracker.EventId_InstallSuccess, at: t0.AddMinutes(31));
+            Emit(_system, WindowsUpdateTracker.EventId_InstallFailure, errorCode: "0x800F0922", at: t0.AddMinutes(32));
+            Emit(_operational, WindowsUpdateTracker.EventId_DownloadFailed, errorCode: "0x80248007", at: t0.AddMinutes(33));
+
+            Assert.Equal(
+                new[]
+                {
+                    OsUpdateSteps.DownloadStarted, OsUpdateSteps.Downloaded, OsUpdateSteps.InstallStarted,
+                    OsUpdateSteps.Installed, OsUpdateSteps.Failed, OsUpdateSteps.Failed,
+                },
+                _osActivity.Select(a => a.Step).ToArray());
+            Assert.All(_osActivity, a => Assert.Equal(Lcu, a.Update));
+            Assert.Equal(t0.AddMinutes(31), _osActivity[3].At);
+        }
+
+        [Fact]
+        public void ThrowingCallback_NeverCostsTheEvent()
+        {
+            var tracker = new WindowsUpdateTracker(
+                "s", "t", new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                backfillEnabled: false,
+                channel: WindowsUpdateTracker.SystemChannel,
+                onOsUpdateActivity: (step, update, at) => throw new InvalidOperationException("boom"));
+
+            Emit(tracker, WindowsUpdateTracker.EventId_InstallSuccess);
 
             Assert.Single(ByType(Constants.EventTypes.WindowsUpdateSucceeded));
         }
 
+        // ---------------------------------------------------------------------------
+        // Channels and XPath
+        // ---------------------------------------------------------------------------
+
+        [Fact]
+        public void DefaultEventIds_FollowTheProviderManifest()
+        {
+            Assert.Equal(WindowsUpdateTracker.SystemChannel, _system.WatchedChannel);
+            Assert.Equal(new[] { 19, 20, 43, 44 }, _system.TargetedEventIds.OrderBy(id => id).ToArray());
+            Assert.Equal(WindowsUpdateTracker.Channel, _operational.WatchedChannel);
+            Assert.Equal(new[] { 25, 26, 31, 41 }, _operational.TargetedEventIds.OrderBy(id => id).ToArray());
+        }
+
+        [Theory]
+        [InlineData(16, true)]
+        [InlineData(19, true)]
+        [InlineData(20, true)]
+        [InlineData(24, true)]
+        [InlineData(27, true)]
+        [InlineData(28, true)]
+        [InlineData(32, true)]
+        [InlineData(33, true)]
+        [InlineData(43, true)]
+        [InlineData(44, true)]
+        [InlineData(212, true)]
+        [InlineData(218, true)]
+        [InlineData(25, false)]
+        [InlineData(26, false)]
+        [InlineData(31, false)]
+        [InlineData(41, false)]
+        [InlineData(15, false)]
+        [InlineData(219, false)]
+        public void IsSystemChannelEventId_MatchesTheManifest(int eventId, bool expected)
+        {
+            Assert.Equal(expected, WindowsUpdateTracker.IsSystemChannelEventId(eventId));
+        }
+
         [Fact]
         public void BuildXPath_ContainsAllTargetedIds_Ordered()
         {
@@ -192,6 +392,113 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             Assert.Equal("*[System[(EventID=19 or EventID=20 or EventID=43 or EventID=44)]]", xpath);
         }
 
+        [Fact]
+        public void BuildXPath_SharedSystemLog_FiltersTheProvider_AndTheLookback()
+        {
+            // Verified against a real System log: the provider clause keeps the other providers'
+            // EventIDs 19/20/43/44 out of the shared channel.
+            var ids = new HashSet<int> { 44, 19, 20, 43 };
+
+            Assert.Equal(
+                "*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and (EventID=19 or EventID=20 or EventID=43 or EventID=44)]]",
+                WindowsUpdateTracker.BuildXPath(ids, WindowsUpdateTracker.ProviderName));
+            Assert.Equal(
+                "*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and (EventID=19 or EventID=20 or EventID=43 or EventID=44) and TimeCreated[timediff(@SystemTime) <= 3600000]]]",
+                WindowsUpdateTracker.BuildXPath(ids, WindowsUpdateTracker.ProviderName, lookbackMs: 3600000));
+            Assert.Equal(
+                "*[System[(EventID=25 or EventID=26) and TimeCreated[timediff(@SystemTime) <= 60000]]]",
+                WindowsUpdateTracker.BuildXPath(new HashSet<int> { 26, 25 }, providerName: null, lookbackMs: 60000));
+        }
+
+        // ---------------------------------------------------------------------------
+        // Watermark
+        // ---------------------------------------------------------------------------
+
+        [Fact]
+        public void Watermark_PersistsAcrossTrackerInstances()
+        {
+            var first = NewTracker(WindowsUpdateTracker.SystemChannel, _tmp.Path);
+            Emit(first, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 500);
+
+            // A fresh tracker (simulating an agent restart) must load the watermark and skip the
+            // already-emitted record when the OOBE backfill re-reads it.
+            var second = NewTracker(WindowsUpdateTracker.SystemChannel, _tmp.Path);
+            second.LoadWatermark();
+            Emit(second, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 500, isBackfill: true);
+
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateSucceeded));
+        }
+
+        [Fact]
+        public void Watermark_IsPerChannel()
+        {
+            // RecordIds are per channel: System record 500 and Operational record 500 are two
+            // different events and must not dedup each other — before or after a restart.
+            Emit(NewTracker(WindowsUpdateTracker.SystemChannel, _tmp.Path), WindowsUpdateTracker.EventId_InstallSuccess, recordId: 500);
+            Emit(NewTracker(null, _tmp.Path), WindowsUpdateTracker.EventId_Downloaded, recordId: 500);
+
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateSucceeded));
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateStarted));
+            Assert.Equal(500L, ReadWatermark(WindowsUpdateTracker.SystemWatermarkStateFileName));
+            Assert.Equal(500L, ReadWatermark(WindowsUpdateTracker.WatermarkStateFileName));
+
+            var system = NewTracker(WindowsUpdateTracker.SystemChannel, _tmp.Path);
+            var operational = NewTracker(null, _tmp.Path);
+            system.LoadWatermark();
+            operational.LoadWatermark();
+            Emit(system, WindowsUpdateTracker.EventId_InstallSuccess, recordId: 500, isBackfill: true);
+            Emit(operational, WindowsUpdateTracker.EventId_Downloaded, recordId: 500, isBackfill: true);
+
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateSucceeded));
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateStarted));
+        }
+
+        [Fact]
+        public void CountedRecords_WriteNoStateFile()
+        {
+            // A Store/Defender burst must not cost a state-file write per record; only emitted
+            // records move the persisted watermark.
+            var tracker = NewTracker(WindowsUpdateTracker.SystemChannel, _tmp.Path);
+            Emit(tracker, WindowsUpdateTracker.EventId_InstallSuccess, updateTitle: StoreApp, recordId: 600);
+            Emit(tracker, WindowsUpdateTracker.EventId_InstallStarted, updateTitle: DefenderIntelligence, recordId: 601);
+
+            Assert.False(File.Exists(Path.Combine(_tmp.Path, WindowsUpdateTracker.SystemWatermarkStateFileName)));
+
+            Emit(tracker, WindowsUpdateTracker.EventId_InstallStarted, recordId: 602);
+            Assert.Equal(602L, ReadWatermark(WindowsUpdateTracker.SystemWatermarkStateFileName));
+        }
+
+        [Fact]
+        public void Watermark_PersistsOnlyAfterTheEngineSignalWasHandedOver()
+        {
+            // A restart's backfill skips a persisted record, so the record's engine signal must be
+            // on its way before the watermark reaches the disk — never the other way round.
+            var path = Path.Combine(_tmp.Path, WindowsUpdateTracker.SystemWatermarkStateFileName);
+            bool? watermarkOnDiskAtSignal = null;
+            var tracker = new WindowsUpdateTracker(
+                sessionId: "sess-wu",
+                tenantId: "tenant-wu",
+                post: new InformationalEventPost(_sink, new VirtualClock(At)),
+                logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                backfillEnabled: false,
+                stateDirectory: _tmp.Path,
+                channel: WindowsUpdateTracker.SystemChannel,
+                tally: _tally,
+                onOsUpdateActivity: (step, update, at) => watermarkOnDiskAtSignal = File.Exists(path));
+
+            Emit(tracker, WindowsUpdateTracker.EventId_InstallStarted, recordId: 700);
+
+            Assert.False(watermarkOnDiskAtSignal);
+            Assert.Equal(700L, ReadWatermark(WindowsUpdateTracker.SystemWatermarkStateFileName));
+        }
+
+        private long ReadWatermark(string fileName) =>
+            JObject.Parse(File.ReadAllText(Path.Combine(_tmp.Path, fileName)))["LastRecordId"]!.Value<long>();
+
+        // ---------------------------------------------------------------------------
+        // Parsing and HRESULT decoding
+        // ---------------------------------------------------------------------------
+
         [Fact]
         public void ParseEventData_ExtractsNamedFields_NamespaceAgnostic()
         {
@@ -212,6 +519,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             Assert.True(data.ContainsKey("UPDATETITLE"));
         }
 
+        [Fact]
+        public void ParseEventData_ReadsTheScanFields()
+        {
+            // Event 26 (scan found N) and 25 (scan failed) carry no update title.
+            const string xml =
+                "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>" +
+                "<System><EventID>26</EventID></System>" +
+                "<EventData>" +
+                "<Data Name='updateCount'>3</Data>" +
+                "<Data Name='serviceGuid'>{8b24b027-1dee-babb-9a95-3517dfb9c552}</Data>" +
+                "</EventData></Event>";
+
+            var data = WindowsUpdateTracker.ParseEventData(xml);
+            Assert.Equal("3", data["updateCount"]);
+            Assert.Equal("{8b24b027-1dee-babb-9a95-3517dfb9c552}", data["serviceGuid"]);
+            Assert.False(data.ContainsKey("updateTitle"));
+        }
+
         [Fact]
         public void ParseEventData_MalformedXml_ReturnsEmpty_NeverThrows()
         {
@@ -303,10 +628,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             var data = Data(s);
             Assert.Equal("21=1,25=3", data["wuClientCensus"]);
             Assert.Equal("200=2", data["updateOrchestratorCensus"]);
-            Assert.Equal("19,20,43,44", data["targetedEventIds"]);
+            Assert.Equal("25,26,31,41", data["targetedEventIds"]);
             Assert.False(data.ContainsKey("censusTruncated"));
         }
 
+        [Fact]
+        public void Census_ListsTheTargetedIdsOfEveryChannel()
+        {
+            // The host runs the census on the Operational instance; the evidence must still say
+            // the System-log install IDs were watched too.
+            var tracker = BuildCensusTracker(censusEnabled: true, osBuildChanged: true);
+
+            tracker.EmitChannelCensusIfBlind(otherChannelsEmitted: 0, otherTargetedEventIds: new[] { 44, 19, 20, 43 });
+
+            var s = Assert.Single(ByType(Constants.EventTypes.WindowsUpdateChannelCensus));
+            Assert.Equal("19,20,25,26,31,41,43,44", Data(s)["targetedEventIds"]);
+        }
+
         [Fact]
         public void Census_BuildUnchanged_EmitsNothing()
         {
@@ -320,17 +658,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         [Fact]
         public void Census_TargetedEventsWereEmittedThisRun_EmitsNothing()
         {
-            // The watcher captured the update through its normal path — no blind spot to report.
+            // The watcher captured activity through its normal path — no blind spot to report.
+            // Any class counts: a counted Store update proves the channel is read as well.
             var tracker = BuildCensusTracker(censusEnabled: true, osBuildChanged: true);
-            tracker.ProcessEvent(WindowsUpdateTracker.EventId_InstallSuccess, 4, recordId: 9, timeCreatedUtc: At,
-                updateTitle: "KB1", updateGuid: null, updateRevisionNumber: null, errorCode: null,
-                formattedDescription: null, isBackfill: false);
+            Emit(tracker, WindowsUpdateTracker.EventId_Downloaded, updateTitle: StoreApp, recordId: 9);
 
             tracker.EmitChannelCensusIfBlind();
 
             Assert.Empty(ByType(Constants.EventTypes.WindowsUpdateChannelCensus));
         }
 
+        [Fact]
+        public void Census_AnotherChannelEmitted_EmitsNothing()
+        {
+            // The System-log watcher saw the install — the update was not missed.
+            var tracker = BuildCensusTracker(censusEnabled: true, osBuildChanged: true);
+
+            tracker.EmitChannelCensusIfBlind(otherChannelsEmitted: 1);
+
+            Assert.Empty(ByType(Constants.EventTypes.WindowsUpdateChannelCensus));
+        }
+
         [Fact]
         public void Census_DisabledByConfig_EmitsNothing()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Transport/EmergencyReporterTests.cs

@@ -20,6 +20,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
         private sealed class FakeApiClient : BackendApiClient
         {
             public readonly List<TimeSpan?> Timeouts = new List<TimeSpan?>();
+            public readonly List<AgentErrorReport> Reports = new List<AgentErrorReport>();
             public readonly Queue<bool> Results = new Queue<bool>();
 
             public FakeApiClient() : base(
@@ -40,6 +41,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
             public override Task<bool> ReportAgentErrorAsync(AgentErrorReport report, TimeSpan? timeout = null)
             {
                 Timeouts.Add(timeout);
+                Reports.Add(report);
                 return Task.FromResult(Results.Count > 0 && Results.Dequeue());
             }
         }
@@ -139,5 +141,37 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
 
             Assert.Equal(2, client.Calls);
         }
+
+        [Fact]
+        public async Task Session_age_is_carried_in_the_report_and_absent_by_default()
+        {
+            // One reporter per report: a delivered report starts the 10-minute cooldown.
+            var client = new FakeApiClient();
+            client.Results.Enqueue(true);
+            client.Results.Enqueue(true);
+
+            await Reporter(client).TrySendAsync(AgentErrorType.SessionAgeEmergencyBreak, "m", sessionAgeHours: 478.2);
+            await Reporter(client).TrySendAsync(AgentErrorType.ConfigFetchFailed, "m");
+
+            Assert.Equal(2, client.Reports.Count);
+            Assert.Equal(478.2, client.Reports[0].SessionAgeHours);
+            Assert.Null(client.Reports[1].SessionAgeHours);
+        }
+
+        [Fact]
+        public async Task Prior_registration_failure_is_carried_in_the_report_and_absent_by_default()
+        {
+            var client = new FakeApiClient();
+            client.Results.Enqueue(true);
+            client.Results.Enqueue(true);
+            var record = new RegistrationFailureSummary { FailedRuns = 2, Outcome = "Failed", NetworkLinkUpAtEnd = false };
+
+            await Reporter(client).TrySendAsync(AgentErrorType.SessionAgeEmergencyBreak, "m", priorRegistrationFailure: record);
+            await Reporter(client).TrySendAsync(AgentErrorType.ConfigFetchFailed, "m");
+
+            Assert.Equal(2, client.Reports.Count);
+            Assert.Same(record, client.Reports[0].PriorRegistrationFailure);
+            Assert.Null(client.Reports[1].PriorRegistrationFailure);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Transport/GeoLocationServiceTests.cs

@@ -0,0 +1,88 @@
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using Newtonsoft.Json.Linq;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
+{
+    /// <summary>
+    /// Response parsers of the geo providers. Addresses come from the RFC 5737 documentation
+    /// ranges — never real ones.
+    /// </summary>
+    public class GeoLocationServiceTests
+    {
+        [Fact]
+        public void ParseDoGeo_maps_country_and_egress_ip_and_ignores_the_do_service_fields()
+        {
+            var json = JObject.Parse(@"{
+                ""ExternalIpAddress"": ""203.0.113.7"",
+                ""CountryCode"": ""DE"",
+                ""KeyValue_EndpointFullUri"": ""https://kv601.prod.do.dsp.mp.microsoft.com/all"",
+                ""Version"": ""26A6D4D6994E8DA5"",
+                ""CacheId"": ""7"",
+                ""ContentCert"": false,
+                ""DownloadModeFailSafe"": """"
+            }");
+
+            var result = GeoLocationService.ParseDoGeo(json);
+
+            Assert.NotNull(result);
+            Assert.Equal("DE", result.Country);
+            Assert.Equal("203.0.113.7", result.Ip);
+            Assert.Equal("do-geo", result.Source);
+            Assert.Null(result.Region);
+            Assert.Null(result.City);
+            Assert.Null(result.Loc);
+            Assert.Null(result.Timezone);
+        }
+
+        [Theory]
+        [InlineData(@"{ ""ExternalIpAddress"": ""203.0.113.7"" }")]
+        [InlineData(@"{ ""ExternalIpAddress"": ""203.0.113.7"", ""CountryCode"": """" }")]
+        public void ParseDoGeo_without_country_is_a_failure(string body)
+        {
+            Assert.Null(GeoLocationService.ParseDoGeo(JObject.Parse(body)));
+        }
+
+        [Fact]
+        public void ParseIpInfo_maps_all_fields()
+        {
+            var json = JObject.Parse(@"{
+                ""ip"": ""198.51.100.4"", ""city"": ""Stuttgart"", ""region"": ""Baden-Wurttemberg"",
+                ""country"": ""DE"", ""loc"": ""48.7823,9.1770"", ""timezone"": ""Europe/Berlin""
+            }");
+
+            var result = GeoLocationService.ParseIpInfo(json);
+
+            Assert.Equal("DE", result.Country);
+            Assert.Equal("Baden-Wurttemberg", result.Region);
+            Assert.Equal("Stuttgart", result.City);
+            Assert.Equal("48.7823,9.1770", result.Loc);
+            Assert.Equal("Europe/Berlin", result.Timezone);
+            Assert.Equal("198.51.100.4", result.Ip);
+            Assert.Equal("ipinfo", result.Source);
+        }
+
+        [Fact]
+        public void ParseIfConfigCo_joins_coordinates_and_leaves_loc_empty_without_them()
+        {
+            var withCoords = GeoLocationService.ParseIfConfigCo(JObject.Parse(@"{
+                ""ip"": ""198.51.100.4"", ""country_iso"": ""DE"", ""region_name"": ""Bavaria"",
+                ""city"": ""Munich"", ""latitude"": 48.13, ""longitude"": 11.58, ""time_zone"": ""Europe/Berlin""
+            }"));
+            var withoutCoords = GeoLocationService.ParseIfConfigCo(JObject.Parse(@"{ ""country_iso"": ""DE"" }"));
+
+            Assert.Equal("48.13,11.58", withCoords.Loc);
+            Assert.Equal("DE", withCoords.Country);
+            Assert.Equal("Bavaria", withCoords.Region);
+            Assert.Equal("ifconfig.co", withCoords.Source);
+            Assert.Equal("", withoutCoords.Loc);
+        }
+
+        [Fact]
+        public void Describe_skips_the_parts_a_provider_did_not_return()
+        {
+            Assert.Equal("Stuttgart, BW, DE", new GeoLocationResult { City = "Stuttgart", Region = "BW", Country = "DE" }.Describe());
+            Assert.Equal("DE", new GeoLocationResult { Country = "DE", Region = "" }.Describe());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/DecisionStepProcessorTerminalStageTests.cs

@@ -153,6 +153,62 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             Assert.Equal(0, callCount);
         }
 
+        [Fact]
+        public void Stopped_waiting_fires_callback_once_with_the_stage_still_non_terminal()
+        {
+            // D-310: the engine stopped waiting for the user without a verdict. The stage stays
+            // non-terminal, yet the agent must end the session — the callback carries the state.
+            using var rig = new Rig();
+            DecisionState? captured = null;
+            var callCount = 0;
+            var sut = rig.Build(DecisionState.CreateInitial("S1", "T1"),
+                onTerminal: state =>
+                {
+                    Interlocked.Increment(ref callCount);
+                    captured = state;
+                });
+
+            var builder = new DecisionStateBuilder(sut.CurrentState)
+            {
+                Stage = SessionStage.EspAccountSetup,
+                StepIndex = sut.CurrentState.StepIndex + 1,
+                StoppedWaitingReason = new SignalFact<string>(StoppedWaitingReasons.OobeUpdateNoSignIn, 1),
+            };
+            var stopped = builder.Build();
+            var step = new DecisionStep(stopped, new DecisionTransition(
+                stepIndex: stopped.StepIndex, sessionTraceOrdinal: 1, signalOrdinalRef: 1, occurredAtUtc: At,
+                trigger: "DeadlineFired:advisory_completion:OobeUpdateSignInWaitExpired",
+                fromStage: SessionStage.SessionStarted, toStage: SessionStage.EspAccountSetup,
+                taken: true, deadEndReason: null, reducerVersion: "2.0.0.0"), Array.Empty<DecisionEffect>());
+            sut.ApplyStep(step, Sig(1, At));
+
+            // A follow-up step must not fire it again.
+            sut.ApplyStep(StepToStage(sut.CurrentState, SessionStage.EspAccountSetup, signalOrdinal: 2, at: At.AddSeconds(1)),
+                Sig(2, At.AddSeconds(1)));
+
+            Assert.Equal(1, callCount);
+            Assert.Equal(SessionStage.EspAccountSetup, captured!.Stage);
+            Assert.Equal(StoppedWaitingReasons.OobeUpdateNoSignIn, captured.StoppedWaitingReason!.Value);
+        }
+
+        [Fact]
+        public void Stopped_waiting_on_load_does_not_refire_the_callback()
+        {
+            // The orchestrator ends a recovered stopped-waiting session itself at start.
+            using var rig = new Rig();
+            var callCount = 0;
+            var recovered = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1"))
+            {
+                Stage = SessionStage.EspAccountSetup,
+                StoppedWaitingReason = new SignalFact<string>(StoppedWaitingReasons.OobeUpdateNoSignIn, 7),
+            }.Build();
+
+            var sut = rig.Build(recovered, onTerminal: _ => Interlocked.Increment(ref callCount));
+            sut.ApplyStep(StepToStage(sut.CurrentState, SessionStage.EspAccountSetup, signalOrdinal: 8, at: At), Sig(8, At));
+
+            Assert.Equal(0, callCount);
+        }
+
         [Fact]
         public void Terminal_callback_null_is_supported()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/DefaultComponentFactoryGatherStateTests.cs

@@ -0,0 +1,103 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Configuration;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
+{
+    /// <summary>
+    /// The production factory hands its state directory to the gather executor. Without it every
+    /// unit test of the gather state passes while the agent keeps replaying logs after each reboot —
+    /// the one line in <see cref="DefaultComponentFactory"/> is the whole feature.
+    /// </summary>
+    [Collection("SerialThreading")] // the startup rule executes on the shared ThreadPool
+    public sealed class DefaultComponentFactoryGatherStateTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly TempDirectory _stateDir = new TempDirectory();
+
+        // %TEMP% lives under C:\Users (hard-blocked) — the log sits beside the test assembly.
+        private readonly string _logDir = Path.Combine(
+            AppContext.BaseDirectory, "factory-gather-state-" + Guid.NewGuid().ToString("N"));
+
+        public DefaultComponentFactoryGatherStateTests() => Directory.CreateDirectory(_logDir);
+
+        public void Dispose()
+        {
+            _tmp.Dispose();
+            _stateDir.Dispose();
+            try { Directory.Delete(_logDir, recursive: true); } catch { /* best effort */ }
+        }
+
+        [Fact]
+        public void Gather_host_built_by_the_factory_persists_logparser_positions_in_the_state_directory()
+        {
+            var log = Path.Combine(_logDir, "vendor.log");
+            File.WriteAllText(log, "Update one\n");
+
+            var factory = new DefaultComponentFactory(
+                agentConfig: new AgentConfiguration
+                {
+                    ApiBaseUrl = "https://example",
+                    TenantId = "t",
+                    SessionId = "s",
+                    UnrestrictedMode = true,
+                },
+                remoteConfig: new AgentConfigResponse
+                {
+                    Collectors = CollectorConfiguration.CreateDefault(),
+                    GatherRules = new List<GatherRule>
+                    {
+                        new GatherRule
+                        {
+                            RuleId = "vendor-log",
+                            Title = "vendor log",
+                            CollectorType = "logparser",
+                            Target = log,
+                            Parameters = new Dictionary<string, string> { ["pattern"] = "^Update", ["format"] = "text" },
+                            Trigger = "startup",
+                            OutputEventType = "vendor_update",
+                            Enabled = true,
+                        },
+                    },
+                },
+                networkMetrics: null,
+                agentVersion: "test",
+                stateDirectory: _stateDir.Path,
+                startupEventGate: null);
+
+            var hosts = factory.CreateCollectorHosts(
+                sessionId: "s",
+                tenantId: "t",
+                logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                whiteGloveSealingPatternIds: Array.Empty<string>(),
+                ingress: new FakeSignalIngressSink(),
+                clock: new VirtualClock(new DateTime(2026, 9, 28, 12, 0, 0, DateTimeKind.Utc)),
+                telemetrySpool: null,
+                timelineEvents: null).Hosts;
+            try
+            {
+                hosts.OfType<GatherRuleExecutorHost>().Single().Start();
+
+                var stateFile = Path.Combine(_stateDir.Path, GatherRuleStatePersistence.FileName);
+                Assert.True(SpinWait.SpinUntil(() => File.Exists(stateFile), TimeSpan.FromSeconds(10)),
+                    "the gather host did not write its state into the factory's state directory");
+            }
+            finally
+            {
+                foreach (var host in hosts)
+                {
+                    try { host.Dispose(); } catch { /* best-effort cleanup */ }
+                }
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/GatherRuleExecutorHostTimelineFeedTests.cs

@@ -16,7 +16,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
     /// <summary>
     /// GatherRuleExecutorHost feeds its phase_change / phase_exit / on_event triggers from the
     /// POST-REDUCE <see cref="TimelineEventStream"/> (emitted timeline events), not from raw
-    /// signals. Regression anchor: session 32312a32 (rsneuffen.de) — a phase_change rule on
+    /// signals. Regression anchor: session 32312a32 — a phase_change rule on
     /// FinalizingSetup fired at the raw EspPhaseChanged(FinalizingSetup) signal (ESP exit),
     /// 7 minutes before the engine's RealmJoin-gated phase_transition(FinalizingSetup), and read
     /// a registry key before the RealmJoin package wrote it. With the timeline feed the rule

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/RecoveryCoordinatorTests.cs

@@ -162,6 +162,28 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             Assert.Equal(SessionStage.AwaitingHello, result.InitialState.Stage);
         }
 
+        [Fact]
+        public void Clean_snapshot_of_a_rotated_session_adopts_the_current_session_id()
+        {
+            // SESSION-OWNER-BINDING: the backend refused the persisted session id at registration,
+            // the agent rotated, and the snapshot on disk still names the old session. The
+            // enrollment state carries over; the session id must be the current one.
+            using var rig = new Rig();
+            var saved = DecisionState.CreateInitial("S-REFUSED", TenantId)
+                .ToBuilder()
+                .WithStage(SessionStage.EspAccountSetup)
+                .WithStepIndex(7)
+                .WithLastAppliedSignalOrdinal(6)
+                .Build();
+            SeedSnapshot(rig, saved);
+
+            var result = rig.Recover();
+
+            Assert.Equal(SessionId, result.InitialState.SessionId);
+            Assert.Equal(SessionStage.EspAccountSetup, result.InitialState.Stage);
+            Assert.Equal(7, result.InitialState.StepIndex);
+        }
+
         [Fact]
         public void Snapshot_plus_pending_tail_replays_tail_onto_snapshot()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/RecoveryPathTests.cs

@@ -174,6 +174,40 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             sut.Stop();
         }
 
+        [Fact]
+        public void Recovered_stopped_waiting_state_ends_the_session_at_start()
+        {
+            // D-310: a crash between "the engine stopped waiting" and the termination must not
+            // leave the session running — the restart ends it the same way, with the engine's reason.
+            using var rig = new Rig();
+            Directory.CreateDirectory(rig.StateDir);
+
+            var stoppedState = DecisionState.CreateInitial("S1", "T1")
+                .ToBuilder()
+                .WithStage(SessionStage.EspAccountSetup)
+                .WithStepIndex(9)
+                .Build()
+                .ToBuilder();
+            stoppedState.StoppedWaitingReason = new SignalFact<string>(StoppedWaitingReasons.OobeUpdateNoSignIn, 42);
+            new SnapshotPersistence(Path.Combine(rig.StateDir, "snapshot.json")).Save(stoppedState.Build());
+
+            var sut = rig.Build();
+            using var fired = new ManualResetEventSlim(false);
+            EnrollmentTerminatedEventArgs? captured = null;
+            sut.Terminated += (_, e) => { captured = e; fired.Set(); };
+
+            sut.Start();
+            Assert.True(fired.Wait(5000), "Terminated did not fire for the recovered stopped-waiting state.");
+
+            Assert.Equal(EnrollmentTerminationReason.StoppedWaiting, captured!.Reason);
+            Assert.Equal(EnrollmentTerminationOutcome.TimedOut, captured.Outcome);
+            Assert.Equal(StoppedWaitingReasons.OobeUpdateNoSignIn, captured.StopReason);
+            Assert.Equal(SessionStage.EspAccountSetup.ToString(), captured.StageName);
+            Assert.Contains("60 minutes", captured.Details);
+
+            sut.Stop();
+        }
+
         // ================================================================= Sonderfall 2: Segment-Quarantine
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/SignalActivityClassifierTests.cs

@@ -37,6 +37,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
         [InlineData("modern_deployment_log")]
         // Environment observation — battery drain on an idle device must not reset idle clocks.
         [InlineData("power_state_change")]
+        // A flapping link is environment too: it must neither keep the collectors awake nor
+        // reset the stall clock of the enrollment it is stalling.
+        [InlineData("network_state_change")]
+        [InlineData("network_connectivity_check")]
+        // Bookkeeping of health-script runs that were deliberately not reported.
+        [InlineData("script_recurrence_summary")]
         // Agent health / control / transport — not device/enrollment progress (P2).
         [InlineData("collector_degraded")]
         [InlineData("telemetry_upload_poisoned")]
@@ -67,6 +73,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             Assert.True(SignalActivityClassifier.IsRealActivity(DecisionSignalKind.InformationalEvent, payload));
         }
 
+        [Theory]
+        // Only the link-change pair is exempt. The device-info snapshots are emitted at start
+        // and at the end, not per flap, and stay activity.
+        [InlineData("network_interface_info")]
+        [InlineData("wifi_signal_info")]
+        [InlineData("network_bandwidth_estimate")]
+        public void Other_network_events_remain_activity(string eventType)
+        {
+            var payload = new Dictionary<string, string> { [SignalPayloadKeys.EventType] = eventType };
+            Assert.True(SignalActivityClassifier.IsRealActivity(DecisionSignalKind.InformationalEvent, payload));
+        }
+
         [Theory]
         // Genuine ModernDeployment warnings/errors stay real activity — only the Info/Debug
         // `modern_deployment_log` forwarding is excluded.

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/WindowsUpdateWatcherHostTests.cs

@@ -0,0 +1,209 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
+{
+    /// <summary>
+    /// WindowsUpdateWatcherHost (D-310) — routes every configured WU EventID to the channel the
+    /// provider manifest writes it to, reports counted activity once, and feeds Windows/.NET update
+    /// steps to the decision engine unless <c>OobeUpdatePhaseMode</c> is Off. The event-log
+    /// watchers themselves are not armed here; the trackers' ProcessEvent seams drive the host.
+    /// </summary>
+    public sealed class WindowsUpdateWatcherHostTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 10, 1, 9, 30, 0, DateTimeKind.Utc);
+        private const string Lcu = "2026-09 Cumulative Update for Windows 11, version 25H2 for x64-based Systems (KB5099999)";
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private long _nextRecordId = 1;
+
+        public void Dispose() => _tmp.Dispose();
+
+        private WindowsUpdateWatcherHost Build(bool osUpdateSignalsEnabled, bool servicingWatcherEnabled = true) =>
+            new WindowsUpdateWatcherHost(
+                sessionId: "sess-wuhost",
+                tenantId: "tenant-wuhost",
+                logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                ingress: _sink,
+                clock: new VirtualClock(At),
+                targetedEventIds: new[] { 19, 20, 43, 44 },
+                backfillLookbackMinutes: 0,
+                stateDirectory: _tmp.Path,
+                operationalEventIds: new[] { 25, 26, 31, 41 },
+                servicingWatcherEnabled: servicingWatcherEnabled,
+                osUpdateSignalsEnabled: osUpdateSignalsEnabled);
+
+        private void Wu(WindowsUpdateTracker tracker, int eventId, string title, DateTime at) =>
+            tracker.ProcessEvent(eventId, 4, _nextRecordId++, at, title, updateGuid: null, updateRevisionNumber: null,
+                errorCode: null, formattedDescription: null, isBackfill: false);
+
+        private void Cbs(ServicingTracker tracker, int eventId, string client, DateTime at) =>
+            tracker.ProcessEvent(eventId, _nextRecordId++, at, "KB5099999", initialState: null, targetState: "Installed",
+                errorCode: "0x0", client: client, isBackfill: false);
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> OsUpdateActivity() =>
+            _sink.Posted.Where(p => p.Kind == DecisionSignalKind.OsUpdateActivity).ToList();
+
+        private IReadOnlyList<FakeSignalIngressSink.PostedSignal> ByType(string eventType) =>
+            _sink.Posted.Where(p =>
+                p.Kind == DecisionSignalKind.InformationalEvent
+                && p.Payload != null
+                && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                && et == eventType).ToList();
+
+        // ---------------------------------------------------------------- routing ----
+
+        [Fact]
+        public void RouteEventIds_Defaults_SplitByManifest()
+        {
+            var (system, operational) = WindowsUpdateWatcherHost.RouteEventIds(new[] { 19, 20, 43, 44 }, new[] { 25, 26, 31, 41 });
+
+            Assert.Equal(new[] { 19, 20, 43, 44 }, system);
+            Assert.Equal(new[] { 25, 26, 31, 41 }, operational);
+        }
+
+        [Fact]
+        public void RouteEventIds_MisplacedIds_EndUpOnTheirRealChannel()
+        {
+            // An old config that lists 41 under the targeted IDs, or 20 under the operational
+            // ones, must still watch the channel that carries them.
+            var (system, operational) = WindowsUpdateWatcherHost.RouteEventIds(new[] { 41, 19 }, new[] { 20, 41 });
+
+            Assert.Equal(new[] { 19, 20 }, system);
+            Assert.Equal(new[] { 41 }, operational);
+        }
+
+        [Fact]
+        public void RouteEventIds_NothingConfigured_WatchesNothing()
+        {
+            var (system, operational) = WindowsUpdateWatcherHost.RouteEventIds(null, Array.Empty<int>());
+
+            Assert.Empty(system);
+            Assert.Empty(operational);
+        }
+
+        [Fact]
+        public void Host_BuildsOneTrackerPerChannel_AndTheServicingTracker()
+        {
+            var host = Build(osUpdateSignalsEnabled: false);
+
+            Assert.Equal(WindowsUpdateTracker.SystemChannel, host.SystemTrackerForTest!.WatchedChannel);
+            Assert.Equal(new[] { 19, 20, 43, 44 }, host.SystemTrackerForTest.TargetedEventIds.OrderBy(id => id).ToArray());
+            Assert.Equal(WindowsUpdateTracker.Channel, host.OperationalTrackerForTest!.WatchedChannel);
+            Assert.Equal(new[] { 25, 26, 31, 41 }, host.OperationalTrackerForTest.TargetedEventIds.OrderBy(id => id).ToArray());
+            Assert.NotNull(host.ServicingTrackerForTest);
+        }
+
+        [Fact]
+        public void ServicingWatcherDisabled_BuildsNoServicingTracker()
+        {
+            Assert.Null(Build(osUpdateSignalsEnabled: false, servicingWatcherEnabled: false).ServicingTrackerForTest);
+        }
+
+        // ------------------------------------------------- engine signal behind flag ----
+
+        [Fact]
+        public void OsUpdateSignalsDisabled_ListsTheUpdate_ButPostsNoEngineSignal()
+        {
+            var host = Build(osUpdateSignalsEnabled: false);
+
+            Wu(host.SystemTrackerForTest!, WindowsUpdateTracker.EventId_InstallStarted, Lcu, At);
+            Cbs(host.ServicingTrackerForTest!, ServicingTracker.EventId_RebootRequired, "UpdateAgentLCU", At.AddMinutes(20));
+
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateStarted));
+            Assert.Single(ByType(Constants.EventTypes.WindowsUpdateServicing));
+            Assert.Empty(OsUpdateActivity());
+        }
+
+        [Fact]
+        public void OsUpdateSignalsEnabled_PostsOsUpdateActivity_FromBothSources()
+        {
+            var host = Build(osUpdateSignalsEnabled: true);
+            var wuAt = DateTime.SpecifyKind(At, DateTimeKind.Unspecified);
+
+            Wu(host.SystemTrackerForTest!, WindowsUpdateTracker.EventId_InstallStarted, Lcu, wuAt);
+            Cbs(host.ServicingTrackerForTest!, ServicingTracker.EventId_RebootRequired, "UpdateAgentLCU", At.AddMinutes(20));
+
+            var signals = OsUpdateActivity();
+            Assert.Equal(2, signals.Count);
+
+            var wu = signals[0];
+            Assert.Equal(OsUpdateSteps.InstallStarted, wu.Payload![OsUpdatePayloadKeys.Step]);
+            Assert.Equal("wu", wu.Payload![OsUpdatePayloadKeys.Source]);
+            Assert.Equal(Lcu, wu.Payload![OsUpdatePayloadKeys.Update]);
+            Assert.Equal("WindowsUpdateWatcher", wu.SourceOrigin);
+            Assert.Equal(EvidenceKind.Raw, wu.Evidence.Kind);
+            Assert.Equal("os-update-activity:wu", wu.Evidence.Identifier);
+            Assert.Equal(At, wu.OccurredAtUtc);
+            Assert.Equal(DateTimeKind.Utc, wu.OccurredAtUtc.Kind);
+            Assert.Equal(1, wu.KindSchemaVersion);
+
+            var cbs = signals[1];
+            Assert.Equal(OsUpdateSteps.RebootRequired, cbs.Payload![OsUpdatePayloadKeys.Step]);
+            Assert.Equal("servicing", cbs.Payload![OsUpdatePayloadKeys.Source]);
+            Assert.Equal("KB5099999", cbs.Payload![OsUpdatePayloadKeys.Update]);
+            Assert.Equal("ServicingWatcher", cbs.SourceOrigin);
+            Assert.Equal("os-update-activity:servicing", cbs.Evidence.Identifier);
+            Assert.Equal(At.AddMinutes(20), cbs.OccurredAtUtc);
+        }
+
+        [Fact]
+        public void OsUpdateSignalsEnabled_NonOsActivity_NeverReachesTheEngine()
+        {
+            var host = Build(osUpdateSignalsEnabled: true);
+
+            Wu(host.SystemTrackerForTest!, WindowsUpdateTracker.EventId_InstallSuccess, "9NSTH9KHZDLQ-Microsoft.UI.Xaml.2.8", At);
+            Wu(host.OperationalTrackerForTest!, WindowsUpdateTracker.EventId_Downloaded,
+                "Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.459.505.0) - Current Channel (Broad)", At);
+            Cbs(host.ServicingTrackerForTest!, ServicingTracker.EventId_StateReached, "CbsTask", At);
+
+            Assert.Empty(OsUpdateActivity());
+            Assert.Empty(_sink.Posted);
+        }
+
+        // ------------------------------------------------------- activity summary ----
+
+        [Fact]
+        public void ActivitySummary_IsEmittedOnce_WhenTheHostStops()
+        {
+            var host = Build(osUpdateSignalsEnabled: false);
+            Wu(host.SystemTrackerForTest!, WindowsUpdateTracker.EventId_InstallSuccess, "9NSTH9KHZDLQ-Microsoft.UI.Xaml.2.8", At);
+            Wu(host.SystemTrackerForTest!, WindowsUpdateTracker.EventId_InstallSuccess, "9NBLGGH4NNS1-Microsoft.DesktopAppInstaller", At);
+            Cbs(host.ServicingTrackerForTest!, ServicingTracker.EventId_InitiatingChanges, "CbsTask", At);
+
+            // The termination path stops the host explicitly and disposes it afterwards.
+            host.Stop();
+            host.Dispose();
+
+            var summary = Assert.Single(ByType(Constants.EventTypes.WindowsUpdateActivitySummary));
+            Assert.Equal("Debug", summary.Payload![SignalPayloadKeys.Severity]);
+            Assert.Contains("3 event(s)", summary.Payload![SignalPayloadKeys.Message]);
+            var data = (IReadOnlyDictionary<string, object>)summary.TypedPayload!;
+            Assert.Equal(2, data["store_19"]);
+            Assert.Equal(1, data["servicing_other_1"]);
+        }
+
+        [Fact]
+        public void ActivitySummary_NothingCounted_EmitsNothing()
+        {
+            var host = Build(osUpdateSignalsEnabled: false);
+            Wu(host.SystemTrackerForTest!, WindowsUpdateTracker.EventId_InstallSuccess, Lcu, At);
+
+            host.Stop();
+
+            Assert.Empty(ByType(Constants.EventTypes.WindowsUpdateActivitySummary));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/BackendSessionRegistrationTests.cs

@@ -118,5 +118,88 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.Throws<ArgumentNullException>(
                 () => BackendSessionRegistration.Register(config, auth, http, "1.0", consoleMode: false, logger: null));
         }
+
+        // ============================================================ failed-registration record
+
+        [Fact]
+        public void RecordRegistrationRun_records_a_failed_run_with_its_window_and_bounded_error()
+        {
+            using var tmp = new TempDirectory();
+            var persistence = new SessionIdPersistence(tmp.Path);
+            var started = new DateTime(2026, 8, 20, 9, 0, 0, DateTimeKind.Utc);
+
+            BackendSessionRegistration.RecordRegistrationRun(
+                persistence, SessionRegistrationResult.Failed(new string('e', 1000)),
+                started, started.AddSeconds(1204.46), linkUpAtStart: false, linkUpAtEnd: true,
+                configFetchOutcome: "UsedDefaults", logger: NewLogger(tmp.Path));
+
+            var record = persistence.LoadRegistrationFailure();
+            Assert.NotNull(record);
+            Assert.Equal(1, record!.FailedRuns);
+            Assert.Equal("Failed", record.Outcome);
+            Assert.Equal(BackendSessionRegistration.MaxRecordedErrorLength, record.LastError!.Length);
+            Assert.False(record.NetworkLinkUpAtStart);
+            Assert.True(record.NetworkLinkUpAtEnd);
+            Assert.Equal(1204.5, record.AttemptWindowSeconds);
+            Assert.Equal("UsedDefaults", record.ConfigFetchOutcome);
+            Assert.Equal(started.AddSeconds(1204.46), record.LastFailedAtUtc);
+        }
+
+        [Fact]
+        public void RecordRegistrationRun_records_auth_failures_and_clears_on_success()
+        {
+            using var tmp = new TempDirectory();
+            var persistence = new SessionIdPersistence(tmp.Path);
+            var at = new DateTime(2026, 8, 20, 9, 0, 0, DateTimeKind.Utc);
+
+            BackendSessionRegistration.RecordRegistrationRun(
+                persistence, SessionRegistrationResult.AuthFailed(401, "unauthorized"),
+                at, at.AddSeconds(3), true, true, "Succeeded", NewLogger(tmp.Path));
+            Assert.Equal("AuthFailed", persistence.LoadRegistrationFailure()!.Outcome);
+
+            BackendSessionRegistration.RecordRegistrationRun(
+                persistence, SessionRegistrationResult.Succeeded(new RegisterSessionResponse { Success = true }),
+                at, at.AddSeconds(1), true, true, "Succeeded", NewLogger(tmp.Path));
+            Assert.Null(persistence.LoadRegistrationFailure());
+        }
+
+        [Fact]
+        public void RecordRegistrationRun_without_persistence_is_a_no_op()
+        {
+            using var tmp = new TempDirectory();
+            BackendSessionRegistration.RecordRegistrationRun(
+                null, SessionRegistrationResult.Failed("x"), DateTime.UtcNow, DateTime.UtcNow,
+                null, null, null, NewLogger(tmp.Path));
+        }
+
+        // ============================================================ emergency-break message
+
+        [Fact]
+        public void Break_message_names_failed_registrations_in_invariant_culture()
+        {
+            var previous = System.Threading.Thread.CurrentThread.CurrentCulture;
+            try
+            {
+                System.Threading.Thread.CurrentThread.CurrentCulture = new System.Globalization.CultureInfo("de-DE");
+                var record = new RegistrationFailureSummary { FailedRuns = 3, Outcome = "Failed", NetworkLinkUpAtEnd = false };
+
+                var message = EmergencyBreakReporter.BuildMessage(478.2, 48, record);
+
+                Assert.Contains("session age 478.2h (cap 48h)", message);
+                Assert.EndsWith(" 3 earlier start(s) failed to register (last: Failed, network link at end: down).", message);
+            }
+            finally
+            {
+                System.Threading.Thread.CurrentThread.CurrentCulture = previous;
+            }
+        }
+
+        [Fact]
+        public void Break_message_without_record_keeps_the_historical_text()
+        {
+            Assert.Equal(
+                "Agent absolute session-age emergency break fired at session age 50.0h (cap 48h) — cleaning up and exiting.",
+                EmergencyBreakReporter.BuildMessage(50.0, 48, null));
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/PostEnrollmentFactsObservedSignalTests.cs

@@ -4,6 +4,7 @@ using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Orchestration;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared.Models;
 using Xunit;
@@ -29,7 +30,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             var sink = new FakeSignalIngressSink();
             var logger = NewLogger(tmp.Path);
 
-            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, logger);
+            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, HelloWaitTimeout.DefaultSeconds, logger);
 
             Assert.Single(sink.Posted);
             var posted = sink.Posted[0];
@@ -47,7 +48,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             var sink = new FakeSignalIngressSink();
             var logger = NewLogger(tmp.Path);
 
-            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, logger);
+            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, HelloWaitTimeout.DefaultSeconds, logger);
 
             var payload = sink.Posted[0].Payload;
             Assert.NotNull(payload);
@@ -73,6 +74,52 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.True(cloudPc == "true" || cloudPc == "false");
         }
 
+        [Theory]
+        [InlineData(300)] // the default — the payload stays exactly what it was before the key existed
+        [InlineData(30)]  // the old default, still stored for many tenants
+        [InlineData(0)]
+        public void Hello_wait_not_extending_the_built_in_window_is_not_stamped(int helloWaitTimeoutSeconds)
+        {
+            using var tmp = new TempDirectory();
+            var sink = new FakeSignalIngressSink();
+
+            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, helloWaitTimeoutSeconds, NewLogger(tmp.Path));
+
+            Assert.DoesNotContain(SignalPayloadKeys.HelloWaitTimeoutSeconds, (IDictionary<string, string>)sink.Posted[0].Payload!);
+        }
+
+        [Theory]
+        [InlineData(1800, "1800")]
+        [InlineData(3600, "3600")]
+        [InlineData(86400, "3600")] // the effective (clamped) value is what the engine should arm
+        public void Extended_hello_wait_is_stamped_as_its_effective_value(int helloWaitTimeoutSeconds, string expected)
+        {
+            using var tmp = new TempDirectory();
+            var sink = new FakeSignalIngressSink();
+
+            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, helloWaitTimeoutSeconds, NewLogger(tmp.Path));
+
+            Assert.Equal(expected, sink.Posted[0].Payload![SignalPayloadKeys.HelloWaitTimeoutSeconds]);
+        }
+
+        [Theory]
+        [InlineData(null, "Shadow")]     // no config value — the default mode
+        [InlineData("Shadow", "Shadow")]
+        [InlineData("active", "Active")] // case-insensitive
+        [InlineData("Off", "Off")]
+        [InlineData("Enforce", "Shadow")] // unknown — changes no decision, still measures
+        public void Oobe_update_phase_mode_is_stamped_at_every_start_normalized(string? configured, string expected)
+        {
+            // D-310: stamped every time, so a later Off/Shadow can take Active away mid-session.
+            using var tmp = new TempDirectory();
+            var sink = new FakeSignalIngressSink();
+
+            AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(
+                sink, HelloWaitTimeout.DefaultSeconds, NewLogger(tmp.Path), configured);
+
+            Assert.Equal(expected, sink.Posted[0].Payload![SignalPayloadKeys.OobeUpdatePhaseMode]);
+        }
+
         [Fact]
         public void Swallows_sink_exceptions()
         {
@@ -82,7 +129,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             var logger = NewLogger(tmp.Path);
 
             var ex = Record.Exception(() =>
-                AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, logger));
+                AutopilotMonitor.Agent.V2.Runtime.LifecycleEmitters.PostEnrollmentFactsObserved(sink, HelloWaitTimeout.DefaultSeconds, logger));
 
             Assert.Null(ex);
         }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/ProgramGuardsTests.cs

@@ -149,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             persistence.SaveSessionCreatedAt(DateTime.UtcNow.AddHours(-100));
 
             var stateDir = Path.Combine(tmp.Path, "State");
+            double? reportedAgeHours = null;
 
             var tripped = AutopilotMonitor.Agent.V2.Program.CheckSessionAgeEmergencyBreak(
                 dataDirectory: tmp.Path,
@@ -157,9 +158,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
                 selfDestructOnComplete: false,
                 cleanupServiceFactory: null,
                 logger: logger,
-                consoleMode: false);
+                consoleMode: false,
+                onBreakFired: ageHours => reportedAgeHours = ageHours);
 
             Assert.True(tripped);
+            // The measured age reaches the break report (the backend cannot derive it).
+            Assert.NotNull(reportedAgeHours);
+            Assert.InRange(reportedAgeHours.Value, 99.9, 100.1);
             // Marker must have been written so the next restart exits cleanly.
             Assert.True(File.Exists(Path.Combine(stateDir, "enrollment-complete.marker")));
             // Session must have been cleared.
@@ -302,6 +307,114 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.False(File.Exists(path));
         }
 
+        // ================================================================= Multi-instance guard
+
+        private static AutopilotMonitor.Agent.V2.Program.AgentProcessFact Proc(int pid, int sessionId)
+            => new AutopilotMonitor.Agent.V2.Program.AgentProcessFact(pid, sessionId);
+
+        [Fact]
+        public void FindSiblingAgentPid_ignores_a_same_named_process_in_a_user_session()
+        {
+            // The agent (pid 100, session 0) starts while a standard user keeps a process with
+            // the agent's image name resident in their own session. It must not block the start.
+            var matches = new[] { Proc(100, 0), Proc(200, 1) };
+
+            Assert.Equal(0, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(matches, ownPid: 100));
+        }
+
+        [Theory]
+        [InlineData(1)]
+        [InlineData(2)]
+        [InlineData(7)]
+        [InlineData(-1)]
+        public void FindSiblingAgentPid_ignores_every_session_but_zero(int sessionId)
+        {
+            var matches = new[] { Proc(100, 0), Proc(200, sessionId) };
+
+            Assert.Equal(0, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(matches, ownPid: 100));
+        }
+
+        [Fact]
+        public void FindSiblingAgentPid_reports_a_second_runtime_in_session_zero()
+        {
+            // Self-update restart while the old runtime is still alive — the single-agent
+            // invariant the guard exists for.
+            var matches = new[] { Proc(100, 0), Proc(300, 0) };
+
+            Assert.Equal(300, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(matches, ownPid: 100));
+        }
+
+        [Fact]
+        public void FindSiblingAgentPid_never_reports_the_caller_itself()
+        {
+            var matches = new[] { Proc(100, 0) };
+
+            Assert.Equal(0, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(matches, ownPid: 100));
+        }
+
+        [Fact]
+        public void FindSiblingAgentPid_skips_user_session_processes_listed_before_the_runtime()
+        {
+            // Install-mode launch verification: a user-session process enumerated first must not
+            // be reported as the launched runtime.
+            var matches = new[] { Proc(200, 1), Proc(201, 2), Proc(100, 0), Proc(300, 0) };
+
+            Assert.Equal(300, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(matches, ownPid: 100));
+        }
+
+        [Fact]
+        public void FindSiblingAgentPid_blocks_an_interactive_start_next_to_the_session_zero_runtime()
+        {
+            // --console run from an admin prompt (session 1) while the Scheduled Task runtime is up.
+            var matches = new[] { Proc(100, 1), Proc(300, 0) };
+
+            Assert.Equal(300, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(matches, ownPid: 100));
+        }
+
+        [Fact]
+        public void FindSiblingAgentPid_returns_zero_for_no_matches()
+        {
+            Assert.Equal(0, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(
+                new AutopilotMonitor.Agent.V2.Program.AgentProcessFact[0], ownPid: 100));
+            Assert.Equal(0, AutopilotMonitor.Agent.V2.Program.FindSiblingAgentPid(null, ownPid: 100));
+        }
+
+        [Fact]
+        public void SnapshotProcessesByName_reads_pid_and_session_of_the_running_test_host()
+        {
+            using var self = System.Diagnostics.Process.GetCurrentProcess();
+
+            var facts = AutopilotMonitor.Agent.V2.Program.SnapshotProcessesByName(self.ProcessName);
+
+            var own = Assert.Single(facts, f => f.Pid == self.Id);
+            Assert.Equal(self.SessionId, own.SessionId);
+        }
+
+        [Fact]
+        public void SnapshotProcessesByName_reads_the_session_of_system_owned_processes_without_access_rights()
+        {
+            // Positive control for the fail-open direction: the session id comes from the process
+            // snapshot, not from an opened handle, so even an unprivileged caller reads it for
+            // SYSTEM-owned service hosts. A skipped process would let a real sibling go unseen.
+            var expected = System.Diagnostics.Process.GetProcessesByName("svchost");
+            foreach (var p in expected) p.Dispose();
+
+            var facts = AutopilotMonitor.Agent.V2.Program.SnapshotProcessesByName("svchost");
+
+            Assert.NotEmpty(facts);
+            Assert.All(facts, f => Assert.True(f.Pid > 0));
+            Assert.Contains(facts, f => f.SessionId == 0);
+            // Service hosts come and go; a wholesale access failure would drop (nearly) all of them.
+            Assert.True(facts.Count >= expected.Length / 2,
+                $"Snapshot returned {facts.Count} of ~{expected.Length} svchost processes.");
+        }
+
+        [Fact]
+        public void SnapshotProcessesByName_returns_empty_for_an_unknown_name()
+        {
+            Assert.Empty(AutopilotMonitor.Agent.V2.Program.SnapshotProcessesByName("no-such-process-" + Guid.NewGuid().ToString("N")));
+        }
+
         // ================================================================= Crash log writer
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Runtime/StartupEnvironmentProbesTests.cs

@@ -62,6 +62,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Runtime
             Assert.Equal("ipinfo.io", evt.Data["source"]);
         }
 
+        [Fact]
+        public void BuildGeoEvent_country_only_location_has_no_empty_parts_in_message()
+        {
+            var loc = new GeoLocationResult { Country = "DE", Source = "do-geo" };
+
+            var evt = StartupEnvironmentProbes.BuildGeoEvent(Config(), loc);
+
+            Assert.Equal("Device location: DE (via do-geo)", evt.Message);
+            Assert.Equal("DE", evt.Data["country"]);
+            Assert.Equal("do-geo", evt.Data["source"]);
+        }
+
         // ================================================================= Outbound IP
 
         [Fact]
@@ -98,6 +110,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Runtime
                 PrimaryError = "connection refused",
                 PrimaryRetryError = "DNS failure",
                 FallbackError = "timeout",
+                DoGeoError = "HTTP 403 (Forbidden)",
             };
 
             var evt = StartupEnvironmentProbes.BuildGeoFailureEvent(cfg, attempt);
@@ -108,6 +121,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Runtime
             Assert.Equal("connection refused", evt.Data["primaryError"]);
             Assert.Equal("DNS failure", evt.Data["primaryRetryError"]);
             Assert.Equal("timeout", evt.Data["fallbackError"]);
+            Assert.Equal("HTTP 403 (Forbidden)", evt.Data["doGeoError"]);
+            Assert.Equal("do-geo", evt.Data["lastResortProvider"]);
         }
 
         [Fact]
@@ -119,6 +134,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Runtime
             Assert.Equal("unknown", evt.Data["primaryError"]);
             Assert.Equal("unknown", evt.Data["primaryRetryError"]);
             Assert.Equal("unknown", evt.Data["fallbackError"]);
+            Assert.Equal("unknown", evt.Data["doGeoError"]);
         }
 
         // ================================================================= Timezone

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/SessionIdPersistenceTests.cs

@@ -3,6 +3,7 @@ using System.IO;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Security;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
 using Xunit;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
@@ -234,5 +235,78 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
             Assert.False(File.Exists(Path.Combine(tmp.Path, "session.created")));
             Assert.False(File.Exists(Path.Combine(tmp.Path, "whiteglove.complete")));
         }
+
+        // ============================================================ failed-registration record
+
+        private static RegistrationFailureSummary FailedRun(DateTime at, string outcome = "Failed", bool? linkUpAtEnd = false) =>
+            new RegistrationFailureSummary
+            {
+                FailedRuns = 1,
+                FirstFailedAtUtc = at,
+                LastFailedAtUtc = at,
+                Outcome = outcome,
+                LastError = "No such host is known.",
+                NetworkLinkUpAtStart = false,
+                NetworkLinkUpAtEnd = linkUpAtEnd,
+                AttemptWindowSeconds = 91.3,
+                ConfigFetchOutcome = "UsedDefaults",
+            };
+
+        [Fact]
+        public void RecordRegistrationFailure_counts_runs_keeps_the_first_time_and_describes_the_latest_run()
+        {
+            using var tmp = new TempDirectory();
+            var sut = new SessionIdPersistence(tmp.Path);
+            var first = new DateTime(2026, 8, 20, 9, 0, 0, DateTimeKind.Utc);
+            var second = new DateTime(2026, 9, 12, 7, 30, 0, DateTimeKind.Utc);
+
+            Assert.Null(sut.LoadRegistrationFailure());
+            sut.RecordRegistrationFailure(FailedRun(first));
+            sut.RecordRegistrationFailure(FailedRun(second, outcome: "AuthFailed", linkUpAtEnd: true));
+
+            // A fresh instance reads it back from disk, as the next boot's emergency break does.
+            var record = new SessionIdPersistence(tmp.Path).LoadRegistrationFailure();
+            Assert.NotNull(record);
+            Assert.Equal(2, record!.FailedRuns);
+            Assert.Equal(first, record.FirstFailedAtUtc);
+            Assert.Equal(second, record.LastFailedAtUtc);
+            Assert.Equal("AuthFailed", record.Outcome);
+            Assert.True(record.NetworkLinkUpAtEnd);
+            Assert.Equal(91.3, record.AttemptWindowSeconds);
+            Assert.Equal("UsedDefaults", record.ConfigFetchOutcome);
+        }
+
+        [Fact]
+        public void Registration_failure_record_is_cleared_by_success_delete_and_rotate()
+        {
+            using var tmp = new TempDirectory();
+            var sut = new SessionIdPersistence(tmp.Path);
+            sut.GetOrCreate();
+            var at = new DateTime(2026, 8, 20, 9, 0, 0, DateTimeKind.Utc);
+
+            sut.RecordRegistrationFailure(FailedRun(at));
+            sut.ClearRegistrationFailure();
+            Assert.Null(sut.LoadRegistrationFailure());
+
+            sut.RecordRegistrationFailure(FailedRun(at));
+            sut.Rotate();
+            Assert.Null(sut.LoadRegistrationFailure());
+
+            sut.RecordRegistrationFailure(FailedRun(at));
+            sut.Delete();
+            Assert.Null(sut.LoadRegistrationFailure());
+            Assert.False(File.Exists(Path.Combine(tmp.Path, "registration-failure.json")));
+        }
+
+        [Theory]
+        [InlineData("not json")]
+        [InlineData("{\"FailedRuns\":0}")]
+        public void LoadRegistrationFailure_reports_nothing_for_a_corrupt_or_empty_record(string content)
+        {
+            using var tmp = new TempDirectory();
+            File.WriteAllText(Path.Combine(tmp.Path, "registration-failure.json"), content);
+
+            Assert.Null(new SessionIdPersistence(tmp.Path).LoadRegistrationFailure());
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/SessionRegistrationHelperTests.cs

@@ -137,6 +137,86 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
             Assert.Equal(originalSessionId, result.RotatedFromSessionId);
         }
 
+        private static BackendRefusalException TenantConflict()
+            => new BackendRefusalException("Backend returned 409 Conflict with error code session_owner_mismatch.", 409,
+                AutopilotMonitor.Shared.Constants.AgentErrorCodes.SessionOwnerMismatch);
+
+        [Fact]
+        public async Task Tenant_conflict_409_rotates_once_like_an_owner_mismatch()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+            var originalSessionId = config.SessionId;
+            var rotatedTo = Guid.NewGuid().ToString();
+            var seenSessionIds = new System.Collections.Generic.List<string>();
+
+            var apiClient = new FakeApiClient(
+                attempt => attempt == 1
+                    ? throw TenantConflict()
+                    : new RegisterSessionResponse { Success = true, SessionId = rotatedTo, ValidatedBy = ValidatorType.AutopilotV1 },
+                onRegister: r => seenSessionIds.Add(r.SessionId));
+
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker,
+                backoffDelay: _ => throw new InvalidOperationException("rotation must retry without backoff"),
+                networkLinkWait: _ => Task.CompletedTask,
+                rotateSession: () => { config.SessionId = rotatedTo; return rotatedTo; });
+
+            Assert.Equal(SessionRegistrationOutcome.Succeeded, result.Outcome);
+            Assert.Equal(new[] { originalSessionId, rotatedTo }, seenSessionIds);
+            Assert.Equal(originalSessionId, result.RotatedFromSessionId);
+            Assert.Equal(0, tracker.ConsecutiveFailures);
+        }
+
+        [Fact]
+        public async Task Coded_refusal_after_rotation_fails_without_retry_or_auth_failure()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var apiClient = new FakeApiClient(_ => throw TenantConflict());
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker,
+                backoffDelay: _ => throw new InvalidOperationException("a coded refusal must not be retried"),
+                networkLinkWait: _ => Task.CompletedTask,
+                rotateSession: () => { config.SessionId = Guid.NewGuid().ToString(); return config.SessionId; });
+
+            Assert.Equal(SessionRegistrationOutcome.Failed, result.Outcome);
+            Assert.Equal(2, apiClient.CallCount);
+            Assert.Equal(0, tracker.ConsecutiveFailures);
+        }
+
+        [Fact]
+        public async Task Rotation_hook_failure_on_a_tenant_conflict_fails_without_auth_failure()
+        {
+            using var tmp = new TempDirectory();
+            var logger = NewLogger(tmp);
+            var config = NewConfig();
+
+            var apiClient = new FakeApiClient(_ => throw TenantConflict());
+            var tracker = new AuthFailureTracker(maxFailures: 5, timeoutMinutes: 0,
+                clock: SystemClock.Instance, logger: logger);
+
+            var result = await SessionRegistrationHelper.RegisterWithRetryAsync(
+                apiClient, config, agentVersion: "0.0.0", logger: logger,
+                authFailureTracker: tracker, networkLinkWait: _ => Task.CompletedTask,
+                rotateSession: () => throw new IOException("disk full"));
+
+            Assert.Equal(SessionRegistrationOutcome.Failed, result.Outcome);
+            Assert.Equal(1, apiClient.CallCount);
+            Assert.Equal(0, tracker.ConsecutiveFailures);
+        }
+
         [Fact]
         public async Task Second_owner_mismatch_after_rotation_is_an_auth_failure()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/EspAndHelloTrackerAdapterTests.cs

@@ -99,6 +99,52 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             Assert.Equal(DecisionSignalKind.WhiteGloveShellCoreSuccess, posted.Kind);
         }
 
+        [Theory]
+        [InlineData(true, "true")]
+        [InlineData(false, "false")]
+        public void WhiteGloveEvent_stamps_read_AccountSetup_progress_on_payload_and_evidence(bool progress, string expected)
+        {
+            using var f = new Fixture();
+            using var adapter = new EspAndHelloTrackerAdapter(
+                f.Coordinator, f.Ingress, f.Clock, accountSetupProgressProbe: () => progress);
+
+            adapter.TriggerWhiteGloveFromTest();
+
+            var posted = Assert.Single(f.Ingress.Posted);
+            Assert.Equal(expected, posted.Payload![SignalPayloadKeys.AccountSetupProgress]);
+            Assert.Equal(expected, posted.Evidence.DerivationInputs![SignalPayloadKeys.AccountSetupProgress]);
+        }
+
+        [Fact]
+        public void WhiteGloveEvent_with_unread_AccountSetup_registry_sends_no_progress_key()
+        {
+            // Unknown must keep the sealing classifier's AccountSetup excluder — the payload key
+            // is absent, the evidence records why.
+            using var f = new Fixture();
+            using var adapter = new EspAndHelloTrackerAdapter(
+                f.Coordinator, f.Ingress, f.Clock, accountSetupProgressProbe: () => null);
+
+            adapter.TriggerWhiteGloveFromTest();
+
+            var posted = Assert.Single(f.Ingress.Posted);
+            Assert.True(posted.Payload == null || !posted.Payload.ContainsKey(SignalPayloadKeys.AccountSetupProgress));
+            Assert.Equal("unread", posted.Evidence.DerivationInputs![SignalPayloadKeys.AccountSetupProgress]);
+        }
+
+        [Fact]
+        public void WhiteGloveEvent_default_probe_on_unstarted_coordinator_reports_unread()
+        {
+            // Production probe: the provisioning tracker does not exist before Start (and never on
+            // Device Preparation) — that is "unread", not "untouched".
+            using var f = new Fixture();
+            using var adapter = new EspAndHelloTrackerAdapter(f.Coordinator, f.Ingress, f.Clock);
+
+            adapter.TriggerWhiteGloveFromTest();
+
+            var posted = Assert.Single(f.Ingress.Posted);
+            Assert.True(posted.Payload == null || !posted.Payload.ContainsKey(SignalPayloadKeys.AccountSetupProgress));
+        }
+
         [Fact]
         public void EspFailureEvent_emits_EspTerminalFailure_with_merged_subSource_annotation()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterDurationProvenanceTests.cs

@@ -0,0 +1,292 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
+{
+    /// <summary>
+    /// A script run duration is the span between two CMTrace lines, each resolved on its own zone
+    /// belief. When the beliefs differ the span is a whole number of offset-grid steps plus the run
+    /// time, not the run time: session 4377911b read a 10 s script as 3610 s (start line-anchored
+    /// +120, result re-read after an overwrite rewind in the reader's zone +60 and rejected as
+    /// ahead of the clock), a fleet tenant read 2–9 s scripts as 17 h every day. The adapter judges
+    /// the pair from the provenance bound to each line and omits the span rather than lie.
+    /// </summary>
+    public sealed class ImeLogTrackerAdapterDurationProvenanceTests
+    {
+        private const string ServiceLog = "IntuneManagementExtension.log";
+        private const string ExecutorLog = "AgentExecutor.log";
+
+        private static CmTraceLineProvenance Line(
+            DateTime resolvedUtc, int offsetMinutes, CmTraceOffsetOrigin origin,
+            string file = ServiceLog, string? anchor = null, int? measured = null) =>
+            new CmTraceLineProvenance
+            {
+                // The writer's local time is the resolved value with the applied offset put back.
+                SourceLocalTs = DateTime.SpecifyKind(resolvedUtc.AddMinutes(offsetMinutes), DateTimeKind.Unspecified),
+                Origin = origin,
+                OffsetMinutes = offsetMinutes,
+                EraAnchorKind = anchor,
+                MeasuredWriterOffsetMinutes = measured,
+                SourceFileName = file,
+            };
+
+        private static ScriptExecutionState Platform(string policyId, DateTime startedAtUtc, CmTraceLineProvenance start,
+            DateTime? resultObservedAtUtc = null, CmTraceLineProvenance? result = null, string outcome = "Success", int exitCode = 0) =>
+            new ScriptExecutionState
+            {
+                PolicyId = policyId,
+                ScriptType = "platform",
+                ExitCode = exitCode,
+                Result = outcome,
+                ResultSource = "ime_policy_result",
+                StartedAtUtc = startedAtUtc,
+                StartedAtProvenance = start,
+                ResultObservedAtUtc = resultObservedAtUtc,
+                ResultProvenance = result,
+            };
+
+        [Fact]
+        public void Rejected_result_line_against_a_line_anchored_start_omits_the_span()
+        {
+            // Session 4377911b, script d94468af: start 15:19:57.005 local, self-anchored (+120);
+            // result 15:20:07.391 local, re-read after a rewind and resolved in the reader's
+            // zone (+60) → 14:20:07Z, one hour ahead of the clock. The raw pair reads 3610 s.
+            var clockNow = new DateTime(2026, 9, 17, 13, 20, 7, 437, DateTimeKind.Utc);
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startUtc = new DateTime(2026, 9, 17, 13, 19, 57, 5, DateTimeKind.Utc);
+            var resultRaw = new DateTime(2026, 9, 17, 14, 20, 7, 391, DateTimeKind.Utc);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("d94468af",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored, measured: 120),
+                resultRaw, Line(resultRaw, 60, CmTraceOffsetOrigin.None, measured: 120)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal(clockNow, info.OccurredAtUtc);                              // stamp: clamped to the clock
+            Assert.Equal("true", info.Payload!["derivedTimestamp"]);
+            Assert.Equal(resultRaw.ToString("o"), info.Payload["rejectedSourceTimestamp"]);
+            Assert.False(info.Payload.ContainsKey("durationSeconds"));
+            Assert.False(info.Payload.ContainsKey("durationBasis"));
+            Assert.Equal("rejected-endpoint", info.Payload["durationSuppressedReason"]);
+            Assert.Equal("unverified", info.Payload["durationProvenance"]);
+            // The end line's own provenance and the start line's, side by side.
+            Assert.Equal("reader-zone-fallback", info.Payload["sourceOffsetOrigin"]);
+            Assert.Equal("60", info.Payload["sourceOffsetMinutes"]);
+            Assert.Equal("120", info.Payload["measuredWriterOffsetMinutes"]);
+            Assert.Equal("2026-09-17T15:20:07.3910000", info.Payload["sourceLocalTs"]);
+            Assert.Equal("line-anchored", info.Payload["startSourceOffsetOrigin"]);
+            Assert.Equal("120", info.Payload["startSourceOffsetMinutes"]);
+        }
+
+        [Fact]
+        public void Rejected_era_anchored_result_of_a_failed_script_omits_the_span_and_the_timeout_verdict()
+        {
+            // Fleet shape (script_failed, daily in one tenant): result era-anchored at −420 (the
+            // OOBE default zone's era) on a line written under +600 → 17 h ahead of the clock;
+            // the 61203 s "run" of a 3 s script fired script_timeout_suspected every day.
+            var clockNow = new DateTime(2026, 9, 21, 1, 30, 13, DateTimeKind.Utc);
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startUtc = clockNow.AddSeconds(-8);
+            var resultRaw = clockNow.AddSeconds(-5).AddHours(17);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("88d406eb",
+                startUtc, Line(startUtc, 600, CmTraceOffsetOrigin.LineAnchored),
+                resultRaw, Line(resultRaw, -420, CmTraceOffsetOrigin.EraAnchored, anchor: "bootstrap-policy-result", measured: 600),
+                outcome: "Failed"));
+
+            var failed = f.InfoEvent(SharedEventTypes.ScriptFailed);
+            Assert.Equal("rejected-endpoint", failed.Payload!["durationSuppressedReason"]);
+            Assert.False(failed.Payload.ContainsKey("durationSeconds"));
+            Assert.Equal("era-anchored", failed.Payload["sourceOffsetOrigin"]);
+            Assert.Equal("bootstrap-policy-result", failed.Payload["sourceOffsetAnchor"]);
+            Assert.Empty(f.InfoEvents(SharedEventTypes.ScriptTimeoutSuspected));
+        }
+
+        [Fact]
+        public void Mixed_pair_on_the_offset_grid_omits_the_span_even_when_nothing_was_rejected()
+        {
+            // Session cbaed57b: start from AgentExecutor.log in the reader's zone (+120, two
+            // hours too early), result era-anchored at 0 in the service log → 7205 s.
+            var clockNow = new DateTime(2026, 9, 11, 8, 48, 25, DateTimeKind.Utc);
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-7205);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("846cea22",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.None, file: ExecutorLog),
+                resultUtc, Line(resultUtc, 0, CmTraceOffsetOrigin.EraAnchored, anchor: "bootstrap-policy-result")));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.False(info.Payload!.ContainsKey("derivedTimestamp"));
+            Assert.False(info.Payload.ContainsKey("durationSeconds"));
+            Assert.Equal("offset-grid", info.Payload["durationSuppressedReason"]);
+            Assert.Equal("unverified", info.Payload["durationProvenance"]);
+        }
+
+        [Fact]
+        public void Mixed_pair_off_the_grid_keeps_the_span_as_unverified()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-26);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("f6f67f79",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored),
+                resultUtc, Line(resultUtc, 120, CmTraceOffsetOrigin.None)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("26.00", info.Payload!["durationSeconds"]);
+            Assert.Equal("script_runtime", info.Payload["durationBasis"]);
+            Assert.Equal("unverified", info.Payload["durationProvenance"]);
+            Assert.False(info.Payload.ContainsKey("durationSuppressedReason"));
+        }
+
+        [Fact]
+        public void Two_line_anchored_ends_on_the_grid_are_a_verified_fifteen_minute_run()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-900);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("11111111",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored),
+                resultUtc, Line(resultUtc, 120, CmTraceOffsetOrigin.LineAnchored)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("900.00", info.Payload!["durationSeconds"]);
+            Assert.Equal("verified", info.Payload["durationProvenance"]);
+        }
+
+        [Fact]
+        public void Two_fallback_ends_from_the_same_file_share_their_error_and_stay_measurable()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-900);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("22222222",
+                startUtc, Line(startUtc, 60, CmTraceOffsetOrigin.None),
+                resultUtc, Line(resultUtc, 60, CmTraceOffsetOrigin.None)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("900.00", info.Payload!["durationSeconds"]);
+            Assert.Equal("verified", info.Payload["durationProvenance"]);
+        }
+
+        [Fact]
+        public void Two_fallback_ends_from_different_files_are_different_writers()
+        {
+            // Same reader zone applied to both, but the executor child process and the service
+            // can hold different beliefs (cbaed57b) — a grid-sized span is not trusted.
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-900);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("33333333",
+                startUtc, Line(startUtc, 60, CmTraceOffsetOrigin.None, file: ExecutorLog),
+                resultUtc, Line(resultUtc, 60, CmTraceOffsetOrigin.None)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.False(info.Payload!.ContainsKey("durationSeconds"));
+            Assert.Equal("offset-grid", info.Payload["durationSuppressedReason"]);
+        }
+
+        [Fact]
+        public void Without_provenance_the_pair_is_taken_as_before()
+        {
+            // States from before the field (persisted by an older agent) and synthetic events:
+            // no snapshot on either end, the 30-minute Failed run still reads as a timeout.
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            f.Tracker.LastMatchedLogTimestamp = clockNow.AddSeconds(-1);
+            adapter.TriggerScriptCompletedFromTest(new ScriptExecutionState
+            {
+                PolicyId = "44444444",
+                ScriptType = "platform",
+                ExitCode = 0,
+                Result = "Failed",
+                StartedAtUtc = clockNow.AddSeconds(-1801),
+            });
+
+            var failed = f.InfoEvent(SharedEventTypes.ScriptFailed);
+            Assert.Equal("1800.00", failed.Payload!["durationSeconds"]);
+            Assert.False(failed.Payload.ContainsKey("durationProvenance"));
+            Assert.False(failed.Payload.ContainsKey("durationSuppressedReason"));
+            Assert.Single(f.InfoEvents(SharedEventTypes.ScriptTimeoutSuspected));
+        }
+
+        [Fact]
+        public void Negative_grid_sized_span_from_a_future_shifted_start_is_named_not_dropped_silently()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(3595); // resolved one hour ahead of its real instant
+
+            adapter.TriggerScriptCompletedFromTest(Platform("55555555",
+                startUtc, Line(startUtc, 60, CmTraceOffsetOrigin.None),
+                resultUtc, Line(resultUtc, 120, CmTraceOffsetOrigin.LineAnchored)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.False(info.Payload!.ContainsKey("durationSeconds"));
+            Assert.Equal("offset-grid", info.Payload["durationSuppressedReason"]);
+        }
+
+        [Fact]
+        public void Health_script_cycle_is_judged_the_same_way()
+        {
+            // HS-SCRIPT-START self-anchored, HS-NEW-RESULT re-read in the reader's zone and
+            // rejected: the cycle duration is omitted, the compliance verdict stays.
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startUtc = clockNow.AddSeconds(-40);
+            var resultRaw = clockNow.AddSeconds(-2).AddHours(1);
+
+            adapter.TriggerScriptCompletedFromTest(new ScriptExecutionState
+            {
+                PolicyId = "66666666",
+                ScriptType = "remediation",
+                ScriptPart = "detection",
+                ExitCode = 0,
+                ComplianceResult = "True",
+                StartedAtUtc = startUtc,
+                StartedAtProvenance = Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored),
+                ResultObservedAtUtc = resultRaw,
+                ResultProvenance = Line(resultRaw, 60, CmTraceOffsetOrigin.None),
+                DurationBasis = "cycle_including_reporting_latency",
+            });
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("True", info.Payload!["complianceResult"]);
+            Assert.False(info.Payload.ContainsKey("durationSeconds"));
+            Assert.Equal("rejected-endpoint", info.Payload["durationSuppressedReason"]);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterHistoricReplayTests.cs

@@ -247,6 +247,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
 
             f.Tracker.LastMatchedLogTimestamp = ClockNow;
             f.Tracker.CompletePlatformScriptFromImeResultForTesting("beef7777", "Success", ClockNow);
+            // No end block is seeded — the held result goes out with the shutdown flush.
+            f.Tracker.FlushPendingPlatformScriptResults(f.Clock.UtcNow, force: true);
 
             var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
             // Without the hardening the slot kept the 7-day-old start: the duration would have

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterPlatformRunTests.cs

@@ -0,0 +1,54 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
+{
+    /// <summary>
+    /// D-316: every emitted platform-script completion carries a run id, and the tracker's run register holds what
+    /// was emitted for it under the IME user id — what the registry reconciliation pairs IME's saved result with.
+    /// </summary>
+    public sealed class ImeLogTrackerAdapterPlatformRunTests
+    {
+        private static readonly DateTime ClockNow = new DateTime(2026, 10, 3, 21, 0, 0, DateTimeKind.Utc);
+        private const string DeviceUser = "00000000-0000-0000-0000-000000000000";
+        private const string PolicyId = "1d6f0a52-3c4e-4b7a-9e21-5f8c7d2b9a10";
+
+        [Fact]
+        public void Platform_completion_carries_its_run_id_and_the_register_holds_the_emitted_run()
+        {
+            using var f = new ImeLogTrackerAdapterFixture(ClockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            f.Tracker.LastMatchedLogTimestamp = ClockNow.AddSeconds(-10);
+            f.Tracker.HandlePlatformScriptStarted(PolicyId, "ime", DeviceUser);
+            f.Tracker.RecordPlatformScriptExitCodeForTesting(PolicyId, 0, ClockNow.AddSeconds(-1));
+            f.Tracker.LastMatchedLogTimestamp = ClockNow;
+            f.Tracker.CompletePlatformScriptFromImeResultForTesting(PolicyId, "Success", ClockNow);
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.True(Guid.TryParse(info.Payload!["runId"], out _));
+
+            f.Tracker.ScriptRuns.NotePassCompleted(ClockNow.AddMinutes(1));
+            Assert.Equal(PlatformRunClaim.Claimed, f.Tracker.ScriptRuns.TryClaim(DeviceUser, PolicyId, ClockNow.AddSeconds(5), out var run));
+            Assert.Equal(info.Payload["runId"], run!.RunId);
+            Assert.Equal(0, run.ExitCode);
+            Assert.Equal("Success", run.Result);
+        }
+
+        [Theory]
+        [InlineData("[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = d94468af-6ebe-4e94-9901-2a62d33ea6c1, policy result = Success", "00000000-0000-0000-0000-000000000000")]
+        [InlineData(@"Adding argument powershell with value C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\6C3F8A20-1D5E-4B97-8F4A-0E2D6B9C7A13_d94468af-6ebe-4e94-9901-2a62d33ea6c1.ps1", "6c3f8a20-1d5e-4b97-8f4a-0e2d6b9c7a13")]
+        [InlineData(@"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_d94468af-6ebe-4e94-9901-2a62d33ea6c1.ps1 is generated", "00000000-0000-0000-0000-000000000000")]
+        [InlineData(@"Adding argument powershellDetection with value C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\8b2e4c71-6a9d-4f03-b5e8-2c7a1d9f4e36_2.ps1", null)]
+        [InlineData("[PowerShell] User Id = not-a-guid, Policy id = d94468af", null)]
+        [InlineData("", null)]
+        public void Ime_user_id_is_read_from_the_result_line_and_the_script_path(string text, string? expected)
+        {
+            Assert.Equal(expected, ImeLogTracker.ImeUserIdFrom(text));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterResultHoldTests.cs

@@ -0,0 +1,91 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
+{
+    /// <summary>
+    /// A held platform-script completion (IME result read before the executor end block) is
+    /// emitted at the end of a later pass, when the tracker's "last matched" line is an unrelated
+    /// one — the event stays bound to the result line's timestamp and pattern.
+    /// </summary>
+    public sealed class ImeLogTrackerAdapterResultHoldTests
+    {
+        private static readonly DateTime ClockNow = new DateTime(2026, 9, 10, 22, 13, 40, DateTimeKind.Utc);
+
+        [Fact]
+        public void Held_completion_is_bound_to_the_result_line_not_to_the_last_matched_one()
+        {
+            using var f = new ImeLogTrackerAdapterFixture(ClockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startTs = ClockNow.AddSeconds(-95);
+            var resultTs = ClockNow.AddSeconds(-3);
+
+            f.Tracker.LastMatchedLogTimestamp = startTs;
+            f.Tracker.HandlePlatformScriptStarted("376ee51a");
+
+            f.Tracker.LastMatchedLogTimestamp = resultTs;
+            f.Tracker.LastMatchedPatternId = "PS-SCRIPT-RESULT";
+            f.Tracker.CompletePlatformScriptFromImeResultForTesting("376ee51a", "Success", resultTs);
+            Assert.Empty(f.InfoEvents(SharedEventTypes.ScriptCompleted));
+
+            // Other lines were matched before the end block was read and the pass ended.
+            f.Tracker.LastMatchedLogTimestamp = ClockNow.AddSeconds(-1);
+            f.Tracker.LastMatchedPatternId = "IME-DOWNLOADING";
+            f.Tracker.RecordPlatformScriptExitCodeForTesting("376ee51a", 0, resultTs.AddMilliseconds(-8));
+            f.Tracker.FlushPendingPlatformScriptResults(f.Clock.UtcNow);
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal(resultTs, info.OccurredAtUtc);
+            Assert.Equal("PS-SCRIPT-RESULT", info.Payload!["patternId"]);
+            Assert.Equal("0", info.Payload["exitCode"]);
+            Assert.Equal("ime_policy_result", info.Payload["resultSource"]);
+            Assert.Equal("92.00", info.Payload["durationSeconds"]);
+        }
+
+        [Fact]
+        public void Held_completion_carries_the_provenance_of_its_result_line()
+        {
+            using var f = new ImeLogTrackerAdapterFixture(ClockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startTs = ClockNow.AddSeconds(-95);
+            var resultTs = ClockNow.AddSeconds(-3);
+
+            // Start and result lines both self-anchored (+120).
+            f.Tracker.LastMatchedLogTimestamp = startTs;
+            f.Tracker.LastMatchedSourceLocalTimestamp = DateTime.SpecifyKind(startTs.AddMinutes(120), DateTimeKind.Unspecified);
+            f.Tracker.LastMatchedSourceOffsetOrigin = CmTraceOffsetOrigin.LineAnchored;
+            f.Tracker.LastMatchedSourceOffsetMinutes = 120;
+            f.Tracker.HandlePlatformScriptStarted("376ee51a");
+
+            f.Tracker.LastMatchedLogTimestamp = resultTs;
+            f.Tracker.LastMatchedSourceLocalTimestamp = DateTime.SpecifyKind(resultTs.AddMinutes(120), DateTimeKind.Unspecified);
+            f.Tracker.LastMatchedPatternId = "PS-SCRIPT-RESULT";
+            f.Tracker.CompletePlatformScriptFromImeResultForTesting("376ee51a", "Success", resultTs);
+
+            // By the time the held completion is emitted, the last matched line is an unrelated
+            // one resolved in the reader's zone.
+            f.Tracker.LastMatchedLogTimestamp = ClockNow.AddSeconds(-1);
+            f.Tracker.LastMatchedSourceLocalTimestamp = DateTime.SpecifyKind(ClockNow.AddSeconds(-1).AddMinutes(60), DateTimeKind.Unspecified);
+            f.Tracker.LastMatchedSourceOffsetOrigin = CmTraceOffsetOrigin.None;
+            f.Tracker.LastMatchedSourceOffsetMinutes = 60;
+            f.Tracker.LastMatchedPatternId = "IME-DOWNLOADING";
+            f.Tracker.RecordPlatformScriptExitCodeForTesting("376ee51a", 0, resultTs.AddMilliseconds(-8));
+            f.Tracker.FlushPendingPlatformScriptResults(f.Clock.UtcNow);
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("line-anchored", info.Payload!["sourceOffsetOrigin"]);
+            Assert.Equal("120", info.Payload["sourceOffsetMinutes"]);
+            Assert.Equal(resultTs.AddMinutes(120).ToString("yyyy-MM-ddTHH:mm:ss.fffffff"), info.Payload["sourceLocalTs"]);
+            Assert.Equal("line-anchored", info.Payload["startSourceOffsetOrigin"]);
+            Assert.Equal("120", info.Payload["startSourceOffsetMinutes"]);
+            Assert.Equal("92.00", info.Payload["durationSeconds"]);
+            Assert.Equal("verified", info.Payload["durationProvenance"]);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Termination/EnrollmentTerminationHandlerTests.cs

@@ -564,6 +564,37 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
             Assert.False(File.Exists(Path.Combine(rig.StateDir, "enrollment-complete.marker")));
         }
 
+        [Fact]
+        public void Handle_whiteglove_part1_writes_marker_before_the_later_exit_steps()
+        {
+            // The technician's reseal can kill the process anywhere after the seal. The marker
+            // is what lets the next boot skip the 48-hour break and resume Part 2, so it must
+            // exist before collectors stop, diagnostics upload, grace and drain run.
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.WhiteGloveSealed }.Build();
+            bool? markerPresentAtCollectorStop = null;
+            rig.StopPeripheralCollectorsHook = () => markerPresentAtCollectorStop = rig.SessionPersistence.IsWhiteGloveResume();
+
+            rig.Build().Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Succeeded, SessionStage.WhiteGloveSealed));
+
+            Assert.True(markerPresentAtCollectorStop, "whiteglove.complete must be written before the peripheral collectors are stopped.");
+            var emitted = rig.EmittedEventTypes.ToList();
+            Assert.True(emitted.IndexOf("agent_shutting_down") >= 0, "agent_shutting_down must still be emitted.");
+        }
+
+        [Fact]
+        public void Handle_non_whiteglove_termination_never_writes_the_marker()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Completed }.Build();
+
+            rig.Build().Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Succeeded, SessionStage.Completed));
+
+            Assert.False(rig.SessionPersistence.IsWhiteGloveResume());
+        }
+
         [Fact]
         public void Handle_whiteglove_part1_stops_collectors_before_emitting_part1_complete()
         {
@@ -902,6 +933,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
             Assert.Equal(EnrollmentTerminationOutcome.Failed.ToString(), (string)data["outcome"]);
         }
 
+        [Fact]
+        public void Handle_propagates_stopped_waiting_reason_and_cause_in_agent_shutting_down_data()
+        {
+            // D-310: the engine stopped waiting for the user (no sign-in after the OOBE update).
+            // The backend classifies this shutdown honestly — it keys on the reason tag.
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.EspAccountSetup }.Build();
+
+            rig.Build().Handle(sender: null!, new EnrollmentTerminatedEventArgs(
+                EnrollmentTerminationReason.StoppedWaiting,
+                EnrollmentTerminationOutcome.TimedOut,
+                SessionStage.EspAccountSetup.ToString(),
+                EndUtc,
+                details: StoppedWaitingReasons.Describe(StoppedWaitingReasons.OobeUpdateNoSignIn),
+                stopReason: StoppedWaitingReasons.OobeUpdateNoSignIn));
+
+            var data = rig.DataOf(Constants.EventTypes.AgentShuttingDown);
+            Assert.NotNull(data);
+            Assert.Equal("stopped_waiting", (string)data!["reason"]);
+            Assert.Equal(StoppedWaitingReasons.OobeUpdateNoSignIn, (string)data["stopReason"]);
+            Assert.Equal(EnrollmentTerminationOutcome.TimedOut.ToString(), (string)data["outcome"]);
+        }
+
+        [Fact]
+        public void Handle_omits_stop_reason_for_other_shutdowns()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.AwaitingHello }.Build();
+
+            rig.Build().Handle(sender: null!,
+                Args(EnrollmentTerminationReason.MaxLifetimeExceeded, EnrollmentTerminationOutcome.TimedOut, SessionStage.AwaitingHello));
+
+            var data = rig.DataOf(Constants.EventTypes.AgentShuttingDown);
+            Assert.NotNull(data);
+            Assert.False(data!.ContainsKey("stopReason"));
+        }
+
         [Fact]
         public void Handle_includes_uptime_and_agent_version_in_agent_shutting_down()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendApiClientAuthClassificationTests.cs

@@ -88,6 +88,35 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.Null(ex.ErrorCode);
         }
 
+        // ── coded 409: a refusal, never an auth failure ─────────────────────
+
+        [Fact]
+        public async Task Coded_409_is_a_refusal_not_an_auth_failure()
+        {
+            using var client = BuildClient(
+                HttpStatusCode.Conflict,
+                "{\"success\":false,\"message\":\"Session id is already registered to another tenant\",\"errorCode\":\"session_owner_mismatch\"}",
+                "application/json");
+
+            var ex = await Assert.ThrowsAsync<BackendRefusalException>(
+                () => client.RegisterSessionAsync(new AutopilotMonitor.Shared.Models.SessionRegistration()));
+
+            Assert.Equal(409, ex.StatusCode);
+            Assert.Equal("session_owner_mismatch", ex.ErrorCode);
+        }
+
+        [Fact]
+        public async Task Uncoded_409_stays_a_plain_http_error()
+        {
+            using var client = BuildClient(
+                HttpStatusCode.Conflict,
+                "{\"success\":false,\"message\":\"A diagnostics package with this name already exists\"}",
+                "application/json");
+
+            await Assert.ThrowsAsync<HttpRequestException>(
+                () => client.GetDiagnosticsUploadUrlAsync("tenant-1", "session-1", "package.zip"));
+        }
+
         [Theory]
         [InlineData(null, null)]
         [InlineData("", null)]