perf(web): stop recording own-origin non-API fetches as dependencies (D-277)

Route payloads (__next.*.txt, index.txt), static JSON and the router's HEAD self-requests were 20k of 62k dependency rows per week and nobody reads them. lib/webTelemetryExclusions.ts builds the patterns (own origins minus /api/, plus relative non-API URLs) for two layers: excludeRequestFromAutoTracking- Patterns for string fetches, and a dependency initializer that drops the finished item by its absolute target - the SDK's own check sees an empty URL for the URL objects Next's router passes to fetch (verified against the ingest batch: 11 such fetches, 0 shipped; API, SignalR and token rows still shipped). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
perf(web): web perf audit 2026-09-23 - cache headers, intent prefetch, seeds, SignalR refcount, lazy telemetry
2026-10-24 20:53:06 +00:00 · 2026-09-23 12:42:00 +02:00 · 2026-09-23 12:10:11 +02:00 · 2026-09-23 09:50:49 +02:00 · 2026-09-23 09:47:29 +02:00 · 2026-09-23 09:46:10 +02:00
266 changed files with 7753 additions and 1871 deletions
@@ -30,6 +30,7 @@
 - Stage explicit file lists; never `git add -A` or a directory. Pushing is the user's call.
 - New API responses need a typed DTO plus the parity fact. MCP vocabularies are generated from the wire types, never retyped.
 - Every route belongs in the route policy catalog; every new event type goes into the MCP resource catalog.
+- Workflow files under `.github/` go through zizmor before they are committed (`zizmor .` from the repository root, findings from severity low on): fix every finding or ignore it in `zizmor.yml` with a reason. The `zizmor` job in `action-pins.yml` runs the same check on every push.
 - The about, terms and privacy pages under `src/Web/autopilot-monitor-web/app/` state facts customers rely on: verify every claim against the code before writing it and update them in the same change as the fact they describe.

 ## Code Quality
@@ -1,5 +1,9 @@
 version: 2

+# Cooldown: a version is proposed only once it has been public for 7 days, so a
+# release that is yanked or found malicious within its first week never reaches a
+# PR. Security updates are exempt from the cooldown by Dependabot's own rules.
+#
 # Grouping: every ecosystem gets one batched PR for minor/patch version
 # updates and one batched PR for security updates. Groups apply to version
 # updates only by default, so the security-updates groups are declared
@@ -10,6 +14,8 @@ updates:
    directory: /
    schedule:
      interval: weekly
+    cooldown:
+      default-days: 7
    open-pull-requests-limit: 5
    groups:
      dotnet:
@@ -23,6 +29,8 @@ updates:
    directory: /src/Web/autopilot-monitor-web
    schedule:
      interval: weekly
+    cooldown:
+      default-days: 7
    open-pull-requests-limit: 5
    groups:
      web:
@@ -41,6 +49,8 @@ updates:
    directory: /src/McpServer/autopilot-monitor-mcp
    schedule:
      interval: weekly
+    cooldown:
+      default-days: 7
    open-pull-requests-limit: 5
    groups:
      mcp:
@@ -55,6 +65,22 @@ updates:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

+  # Validator tooling for rules/ (ajv-cli); combine-rules.yml installs it from this
+  # lockfile with contents:write in hand, so the pins must not go stale.
+  - package-ecosystem: npm
+    directory: /rules/scripts
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      rules-tooling:
+        patterns: ['*']
+      rules-tooling-security:
+        applies-to: security-updates
+        patterns: ['*']
+
  # Every action is referenced by commit SHA with the version in a trailing comment;
  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
@@ -63,6 +89,8 @@ updates:
    directory: /
    schedule:
      interval: monthly
+    cooldown:
+      default-days: 7
    groups:
      actions:
        patterns: ['*']
@@ -1,5 +1,13 @@
-name: Action Pin Gate
+name: Workflow gates

+# Two checks over the workflow files themselves:
+#   * verify-pins -- every third-party action is referenced by a full commit SHA plus a
+#                    version comment (stricter than zizmor's unpinned-uses audit).
+#   * zizmor      -- static analysis of every workflow (permissions, credential
+#                    persistence, template injection, ...). Configuration and the
+#                    reasoned ignores live in zizmor.yml at the repository root; the
+#                    same run is expected locally before a workflow change is committed.
+#
 # Every third-party action must be referenced by a full commit SHA, never by a tag.
 # Tags are mutable: whoever controls an action repository can repoint v4 at new code,
 # and that code runs inside jobs that hold the code-signing identity, the storage
@@ -8,7 +16,8 @@ name: Action Pin Gate
 #
 # Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
 # the other workflow files, so a guard placed there would stay silent for exactly the
-# commits it needs to inspect.
+# commits it needs to inspect. Dependabot's action-pin PRs are the main customer: they
+# rewrite workflow files without anyone running zizmor locally.
 #
 # Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
 # run is a signal to act on, not a merge barrier. Making it binding means adding
@@ -22,10 +31,10 @@ name: Action Pin Gate
 on:
  push:
    branches: [main]
-    paths: ['.github/workflows/**']
+    paths: ['.github/workflows/**', '.github/dependabot.yml', 'zizmor.yml']
  pull_request:
    branches: [main]
-    paths: ['.github/workflows/**']
+    paths: ['.github/workflows/**', '.github/dependabot.yml', 'zizmor.yml']
  workflow_dispatch:

 permissions:
@@ -37,15 +46,18 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - name: Every third-party action is pinned to a SHA
        run: |
          set -uo pipefail
          failed=0
          while IFS=: read -r file line ref; do
-            # Reusable workflows from this repository move with the commit that calls
-            # them, so there is nothing to pin.
-            case "$ref" in ./*) continue ;; esac
+            # Reusable workflows from this repository (workspace-relative ./ or the
+            # self-repository form $/) move with the commit that calls them, so there is
+            # nothing to pin.
+            case "$ref" in ./*|\$/*) continue ;; esac

            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
@@ -68,3 +80,24 @@ jobs:
            exit 1
          fi
          echo "All action references are pinned to commit SHAs."
+
+  zizmor:
+    name: zizmor audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # SARIF upload: findings land in the Code scanning tab next to CodeQL
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      # zizmor itself is version-pinned like every other tool here; bump it together with
+      # the local install so the gate and the pre-commit run agree on the finding set.
+      # Informational findings (template expansion of our own step outputs in pwsh) are
+      # visible locally but do not fail the gate.
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          version: 1.30.1
+          min-severity: low
@@ -19,6 +19,8 @@ jobs:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - name: Install Pester 5+
        shell: powershell
@@ -73,6 +73,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      # Every released build is signed; a missing variable stops the run before a build
      # number is burnt.
@@ -91,7 +93,7 @@ jobs:
      # are bound to the ref, so this job must never be given an `environment:` -- that would
      # change the OIDC subject claim and break both logins.
      - name: Login to Azure (code-signing identity)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -114,7 +116,7 @@ jobs:
      # well inside the token lifetime. Only the legacy mirror still needs a SAS: that account
      # lives in the pre-migration tenant, where this principal has no identity.
      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -41,6 +41,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      # The loader executes as SYSTEM on every enrolling device — a parse error or
      # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
@@ -86,7 +88,7 @@ jobs:
      # are bound to the ref, so this job must never be given an `environment:` -- that would
      # change the OIDC subject claim and break both logins.
      - name: Login to Azure (code-signing identity)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -105,7 +107,7 @@ jobs:

      # The blob upload below is authorized by this federated identity, not by a SAS.
      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -24,6 +24,7 @@ on:
      - 'infra/**'
      - '.claude/**'
      - '.gitmodules'
+      - 'zizmor.yml'
      - '**/*.md'
      - 'LICENSE'
      - '.github/ISSUE_TEMPLATE/**'
@@ -57,6 +58,7 @@ on:
      - 'infra/**'
      - '.claude/**'
      - '.gitmodules'
+      - 'zizmor.yml'
      - '**/*.md'
      - 'LICENSE'
      - '.github/ISSUE_TEMPLATE/**'
@@ -97,6 +99,8 @@ jobs:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
@@ -128,6 +132,8 @@ jobs:
        working-directory: src/Web/autopilot-monitor-web
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
@@ -162,6 +168,8 @@ jobs:
        working-directory: src/McpServer/autopilot-monitor-mcp
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
@@ -196,6 +204,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
@@ -217,6 +227,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
@@ -17,6 +17,7 @@ on:
      - 'infra/**'
      - '.claude/**'
      - '.gitmodules'
+      - 'zizmor.yml'
      - '**/*.md'
      - 'LICENSE'
      - '.github/ISSUE_TEMPLATE/**'
@@ -48,6 +49,7 @@ on:
      - 'infra/**'
      - '.claude/**'
      - '.gitmodules'
+      - 'zizmor.yml'
      - '**/*.md'
      - 'LICENSE'
      - '.github/ISSUE_TEMPLATE/**'
@@ -103,6 +105,8 @@ jobs:

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        if: matrix.language == 'csharp'
@@ -110,7 +114,7 @@ jobs:
          dotnet-version: '10.0.x'

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -121,6 +125,6 @@ jobs:
        run: dotnet build AutopilotMonitor.sln --configuration Release

      - name: Analyze
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
        with:
          category: /language:${{ matrix.language }}
@@ -30,11 +30,16 @@ jobs:
        with:
          node-version: '22'

-      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # Lockfile and no lifecycle scripts: this job holds contents:write and pushes to
      # main, so an install-time script from a hijacked package would run with a token that
-      # can rewrite the repository. ajv is pure JS and needs no install hooks.
-      - name: Install ajv-cli
-        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1
+      # can rewrite the repository. rules/scripts/package-lock.json pins ajv-cli, ajv-formats
+      # and every transitive package (Dependabot keeps it current); ajv is pure JS and
+      # needs no install hooks.
+      - name: Install ajv-cli from the lockfile
+        working-directory: rules/scripts
+        run: |
+          npm ci --ignore-scripts
+          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Validate Gather Rules
        run: |
@@ -20,9 +20,11 @@ jobs:

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -27,6 +27,8 @@ jobs:

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      # The published customer documentation lives in its own PUBLIC repo and is
      # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -38,6 +40,7 @@ jobs:
      - name: Check out documentation bundle
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
+          persist-credentials: false
          repository: autopilotmonitor/autopilotmonitor-docs
          path: mcp-docs

@@ -46,7 +49,7 @@ jobs:
        run: echo "sha=$(git -C mcp-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -77,7 +80,7 @@ jobs:
          "short_sha=$shortSha" >> $env:GITHUB_OUTPUT

      - name: Login to ACR
-        run: az acr login --name ${{ env.ACR_NAME }}
+        run: az acr login --name "$ACR_NAME"

      - name: Build and push container image
        run: |
@@ -87,17 +90,17 @@ jobs:
            --build-arg BUILD_NUMBER=${{ steps.version.outputs.build_number }} \
            --build-arg BUILD_COMMIT=${{ steps.version.outputs.short_sha }} \
            --build-arg BUILD_UTC=${{ steps.version.outputs.build_utc }} \
-            -t ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }}:${{ env.IMAGE_TAG }} \
-            -t ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }}:latest \
+            -t "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME:$IMAGE_TAG" \
+            -t "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME:latest" \
            .
-          docker push ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }} --all-tags
+          docker push "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME" --all-tags

      - name: Deploy to Container App
        run: |
          az containerapp update \
-            --name ${{ env.CONTAINER_APP_NAME }} \
-            --resource-group ${{ env.RESOURCE_GROUP }} \
-            --image ${{ env.ACR_NAME }}.azurecr.io/${{ env.CONTAINER_APP_NAME }}:${{ env.IMAGE_TAG }}
+            --name "$CONTAINER_APP_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --image "$ACR_NAME.azurecr.io/$CONTAINER_APP_NAME:$IMAGE_TAG"

      # `az containerapp update` returns once the revision is provisioned, not once
      # it serves traffic — and with minReplicas=0 the first request also pays a cold
@@ -37,13 +37,14 @@ jobs:
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
+          persist-credentials: false
          lfs: false
          fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates

      # Only the version manifest at the very end needs Azure; logging in here rather than
      # next to that step keeps a credential problem from surfacing after a live deploy.
      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -58,6 +59,7 @@ jobs:
      - name: Check out documentation bundle
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
+          persist-credentials: false
          repository: autopilotmonitor/autopilotmonitor-docs
          path: whats-new-docs
          fetch-depth: 0
@@ -3,6 +3,9 @@ name: IndexNow Notify (Bing/Yandex)
 on:
  workflow_dispatch:

+# The job only talks to public endpoints; it never needs a repository token.
+permissions: {}
+
 jobs:
  notify:
    runs-on: ubuntu-latest
@@ -15,7 +15,7 @@ jobs:
    name: Federated login + read check
    steps:
      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -25,5 +25,6 @@ concurrency:
  cancel-in-progress: true

 jobs:
+  # $/ is the self-repository form: this repository at the running commit.
  gates:
-    uses: ./.github/workflows/bootstrap-script-gates.yml
+    uses: $/.github/workflows/bootstrap-script-gates.yml
@@ -26,7 +26,6 @@ on:

 permissions:
  contents: read
-  id-token: write   # OIDC federated login for the storage writes (secret-less)

 # Shared with build-agent.yml: a script publish and an agent release both touch
 # version.json, and the bootstrapVersion read-modify-write must not interleave with the
@@ -46,15 +45,24 @@ env:
  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com

 jobs:
+  # $/ is the self-repository form: this repository at the running commit, never a
+  # path some earlier step could have written to the workspace.
  gates:
-    uses: ./.github/workflows/bootstrap-script-gates.yml
+    uses: $/.github/workflows/bootstrap-script-gates.yml

  publish:
    name: Publish to the download alias
    needs: gates
    runs-on: windows-latest
+    # Job-scoped: only the publish job federates to Azure, the gates job never holds an
+    # OIDC token it does not need.
+    permissions:
+      contents: read
+      id-token: write   # OIDC federated login for the storage writes (secret-less)
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false

      - name: Check code-signing configuration
        shell: pwsh
@@ -70,7 +78,7 @@ jobs:
      # both federated credentials are bound to the ref, so this job must never carry a
      # GitHub `environment:`.
      - name: Login to Azure (code-signing identity)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -91,7 +99,7 @@ jobs:
      # runs the same publisher with -DryRun and deliberately without a login -- a dry run
      # must never need Azure credentials.
      - name: Login to Azure (OIDC)
-        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -300,6 +300,7 @@
    "script_completed",
    "script_failed",
    "script_timeout_suspected",
+    "script_recurrence_summary",
    "esp_phase_changed",
    "ime_agent_version",
    "ime_token_failure",
@@ -0,0 +1,3 @@
+# ajv-cli declares ts-node as a peer dependency it never needs for JSON schemas; do not
+# pull ts-node + typescript into a job that pushes to main.
+legacy-peer-deps=true
@@ -0,0 +1,315 @@
+{
+  "name": "autopilot-monitor-rules-tooling",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "autopilot-monitor-rules-tooling",
+      "devDependencies": {
+        "ajv-cli": "5.0.0",
+        "ajv-formats": "3.0.1"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-cli": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/ajv-cli/-/ajv-cli-5.0.0.tgz",
+      "integrity": "sha512-LY4m6dUv44HTyhV+u2z5uX4EhPYTM38Iv1jdgDJJJCyOOuqB8KtZEGjPZ2T+sh5ZIJrXUfgErYx/j3gLd3+PlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0",
+        "fast-json-patch": "^2.0.0",
+        "glob": "^7.1.0",
+        "js-yaml": "^3.14.0",
+        "json-schema-migrate": "^2.0.0",
+        "json5": "^2.1.3",
+        "minimist": "^1.2.0"
+      },
+      "bin": {
+        "ajv": "dist/index.js"
+      },
+      "peerDependencies": {
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ts-node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-json-patch": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz",
+      "integrity": "sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/js-yaml": {
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/json-schema-migrate": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-migrate/-/json-schema-migrate-2.0.0.tgz",
+      "integrity": "sha512-r38SVTtojDRp4eD6WsCqiE0eNDt4v1WalBXb9cyZYw9ai5cGtBwzRNWjHzJl38w6TxFkXAIA7h+fyX3tnrAFhQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      }
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true,
+      "license": "ISC"
+    }
+  }
+}
@@ -0,0 +1,12 @@
+{
+  "name": "autopilot-monitor-rules-tooling",
+  "private": true,
+  "description": "Validator tooling for rules/ - combine-rules.yml installs from the lockfile so nothing unpinned reaches a job that pushes to main.",
+  "devDependencies": {
+    "ajv-cli": "5.0.0",
+    "ajv-formats": "3.0.1"
+  },
+  "overrides": {
+    "fast-json-patch": "3.1.1"
+  }
+}
@@ -186,5 +186,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
            DateTime resolved;
            Assert.False(sut.TryResolveUtc(Source, UtcNow, out resolved));
        }
+
+        [Theory]
+        [InlineData(3610.39, true, 4)]     // session 4377911b: +1 h on a 10 s script
+        [InlineData(61203.0, true, 68)]    // 17 h on a 3 s script
+        [InlineData(7205.66, true, 8)]     // session cbaed57b: +2 h
+        [InlineData(-3596.0, true, 4)]     // the same error on the start end
+        [InlineData(26.4, false, 0)]       // a run time below one grid step
+        [InlineData(1030.0, false, 1)]     // 17 min 10 s: residual past the tolerance
+        [InlineData(900.0, true, 1)]       // exactly one step — a genuine 15-minute run reads the same, the caller needs mixed provenance too
+        public void A_grid_sized_span_is_the_signature_of_an_offset_error(double seconds, bool onGrid, int expectedSteps)
+        {
+            int steps;
+            Assert.Equal(onGrid, CmTraceOffsetCalibrator.IsOnOffsetGrid(TimeSpan.FromSeconds(seconds), out steps));
+            if (onGrid) Assert.Equal(expectedSteps, steps);
+        }
    }
 }
@@ -304,5 +304,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
            tracker.HandlePlatformScriptStarted("policyZ");
            Assert.Single(started);
        }
+
+        [Fact]
+        public void Emitted_marker_is_capped_at_the_clock_so_the_next_run_still_opens_a_slot()
+        {
+            // Session 4377911b: the result line was re-read after an overwrite rewind and resolved
+            // in the reader's zone, one hour ahead of the clock. Stored uncapped, that stamp made
+            // the genuine second run's start line read as a late line of the first run and its
+            // result a duplicate.
+            using var h = new Harness();
+            h.Start("d94468af", T0.AddSeconds(-10));
+            h.Result("d94468af", T0.AddHours(1));
+            h.Exit("d94468af", T0.AddSeconds(-1));
+            h.Flush();
+            Assert.Single(h.Completed);
+
+            // The second run, two minutes later on the clock — still "before" the uncapped stamp.
+            h.Now = T0.AddMinutes(2);
+            h.Start("d94468af", h.Now.AddSeconds(-5));
+            h.Result("d94468af", h.Now.AddSeconds(-1));
+            h.Exit("d94468af", h.Now.AddSeconds(-2));
+            h.Flush();
+
+            Assert.Equal(2, h.Completed.Count);
+        }
    }
 }
@@ -154,5 +154,45 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
            Assert.False(tracker2.TryClaimScriptTimeoutSuspected("policyF")); // cross-restart dedup
            Assert.True(tracker2.TryClaimScriptTimeoutSuspected("policyG"));  // other policies unaffected
        }
+
+        [Fact]
+        public void Line_provenance_of_a_pending_script_survives_restart()
+        {
+            using var tmp = new TempDirectory();
+            var observedAt = new DateTime(2026, 9, 17, 13, 20, 7, DateTimeKind.Utc);
+            var start = new CmTraceLineProvenance
+            {
+                SourceLocalTs = new DateTime(2026, 9, 17, 15, 19, 57, DateTimeKind.Unspecified),
+                Origin = CmTraceOffsetOrigin.LineAnchored,
+                OffsetMinutes = 120,
+                MeasuredWriterOffsetMinutes = 120,
+                SourceFileName = "IntuneManagementExtension.log",
+            };
+            var exit = new CmTraceLineProvenance
+            {
+                SourceLocalTs = new DateTime(2026, 9, 17, 15, 20, 7, DateTimeKind.Unspecified),
+                Origin = CmTraceOffsetOrigin.None,
+                OffsetMinutes = 60,
+                SourceFileName = "AgentExecutor.log",
+            };
+
+            var tracker1 = BuildTracker(tmp, out _);
+            tracker1.SeedPendingPlatformScriptForTesting("policyH", exitCode: 0, exitObservedAtUtc: observedAt,
+                startedAtUtc: observedAt.AddSeconds(-10), startedAtProvenance: start, exitProvenance: exit);
+            tracker1.SaveStateForTest();
+
+            var tracker2 = BuildTracker(tmp, out var emitted2);
+            tracker2.LoadStateForTest();
+            tracker2.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
+
+            var script = Assert.Single(emitted2);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.StartedAtProvenance.Origin);
+            Assert.Equal(120, script.StartedAtProvenance.OffsetMinutes);
+            Assert.Equal(start.SourceLocalTs, script.StartedAtProvenance.SourceLocalTs);
+            Assert.Equal(DateTimeKind.Unspecified, script.StartedAtProvenance.SourceLocalTs!.Value.Kind); // no zone was ever attached
+            Assert.Equal("AgentExecutor.log", script.ExitProvenance.SourceFileName);
+            Assert.Equal(60, script.ExitProvenance.OffsetMinutes);
+            Assert.Null(script.ResultProvenance);
+        }
    }
 }
@@ -0,0 +1,267 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// IME re-runs health-script policies on its own schedule for as long as the device is up.
+    /// A session that waited days for its user reported every hourly run of every policy
+    /// (field: 9 policies × 94 runs in one session). The gate emits the first run and every
+    /// changed result, counts the rest, and keeps the start/result pairing intact that the
+    /// running indicators rely on.
+    /// </summary>
+    public sealed class RecurringScriptGateTests
+    {
+        private const string Policy = "11111111-2222-3333-4444-555555555555";
+        private static readonly DateTime T0 = new DateTime(2026, 9, 16, 20, 0, 0, DateTimeKind.Utc);
+
+        private static ScriptExecutionState Early(string compliance, int exit = 0, string? stderr = null) =>
+            new ScriptExecutionState
+            {
+                PolicyId = Policy, ScriptType = "remediation", ScriptPart = "detection",
+                ComplianceResult = compliance, ExitCode = exit, Stderr = stderr, DurationBasis = "script_runtime",
+            };
+
+        private static ScriptExecutionState Consolidated(string compliance, int exit = 0, int status = 1) =>
+            new ScriptExecutionState
+            {
+                PolicyId = Policy, ScriptType = "remediation", ScriptPart = "detection",
+                ComplianceResult = compliance, ExitCode = exit, RemediationStatus = status,
+                DurationBasis = "cycle_including_reporting_latency",
+            };
+
+        [Fact]
+        public void First_run_emits_start_and_result()
+        {
+            var gate = new RecurringScriptGate();
+
+            Assert.True(gate.OnStart(Policy, T0, "6", "HS-SCRIPT-START"));
+            Assert.True(gate.OnResult(Early("True"), T0.AddSeconds(5), out var released));
+            Assert.Null(released);
+        }
+
+        [Fact]
+        public void Repeated_result_is_counted_and_its_start_stays_held()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "HS-SCRIPT-START");
+            gate.OnResult(Early("True"), T0.AddSeconds(5), out _);
+
+            Assert.False(gate.OnStart(Policy, T0.AddHours(1), "6", "HS-SCRIPT-START"));
+            Assert.False(gate.OnResult(Early("True"), T0.AddHours(1).AddSeconds(5), out var released));
+            Assert.Null(released);
+
+            var summary = Assert.Single(gate.TakeSummaries());
+            Assert.Equal(2, summary.RunsObserved);
+            Assert.Equal(1, summary.RunsCollapsed);
+            Assert.Equal(1, summary.CollapsedResults);
+            Assert.Equal(T0.AddHours(1).AddSeconds(5), summary.LastCollapsedAtUtc);
+        }
+
+        [Fact]
+        public void Changed_result_releases_the_held_start_with_its_own_timestamp()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "HS-SCRIPT-START");
+            gate.OnResult(Early("True"), T0.AddSeconds(5), out _);
+
+            var secondStart = T0.AddHours(1);
+            gate.OnStart(Policy, secondStart, "6", "HS-SCRIPT-START");
+            Assert.True(gate.OnResult(Early("False", exit: 1), secondStart.AddSeconds(5), out var released));
+
+            Assert.NotNull(released);
+            Assert.Equal(Policy, released.PolicyId);
+            Assert.Equal(secondStart, released.SourceTimestampUtc);
+            Assert.Equal("HS-SCRIPT-START", released.PatternId);
+            Assert.Equal("6", released.PolicyType);
+            Assert.Empty(gate.TakeSummaries());
+        }
+
+        [Fact]
+        public void New_stderr_counts_as_a_changed_result()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            Assert.True(gate.OnResult(Early("True", stderr: "Get-ChildItem : path not found"), T0.AddHours(1), out _));
+        }
+
+        [Fact]
+        public void Early_signal_and_consolidated_result_do_not_overwrite_each_other()
+        {
+            // Both describe the detection phase, but only the consolidated one knows
+            // RemediationStatus. Sharing one signature slot would make every run look changed.
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            Assert.True(gate.OnResult(Early("True"), T0, out _));
+            Assert.True(gate.OnResult(Consolidated("True"), T0.AddMinutes(1), out _));
+
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            Assert.False(gate.OnResult(Early("True"), T0.AddHours(1), out _));
+            Assert.False(gate.OnResult(Consolidated("True"), T0.AddHours(1).AddMinutes(1), out _));
+        }
+
+        [Fact]
+        public void Held_start_without_result_is_released_only_after_the_grace()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            var heldAt = T0.AddHours(1);
+            gate.OnStart(Policy, heldAt, "6", "p");
+
+            Assert.Empty(gate.ReleaseStartsWithoutResult(heldAt.AddMinutes(29), TimeSpan.FromMinutes(30)));
+
+            var released = Assert.Single(gate.ReleaseStartsWithoutResult(heldAt.AddMinutes(31), TimeSpan.FromMinutes(30)));
+            Assert.Equal(heldAt, released.SourceTimestampUtc);
+            Assert.Empty(gate.ReleaseStartsWithoutResult(heldAt.AddHours(2), TimeSpan.FromMinutes(30)));
+        }
+
+        [Fact]
+        public void Held_start_whose_result_was_collapsed_is_never_released_as_unfinished()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(1), out _);
+
+            Assert.Empty(gate.ReleaseStartsWithoutResult(T0.AddDays(1), TimeSpan.FromMinutes(30)));
+        }
+
+        [Fact]
+        public void Run_superseded_by_the_next_start_counts_as_without_result()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");   // no result
+            gate.OnStart(Policy, T0.AddHours(2), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(2), out _);
+
+            var summary = Assert.Single(gate.TakeSummaries());
+            Assert.Equal(3, summary.RunsObserved);
+            Assert.Equal(1, summary.RunsWithoutResult);
+            Assert.Equal(1, summary.RunsCollapsed);
+        }
+
+        [Fact]
+        public void Summary_reports_growth_only()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(1), out _);
+
+            Assert.Single(gate.TakeSummaries());
+            Assert.Empty(gate.TakeSummaries());
+
+            gate.OnStart(Policy, T0.AddHours(2), "6", "p");
+            gate.OnResult(Early("True"), T0.AddHours(2), out _);
+            Assert.Equal(2, Assert.Single(gate.TakeSummaries()).RunsCollapsed);
+        }
+
+        [Fact]
+        public void State_round_trips_through_json()
+        {
+            var gate = new RecurringScriptGate();
+            gate.OnStart(Policy, T0, "6", "p");
+            gate.OnResult(Early("True"), T0, out _);
+            gate.OnStart(Policy, T0.AddHours(1), "6", "p");
+
+            var json = JsonConvert.SerializeObject(gate.ToPersisted());
+            var restored = new RecurringScriptGate();
+            restored.Restore(JsonConvert.DeserializeObject<Dictionary<string, RecurringScriptPolicyState>>(json));
+
+            // The restored gate still knows the last report and still holds the second start.
+            Assert.True(restored.OnResult(Early("False", exit: 1), T0.AddHours(1).AddSeconds(5), out var released));
+            Assert.Equal(T0.AddHours(1), released.SourceTimestampUtc);
+        }
+
+        // ── Through the tracker ───────────────────────────────────────────────────
+
+        private sealed class Rig
+        {
+            public readonly List<ScriptStartedInfo> Started = new List<ScriptStartedInfo>();
+            public readonly List<ScriptExecutionState> Completed = new List<ScriptExecutionState>();
+            public readonly List<ScriptRecurrenceSummary> Summaries = new List<ScriptRecurrenceSummary>();
+            public readonly ImeLogTracker Tracker;
+
+            public Rig(TempDirectory tmp)
+            {
+                Tracker = new ImeLogTracker(
+                    logFolder: tmp.Path,
+                    patterns: new List<ImeLogPattern>(),
+                    logger: new AgentLogger(tmp.Path, AgentLogLevel.Info),
+                    stateDirectory: tmp.Path);
+                Tracker.OnScriptStarted = Started.Add;
+                Tracker.OnScriptCompleted = Completed.Add;
+                Tracker.OnScriptRecurrenceSummary = Summaries.Add;
+            }
+
+            public void Run(DateTime startedAtUtc, string compliance)
+            {
+                Tracker.HandleHealthScriptStartForTest(Policy, startedAtUtc);
+                Tracker.HandleHealthScriptDetectionResultForTest(Policy, compliance, "pre", exitCode: compliance == "True" ? 0 : 1);
+            }
+        }
+
+        [Fact]
+        public void Tracker_collapses_repeats_across_a_restart_and_reports_them_on_stop()
+        {
+            using var tmp = new TempDirectory();
+
+            var first = new Rig(tmp);
+            first.Run(T0, "True");
+            first.Run(T0.AddHours(1), "True");
+            Assert.Single(first.Started);
+            Assert.Single(first.Completed);
+            first.Tracker.SaveStateForTest();
+
+            // Restart (reboot kill, WhiteGlove Part 2): the last report and the counter are back.
+            var second = new Rig(tmp);
+            second.Tracker.LoadStateForTest();
+            second.Run(T0.AddHours(2), "True");
+            Assert.Empty(second.Started);
+            Assert.Empty(second.Completed);
+
+            second.Run(T0.AddHours(3), "False");
+            var start = Assert.Single(second.Started);
+            Assert.Equal(T0.AddHours(3), start.SourceTimestampUtc);
+            Assert.Equal("False", Assert.Single(second.Completed).ComplianceResult);
+
+            second.Tracker.FlushRecurringScripts(T0.AddHours(4), shuttingDown: true);
+            var summary = Assert.Single(second.Summaries);
+            Assert.Equal(4, summary.RunsObserved);
+            Assert.Equal(2, summary.RunsCollapsed);
+        }
+
+        [Fact]
+        public void Tracker_leaves_platform_scripts_alone()
+        {
+            using var tmp = new TempDirectory();
+            var rig = new Rig(tmp);
+            var observedAt = T0;
+
+            for (var run = 0; run < 2; run++)
+            {
+                rig.Tracker.SeedPendingPlatformScriptForTesting("platformA", exitCode: 0, exitObservedAtUtc: observedAt.AddMinutes(run * 10));
+                rig.Tracker.CompletePlatformScriptFromImeResultForTesting("platformA", "Success", observedAt.AddMinutes(run * 10 + 1));
+            }
+
+            Assert.Equal(2, rig.Completed.Count(s => s.ScriptType == "platform"));
+            rig.Tracker.FlushRecurringScripts(T0.AddDays(1), shuttingDown: true);
+            Assert.Empty(rig.Summaries);
+        }
+    }
+}
@@ -59,9 +59,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
        public void ClassifyEnforcementState_bands(int state, string expected)
            => Assert.Equal(expected, ImeRegistryAppStateObserver.ClassifyEnforcementState(state));

+        // IME AppInstallStatus values (StatusServiceReports\..\Status), stable IME 1.50 .. 1.106.
+        // 1001/1003 sit inside the 1000 band but are NOT terminal — IME maps every InProgress
+        // enforcement state to 1001 (verified in the decompiled 1.106 StatusServiceHelpers).
        [Theory]
        [InlineData(1000, "installed")]
-        [InlineData(1999, "installed")]
+        [InlineData(1002, "installed")]
+        [InlineData(1004, "installed")]
+        [InlineData(1001, "installing")]
+        [InlineData(1003, "installing")]
+        [InlineData(1005, null)]
+        [InlineData(1999, null)]
        [InlineData(3000, "failed")]
        [InlineData(2000, "notApplicable")]
        [InlineData(2999, "notApplicable")]
@@ -72,6 +80,35 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
        public void ClassifyStatusServiceStatus_bands(int status, string? expected)
            => Assert.Equal(expected, ImeRegistryAppStateObserver.ClassifyStatusServiceStatus(status));

+        [Fact]
+        public void TryParseRegistryDateTime_reads_both_ime_shapes_as_utc()
+        {
+            // ExecutionDeadlineTime: DateTime.ToString(InvariantCulture), UTC without a kind marker.
+            var deadline = ImeRegistryAppStateObserver.TryParseRegistryDateTime("09/23/2026 18:00:00");
+            Assert.Equal(new DateTime(2026, 9, 23, 18, 0, 0, DateTimeKind.Utc), deadline);
+            Assert.Equal(DateTimeKind.Utc, deadline!.Value.Kind);
+
+            // DeferUntilTime: round-trip "o" with trailing Z.
+            var until = ImeRegistryAppStateObserver.TryParseRegistryDateTime("2026-09-23T10:30:00.0000000Z");
+            Assert.Equal(new DateTime(2026, 9, 23, 10, 30, 0, DateTimeKind.Utc), until);
+            Assert.Equal(DateTimeKind.Utc, until!.Value.Kind);
+
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime(null));
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime(""));
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime("not a date"));
+            Assert.Null(ImeRegistryAppStateObserver.TryParseRegistryDateTime(42));
+        }
+
+        [Fact]
+        public void TryReadBool_parses_registry_strings_only()
+        {
+            Assert.True(ImeRegistryAppStateObserver.TryReadBool("True"));
+            Assert.False(ImeRegistryAppStateObserver.TryReadBool("false"));
+            Assert.Null(ImeRegistryAppStateObserver.TryReadBool("yes"));
+            Assert.Null(ImeRegistryAppStateObserver.TryReadBool(1));
+            Assert.Null(ImeRegistryAppStateObserver.TryReadBool(null));
+        }
+
        [Fact]
        public void TerminalOutcome_prefers_enforcement_state_then_status_service()
        {
@@ -88,6 +125,49 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(enforcementState: 3000)));
            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(statusServiceStatus: 2500)));
            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry()));
+            // Installing (1001) / InstallingPendingReboot (1003) share the 1000 band but are not terminal.
+            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(statusServiceStatus: 1001)));
+            Assert.Null(ImeRegistryAppStateObserver.TerminalOutcome(Entry(enforcementState: 2009, statusServiceStatus: 1003)));
+        }
+
+        [Fact]
+        public void ChangedFields_reports_wait_state_triggers_only()
+        {
+            var prev = Entry(enforcementState: 2009);
+            var next = Entry(enforcementState: 2009,
+                installDeadlineUtc: T0.AddHours(2),
+                deferralsUsed: 1, deferralMaxDeferrals: 3, deferUntilUtc: T0.AddMinutes(30), deferralAutoDeferred: false);
+
+            Assert.Equal(new[] { "installDeadline", "deferralsUsed", "deferUntil" },
+                ImeRegistryAppStateObserver.ChangedFields(prev, next));
+
+            // MaxDeferrals / AutoDeferred alone are data, not a transition.
+            var sameCounters = Entry(enforcementState: 2009,
+                installDeadlineUtc: T0.AddHours(2),
+                deferralsUsed: 1, deferralMaxDeferrals: 5, deferUntilUtc: T0.AddMinutes(30), deferralAutoDeferred: true);
+            Assert.Empty(ImeRegistryAppStateObserver.ChangedFields(next, sameCounters));
+
+            // A cleared deadline is a transition too (IME clears it when the next download starts).
+            Assert.Equal(new[] { "installDeadline" },
+                ImeRegistryAppStateObserver.ChangedFields(
+                    Entry(installDeadlineUtc: T0.AddHours(2)), Entry()));
+        }
+
+        [Fact]
+        public void DescribeWaitState_texts()
+        {
+            Assert.Equal(string.Empty, ImeRegistryAppStateObserver.DescribeWaitState(Entry(enforcementState: 2009)));
+            Assert.Equal(", downloaded, install deadline 2026-08-18 10:00 UTC",
+                ImeRegistryAppStateObserver.DescribeWaitState(Entry(installDeadlineUtc: T0.AddHours(2))));
+            Assert.Equal(", deferred by user 1/3 until 2026-08-18 08:30 UTC",
+                ImeRegistryAppStateObserver.DescribeWaitState(Entry(
+                    deferralsUsed: 1, deferralMaxDeferrals: 3, deferUntilUtc: T0.AddMinutes(30), deferralAutoDeferred: false)));
+            Assert.Equal(", auto-deferred 2/3",
+                ImeRegistryAppStateObserver.DescribeWaitState(Entry(
+                    deferralsUsed: 2, deferralMaxDeferrals: 3, deferralAutoDeferred: true)));
+            // Zero deferrals used is not a deferral; a missing max falls back to the bare count.
+            Assert.Equal(string.Empty, ImeRegistryAppStateObserver.DescribeWaitState(Entry(deferralsUsed: 0, deferralMaxDeferrals: 3)));
+            Assert.Equal(", deferred by user 1", ImeRegistryAppStateObserver.DescribeWaitState(Entry(deferralsUsed: 1)));
        }

        [Fact]
@@ -184,6 +264,54 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
            Assert.Equal("success", evt.Payload["enforcementClass"]);
        }

+        [Fact]
+        public void Wait_state_changes_emit_state_events_with_data_and_text()
+        {
+            var (sink, clock, observer) = CreateObserver(trackerApps: null);
+            var current = Snapshot((App1, 2009, null));
+
+            using (new ImeRegistryAppStateObserver.ScopedSnapshotOverride(() => current))
+            {
+                observer.Tick("baseline");
+
+                // Download finished, IME parks the app until its install deadline (1.106 ExecutionDeadlineTime).
+                var withDeadline = Snapshot((App1, 2009, null));
+                withDeadline.Entries.Values.Single().InstallDeadlineUtc = T0.AddHours(2);
+                current = withDeadline;
+                observer.Tick("registry_change");
+
+                // A required app hits a running process and the user defers (1.105 app-in-use deferral).
+                var deferred = Snapshot((App1, 2014, null));
+                var entry = deferred.Entries.Values.Single();
+                entry.InstallDeadlineUtc = T0.AddHours(2);
+                entry.DeferralsUsed = 1;
+                entry.DeferralMaxDeferrals = 3;
+                entry.DeferUntilUtc = T0.AddMinutes(30);
+                entry.DeferralAutoDeferred = false;
+                current = deferred;
+                observer.Tick("registry_change");
+            }
+
+            var events = Events(sink, SharedEventTypes.RegistryAppState);
+            Assert.Equal(2, events.Count);
+
+            var deadlineEvent = events[0];
+            Assert.Equal("installDeadline", deadlineEvent.Payload!["changedFields"]);
+            Assert.Equal("2026-08-18T10:00:00.0000000Z", deadlineEvent.Payload["installDeadlineUtc"]);
+            Assert.DoesNotContain("deferralsUsed", deadlineEvent.Payload.Keys);
+            Assert.Contains("-> inProgress, downloaded, install deadline 2026-08-18 10:00 UTC",
+                deadlineEvent.Payload[SignalPayloadKeys.Message]);
+
+            var deferralEvent = events[1];
+            Assert.Equal("enforcementState,deferralsUsed,deferUntil", deferralEvent.Payload!["changedFields"]);
+            Assert.Equal("2014", deferralEvent.Payload["enforcementState"]);
+            Assert.Equal("1", deferralEvent.Payload["deferralsUsed"]);
+            Assert.Equal("3", deferralEvent.Payload["deferralMaxDeferrals"]);
+            Assert.Equal("2026-08-18T08:30:00.0000000Z", deferralEvent.Payload["deferUntilUtc"]);
+            Assert.Equal("false", deferralEvent.Payload["deferralAutoDeferred"]);
+            Assert.Contains("deferred by user 1/3 until 2026-08-18 08:30 UTC", deferralEvent.Payload[SignalPayloadKeys.Message]);
+        }
+
        [Fact]
        public void NonEmpty_baseline_emits_one_summary_with_counts()
        {
@@ -331,7 +459,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals

        private static AppRegistryEntry Entry(
            int? enforcementState = null, long? errorCode = null, int? exitCode = null,
-            int? statusServiceStatus = null, bool espTracked = false, string? espPhase = null)
+            int? statusServiceStatus = null, bool espTracked = false, string? espPhase = null,
+            DateTime? installDeadlineUtc = null, int? deferralsUsed = null, int? deferralMaxDeferrals = null,
+            DateTime? deferUntilUtc = null, bool? deferralAutoDeferred = null)
        {
            var entry = new AppRegistryEntry($"{ImeRegistrySnapshot.DeviceContext}|{App1}", ImeRegistrySnapshot.DeviceContext, App1);
            entry.EnforcementState = enforcementState;
@@ -340,6 +470,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
            entry.StatusServiceStatus = statusServiceStatus;
            entry.EspTracked = espTracked;
            entry.EspPhase = espPhase;
+            entry.InstallDeadlineUtc = installDeadlineUtc;
+            entry.DeferralsUsed = deferralsUsed;
+            entry.DeferralMaxDeferrals = deferralMaxDeferrals;
+            entry.DeferUntilUtc = deferUntilUtc;
+            entry.DeferralAutoDeferred = deferralAutoDeferred;
            return entry;
        }

@@ -37,6 +37,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
        [InlineData("modern_deployment_log")]
        // Environment observation — battery drain on an idle device must not reset idle clocks.
        [InlineData("power_state_change")]
+        // A flapping link is environment too: it must neither keep the collectors awake nor
+        // reset the stall clock of the enrollment it is stalling.
+        [InlineData("network_state_change")]
+        [InlineData("network_connectivity_check")]
+        // Bookkeeping of health-script runs that were deliberately not reported.
+        [InlineData("script_recurrence_summary")]
        // Agent health / control / transport — not device/enrollment progress (P2).
        [InlineData("collector_degraded")]
        [InlineData("telemetry_upload_poisoned")]
@@ -67,6 +73,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
            Assert.True(SignalActivityClassifier.IsRealActivity(DecisionSignalKind.InformationalEvent, payload));
        }

+        [Theory]
+        // Only the link-change pair is exempt. The device-info snapshots are emitted at start
+        // and at the end, not per flap, and stay activity.
+        [InlineData("network_interface_info")]
+        [InlineData("wifi_signal_info")]
+        [InlineData("network_bandwidth_estimate")]
+        public void Other_network_events_remain_activity(string eventType)
+        {
+            var payload = new Dictionary<string, string> { [SignalPayloadKeys.EventType] = eventType };
+            Assert.True(SignalActivityClassifier.IsRealActivity(DecisionSignalKind.InformationalEvent, payload));
+        }
+
        [Theory]
        // Genuine ModernDeployment warnings/errors stay real activity — only the Info/Debug
        // `modern_deployment_log` forwarding is excluded.
@@ -0,0 +1,292 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
+{
+    /// <summary>
+    /// A script run duration is the span between two CMTrace lines, each resolved on its own zone
+    /// belief. When the beliefs differ the span is a whole number of offset-grid steps plus the run
+    /// time, not the run time: session 4377911b read a 10 s script as 3610 s (start line-anchored
+    /// +120, result re-read after an overwrite rewind in the reader's zone +60 and rejected as
+    /// ahead of the clock), a fleet tenant read 2–9 s scripts as 17 h every day. The adapter judges
+    /// the pair from the provenance bound to each line and omits the span rather than lie.
+    /// </summary>
+    public sealed class ImeLogTrackerAdapterDurationProvenanceTests
+    {
+        private const string ServiceLog = "IntuneManagementExtension.log";
+        private const string ExecutorLog = "AgentExecutor.log";
+
+        private static CmTraceLineProvenance Line(
+            DateTime resolvedUtc, int offsetMinutes, CmTraceOffsetOrigin origin,
+            string file = ServiceLog, string? anchor = null, int? measured = null) =>
+            new CmTraceLineProvenance
+            {
+                // The writer's local time is the resolved value with the applied offset put back.
+                SourceLocalTs = DateTime.SpecifyKind(resolvedUtc.AddMinutes(offsetMinutes), DateTimeKind.Unspecified),
+                Origin = origin,
+                OffsetMinutes = offsetMinutes,
+                EraAnchorKind = anchor,
+                MeasuredWriterOffsetMinutes = measured,
+                SourceFileName = file,
+            };
+
+        private static ScriptExecutionState Platform(string policyId, DateTime startedAtUtc, CmTraceLineProvenance start,
+            DateTime? resultObservedAtUtc = null, CmTraceLineProvenance? result = null, string outcome = "Success", int exitCode = 0) =>
+            new ScriptExecutionState
+            {
+                PolicyId = policyId,
+                ScriptType = "platform",
+                ExitCode = exitCode,
+                Result = outcome,
+                ResultSource = "ime_policy_result",
+                StartedAtUtc = startedAtUtc,
+                StartedAtProvenance = start,
+                ResultObservedAtUtc = resultObservedAtUtc,
+                ResultProvenance = result,
+            };
+
+        [Fact]
+        public void Rejected_result_line_against_a_line_anchored_start_omits_the_span()
+        {
+            // Session 4377911b, script d94468af: start 15:19:57.005 local, self-anchored (+120);
+            // result 15:20:07.391 local, re-read after a rewind and resolved in the reader's
+            // zone (+60) → 14:20:07Z, one hour ahead of the clock. The raw pair reads 3610 s.
+            var clockNow = new DateTime(2026, 9, 17, 13, 20, 7, 437, DateTimeKind.Utc);
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startUtc = new DateTime(2026, 9, 17, 13, 19, 57, 5, DateTimeKind.Utc);
+            var resultRaw = new DateTime(2026, 9, 17, 14, 20, 7, 391, DateTimeKind.Utc);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("d94468af",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored, measured: 120),
+                resultRaw, Line(resultRaw, 60, CmTraceOffsetOrigin.None, measured: 120)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal(clockNow, info.OccurredAtUtc);                              // stamp: clamped to the clock
+            Assert.Equal("true", info.Payload!["derivedTimestamp"]);
+            Assert.Equal(resultRaw.ToString("o"), info.Payload["rejectedSourceTimestamp"]);
+            Assert.False(info.Payload.ContainsKey("durationSeconds"));
+            Assert.False(info.Payload.ContainsKey("durationBasis"));
+            Assert.Equal("rejected-endpoint", info.Payload["durationSuppressedReason"]);
+            Assert.Equal("unverified", info.Payload["durationProvenance"]);
+            // The end line's own provenance and the start line's, side by side.
+            Assert.Equal("reader-zone-fallback", info.Payload["sourceOffsetOrigin"]);
+            Assert.Equal("60", info.Payload["sourceOffsetMinutes"]);
+            Assert.Equal("120", info.Payload["measuredWriterOffsetMinutes"]);
+            Assert.Equal("2026-09-17T15:20:07.3910000", info.Payload["sourceLocalTs"]);
+            Assert.Equal("line-anchored", info.Payload["startSourceOffsetOrigin"]);
+            Assert.Equal("120", info.Payload["startSourceOffsetMinutes"]);
+        }
+
+        [Fact]
+        public void Rejected_era_anchored_result_of_a_failed_script_omits_the_span_and_the_timeout_verdict()
+        {
+            // Fleet shape (script_failed, daily in one tenant): result era-anchored at −420 (the
+            // OOBE default zone's era) on a line written under +600 → 17 h ahead of the clock;
+            // the 61203 s "run" of a 3 s script fired script_timeout_suspected every day.
+            var clockNow = new DateTime(2026, 9, 21, 1, 30, 13, DateTimeKind.Utc);
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startUtc = clockNow.AddSeconds(-8);
+            var resultRaw = clockNow.AddSeconds(-5).AddHours(17);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("88d406eb",
+                startUtc, Line(startUtc, 600, CmTraceOffsetOrigin.LineAnchored),
+                resultRaw, Line(resultRaw, -420, CmTraceOffsetOrigin.EraAnchored, anchor: "bootstrap-policy-result", measured: 600),
+                outcome: "Failed"));
+
+            var failed = f.InfoEvent(SharedEventTypes.ScriptFailed);
+            Assert.Equal("rejected-endpoint", failed.Payload!["durationSuppressedReason"]);
+            Assert.False(failed.Payload.ContainsKey("durationSeconds"));
+            Assert.Equal("era-anchored", failed.Payload["sourceOffsetOrigin"]);
+            Assert.Equal("bootstrap-policy-result", failed.Payload["sourceOffsetAnchor"]);
+            Assert.Empty(f.InfoEvents(SharedEventTypes.ScriptTimeoutSuspected));
+        }
+
+        [Fact]
+        public void Mixed_pair_on_the_offset_grid_omits_the_span_even_when_nothing_was_rejected()
+        {
+            // Session cbaed57b: start from AgentExecutor.log in the reader's zone (+120, two
+            // hours too early), result era-anchored at 0 in the service log → 7205 s.
+            var clockNow = new DateTime(2026, 9, 11, 8, 48, 25, DateTimeKind.Utc);
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-7205);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("846cea22",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.None, file: ExecutorLog),
+                resultUtc, Line(resultUtc, 0, CmTraceOffsetOrigin.EraAnchored, anchor: "bootstrap-policy-result")));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.False(info.Payload!.ContainsKey("derivedTimestamp"));
+            Assert.False(info.Payload.ContainsKey("durationSeconds"));
+            Assert.Equal("offset-grid", info.Payload["durationSuppressedReason"]);
+            Assert.Equal("unverified", info.Payload["durationProvenance"]);
+        }
+
+        [Fact]
+        public void Mixed_pair_off_the_grid_keeps_the_span_as_unverified()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-26);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("f6f67f79",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored),
+                resultUtc, Line(resultUtc, 120, CmTraceOffsetOrigin.None)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("26.00", info.Payload!["durationSeconds"]);
+            Assert.Equal("script_runtime", info.Payload["durationBasis"]);
+            Assert.Equal("unverified", info.Payload["durationProvenance"]);
+            Assert.False(info.Payload.ContainsKey("durationSuppressedReason"));
+        }
+
+        [Fact]
+        public void Two_line_anchored_ends_on_the_grid_are_a_verified_fifteen_minute_run()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-900);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("11111111",
+                startUtc, Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored),
+                resultUtc, Line(resultUtc, 120, CmTraceOffsetOrigin.LineAnchored)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("900.00", info.Payload!["durationSeconds"]);
+            Assert.Equal("verified", info.Payload["durationProvenance"]);
+        }
+
+        [Fact]
+        public void Two_fallback_ends_from_the_same_file_share_their_error_and_stay_measurable()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-900);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("22222222",
+                startUtc, Line(startUtc, 60, CmTraceOffsetOrigin.None),
+                resultUtc, Line(resultUtc, 60, CmTraceOffsetOrigin.None)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("900.00", info.Payload!["durationSeconds"]);
+            Assert.Equal("verified", info.Payload["durationProvenance"]);
+        }
+
+        [Fact]
+        public void Two_fallback_ends_from_different_files_are_different_writers()
+        {
+            // Same reader zone applied to both, but the executor child process and the service
+            // can hold different beliefs (cbaed57b) — a grid-sized span is not trusted.
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(-900);
+
+            adapter.TriggerScriptCompletedFromTest(Platform("33333333",
+                startUtc, Line(startUtc, 60, CmTraceOffsetOrigin.None, file: ExecutorLog),
+                resultUtc, Line(resultUtc, 60, CmTraceOffsetOrigin.None)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.False(info.Payload!.ContainsKey("durationSeconds"));
+            Assert.Equal("offset-grid", info.Payload["durationSuppressedReason"]);
+        }
+
+        [Fact]
+        public void Without_provenance_the_pair_is_taken_as_before()
+        {
+            // States from before the field (persisted by an older agent) and synthetic events:
+            // no snapshot on either end, the 30-minute Failed run still reads as a timeout.
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            f.Tracker.LastMatchedLogTimestamp = clockNow.AddSeconds(-1);
+            adapter.TriggerScriptCompletedFromTest(new ScriptExecutionState
+            {
+                PolicyId = "44444444",
+                ScriptType = "platform",
+                ExitCode = 0,
+                Result = "Failed",
+                StartedAtUtc = clockNow.AddSeconds(-1801),
+            });
+
+            var failed = f.InfoEvent(SharedEventTypes.ScriptFailed);
+            Assert.Equal("1800.00", failed.Payload!["durationSeconds"]);
+            Assert.False(failed.Payload.ContainsKey("durationProvenance"));
+            Assert.False(failed.Payload.ContainsKey("durationSuppressedReason"));
+            Assert.Single(f.InfoEvents(SharedEventTypes.ScriptTimeoutSuspected));
+        }
+
+        [Fact]
+        public void Negative_grid_sized_span_from_a_future_shifted_start_is_named_not_dropped_silently()
+        {
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var resultUtc = clockNow.AddSeconds(-1);
+            var startUtc = resultUtc.AddSeconds(3595); // resolved one hour ahead of its real instant
+
+            adapter.TriggerScriptCompletedFromTest(Platform("55555555",
+                startUtc, Line(startUtc, 60, CmTraceOffsetOrigin.None),
+                resultUtc, Line(resultUtc, 120, CmTraceOffsetOrigin.LineAnchored)));
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.False(info.Payload!.ContainsKey("durationSeconds"));
+            Assert.Equal("offset-grid", info.Payload["durationSuppressedReason"]);
+        }
+
+        [Fact]
+        public void Health_script_cycle_is_judged_the_same_way()
+        {
+            // HS-SCRIPT-START self-anchored, HS-NEW-RESULT re-read in the reader's zone and
+            // rejected: the cycle duration is omitted, the compliance verdict stays.
+            var clockNow = ImeLogTrackerAdapterFixture.DefaultClockStart;
+            using var f = new ImeLogTrackerAdapterFixture(clockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startUtc = clockNow.AddSeconds(-40);
+            var resultRaw = clockNow.AddSeconds(-2).AddHours(1);
+
+            adapter.TriggerScriptCompletedFromTest(new ScriptExecutionState
+            {
+                PolicyId = "66666666",
+                ScriptType = "remediation",
+                ScriptPart = "detection",
+                ExitCode = 0,
+                ComplianceResult = "True",
+                StartedAtUtc = startUtc,
+                StartedAtProvenance = Line(startUtc, 120, CmTraceOffsetOrigin.LineAnchored),
+                ResultObservedAtUtc = resultRaw,
+                ResultProvenance = Line(resultRaw, 60, CmTraceOffsetOrigin.None),
+                DurationBasis = "cycle_including_reporting_latency",
+            });
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("True", info.Payload!["complianceResult"]);
+            Assert.False(info.Payload.ContainsKey("durationSeconds"));
+            Assert.Equal("rejected-endpoint", info.Payload["durationSuppressedReason"]);
+        }
+    }
+}
@@ -1,4 +1,5 @@
 using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
 using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
@@ -45,5 +46,46 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
            Assert.Equal("ime_policy_result", info.Payload["resultSource"]);
            Assert.Equal("92.00", info.Payload["durationSeconds"]);
        }
+
+        [Fact]
+        public void Held_completion_carries_the_provenance_of_its_result_line()
+        {
+            using var f = new ImeLogTrackerAdapterFixture(ClockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            var startTs = ClockNow.AddSeconds(-95);
+            var resultTs = ClockNow.AddSeconds(-3);
+
+            // Start and result lines both self-anchored (+120).
+            f.Tracker.LastMatchedLogTimestamp = startTs;
+            f.Tracker.LastMatchedSourceLocalTimestamp = DateTime.SpecifyKind(startTs.AddMinutes(120), DateTimeKind.Unspecified);
+            f.Tracker.LastMatchedSourceOffsetOrigin = CmTraceOffsetOrigin.LineAnchored;
+            f.Tracker.LastMatchedSourceOffsetMinutes = 120;
+            f.Tracker.HandlePlatformScriptStarted("376ee51a");
+
+            f.Tracker.LastMatchedLogTimestamp = resultTs;
+            f.Tracker.LastMatchedSourceLocalTimestamp = DateTime.SpecifyKind(resultTs.AddMinutes(120), DateTimeKind.Unspecified);
+            f.Tracker.LastMatchedPatternId = "PS-SCRIPT-RESULT";
+            f.Tracker.CompletePlatformScriptFromImeResultForTesting("376ee51a", "Success", resultTs);
+
+            // By the time the held completion is emitted, the last matched line is an unrelated
+            // one resolved in the reader's zone.
+            f.Tracker.LastMatchedLogTimestamp = ClockNow.AddSeconds(-1);
+            f.Tracker.LastMatchedSourceLocalTimestamp = DateTime.SpecifyKind(ClockNow.AddSeconds(-1).AddMinutes(60), DateTimeKind.Unspecified);
+            f.Tracker.LastMatchedSourceOffsetOrigin = CmTraceOffsetOrigin.None;
+            f.Tracker.LastMatchedSourceOffsetMinutes = 60;
+            f.Tracker.LastMatchedPatternId = "IME-DOWNLOADING";
+            f.Tracker.RecordPlatformScriptExitCodeForTesting("376ee51a", 0, resultTs.AddMilliseconds(-8));
+            f.Tracker.FlushPendingPlatformScriptResults(f.Clock.UtcNow);
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.Equal("line-anchored", info.Payload!["sourceOffsetOrigin"]);
+            Assert.Equal("120", info.Payload["sourceOffsetMinutes"]);
+            Assert.Equal(resultTs.AddMinutes(120).ToString("yyyy-MM-ddTHH:mm:ss.fffffff"), info.Payload["sourceLocalTs"]);
+            Assert.Equal("line-anchored", info.Payload["startSourceOffsetOrigin"]);
+            Assert.Equal("120", info.Payload["startSourceOffsetMinutes"]);
+            Assert.Equal("92.00", info.Payload["durationSeconds"]);
+            Assert.Equal("verified", info.Payload["durationProvenance"]);
+        }
    }
 }
@@ -0,0 +1,57 @@
+using System;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>
+    /// How ONE CMTrace line's UTC value was arrived at, captured at the line itself.
+    /// <para>
+    /// The tracker exposes the provenance of the line it matched last. A consumer that acts later —
+    /// a platform-script result held for its executor end block, a run duration spanning a start
+    /// line and a result line — must describe ITS line, not whichever line happened to be matched
+    /// last, so the snapshot travels on <see cref="ScriptExecutionState"/> (persisted as a plain
+    /// DTO; null on state files written before it existed).
+    /// </para>
+    /// </summary>
+    public sealed class CmTraceLineProvenance
+    {
+        /// <summary>
+        /// The line's local time exactly as the writer wrote it (Kind Unspecified, no zone). Null
+        /// when the value did not come from a CMTrace line at all (clock fallback).
+        /// </summary>
+        public DateTime? SourceLocalTs { get; set; }
+
+        /// <summary>How the offset applied to <see cref="SourceLocalTs"/> was obtained.</summary>
+        public CmTraceOffsetOrigin Origin { get; set; }
+
+        /// <summary>The offset that was applied, in minutes (local = UTC + offset).</summary>
+        public int? OffsetMinutes { get; set; }
+
+        /// <summary>For <see cref="CmTraceOffsetOrigin.EraAnchored"/>: which anchor established the era's offset.</summary>
+        public string EraAnchorKind { get; set; }
+
+        /// <summary>What the calibrator measured for the source file — observational, never applied.</summary>
+        public int? MeasuredWriterOffsetMinutes { get; set; }
+
+        /// <summary>Name of the log file the line was read from — the closest thing to a writer identity the tracker has.</summary>
+        public string SourceFileName { get; set; }
+
+        /// <summary>
+        /// True when the applied offset was ASSUMED for this line rather than declared by the
+        /// writer or measured against the agent clock: the reader's own zone (fallback), a writer
+        /// era's anchor, or the retired per-file calibration. A clock-derived value (no source
+        /// timestamp) sits on the true UTC axis and is not an assumption.
+        /// </summary>
+        public bool IsAssumed()
+        {
+            if (!SourceLocalTs.HasValue) return false;
+            switch (Origin)
+            {
+                case CmTraceOffsetOrigin.Bias:
+                case CmTraceOffsetOrigin.LineAnchored:
+                    return false;
+                default:
+                    return true;
+            }
+        }
+    }
+}
@@ -159,6 +159,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            return true;
        }

+        /// <summary>
+        /// Whether a span between two resolved lines is the signature of a wrong offset on one
+        /// of them rather than of elapsed time: a zone error is always a whole number of grid
+        /// steps, so a span within <see cref="MaxGridResidual"/> of k × <see cref="OffsetGrid"/>
+        /// (k ≥ 1) reads as an offset error plus a run time of seconds. Sign is ignored — a wrong
+        /// offset on the START end produces the same magnitude with the opposite sign.
+        /// </summary>
+        internal static bool IsOnOffsetGrid(TimeSpan span, out int gridSteps)
+        {
+            var magnitude = span.Duration();
+            gridSteps = (int)Math.Round(magnitude.TotalMinutes / OffsetGrid.TotalMinutes, MidpointRounding.AwayFromZero);
+            if (gridSteps < 1) return false;
+
+            var nearest = TimeSpan.FromMinutes(gridSteps * OffsetGrid.TotalMinutes);
+            return (magnitude - nearest).Duration() <= MaxGridResidual;
+        }
+
        public bool TryCalibrate(string sourceKey, DateTime localTimestamp, DateTime agentUtcNow)
        {
            if (string.IsNullOrEmpty(sourceKey)) return false;
@@ -252,10 +252,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                // duration when the consolidated [HS] new result line arrives (the slot above is
                // cleared by the early-signal HS-COMPLIANCE handler, so timing lives in its own
                // map). Prefer the source CMTrace timestamp; latest start wins on a policy re-run.
-                _healthScriptStartTimes[id] = LastMatchedLogTimestamp ?? DateTime.UtcNow;
+                var startedAtUtc = LastMatchedLogTimestamp ?? UtcNowProvider();
+                _healthScriptStartTimes[id] = (startedAtUtc, CaptureLastMatchedProvenance());
                _logger.Info($"ImeLogTracker: health script started: {id}");
-                try { OnScriptStarted?.Invoke(new ScriptStartedInfo { PolicyId = id, ScriptType = "remediation", PolicyType = policyType }); }
-                catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptStarted handler threw: {ex.Message}"); }
+
+                // A replayed line of a previous enrollment bypasses the recurrence gate: the
+                // adapter drops its event, and a dropped run must not count as the policy's
+                // first report.
+                if (!_currentLineIsHistoricReplay
+                    && !_recurringScripts.OnStart(id, startedAtUtc, policyType, LastMatchedPatternId))
+                {
+                    _stateDirty = true;
+                    _logger.Debug($"ImeLogTracker: health script {id} is a recurring policy — start held until its result is known");
+                    return;
+                }
+                _stateDirty = true;
+                RaiseScriptStarted(new ScriptStartedInfo { PolicyId = id, ScriptType = "remediation", PolicyType = policyType });
            }
            else
            {
@@ -269,6 +281,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        internal void HandlePlatformScriptStarted(string id, string source = null)
        {
            var currentStartTs = LastMatchedLogTimestamp ?? UtcNowProvider();
+            var currentStartProvenance = CaptureLastMatchedProvenance();

            // A start line older than the result this policy already emitted is the late start
            // line of THAT run: its AgentExecutor block surfaced after the IME result — the two
@@ -311,6 +324,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    // The slot was opened by its result while the start block was still hidden;
                    // the recovered start line dates the run.
                    pendingSlot.StartedAtUtc = currentStartTs;
+                    pendingSlot.StartedAtProvenance = currentStartProvenance;
                    _stateDirty = true;
                }
            }
@@ -331,6 +345,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    // Set only at slot creation: the start line fires twice (agentexecutor + ime
                    // source) but the earliest wins.
                    StartedAtUtc = currentStartTs,
+                    StartedAtProvenance = currentStartProvenance,
                };
                // Live "running" indicator — same signal health scripts emit. Gated on slot
                // creation so the duplicate start line (agentexecutor + ime source) doesn't
@@ -421,7 +436,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

            var script = GetCurrentScriptForLineUpdate(parameters, out var ownerPolicyId);
            if (script != null)
-                ApplyExitCode(script, exitCode, LastMatchedLogTimestamp ?? UtcNowProvider());
+                ApplyExitCode(script, exitCode, LastMatchedLogTimestamp ?? UtcNowProvider(), CaptureLastMatchedProvenance());
            else if (ownerPolicyId != null)
                _logger.Debug($"ImeLogTracker: exit code {exitCode} belongs to platform script {ownerPolicyId}, whose completion was already emitted — dropped");
            // An exit code means the executor just wrote its end block and IME is about to
@@ -430,15 +445,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            RequestOverwriteCheck();
        }

-        private void ApplyExitCode(ScriptExecutionState script, int exitCode, DateTime observedAtUtc)
+        private void ApplyExitCode(ScriptExecutionState script, int exitCode, DateTime observedAtUtc, CmTraceLineProvenance exitProvenance)
        {
            script.ExitCode = exitCode;
            // Stamp when we learned the script's exit code so the deadline-based fallback
            // (FlushPendingPlatformScriptResults) can fire if IME never logs its authoritative
            // PS-SCRIPT-RESULT line in time. Prefer the source CMTrace timestamp (already
-            // UTC-normalized by the parser) so replayed log content is dated correctly.
+            // UTC-normalized by the parser) so replayed log content is dated correctly. The
+            // line's provenance rides along: the fallback emit is bound to this line.
            if (string.Equals(script.ScriptType, "platform", StringComparison.OrdinalIgnoreCase))
+            {
                script.ExitObservedAtUtc = observedAtUtc;
+                script.ExitProvenance = exitProvenance;
+            }
            _logger.Debug($"ImeLogTracker: script exit code {exitCode} for {script.PolicyId}");
        }

@@ -488,7 +507,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

            if (string.IsNullOrEmpty(id)) return;

-            CompletePlatformScriptFromImeResult(id, result, LastMatchedLogTimestamp, LastMatchedPatternId);
+            CompletePlatformScriptFromImeResult(id, result, LastMatchedLogTimestamp, LastMatchedPatternId, CaptureLastMatchedProvenance());
        }

        /// <summary>
@@ -502,7 +521,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// line reopened the slot, produced a fallback duplicate (session e7f3c910).
        /// <see cref="FlushPendingPlatformScriptResults"/> emits the held completion.
        /// </summary>
-        internal void CompletePlatformScriptFromImeResult(string policyId, string result, DateTime? resultLineTimestampUtc, string patternId)
+        internal void CompletePlatformScriptFromImeResult(string policyId, string result, DateTime? resultLineTimestampUtc, string patternId, CmTraceLineProvenance resultProvenance)
        {
            // Dedup: the deadline-based fallback (FlushPendingPlatformScriptResults) may already have
            // emitted this script from its AgentExecutor exit code because IME's authoritative
@@ -547,6 +566,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            script.Result = result;
            script.ResultSource = "ime_policy_result";
            script.ResultObservedAtUtc = resultLineTimestampUtc ?? UtcNowProvider();
+            script.ResultProvenance = resultProvenance;
            script.ResultPatternId = patternId;
            _stateDirty = true;

@@ -572,7 +592,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        {
            _logger.Info($"ImeLogTracker: platform script completed: {script.PolicyId}, result={script.Result}, exit={script.ExitCode}{(note != null ? $" ({note})" : string.Empty)}");
            EmitScriptEvent(script);
-            _platformScriptResultEmitted[script.PolicyId] = script.ResultObservedAtUtc ?? script.ExitObservedAtUtc ?? UtcNowProvider();
+            // The run's source stamp, capped at the clock: a result line cannot be read before it
+            // was written, so a stamp ahead of the clock is a wrong zone assumption on that line
+            // (a rewound result resolved in the reader's zone, session 4377911b: +1 h). Left
+            // uncapped, the marker made the genuine NEXT run's start line read as a late line of
+            // this run and its result a duplicate.
+            var runStamp = script.ResultObservedAtUtc ?? script.ExitObservedAtUtc ?? UtcNowProvider();
+            var nowUtc = UtcNowProvider();
+            _platformScriptResultEmitted[script.PolicyId] = runStamp > nowUtc ? nowUtc : runStamp;
            _pendingPlatformScripts.Remove(script.PolicyId);
            _stateDirty = true;
        }
@@ -669,7 +696,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

        /// <summary>Test seam: inject a pending platform script as if AgentExecutor.log had reported
        /// its start + exit code, without an IME PS-SCRIPT-RESULT line.</summary>
-        internal void SeedPendingPlatformScriptForTesting(string policyId, int? exitCode, DateTime? exitObservedAtUtc, string stdout = null, DateTime? startedAtUtc = null)
+        internal void SeedPendingPlatformScriptForTesting(string policyId, int? exitCode, DateTime? exitObservedAtUtc, string stdout = null, DateTime? startedAtUtc = null,
+            CmTraceLineProvenance startedAtProvenance = null, CmTraceLineProvenance exitProvenance = null)
        {
            // Mirrors a fresh execution start: a new run clears any prior emitted-marker (see
            // HandleScriptStarted) so re-runs of the same policy within one lifetime emit again.
@@ -682,6 +710,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                ExitObservedAtUtc = exitObservedAtUtc,
                Stdout = stdout,
                StartedAtUtc = startedAtUtc,
+                StartedAtProvenance = startedAtProvenance,
+                ExitProvenance = exitProvenance,
            };
            NextTestEntry();
            RecordInvocationMarker(policyId, isClose: false);
@@ -691,18 +721,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// (the production handler minus regex extraction). <paramref name="resultLineTimestampUtc"/>
        /// stands in for the CMTrace timestamp of the PS-SCRIPT-RESULT line (production reads it
        /// via <see cref="LastMatchedLogTimestamp"/>, the fallback here).</summary>
-        internal void CompletePlatformScriptFromImeResultForTesting(string policyId, string result, DateTime? resultLineTimestampUtc = null)
+        internal void CompletePlatformScriptFromImeResultForTesting(string policyId, string result, DateTime? resultLineTimestampUtc = null, CmTraceLineProvenance resultProvenance = null)
        {
            if (string.IsNullOrEmpty(policyId)) return;
-            CompletePlatformScriptFromImeResult(policyId, result, resultLineTimestampUtc ?? LastMatchedLogTimestamp, "PS-SCRIPT-RESULT");
+            CompletePlatformScriptFromImeResult(policyId, result, resultLineTimestampUtc ?? LastMatchedLogTimestamp, "PS-SCRIPT-RESULT", resultProvenance ?? CaptureLastMatchedProvenance());
        }

        /// <summary>Test seam: the AgentExecutor exit-code line of a pending platform script (the
        /// production handler minus regex extraction and positional ownership).</summary>
-        internal void RecordPlatformScriptExitCodeForTesting(string policyId, int exitCode, DateTime observedAtUtc)
+        internal void RecordPlatformScriptExitCodeForTesting(string policyId, int exitCode, DateTime observedAtUtc, CmTraceLineProvenance exitProvenance = null)
        {
            if (_pendingPlatformScripts.TryGetValue(policyId, out var script))
-                ApplyExitCode(script, exitCode, observedAtUtc);
+                ApplyExitCode(script, exitCode, observedAtUtc, exitProvenance);
        }

        /// <summary>
@@ -778,8 +808,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                // HS-NEW-RESULT path whose end stamp includes IME's batched reporting latency.
                // Peek only: HS-NEW-RESULT still consumes + removes the entry for cycle timing.
                StartedAtUtc = _healthScriptStartTimes.TryGetValue(id, out var earlyStart)
-                    ? earlyStart
+                    ? earlyStart.Utc
                    : (DateTime?)null,
+                StartedAtProvenance = _healthScriptStartTimes.TryGetValue(id, out var earlyStartProvenance)
+                    ? earlyStartProvenance.Provenance
+                    : null,
+                // The HS-COMPLIANCE line is the end of this phase; emitted synchronously, so the
+                // last matched line is it.
+                ResultProvenance = CaptureLastMatchedProvenance(),
                DurationBasis = "script_runtime",
            };

@@ -794,6 +830,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            _pendingHealthScript = null;
        }

+        /// <summary>
+        /// Test seam: a health-script start line for <paramref name="id"/> stamped
+        /// <paramref name="startedAtUtc"/>, without driving the regex pipeline.
+        /// </summary>
+        internal void HandleHealthScriptStartForTest(string id, DateTime startedAtUtc)
+        {
+            LastMatchedLogTimestamp = startedAtUtc;
+            var match = System.Text.RegularExpressions.Regex.Match(id ?? string.Empty, @"(?<id>.+)");
+            HandleScriptStarted(match, new Dictionary<string, string> { ["scriptType"] = "remediation" });
+        }
+
        /// <summary>
        /// Test seam: simulates the full HS-SCRIPT-START → HS-RUN-CONTEXT / HS-EXITCODE /
        /// HS-STDOUT / HS-STDERR → HS-COMPLIANCE sequence by directly populating the
@@ -837,10 +884,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// HS-SCRIPT-START line had been observed, so a subsequent
        /// <see cref="HandleHealthScriptResultJson"/> surfaces a run duration without driving the
        /// full regex pipeline.</summary>
-        internal void SeedHealthScriptStartForTesting(string policyId, DateTime startedAtUtc)
+        internal void SeedHealthScriptStartForTesting(string policyId, DateTime startedAtUtc, CmTraceLineProvenance provenance = null)
        {
            if (string.IsNullOrEmpty(policyId)) return;
-            _healthScriptStartTimes[policyId] = startedAtUtc;
+            _healthScriptStartTimes[policyId] = (startedAtUtc, provenance);
        }

        private void HandleHealthScriptResult(Match match, Dictionary<string, string> parameters)
@@ -897,10 +944,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            // emitted phase events — the remediation analog of platform-script timing. Consumed +
            // removed so a later re-run of the same policy re-times from its own start. Null when
            // the start line was never seen in the agent's window (e.g. a replayed result).
-            DateTime? cycleStartedAtUtc = _healthScriptStartTimes.TryGetValue(policyId, out var hsStart)
-                ? hsStart
-                : (DateTime?)null;
+            var hasCycleStart = _healthScriptStartTimes.TryGetValue(policyId, out var hsStart);
+            DateTime? cycleStartedAtUtc = hasCycleStart ? hsStart.Utc : (DateTime?)null;
+            var cycleStartProvenance = hasCycleStart ? hsStart.Provenance : null;
            _healthScriptStartTimes.Remove(policyId);
+            // Every phase ends on this HS-NEW-RESULT line.
+            var resultProvenance = CaptureLastMatchedProvenance();

            // Common metadata — applied to every emitted phase event.
            var remediationStatus = TryGetInt(root, "RemediationStatus");
@@ -940,7 +989,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                targetType: targetType,
                errorCode: errorCode,
                errorDetails: errorDetails,
-                startedAtUtc: cycleStartedAtUtc);
+                startedAtUtc: cycleStartedAtUtc,
+                startedAtProvenance: cycleStartProvenance,
+                resultProvenance: resultProvenance);
            // complianceResult mirrors the legacy HS-COMPLIANCE event semantics: True when the
            // pre-detection script reported compliant (exit 0), False otherwise.
            detection.ComplianceResult = firstDetectExit == 0 ? "True" : (firstDetectExit.HasValue ? "False" : null);
@@ -964,7 +1015,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    targetType: targetType,
                    errorCode: errorCode,
                    errorDetails: errorDetails,
-                    startedAtUtc: cycleStartedAtUtc);
+                    startedAtUtc: cycleStartedAtUtc,
+                startedAtProvenance: cycleStartProvenance,
+                resultProvenance: resultProvenance);
                // No complianceResult on the remediation phase — there is nothing to be compliant about.
                EmitScriptEvent(remediation);
            }
@@ -986,7 +1039,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    targetType: targetType,
                    errorCode: errorCode,
                    errorDetails: errorDetails,
-                    startedAtUtc: cycleStartedAtUtc);
+                    startedAtUtc: cycleStartedAtUtc,
+                startedAtProvenance: cycleStartProvenance,
+                resultProvenance: resultProvenance);
                postDetection.ComplianceResult = lastDetectExit == 0 ? "True" : (lastDetectExit.HasValue ? "False" : null);
                EmitScriptEvent(postDetection);
            }
@@ -1009,7 +1064,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            int? targetType,
            int? errorCode,
            string errorDetails,
-            DateTime? startedAtUtc) =>
+            DateTime? startedAtUtc,
+            CmTraceLineProvenance startedAtProvenance,
+            CmTraceLineProvenance resultProvenance) =>
            new ScriptExecutionState
            {
                PolicyId = policyId,
@@ -1026,6 +1083,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                // Cycle start (HS-SCRIPT-START). Every phase carries the same cycle start so the
                // adapter computes the total run duration; the Web surfaces it once at card level.
                StartedAtUtc = startedAtUtc,
+                StartedAtProvenance = startedAtProvenance,
+                ResultProvenance = resultProvenance,
                // End stamp is the HS-NEW-RESULT line — written only after IME's batched report
                // to the service, so this duration overstates the actual script execution time.
                DurationBasis = "cycle_including_reporting_latency"
@@ -1052,9 +1111,58 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        private void EmitScriptEvent(ScriptExecutionState script)
        {
            if (script == null || string.IsNullOrEmpty(script.PolicyId)) return;
+
+            // Health scripts recur for as long as the device is up; platform scripts run once.
+            if (string.Equals(script.ScriptType, "remediation", StringComparison.OrdinalIgnoreCase)
+                && !_currentLineIsHistoricReplay)
+            {
+                var emit = _recurringScripts.OnResult(script, LastMatchedLogTimestamp ?? UtcNowProvider(), out var releasedStart);
+                _stateDirty = true;
+                if (!emit)
+                {
+                    _logger.Debug($"ImeLogTracker: health script {script.PolicyId} {script.ScriptPart} repeats its last reported result — counted, not emitted");
+                    return;
+                }
+                if (releasedStart != null) RaiseScriptStarted(releasedStart);
+            }
+
            OnScriptCompleted?.Invoke(script);
        }

+        private void RaiseScriptStarted(ScriptStartedInfo info)
+        {
+            try { OnScriptStarted?.Invoke(info); }
+            catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptStarted handler threw: {ex.Message}"); }
+        }
+
+        /// <summary>
+        /// A held start whose run produced no result for <see cref="HeldScriptStartGrace"/> is
+        /// emitted after all: the script did not finish. On shutdown the shorter
+        /// <see cref="HeldScriptStartShutdownGrace"/> applies — a start read moments before the
+        /// stop stays held for the next run of this session instead of reading as unfinished.
+        /// </summary>
+        internal void FlushRecurringScripts(DateTime nowUtc, bool shuttingDown)
+        {
+            var released = _recurringScripts.ReleaseStartsWithoutResult(
+                nowUtc, shuttingDown ? HeldScriptStartShutdownGrace : HeldScriptStartGrace);
+            foreach (var start in released) RaiseScriptStarted(start);
+
+            if (shuttingDown)
+            {
+                foreach (var summary in _recurringScripts.TakeSummaries())
+                {
+                    try { OnScriptRecurrenceSummary?.Invoke(summary); }
+                    catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptRecurrenceSummary handler threw: {ex.Message}"); }
+                }
+            }
+
+            if (_recurringScripts.ConsumeDirty()) _stateDirty = true;
+        }
+
+        // IME aborts a health script after roughly 30 minutes.
+        internal static readonly TimeSpan HeldScriptStartGrace = TimeSpan.FromMinutes(30);
+        internal static readonly TimeSpan HeldScriptStartShutdownGrace = TimeSpan.FromMinutes(5);
+
        private static string TruncateOutput(string output)
        {
            if (string.IsNullOrEmpty(output) || output.Length <= MaxScriptOutputLength)
@@ -505,6 +505,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            "imetokenfailure",
        };

+        /// <summary>
+        /// Snapshot of the last matched line's provenance, for a consumer that acts later than
+        /// the match (a held platform-script result, a run duration across two lines) and must
+        /// describe THAT line rather than whichever line is matched by then.
+        /// </summary>
+        internal CmTraceLineProvenance CaptureLastMatchedProvenance() => new CmTraceLineProvenance
+        {
+            SourceLocalTs = LastMatchedSourceLocalTimestamp,
+            Origin = LastMatchedSourceOffsetOrigin,
+            OffsetMinutes = LastMatchedSourceOffsetMinutes,
+            EraAnchorKind = LastMatchedEraAnchorKind,
+            MeasuredWriterOffsetMinutes = LastMatchedMeasuredWriterOffsetMinutes,
+            SourceFileName = _currentSourceFileName,
+        };
+
        private void HandlePatternMatch(CompiledPattern pattern, Match match, string message, CmTraceLogEntry entry)
        {
            LastMatchedPatternId = pattern.PatternId;
@@ -551,6 +566,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            // replays historic logs on purpose and bypasses the guard.
            var isStaleReplayLine = !SimulationMode && entry != null
                && (UtcNowProvider() - NormalizeUtc(ResolveEntryUtc(entry))) > HistoricReplayThreshold;
+            _currentLineIsHistoricReplay = isStaleReplayLine;
            if (isStaleReplayLine && AppMutatingActions.Contains(pattern.Action?.ToLower() ?? string.Empty))
            {
                _logger.Debug($"ImeLogTracker: skipped app action '{pattern.Action}' for historic line ({ResolveEntryUtc(entry):o})");
@@ -192,14 +192,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        // UI dedupe (dataCompleteness scoring).
        private ScriptExecutionState _pendingHealthScript;

+        // Collapses recurring health-script runs; persisted with the file positions.
+        private readonly RecurringScriptGate _recurringScripts = new RecurringScriptGate();
+
+        // Set for the duration of one pattern dispatch: the matched line is older than
+        // HistoricReplayThreshold, so the adapter drops whatever it produces.
+        private bool _currentLineIsHistoricReplay;
+
        // Cycle start timestamps for health (remediation) scripts, keyed by policyId. Captured
        // from the HS-SCRIPT-START line ([HS] ProcessScript) so the consolidated HS-NEW-RESULT
        // emit can surface the cycle's total run duration (start → result) on its phase events —
        // the remediation-script analog of the platform-script StartedAtUtc timing. Kept in a
        // dedicated map (not on _pendingHealthScript) because the early-signal HS-COMPLIANCE
        // handler clears that slot before HS-NEW-RESULT arrives. Consumed + removed on result emit.
-        private readonly Dictionary<string, DateTime> _healthScriptStartTimes =
-            new Dictionary<string, DateTime>(StringComparer.OrdinalIgnoreCase);
+        // The start line's provenance rides along so the adapter can tell whether start and result
+        // were resolved on the same zone assumption before it subtracts them.
+        private readonly Dictionary<string, (DateTime Utc, CmTraceLineProvenance Provenance)> _healthScriptStartTimes =
+            new Dictionary<string, (DateTime Utc, CmTraceLineProvenance Provenance)>(StringComparer.OrdinalIgnoreCase);

        // Restart-safe dedup for the adapter's one-shot script_timeout_suspected Warning.
        // Owned by the tracker (not the adapter) solely so it rides the persisted state file —
@@ -498,6 +507,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// </summary>
        public Action<ScriptStartedInfo> OnScriptStarted { get; set; }

+        /// <summary>
+        /// Fires when the tracker stops, once per health-script policy whose repeated runs were
+        /// counted instead of emitted since the last summary (see <see cref="RecurringScriptGate"/>).
+        /// </summary>
+        public Action<ScriptRecurrenceSummary> OnScriptRecurrenceSummary { get; set; }
+
        /// <summary>
        /// Fires on every pattern match with the matched <c>PatternId</c>. Plan §4.x M4.4.4.
        /// Invoked by <c>HandlePatternMatch</c> after <see cref="LastMatchedPatternId"/> is
@@ -994,6 +1009,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                try { FlushPendingPlatformScriptResults(UtcNowProvider(), force: true); }
                catch (Exception ex) { _logger.Warning($"ImeLogTracker: shutdown script flush failed: {ex.Message}"); }

+                try { FlushRecurringScripts(UtcNowProvider(), shuttingDown: true); }
+                catch (Exception ex) { _logger.Warning($"ImeLogTracker: shutdown recurring-script flush failed: {ex.Message}"); }
+
                // Final state save on shutdown
                if (_stateDirty)
                {
@@ -1024,6 +1042,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

            await CheckLogFilesAsync(token);
            FlushPendingPlatformScriptResults(UtcNowProvider());
+            FlushRecurringScripts(UtcNowProvider(), shuttingDown: false);
            CheckPendingTokenFailure(UtcNowProvider());

            var endMs = MonotonicMillisProvider();
@@ -1163,6 +1182,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    _scriptTimeoutSuspectedPosted.Add(id);
            }

+            _recurringScripts.Restore(state.RecurringScripts);
+
            // Health counters + histogram: a restart (or WhiteGlove Part 2) must report the
            // whole session, not only the lines seen since the last start. Null on state files
            // written before these fields existed → counters start at zero.
@@ -1239,6 +1260,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                PlatformScriptResultEmittedAt = new Dictionary<string, DateTime>(_platformScriptResultEmitted, StringComparer.OrdinalIgnoreCase),
                PendingPlatformScripts = _pendingPlatformScripts.Values.ToList(),
                ScriptTimeoutSuspectedPosted = _scriptTimeoutSuspectedPosted.ToList(),
+                RecurringScripts = _recurringScripts.ToPersisted(),
            };

            lock (_healthLock)
@@ -153,6 +153,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        public List<ScriptExecutionState> PendingPlatformScripts { get; set; }
        public List<string> ScriptTimeoutSuspectedPosted { get; set; }

+        // Recurring health-script runs collapsed per policy. Saved in the same write as
+        // FilePositions on purpose: after a hard kill both fall back together, so re-read lines
+        // are counted again instead of twice. Null on older state files → empty.
+        public Dictionary<string, RecurringScriptPolicyState> RecurringScripts { get; set; }
+
        // Cumulative tracker health + per-pattern histogram (ime_pattern_hits / ime_tracker_degraded,
        // 2026-08-30). Restart-safe on purpose: WhiteGlove Part 2 reports the whole session and the
        // one-shot degraded event must not fire twice. Null on older state files → zero.
@@ -0,0 +1,257 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>
+    /// Collapses recurring health-script (proactive remediation) runs. IME re-runs every assigned
+    /// policy on its own schedule for as long as the device is up; an enrollment that waits for
+    /// its user for days would otherwise report every hourly run of every policy. A policy's
+    /// first run and every run whose result differs from the last reported one are emitted in
+    /// full; runs that repeat the last reported result are only counted and surface once per
+    /// policy as a recurrence summary.
+    /// <para>
+    /// The start signal of an already known policy is held until its result is known, because
+    /// the running indicators (web panel, session coverage) pair a start with a later result of
+    /// the same policy — a start whose result was collapsed would read as "still running".
+    /// </para>
+    /// <para>
+    /// The state is part of the tracker state file and is saved in the same write as the file
+    /// positions: after a hard kill both fall back together, the lines after the last save are
+    /// read again and counted again — nothing is lost and nothing counts twice.
+    /// </para>
+    /// Not thread-safe: called from the tracker's single poll thread only.
+    /// </summary>
+    public sealed class RecurringScriptGate
+    {
+        private readonly Dictionary<string, RecurringScriptPolicyState> _policies =
+            new Dictionary<string, RecurringScriptPolicyState>(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>True when any call changed persisted state since the last <see cref="ConsumeDirty"/>.</summary>
+        private bool _dirty;
+
+        public bool ConsumeDirty()
+        {
+            var wasDirty = _dirty;
+            _dirty = false;
+            return wasDirty;
+        }
+
+        /// <summary>
+        /// A start line was read. Returns <c>true</c> when the start signal is emitted right away
+        /// (first run of the policy); <c>false</c> when it is held until the run's result is known.
+        /// </summary>
+        public bool OnStart(string policyId, DateTime startedAtUtc, string policyType, string patternId)
+        {
+            if (string.IsNullOrEmpty(policyId)) return true;
+
+            var isKnown = _policies.TryGetValue(policyId, out var state);
+            if (!isKnown)
+            {
+                state = new RecurringScriptPolicyState();
+                _policies[policyId] = state;
+            }
+
+            CloseHeldRun(state);
+            state.RunsObserved++;
+            _dirty = true;
+
+            if (!isKnown) return true;
+
+            state.HeldStartAtUtc = startedAtUtc;
+            state.HeldStartPolicyType = policyType;
+            state.HeldStartPatternId = patternId;
+            state.HeldRunSawResult = false;
+            return false;
+        }
+
+        /// <summary>
+        /// A result (one phase event) is about to be emitted. Returns <c>true</c> to emit it; when
+        /// the run's start was held, <paramref name="releasedStart"/> carries the start signal to
+        /// emit first. Returns <c>false</c> when the result repeats the last reported one.
+        /// </summary>
+        public bool OnResult(ScriptExecutionState script, DateTime observedAtUtc, out ScriptStartedInfo releasedStart)
+        {
+            releasedStart = null;
+            if (script == null || string.IsNullOrEmpty(script.PolicyId)) return true;
+
+            if (!_policies.TryGetValue(script.PolicyId, out var state))
+            {
+                state = new RecurringScriptPolicyState();
+                _policies[script.PolicyId] = state;
+            }
+
+            var key = SignatureKey(script);
+            var signature = Signature(script);
+            _dirty = true;
+
+            if (state.Signatures.TryGetValue(key, out var last) && string.Equals(last, signature, StringComparison.Ordinal))
+            {
+                state.CollapsedResults++;
+                if (!state.FirstCollapsedAtUtc.HasValue) state.FirstCollapsedAtUtc = observedAtUtc;
+                state.LastCollapsedAtUtc = observedAtUtc;
+                if (state.HeldStartAtUtc.HasValue) state.HeldRunSawResult = true;
+                return false;
+            }
+
+            state.Signatures[key] = signature;
+            releasedStart = ReleaseHeldStart(script.PolicyId, state);
+            return true;
+        }
+
+        /// <summary>
+        /// Start signals that were held for at least <paramref name="minAge"/> without any result:
+        /// the script did not finish, which is exactly what the running indicators are for.
+        /// </summary>
+        public List<ScriptStartedInfo> ReleaseStartsWithoutResult(DateTime nowUtc, TimeSpan minAge)
+        {
+            var released = new List<ScriptStartedInfo>();
+            foreach (var kv in _policies)
+            {
+                var state = kv.Value;
+                if (!state.HeldStartAtUtc.HasValue || state.HeldRunSawResult) continue;
+                if (nowUtc - state.HeldStartAtUtc.Value < minAge) continue;
+                released.Add(ReleaseHeldStart(kv.Key, state));
+                _dirty = true;
+            }
+            return released;
+        }
+
+        /// <summary>
+        /// One summary per policy whose collapsed-run count grew since the last summary. Marks
+        /// the reported count, so a later stop of the same session only reports new growth.
+        /// </summary>
+        public List<ScriptRecurrenceSummary> TakeSummaries()
+        {
+            var summaries = new List<ScriptRecurrenceSummary>();
+            foreach (var kv in _policies)
+            {
+                var state = kv.Value;
+                var collapsedRuns = state.RunsCollapsed + (state.HeldStartAtUtc.HasValue && state.HeldRunSawResult ? 1 : 0);
+                if (collapsedRuns <= state.RunsCollapsedAtLastSummary) continue;
+
+                summaries.Add(new ScriptRecurrenceSummary
+                {
+                    PolicyId = kv.Key,
+                    RunsObserved = state.RunsObserved,
+                    RunsCollapsed = collapsedRuns,
+                    RunsWithoutResult = state.RunsWithoutResult,
+                    CollapsedResults = state.CollapsedResults,
+                    FirstCollapsedAtUtc = state.FirstCollapsedAtUtc,
+                    LastCollapsedAtUtc = state.LastCollapsedAtUtc,
+                });
+                state.RunsCollapsedAtLastSummary = collapsedRuns;
+                _dirty = true;
+            }
+            return summaries;
+        }
+
+        public Dictionary<string, RecurringScriptPolicyState> ToPersisted() =>
+            new Dictionary<string, RecurringScriptPolicyState>(_policies, StringComparer.OrdinalIgnoreCase);
+
+        public void Restore(Dictionary<string, RecurringScriptPolicyState> persisted)
+        {
+            _policies.Clear();
+            if (persisted == null) return;
+            foreach (var kv in persisted)
+            {
+                if (string.IsNullOrEmpty(kv.Key) || kv.Value == null) continue;
+                if (kv.Value.Signatures == null)
+                    kv.Value.Signatures = new Dictionary<string, string>(StringComparer.Ordinal);
+                _policies[kv.Key] = kv.Value;
+            }
+        }
+
+        // A held run ends when the next start of the policy arrives: all its results repeated the
+        // last report (collapsed), or it never produced one.
+        private static void CloseHeldRun(RecurringScriptPolicyState state)
+        {
+            if (!state.HeldStartAtUtc.HasValue) return;
+            if (state.HeldRunSawResult) state.RunsCollapsed++;
+            else state.RunsWithoutResult++;
+            ClearHeldStart(state);
+        }
+
+        private static ScriptStartedInfo ReleaseHeldStart(string policyId, RecurringScriptPolicyState state)
+        {
+            if (!state.HeldStartAtUtc.HasValue) return null;
+            var info = new ScriptStartedInfo
+            {
+                PolicyId = policyId,
+                ScriptType = "remediation",
+                PolicyType = state.HeldStartPolicyType,
+                SourceTimestampUtc = state.HeldStartAtUtc,
+                PatternId = state.HeldStartPatternId,
+            };
+            ClearHeldStart(state);
+            return info;
+        }
+
+        private static void ClearHeldStart(RecurringScriptPolicyState state)
+        {
+            state.HeldStartAtUtc = null;
+            state.HeldStartPolicyType = null;
+            state.HeldStartPatternId = null;
+            state.HeldRunSawResult = false;
+        }
+
+        // The early compliance signal and the consolidated result of one phase differ in
+        // completeness (only the latter knows RemediationStatus); keyed apart, or the two would
+        // overwrite each other's signature on every run and nothing would ever collapse.
+        private static string SignatureKey(ScriptExecutionState script) =>
+            (script.ScriptPart ?? string.Empty) + "|" + (script.DurationBasis ?? string.Empty);
+
+        private static string Signature(ScriptExecutionState script)
+        {
+            var culture = CultureInfo.InvariantCulture;
+            return string.Join("|",
+                script.ComplianceResult ?? string.Empty,
+                script.ExitCode.HasValue ? script.ExitCode.Value.ToString(culture) : string.Empty,
+                string.IsNullOrWhiteSpace(script.Stderr) ? "0" : "1",
+                script.RemediationStatus.HasValue ? script.RemediationStatus.Value.ToString(culture) : string.Empty,
+                script.ErrorCode.HasValue ? script.ErrorCode.Value.ToString(culture) : string.Empty);
+        }
+    }
+
+    /// <summary>Persisted per-policy state of <see cref="RecurringScriptGate"/>.</summary>
+    public class RecurringScriptPolicyState
+    {
+        /// <summary>Last reported result per phase and signal kind.</summary>
+        public Dictionary<string, string> Signatures { get; set; } = new Dictionary<string, string>(StringComparer.Ordinal);
+
+        /// <summary>Start lines read for the policy.</summary>
+        public int RunsObserved { get; set; }
+
+        /// <summary>Runs whose every result repeated the last reported one.</summary>
+        public int RunsCollapsed { get; set; }
+
+        /// <summary>Runs that were followed by the next start without any result in between.</summary>
+        public int RunsWithoutResult { get; set; }
+
+        /// <summary>Phase events that were not emitted.</summary>
+        public int CollapsedResults { get; set; }
+
+        public DateTime? FirstCollapsedAtUtc { get; set; }
+        public DateTime? LastCollapsedAtUtc { get; set; }
+
+        public DateTime? HeldStartAtUtc { get; set; }
+        public string HeldStartPolicyType { get; set; }
+        public string HeldStartPatternId { get; set; }
+        public bool HeldRunSawResult { get; set; }
+
+        public int RunsCollapsedAtLastSummary { get; set; }
+    }
+
+    /// <summary>What <see cref="RecurringScriptGate"/> collapsed for one policy.</summary>
+    public class ScriptRecurrenceSummary
+    {
+        public string PolicyId { get; set; }
+        public int RunsObserved { get; set; }
+        public int RunsCollapsed { get; set; }
+        public int RunsWithoutResult { get; set; }
+        public int CollapsedResults { get; set; }
+        public DateTime? FirstCollapsedAtUtc { get; set; }
+        public DateTime? LastCollapsedAtUtc { get; set; }
+    }
+}
@@ -29,6 +29,15 @@ public class ScriptExecutionState
    /// </summary>
    public System.DateTime? StartedAtUtc { get; set; }

+    /// <summary>
+    /// Provenance of <see cref="StartedAtUtc"/>: how the start line's offset was obtained. Paired
+    /// with <see cref="ResultProvenance"/> / <see cref="ExitProvenance"/> by the adapter to decide
+    /// whether a run duration is measurable — two lines resolved on different zone assumptions
+    /// differ by whole offset-grid steps, not by run time (session 4377911b: a 10 s script read
+    /// as 3610 s). Null when the start was never observed or on state files from before the field.
+    /// </summary>
+    public CmTraceLineProvenance StartedAtProvenance { get; set; }
+
    /// <summary>"detection", "remediation", or "post-detection" (remediation scripts only).</summary>
    public string ScriptPart { get; set; }

@@ -66,6 +75,9 @@ public class ScriptExecutionState
    /// </summary>
    public System.DateTime? ExitObservedAtUtc { get; set; }

+    /// <summary>Provenance of the exit-code line behind <see cref="ExitObservedAtUtc"/> (the fallback emit's end).</summary>
+    public CmTraceLineProvenance ExitProvenance { get; set; }
+
    /// <summary>
    /// Source (CMTrace) timestamp of the IME <c>PS-SCRIPT-RESULT</c> line that delivered
    /// <see cref="Result"/> (platform scripts, <c>ime_policy_result</c> only). The emitted event is
@@ -76,6 +88,14 @@ public class ScriptExecutionState
    /// </summary>
    public System.DateTime? ResultObservedAtUtc { get; set; }

+    /// <summary>
+    /// Provenance of the line that delivered <see cref="Result"/> — bound here for the same reason
+    /// as <see cref="ResultObservedAtUtc"/>: a held completion is emitted passes later, when the
+    /// tracker's "last matched" provenance describes an unrelated line. For health scripts the
+    /// result line of the phase (HS-COMPLIANCE early signal or HS-NEW-RESULT).
+    /// </summary>
+    public CmTraceLineProvenance ResultProvenance { get; set; }
+
    /// <summary>Pattern id of the line that delivered <see cref="Result"/> (surfaced as <c>patternId</c> on the event).</summary>
    public string ResultPatternId { get; set; }

@@ -142,4 +162,14 @@ public class ScriptStartedInfo

    /// <summary>Numeric IME PolicyType from the start line (captured as string), e.g. "6" for health scripts.</summary>
    public string PolicyType { get; set; }
+
+    /// <summary>
+    /// Source timestamp of the start line when the signal is emitted later than it was read
+    /// (a held start of a recurring health script, see <see cref="RecurringScriptGate"/>). Null
+    /// for a start emitted while its own line is the tracker's last matched one.
+    /// </summary>
+    public System.DateTime? SourceTimestampUtc { get; set; }
+
+    /// <summary>Pattern id of the start line; set together with <see cref="SourceTimestampUtc"/>.</summary>
+    public string PatternId { get; set; }
 }
@@ -24,10 +24,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
    /// <item><c>EspTrackingWin32Apps\&lt;userGuid&gt;\&lt;appGuid&gt;_&lt;rev&gt;</c> — which apps IME
    /// registered for ESP tracking and in which phase.</item>
    /// <item><c>SideCarPolicies\StatusServiceReports\&lt;userGuid&gt;\&lt;appId&gt;</c> — the exact
-    /// AppInstallStatusReport the ESP page renders (Status 1000=Installed .. 3000=Failed).</item>
+    /// AppInstallStatusReport the ESP page renders (Status 1000=Installed, 1001=Installing,
+    /// 1003=InstallingPendingReboot, 2000=NotApplicable, 3000=Failed).</item>
+    /// <item><c>Win32Apps\OperationalState\&lt;userGuid&gt;\&lt;appGuid&gt;</c> (bare GUIDs) — IME's
+    /// per-app operational state: the install deadline a downloaded app is waiting for
+    /// (<c>ExecutionDeadlineTime</c>, IME 1.106+) and the app-in-use deferral counters
+    /// (<c>DeferralsUsed</c>, <c>DeferUntilTime</c>, ..., IME 1.105+).</item>
    /// </list>
    /// The observer is snapshot-and-diff driven (RegistryWatcher gives key-scope edges only,
-    /// coalesced — a per-write parse is impossible by design): every tick re-reads the three
+    /// coalesced — a per-write parse is impossible by design): every tick re-reads the four
    /// surfaces and emits <c>registry_app_state</c> on real field changes. Pre-existing state at
    /// agent start is the silent baseline — Win32Apps keys survive re-enrollments, so replaying
    /// them as fresh events would be the registry twin of the historic-IME-replay bug.
@@ -162,6 +167,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            ReadWin32Apps(root, snapshot);
            ReadEspTracking(root, snapshot);
            ReadStatusServiceReports(root, snapshot);
+            ReadOperationalState(root, snapshot);
            return snapshot;
        }

@@ -250,6 +256,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            }
        }

+        // Only the two wait states are read; the download/execution bookkeeping next to them
+        // (DownloadStatus, DownloadStartTime, ExecutionStatus, ...) duplicates the log narrative
+        // and would double the event volume without adding a state the timeline lacks.
+        private static void ReadOperationalState(RegistryKey root, ImeRegistrySnapshot snapshot)
+        {
+            using var operational = root.OpenSubKey(@"Win32Apps\OperationalState");
+            if (operational == null) return;
+
+            foreach (var userName in operational.GetSubKeyNames())
+            {
+                if (!LooksLikeGuid(userName)) continue;
+                using var userKey = operational.OpenSubKey(userName);
+                if (userKey == null) continue;
+
+                foreach (var appKeyName in userKey.GetSubKeyNames())
+                {
+                    var appId = ExtractAppId(appKeyName);
+                    if (appId == null) continue;
+
+                    using var appKey = userKey.OpenSubKey(appKeyName);
+                    if (appKey == null) continue;
+
+                    var deadline = TryParseRegistryDateTime(appKey.GetValue("ExecutionDeadlineTime"));
+                    var deferralsUsed = TryReadInt(appKey.GetValue("DeferralsUsed"));
+                    if (deadline == null && deferralsUsed == null) continue; // no wait state — no entry of its own
+
+                    var entry = snapshot.GetOrAdd(userName, appId);
+                    entry.InstallDeadlineUtc = deadline;
+                    entry.DeferralsUsed = deferralsUsed;
+                    entry.DeferralMaxDeferrals = TryReadInt(appKey.GetValue("DeferralMaxDeferrals"));
+                    entry.DeferUntilUtc = TryParseRegistryDateTime(appKey.GetValue("DeferUntilTime"));
+                    entry.DeferralAutoDeferred = TryReadBool(appKey.GetValue("DeferralAutoDeferred"));
+                }
+            }
+        }
+
        // ── pure helpers (unit-tested directly) ─────────────────────────────────

        internal static bool LooksLikeGuid(string name) =>
@@ -301,6 +343,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            }
        }

+        internal static bool? TryReadBool(object? value) =>
+            value is string s && bool.TryParse(s, out var parsed) ? parsed : (bool?)null;
+
+        /// <summary>
+        /// OperationalState timestamps are UTC but stored in two InvariantCulture shapes:
+        /// <c>ExecutionDeadlineTime</c> as <c>MM/dd/yyyy HH:mm:ss</c> without a kind marker,
+        /// <c>DeferUntilTime</c> round-trip ("o", trailing Z). Both come back as UTC here.
+        /// </summary>
+        internal static DateTime? TryParseRegistryDateTime(object? value)
+        {
+            if (!(value is string s) || string.IsNullOrWhiteSpace(s)) return null;
+            return DateTime.TryParse(s, CultureInfo.InvariantCulture,
+                DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal, out var parsed)
+                ? parsed
+                : (DateTime?)null;
+        }
+
        /// <summary>StateMessageEnforcementState bands (verified against decompiled IME 1.97/1.104).</summary>
        internal static string ClassifyEnforcementState(int state)
        {
@@ -312,15 +371,59 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            return "unknown";
        }

-        /// <summary>AppInstallStatus (StatusService/ESP page): 1000er = installed, 3000 = failed.</summary>
+        /// <summary>
+        /// AppInstallStatus as IME writes it to StatusServiceReports (unchanged IME 1.50 .. 1.106):
+        /// 1000 Installed, 1001 Installing, 1002 InstalledButDependenciesNotPresent,
+        /// 1003 InstallingPendingReboot, 1004 InstalledPendingReboot, 2000 NotApplicable, 3000 Failed.
+        /// The 1000 band is NOT uniformly terminal — IME maps every InProgress enforcement state to
+        /// 1001 — so the mapping is explicit and an unknown value is not judged.
+        /// </summary>
        internal static string? ClassifyStatusServiceStatus(int status)
        {
-            if (status >= 1000 && status < 2000) return "installed";
-            if (status == 3000) return "failed";
+            switch (status)
+            {
+                case 1000:
+                case 1002:
+                case 1004:
+                    return "installed";
+                case 1001:
+                case 1003:
+                    return "installing";
+                case 3000:
+                    return "failed";
+            }
            if (status >= 2000 && status < 3000) return "notApplicable";
            return null;
        }

+        /// <summary>
+        /// Human-readable suffix for the two IME wait states (install deadline, app-in-use
+        /// deferral); empty when neither applies. Culture-invariant on purpose — the agent runs
+        /// under whatever culture the SYSTEM account carries.
+        /// </summary>
+        internal static string DescribeWaitState(AppRegistryEntry entry)
+        {
+            var parts = new List<string>(2);
+            if (entry.InstallDeadlineUtc is DateTime deadline)
+                parts.Add("downloaded, install deadline " + FormatUtcMinute(deadline));
+
+            if (entry.DeferralsUsed is int used && used > 0)
+            {
+                var kind = entry.DeferralAutoDeferred == true ? "auto-deferred" : "deferred by user";
+                var count = entry.DeferralMaxDeferrals is int max
+                    ? used.ToString(CultureInfo.InvariantCulture) + "/" + max.ToString(CultureInfo.InvariantCulture)
+                    : used.ToString(CultureInfo.InvariantCulture);
+                parts.Add(entry.DeferUntilUtc is DateTime until
+                    ? kind + " " + count + " until " + FormatUtcMinute(until)
+                    : kind + " " + count);
+            }
+
+            return parts.Count == 0 ? string.Empty : ", " + string.Join(", ", parts);
+        }
+
+        private static string FormatUtcMinute(DateTime utc) =>
+            utc.ToString("yyyy-MM-dd HH:mm", CultureInfo.InvariantCulture) + " UTC";
+
        internal static List<AppRegistryChange> DiffSnapshots(ImeRegistrySnapshot previous, ImeRegistrySnapshot next)
        {
            var changes = new List<AppRegistryChange>();
@@ -343,6 +446,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            if (prev?.StatusServiceStatus != next.StatusServiceStatus) changed.Add("statusServiceStatus");
            if ((prev?.EspTracked ?? false) != next.EspTracked) changed.Add("espTracked");
            if (!string.Equals(prev?.EspPhase, next.EspPhase, StringComparison.OrdinalIgnoreCase)) changed.Add("espPhase");
+            // Wait states: the deadline and each recorded deferral are transitions worth an event;
+            // MaxDeferrals / AutoDeferred only travel along as data.
+            if (prev?.InstallDeadlineUtc != next.InstallDeadlineUtc) changed.Add("installDeadline");
+            if (prev?.DeferralsUsed != next.DeferralsUsed) changed.Add("deferralsUsed");
+            if (prev?.DeferUntilUtc != next.DeferUntilUtc) changed.Add("deferUntil");
            return changed;
        }

@@ -445,6 +553,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            }
            if (e.EspTracked) data["espTracked"] = "true";
            if (!string.IsNullOrEmpty(e.EspPhase)) data["espPhase"] = e.EspPhase!;
+            if (e.InstallDeadlineUtc is DateTime deadline) data["installDeadlineUtc"] = deadline.ToString("o", CultureInfo.InvariantCulture);
+            if (e.DeferralsUsed is int used) data["deferralsUsed"] = used.ToString(CultureInfo.InvariantCulture);
+            if (e.DeferralMaxDeferrals is int max) data["deferralMaxDeferrals"] = max.ToString(CultureInfo.InvariantCulture);
+            if (e.DeferUntilUtc is DateTime until) data["deferUntilUtc"] = until.ToString("o", CultureInfo.InvariantCulture);
+            if (e.DeferralAutoDeferred is bool auto) data["deferralAutoDeferred"] = auto ? "true" : "false";

            var summary = data.TryGetValue("enforcementClass", out var encls) ? encls
                        : data.TryGetValue("statusServiceClass", out var sscls) ? sscls
@@ -453,7 +566,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            _post.Emit(
                eventType: SharedEventTypes.RegistryAppState,
                source: SourceLabel,
-                message: $"Registry app state: {e.AppId} ({(e.UserContext == ImeRegistrySnapshot.DeviceContext ? "device" : "user")}) -> {summary}",
+                message: $"Registry app state: {e.AppId} ({(e.UserContext == ImeRegistrySnapshot.DeviceContext ? "device" : "user")}) -> {summary}{DescribeWaitState(e)}",
                severity: EventSeverity.Info,
                data: data,
                occurredAtUtc: nowUtc);
@@ -625,6 +738,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        public int? StatusServiceStatus { get; set; }
        public bool EspTracked { get; set; }
        public string? EspPhase { get; set; }
+
+        // Win32Apps\OperationalState — the two IME wait states (all UTC).
+        public DateTime? InstallDeadlineUtc { get; set; }
+        public int? DeferralsUsed { get; set; }
+        public int? DeferralMaxDeferrals { get; set; }
+        public DateTime? DeferUntilUtc { get; set; }
+        public bool? DeferralAutoDeferred { get; set; }
    }

    internal sealed class AppRegistryChange
@@ -61,6 +61,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            // detection — the exact scenario the power watcher exists to observe.
            SharedConstants.EventTypes.PowerStateChange,

+            // Same for the network link: a dock or access point that flaps for hours (field:
+            // 288 lost/connected pairs in 11 h, each with its connectivity check) is not
+            // enrollment progress. Counted as activity it kept the periodic collectors running
+            // for the whole episode and hid the stall it was causing, because every flap reset
+            // the stall clock. Progress that follows a reconnect arrives as its own download,
+            // app or phase event.
+            SharedConstants.EventTypes.NetworkStateChange,
+            SharedConstants.EventTypes.NetworkConnectivityCheck,
+
            // Same reasoning for the system timeline watcher: a clock step, a wake from standby,
            // or a backfilled episode at agent start is environment observation and must not
            // reset the idle/stall clocks.
@@ -81,6 +90,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            // says something about the agent, not about the device's enrollment progress.
            SharedConstants.EventTypes.ImeTrackerDegraded,
            SharedConstants.EventTypes.ImePatternHits,
+            // Bookkeeping of runs that were deliberately not reported as activity.
+            SharedConstants.EventTypes.ScriptRecurrenceSummary,
        };

        /// <summary>
@@ -94,6 +94,8 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
        private readonly Action<AppPackageState, DateTime?> _ourOnDoTelemetryReceived;
        private readonly Action<ScriptExecutionState> _ourOnScriptCompleted;
        private readonly Action<ScriptStartedInfo> _ourOnScriptStarted;
+        private readonly Action<ScriptRecurrenceSummary>? _prevOnScriptRecurrenceSummary;
+        private readonly Action<ScriptRecurrenceSummary> _ourOnScriptRecurrenceSummary;
        private readonly Action<string, string> _ourOnImeTokenFailure;

        // Dedup state for DecisionSignals.
@@ -195,6 +197,7 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            _prevOnDoTelemetryReceived = _tracker.OnDoTelemetryReceived;
            _prevOnScriptCompleted = _tracker.OnScriptCompleted;
            _prevOnScriptStarted = _tracker.OnScriptStarted;
+            _prevOnScriptRecurrenceSummary = _tracker.OnScriptRecurrenceSummary;
            _prevOnImeTokenFailure = _tracker.OnImeTokenFailure;
            _prevOnTrackerDegraded = _tracker.OnTrackerDegraded;

@@ -209,6 +212,7 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            _ourOnDoTelemetryReceived = OnDoTelemetryReceived;
            _ourOnScriptCompleted = OnScriptCompleted;
            _ourOnScriptStarted = OnScriptStarted;
+            _ourOnScriptRecurrenceSummary = OnScriptRecurrenceSummary;
            _ourOnImeTokenFailure = OnImeTokenFailure;

            _tracker.OnEspPhaseChanged = _ourOnEspPhaseChanged;
@@ -219,6 +223,7 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            _tracker.OnDoTelemetryReceived = _ourOnDoTelemetryReceived;
            _tracker.OnScriptCompleted = _ourOnScriptCompleted;
            _tracker.OnScriptStarted = _ourOnScriptStarted;
+            _tracker.OnScriptRecurrenceSummary = _ourOnScriptRecurrenceSummary;
            _tracker.OnImeTokenFailure = _ourOnImeTokenFailure;
            _tracker.OnTrackerDegraded = _ourOnTrackerDegraded;
        }
@@ -245,6 +250,8 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                _tracker.OnScriptCompleted = _prevOnScriptCompleted;
            if (ReferenceEquals(_tracker.OnScriptStarted, _ourOnScriptStarted))
                _tracker.OnScriptStarted = _prevOnScriptStarted;
+            if (ReferenceEquals(_tracker.OnScriptRecurrenceSummary, _ourOnScriptRecurrenceSummary))
+                _tracker.OnScriptRecurrenceSummary = _prevOnScriptRecurrenceSummary;
            if (ReferenceEquals(_tracker.OnImeTokenFailure, _ourOnImeTokenFailure))
                _tracker.OnImeTokenFailure = _prevOnImeTokenFailure;
        }
@@ -297,6 +304,12 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            EmitScriptStarted(info);
        }

+        private void OnScriptRecurrenceSummary(ScriptRecurrenceSummary summary)
+        {
+            _prevOnScriptRecurrenceSummary?.Invoke(summary);
+            EmitScriptRecurrenceSummary(summary);
+        }
+
        private void OnImeTokenFailure(string errorCode, string message)
        {
            _prevOnImeTokenFailure?.Invoke(errorCode, message);
@@ -448,31 +461,35 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
        /// no second clock frame, so there is nothing to record.
        /// </para>
        /// </summary>
-        private void TagDerivedTimestamp(IDictionary<string, string> data, bool derivedFromClock, DateTime? rawSourceTs)
+        private void TagDerivedTimestamp(IDictionary<string, string> data, bool derivedFromClock, DateTime? rawSourceTs, CmTraceLineProvenance? lineProvenance = null)
        {
            var culture = System.Globalization.CultureInfo.InvariantCulture;

-            var sourceLocal = _tracker.LastMatchedSourceLocalTimestamp;
+            // The line the event is bound to. Callers that emit later than the match (a held
+            // platform-script result) pass the snapshot taken at their line; everyone else is
+            // emitting while its line is still the last matched one.
+            var line = lineProvenance ?? _tracker.CaptureLastMatchedProvenance();
+            var sourceLocal = line.SourceLocalTs;
            if (sourceLocal.HasValue)
            {
                // No zone suffix: the value genuinely carries none, and formatting one in would
                // re-introduce the very assumption this whole change removes.
                data["sourceLocalTs"] = sourceLocal.Value.ToString("yyyy-MM-ddTHH:mm:ss.fffffff", culture);
-                data["sourceOffsetOrigin"] = OriginTag(_tracker.LastMatchedSourceOffsetOrigin);
+                data["sourceOffsetOrigin"] = OriginTag(line.Origin);

-                var offsetMinutes = _tracker.LastMatchedSourceOffsetMinutes;
+                var offsetMinutes = line.OffsetMinutes;
                if (offsetMinutes.HasValue)
                    data["sourceOffsetMinutes"] = offsetMinutes.Value.ToString(culture);

                // Which era anchor the offset came from — forensics for the era-anchored origin.
-                var anchorKind = _tracker.LastMatchedEraAnchorKind;
+                var anchorKind = line.EraAnchorKind;
                if (!string.IsNullOrEmpty(anchorKind))
                    data["sourceOffsetAnchor"] = anchorKind;

                // Observational only — what the calibrator measured, which since the 2026-08-20
                // revert is deliberately NOT what was applied. Kept separate so the two can never
                // be read as the same thing.
-                var measured = _tracker.LastMatchedMeasuredWriterOffsetMinutes;
+                var measured = line.MeasuredWriterOffsetMinutes;
                if (measured.HasValue)
                    data["measuredWriterOffsetMinutes"] = measured.Value.ToString(culture);
            }
@@ -1280,7 +1297,11 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            if (SuppressIfHistoricReplay(derivedFromClock, rawSourceTs, eventType, script.PolicyId))
                return;

-            TagDerivedTimestamp(data, derivedFromClock, rawSourceTs);
+            // The line that delivered the result is bound on the state (D-247), so a completion
+            // emitted passes later still describes ITS line. Null (states from before the field,
+            // synthetic tests) falls back to the tracker's last matched line as before.
+            var endProvenance = isFallback ? script.ExitProvenance : script.ResultProvenance;
+            TagDerivedTimestamp(data, derivedFromClock, rawSourceTs, endProvenance);

            // Per-script run duration (start line → this completion). Surfaced on every
            // script completion so the UI can flag slow / inefficient scripts, not just timed-out
@@ -1288,11 +1309,13 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            // against clock skew between the (possibly clock-derived) completion stamp and start.
            //
            // When the completion timestamp was clock-derived because the source line's timestamp
-            // was rejected (future-skew CMTrace clock jump — the stale case never reaches here),
-            // `now` lives on the clock's timeline while StartedAtUtc was captured RAW from the
-            // source log. Mixing the two produced absurd durations (session eaf3d8c4: 170 h), so
-            // the duration uses the raw source pair — both ends on the same timeline, the
-            // difference is the true runtime. The event stamp stays `now` (timeline position).
+            // was rejected (future-skew — the stale case never reaches here), `now` lives on the
+            // clock's timeline while StartedAtUtc was captured RAW from the source log. Mixing the
+            // two produced absurd durations (session eaf3d8c4: 170 h), so the span is taken from
+            // the raw source pair. That pair is a run time only when both lines were resolved on
+            // the same zone belief — JudgeDurationPair decides, from the provenance bound to each
+            // line, whether the span is verified, unverified, or an offset error to omit (session
+            // 4377911b: a 10 s script read as 3610 s). The event stamp stays `now`.
            //
            // L19 (delta review 2026-07-02): the same field name carries two different semantics —
            // start→own-end-signal (≈ script runtime) vs HS-SCRIPT-START→HS-NEW-RESULT (the whole
@@ -1304,15 +1327,26 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            var completionForDuration = derivedFromClock && rawSourceTs.HasValue
                ? NormalizeUtc(rawSourceTs.Value)
                : now;
+            TimeSpan? measurableDuration = null;
            if (script.StartedAtUtc.HasValue)
            {
-                var durationSeconds = (completionForDuration - script.StartedAtUtc.Value).TotalSeconds;
+                var span = completionForDuration - script.StartedAtUtc.Value;
+                var verdict = JudgeDurationPair(script.StartedAtProvenance, endProvenance,
+                    endStampRejected: derivedFromClock && rawSourceTs.HasValue, span, out var suppressedReason);
+                if (verdict != DurationPairVerdict.Unknown)
+                    data["durationProvenance"] = verdict == DurationPairVerdict.Verified ? "verified" : "unverified";
+
+                if (verdict == DurationPairVerdict.Suppressed)
+                {
+                    data["durationSuppressedReason"] = suppressedReason!;
+                }
                // Plausibility backstop: IME's script execution timeout is ~30 min; anything above
                // 24 h is a cross-run artifact (e.g. a stale pending start slot from a previous
                // enrollment paired with a fresh completion) — omit rather than lie.
-                if (durationSeconds >= 0 && durationSeconds <= StaleSourceThreshold.TotalSeconds)
+                else if (span >= TimeSpan.Zero && span <= StaleSourceThreshold)
                {
-                    data["durationSeconds"] = durationSeconds.ToString("F2", culture);
+                    measurableDuration = span;
+                    data["durationSeconds"] = span.TotalSeconds.ToString("F2", culture);
                    data["durationBasis"] = script.DurationBasis
                        ?? (IsRemediation(script.ScriptType)
                            ? "cycle_including_reporting_latency"
@@ -1320,6 +1354,18 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                }
            }

+            // The start line's provenance, next to the end line's (sourceOffset*), so the pair can
+            // be judged downstream as well.
+            var startProvenance = script.StartedAtProvenance;
+            if (startProvenance != null && startProvenance.SourceLocalTs.HasValue)
+            {
+                data["startSourceOffsetOrigin"] = OriginTag(startProvenance.Origin);
+                if (startProvenance.OffsetMinutes.HasValue)
+                    data["startSourceOffsetMinutes"] = startProvenance.OffsetMinutes.Value.ToString(culture);
+                if (!string.IsNullOrEmpty(startProvenance.EraAnchorKind))
+                    data["startSourceOffsetAnchor"] = startProvenance.EraAnchorKind;
+            }
+
            var label = IsRemediation(script.ScriptType) ? "Remediation script" : "Platform script";
            var shortId = script.PolicyId.Length >= 8 ? script.PolicyId.Substring(0, 8) : script.PolicyId;
            string messageCore;
@@ -1362,7 +1408,51 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                $"ImeAdapter: script completed policyId={shortId} type={script.ScriptType ?? "?"} result={script.Result ?? "?"} exit={(script.ExitCode.HasValue ? script.ExitCode.Value.ToString() : "n/a")}");

            MaybeEmitBootstrapDetected(script, now);
-            MaybeEmitScriptTimeoutSuspected(script, now, completionForDuration);
+            MaybeEmitScriptTimeoutSuspected(script, now, measurableDuration);
+        }
+
+        internal enum DurationPairVerdict { Unknown, Verified, Unverified, Suppressed }
+
+        /// <summary>
+        /// Whether the span between a start line and an end line measures elapsed time.
+        /// <para>
+        /// Each CMTrace line is resolved on its own zone belief: declared or measured (bias,
+        /// line-anchored, or the clock itself) — or ASSUMED (the reader's zone, a writer era's
+        /// anchor). Two measured ends sit on the true UTC axis; two assumed ends resolved with the
+        /// same offset from the same file share their error, which cancels (D-191). Any other pair
+        /// is unverified, and its span is omitted when the end stamp was rejected as ahead of the
+        /// clock — its assumption is proven wrong and the raw pair inherits the error (session
+        /// 4377911b: a 10 s script read as 3610 s) — or when the span sits on the 15-minute offset
+        /// grid, the signature of a wrong assumption on either end (session cbaed57b: 7200 s). A
+        /// missing snapshot (state files from before the field, synthetic tests) leaves the rule
+        /// off and the pair treated as before.
+        /// </para>
+        /// </summary>
+        internal static DurationPairVerdict JudgeDurationPair(
+            CmTraceLineProvenance? start, CmTraceLineProvenance? end, bool endStampRejected, TimeSpan span, out string? suppressedReason)
+        {
+            suppressedReason = null;
+            if (start == null || end == null) return DurationPairVerdict.Unknown;
+
+            var startAssumed = start.IsAssumed();
+            var endAssumed = end.IsAssumed();
+            var sameTimeline = (!startAssumed && !endAssumed)
+                || (startAssumed && endAssumed
+                    && start.OffsetMinutes == end.OffsetMinutes
+                    && string.Equals(start.SourceFileName, end.SourceFileName, StringComparison.OrdinalIgnoreCase));
+            if (sameTimeline) return DurationPairVerdict.Verified;
+
+            if (endStampRejected)
+            {
+                suppressedReason = "rejected-endpoint";
+                return DurationPairVerdict.Suppressed;
+            }
+            if (CmTraceOffsetCalibrator.IsOnOffsetGrid(span, out _))
+            {
+                suppressedReason = "offset-grid";
+                return DurationPairVerdict.Suppressed;
+            }
+            return DurationPairVerdict.Unverified;
        }

        /// <summary>
@@ -1374,19 +1464,19 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
        /// late start / pre-failed ESP. Advisory only: no state mutation, the underlying
        /// <c>script_failed</c> is still emitted separately. Health (remediation) scripts are
        /// excluded — they re-run on their own cadence and have a different timeout regime.
-        /// <paramref name="durationEndUtc"/> is the timeline-consistent completion for duration
-        /// math (raw source ts on rejected-timestamp emissions); <paramref name="occurredAtUtc"/>
-        /// stamps the emitted event.
+        /// <paramref name="measurableDuration"/> is the run duration the completion event carries —
+        /// null when it was omitted (no start line, implausible span, or a start/end pair resolved
+        /// on different zone assumptions: the fleet's daily 17 h "timeouts" of 2–9 s scripts were
+        /// offset errors); <paramref name="occurredAtUtc"/> stamps the emitted event.
        /// </summary>
-        private void MaybeEmitScriptTimeoutSuspected(ScriptExecutionState script, DateTime occurredAtUtc, DateTime durationEndUtc)
+        private void MaybeEmitScriptTimeoutSuspected(ScriptExecutionState script, DateTime occurredAtUtc, TimeSpan? measurableDuration)
        {
            if (IsRemediation(script.ScriptType)) return;                 // platform scripts only
-            if (!script.StartedAtUtc.HasValue) return;                    // no start ⇒ no duration
+            if (!measurableDuration.HasValue) return;                     // no measurable duration ⇒ no verdict
            if (!string.Equals(script.Result, "Failed", StringComparison.OrdinalIgnoreCase)) return;

-            var duration = durationEndUtc - script.StartedAtUtc.Value;
+            var duration = measurableDuration.Value;
            if (duration < ScriptTimeoutSuspectedThreshold) return;
-            if (duration > StaleSourceThreshold) return;                  // implausible — cross-run artifact, not a hung script

            if (!_tracker.TryClaimScriptTimeoutSuspected(script.PolicyId)) return; // restart-safe dedup per policyId (persisted tracker state)

@@ -1464,10 +1554,13 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            };
            if (!string.IsNullOrEmpty(info.ScriptType)) data["scriptType"] = info.ScriptType!;
            if (!string.IsNullOrEmpty(info.PolicyType)) data["policyType"] = info.PolicyType!;
-            var patternId = _tracker.LastMatchedPatternId;
+            // A held start of a recurring health script arrives with its own line's stamp and
+            // pattern — by now the tracker's "last matched" line is the result line.
+            var wasHeld = info.SourceTimestampUtc.HasValue;
+            var patternId = wasHeld ? info.PatternId : _tracker.LastMatchedPatternId;
            if (!string.IsNullOrEmpty(patternId)) data["patternId"] = patternId!;

-            var now = ResolveOccurredAt(out var derivedFromClock, out var rawSourceTs);
+            var now = ResolveOccurredAt(info.SourceTimestampUtc, out var derivedFromClock, out var rawSourceTs);

            // Historic replay — suppressing here also kills the immediateUpload flood the
            // replayed batch caused (session eaf3d8c4: 3× ingress_backpressure).
@@ -1485,13 +1578,42 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                message: $"{label} {shortId}: started",
                // Live UI indicator — flush immediately so the running card appears within seconds,
                // not at the next batch boundary (which would defeat the purpose of a live signal).
-                immediateUpload: true,
+                // A held start is no longer live and rides the normal batch.
+                immediateUpload: !wasHeld,
                data: data,
                occurredAtUtc: now);

            _logger?.Debug($"ImeAdapter: script started policyId={shortId} type={info.ScriptType ?? "?"} policyType={info.PolicyType ?? "?"}");
        }

+        private void EmitScriptRecurrenceSummary(ScriptRecurrenceSummary summary)
+        {
+            if (summary == null || string.IsNullOrEmpty(summary.PolicyId)) return;
+
+            var culture = System.Globalization.CultureInfo.InvariantCulture;
+            var data = new Dictionary<string, string>(StringComparer.Ordinal)
+            {
+                ["policyId"] = summary.PolicyId,
+                ["scriptType"] = "remediation",
+                ["runsObserved"] = summary.RunsObserved.ToString(culture),
+                ["runsCollapsed"] = summary.RunsCollapsed.ToString(culture),
+                ["runsWithoutResult"] = summary.RunsWithoutResult.ToString(culture),
+                ["collapsedResults"] = summary.CollapsedResults.ToString(culture),
+            };
+            if (summary.FirstCollapsedAtUtc.HasValue)
+                data["firstCollapsedAt"] = NormalizeUtc(summary.FirstCollapsedAtUtc.Value).ToString("o", culture);
+            if (summary.LastCollapsedAtUtc.HasValue)
+                data["lastCollapsedAt"] = NormalizeUtc(summary.LastCollapsedAtUtc.Value).ToString("o", culture);
+
+            var shortId = summary.PolicyId.Length >= 8 ? summary.PolicyId.Substring(0, 8) : summary.PolicyId;
+            _post.Emit(
+                eventType: SharedEventTypes.ScriptRecurrenceSummary,
+                source: SourceLabel,
+                message: $"Health script {shortId}: {summary.RunsCollapsed} further run(s) repeated the last reported result",
+                severity: EventSeverity.Info,
+                data: data);
+        }
+
        private static bool IsRemediation(string? scriptType) =>
            string.Equals(scriptType, "remediation", StringComparison.OrdinalIgnoreCase);

@@ -0,0 +1,156 @@
+using System.Text.Json;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Models.Backup;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Wire-identity proof for moving the backup job, row-restore and queued-run bodies off their
+/// private <c>WriteJsonAsync(req, status, object)</c> wrappers onto <c>ResponseHelper</c>.
+/// Two things changed at once and both are pinned here: the anonymous 202 bodies became DTOs,
+/// and the typed bodies left <see cref="BackupManifestJson.SerializerOptions"/> for the worker
+/// pipeline (<see cref="ApiJsonOptions"/>). The two option sets differ only in how they READ
+/// enums (<c>allowIntegerValues</c>); the facts below keep the WRITE side honest if either set
+/// ever gains a naming policy, a key policy or a converter.
+/// </summary>
+public class BackupWireParityTests
+{
+    private static readonly JsonSerializerOptions WireOptions = ApiJsonOptions.Create();
+
+    private static JsonElement Json(string raw)
+    {
+        using var doc = JsonDocument.Parse(raw);
+        return doc.RootElement.Clone();
+    }
+
+    private static void AssertSameUnderBothOptionSets(object body)
+    {
+        var backupSurface = JsonSerializer.Serialize(body, body.GetType(), BackupManifestJson.SerializerOptions);
+        var pipeline = JsonSerializer.Serialize(body, body.GetType(), WireOptions);
+        Assert.Equal(backupSurface, pipeline);
+    }
+
+    [Fact]
+    public void BackupJobStatus_serializes_identically_under_both_option_sets()
+    {
+        var t = new DateTime(2026, 9, 21, 4, 0, 0, DateTimeKind.Utc);
+
+        AssertSameUnderBothOptionSets(new BackupJobStatus
+        {
+            JobId = "0f8fad5bd9cb469fa16570867728950e",
+            Kind = BackupJobKind.RestoreTable,
+            State = BackupJobState.BlockedTerminal,
+            RequestedBy = "admin@contoso.example",
+            QueuedAtUtc = t,
+            StartedAtUtc = t.AddSeconds(3),
+            CompletedAtUtc = t.AddMinutes(2),
+            LastHeartbeatUtc = t.AddMinutes(2),
+            BackupId = "20260921T040000Z_a1b2c3d4",
+            SourceBackupId = "20260920T040000Z_e5f6a7b8",
+            TableName = "TenantConfiguration",
+            Strategy = "upsert-only",
+            Progress = "{\"phase\":\"copy\",\"rows\":12}",
+            Error = "IntegrityCheckFailed",
+            BackupOutcome = BackupOutcome.Partial,
+        });
+
+        // Freshly queued: every nullable slot absent on both sides.
+        AssertSameUnderBothOptionSets(new BackupJobStatus
+        {
+            JobId = "0f8fad5bd9cb469fa16570867728950e",
+            Kind = BackupJobKind.Backup,
+            State = BackupJobState.Queued,
+            RequestedBy = "admin@contoso.example",
+            QueuedAtUtc = t,
+            LastHeartbeatUtc = t,
+        });
+    }
+
+    [Fact]
+    public void RestoreRowPreviewResponse_serializes_identically_under_both_option_sets()
+    {
+        var text = new RestoreRowPropertySnapshot { EdmType = "Edm.String", Value = Json("\"Pro\"") };
+        var flag = new RestoreRowPropertySnapshot { EdmType = "Edm.Boolean", Value = Json("true") };
+        var number = new RestoreRowPropertySnapshot { EdmType = "Edm.Int64", Value = Json("\"9007199254740993\"") };
+
+        AssertSameUnderBothOptionSets(new RestoreRowPreviewResponse
+        {
+            BackupId = "20260921T040000Z_a1b2c3d4",
+            TableName = "TenantConfiguration",
+            PartitionKey = "tenant/with+odd%chars",
+            RowKey = "config",
+            // Case-faithful column names: a key policy on either side would rewrite them.
+            BackupProperties = { ["PlanTier"] = text, ["IsEnabled"] = flag, ["lowerCaseColumn"] = number },
+            CurrentProperties = new Dictionary<string, RestoreRowPropertySnapshot> { ["PlanTier"] = text },
+            Diff =
+            {
+                new RestoreRowPropertyDiff { Name = "IsEnabled", Kind = RestoreRowDiffKind.Added, Backup = flag },
+                new RestoreRowPropertyDiff { Name = "PlanTier", Kind = RestoreRowDiffKind.Unchanged, Backup = text, Current = text },
+            },
+            RowSha256 = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
+            CurrentETag = "W/\"datetime'2026-09-21T04%3A00%3A00Z'\"",
+            IsAuthTable = true,
+        });
+
+        // Live row absent: currentProperties and currentETag vanish on both sides.
+        AssertSameUnderBothOptionSets(new RestoreRowPreviewResponse
+        {
+            BackupId = "20260921T040000Z_a1b2c3d4",
+            TableName = "TenantConfiguration",
+            PartitionKey = "pk",
+            RowKey = "rk",
+            BackupProperties = { ["PlanTier"] = text },
+            Diff = { new RestoreRowPropertyDiff { Name = "PlanTier", Kind = RestoreRowDiffKind.Added, Backup = text } },
+            RowSha256 = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
+        });
+    }
+
+    [Fact]
+    public void RestoreRowCommitResponse_serializes_identically_under_both_option_sets()
+    {
+        AssertSameUnderBothOptionSets(new RestoreRowCommitResponse
+        {
+            BackupId = "20260921T040000Z_a1b2c3d4",
+            TableName = "TenantConfiguration",
+            PartitionKey = "pk",
+            RowKey = "rk",
+            Outcome = RestoreRowCommitOutcome.Replaced,
+        });
+    }
+
+    [Fact]
+    public void BackupTriggerResponse_matches_the_anonymous_202_body()
+    {
+        const string jobId = "0f8fad5bd9cb469fa16570867728950e";
+        var old = new { jobId, statusUrl = $"/api/global/backups/jobs/{jobId}" };
+
+        Assert.Equal(
+            JsonSerializer.Serialize(old, old.GetType(), BackupManifestJson.SerializerOptions),
+            JsonSerializer.Serialize(
+                new BackupTriggerResponse { JobId = jobId, StatusUrl = $"/api/global/backups/jobs/{jobId}" },
+                WireOptions));
+    }
+
+    [Fact]
+    public void SessionDeletionMaintenanceTriggerResponse_matches_the_anonymous_202_body()
+    {
+        var old = new { message = "Maintenance run queued.", triggeredBy = "admin@contoso.example" };
+
+        // The old wrapper serialized with DEFAULT options; its keys were camelCase by hand.
+        Assert.Equal(
+            JsonSerializer.Serialize(old, old.GetType()),
+            JsonSerializer.Serialize(
+                new SessionDeletionMaintenanceTriggerResponse { Message = "Maintenance run queued.", TriggeredBy = "admin@contoso.example" },
+                WireOptions));
+    }
+
+    [Fact]
+    public void Delegation_acknowledgements_match_the_anonymous_message_body()
+    {
+        ApiResponseWireParityTests.AssertWireIdentical(
+            new { message = "Delegation ended" },
+            new MessageResponse { Message = "Delegation ended" });
+    }
+}
@@ -156,6 +156,8 @@ public sealed class BootstrapRouteFailClosedTests

        reqMock.SetupGet(r => r.Headers).Returns(headers);
        reqMock.SetupGet(r => r.Url).Returns(new Uri(url));
+        // Query is virtual: without CallBase a loose mock answers null instead of parsing Url.
+        reqMock.SetupGet(r => r.Query).CallBase();
        return reqMock.Object;
    }
 }
@@ -526,7 +526,41 @@ public class DelegationSelfServiceTests
        Assert.Equal(Now.AddDays(-3), owned.SinceUtc);
        var direct = managers.Single(m => m.GroupId == null);
        Assert.Equal(DelegationSelfService.SourceOperator, direct.Source);
+        Assert.Equal(DelegationSelfService.OperatorLabel, direct.Name);
        Assert.False(direct.Revocable);
        Assert.Single(direct.Assignees); // the revoked row confers nothing
    }
+
+    [Fact]
+    public async Task ListManagers_OperatorGroup_ShowsNeutralLabelNotItsName_ButItsAssignees()
+    {
+        const string operatorGroupId = "0f1e2d3c4b5a69788796a5b4c3d2e1f0";
+        var h = Build();
+        h.Repo.Setup(x => x.GetGroupIdsContainingTenantAsync(Customer)).ReturnsAsync(new List<string> { operatorGroupId });
+        h.Repo.Setup(x => x.GetTenantGroupAsync(operatorGroupId)).ReturnsAsync(new TenantGroup
+        {
+            GroupId = operatorGroupId,
+            Name = "Internal MSP customers north",
+            OwnerTenantId = null,
+            TenantIds = new List<string> { Customer, Other },
+            Assignees = new List<TenantGroupAssignment>
+            {
+                new() { Upn = "ops@vendor.example", GroupId = operatorGroupId, Role = Constants.DelegatedRoles.DelegatedReader, IsEnabled = true },
+                new() { Upn = "ops2@vendor.example", GroupId = operatorGroupId, Role = Constants.DelegatedRoles.DelegatedReader, IsEnabled = true },
+            },
+        });
+
+        var managers = await h.Svc.ListManagersAsync(Customer);
+
+        var group = Assert.Single(managers);
+        Assert.Equal(operatorGroupId, group.GroupId);
+        Assert.Equal(DelegationSelfService.OperatorLabel, group.Name);
+        Assert.DoesNotContain("north", group.Name, StringComparison.OrdinalIgnoreCase);
+        Assert.Null(group.OwnerTenantId);
+        Assert.Null(group.OwnerDomain);
+        Assert.Null(group.SinceUtc);
+        Assert.Equal(DelegationSelfService.SourceOperator, group.Source);
+        Assert.False(group.Revocable);
+        Assert.Equal(2, group.Assignees.Count);
+    }
 }
@@ -194,7 +194,7 @@ public class DelegationWireParityTests
                managers = new object[]
                {
                    new { groupId = (string?)("msp-" + Home), ownerTenantId = (string?)Home, ownerDomain = (string?)"partner.example", name = "Customers of partner.example", source = "self-service", assignees, sinceUtc = (DateTime?)since, revocable = true },
-                    new { groupId = nullGroup, ownerTenantId = nullOwner, ownerDomain = nullDomain, name = "Platform operators", source = "operator", assignees, sinceUtc = (DateTime?)null, revocable = false },
+                    new { groupId = nullGroup, ownerTenantId = nullOwner, ownerDomain = nullDomain, name = "Platform support", source = "operator", assignees, sinceUtc = (DateTime?)null, revocable = false },
                },
            },
            new TenantManagerListResponse
@@ -204,7 +204,7 @@ public class DelegationWireParityTests
                {
                    new() { GroupId = "msp-" + Home, OwnerTenantId = Home, OwnerDomain = "partner.example", Name = "Customers of partner.example", Source = "self-service",
                            Assignees = new List<TenantManagerAssignee> { new() { Upn = "analyst@partner.example", Role = "DelegatedReader", IsEnabled = true } }, SinceUtc = since, Revocable = true },
-                    new() { Name = "Platform operators", Source = "operator",
+                    new() { Name = "Platform support", Source = "operator",
                            Assignees = new List<TenantManagerAssignee> { new() { Upn = "analyst@partner.example", Role = "DelegatedReader", IsEnabled = true } }, Revocable = false },
                },
            });
@@ -32,24 +32,28 @@ public sealed class EmailServiceTests
    // ----- configuration gates -----

    [Fact]
-    public async Task SendAsync_EmptyApiKey_NoOps_AndLogsMissingKeyDebugLine()
+    public async Task SendAsync_EmptyApiKey_NoOps_ReturnsFalse_AndLogsMissingKeyWarning()
    {
        var (sut, handler, logger) = Build(apiKey: "");

-        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId, CancellationToken.None);
+        var sent = await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId, CancellationToken.None);

+        Assert.False(sent);
        Assert.Equal(0, handler.CallCount);
+        // Warning, not Debug: same reasoning as the welcome mail — worker logs below Warning never
+        // reach Application Insights, and the handler records FarewellEmailFailed on the false.
        Assert.Contains(logger.Entries,
-            e => e.Level == LogLevel.Debug && e.Message.Contains("Email:ApiKey not configured"));
+            e => e.Level == LogLevel.Warning && e.Message.Contains("Email:ApiKey not configured"));
    }

    [Fact]
-    public async Task SendAsync_EmptyRecipient_NoOps_AndLogsMissingEmailDebugLine()
+    public async Task SendAsync_EmptyRecipient_NoOps_ReturnsFalse_AndLogsMissingEmailDebugLine()
    {
        var (sut, handler, logger) = Build(apiKey: "any-non-empty-key");

-        await sut.SendAsync("", "contoso.invalid", TenantId);
+        var sent = await sut.SendAsync("", "contoso.invalid", TenantId);

+        Assert.False(sent);
        Assert.Equal(0, handler.CallCount);
        Assert.Contains(logger.Entries,
            e => e.Level == LogLevel.Debug && e.Message.Contains("No notification email captured"));
@@ -65,7 +69,7 @@ public sealed class EmailServiceTests
        await sut.SendAsync("", "contoso.invalid", TenantId);

        Assert.Contains(logger.Entries,
-            e => e.Level == LogLevel.Debug && e.Message.Contains("Email:ApiKey not configured"));
+            e => e.Level == LogLevel.Warning && e.Message.Contains("Email:ApiKey not configured"));
        Assert.DoesNotContain(logger.Entries,
            e => e.Message.Contains("No notification email captured"));
    }
@@ -123,8 +127,9 @@ public sealed class EmailServiceTests
    {
        var (sut, handler, logger) = Build(apiKey: "md-test-key");

-        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+        var sent = await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);

+        Assert.True(sent);
        using var doc = JsonDocument.Parse(handler.LastBody!);
        var message = doc.RootElement.GetProperty("message");
        Assert.Equal(EmailTemplates.OffboardingFarewellSubject, message.GetProperty("subject").GetString());
@@ -161,8 +166,9 @@ public sealed class EmailServiceTests
            responder: _ => Json(HttpStatusCode.InternalServerError,
                "{\"status\":\"error\",\"code\":-1,\"name\":\"Invalid_Key\",\"message\":\"Invalid API key\"}"));

-        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+        var sent = await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);

+        Assert.False(sent);
        Assert.Contains(logger.Entries,
            e => e.Level == LogLevel.Warning && e.Message.Contains("500") && e.Message.Contains("Invalid_Key"));
        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Information);
@@ -175,8 +181,9 @@ public sealed class EmailServiceTests
            responder: _ => Json(HttpStatusCode.OK,
                "[{\"email\":\"ops@contoso.invalid\",\"status\":\"rejected\",\"reject_reason\":\"hard-bounce\",\"_id\":\"abc\"}]"));

-        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+        var sent = await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);

+        Assert.False(sent);
        Assert.Contains(logger.Entries,
            e => e.Level == LogLevel.Warning && e.Message.Contains("rejected") && e.Message.Contains("hard-bounce"));
        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Information);
@@ -192,8 +199,9 @@ public sealed class EmailServiceTests
            responder: _ => Json(HttpStatusCode.OK,
                $"[{{\"email\":\"ops@contoso.invalid\",\"status\":\"{status}\",\"_id\":\"abc\"}}]"));

-        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+        var sent = await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);

+        Assert.True(sent);
        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Information);
        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Warning);
    }
@@ -204,8 +212,9 @@ public sealed class EmailServiceTests
        var (sut, _, logger) = Build(apiKey: "md-test-key",
            responder: _ => Json(HttpStatusCode.OK, "not json"));

-        await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);
+        var sent = await sut.SendAsync("ops@contoso.invalid", "contoso.invalid", TenantId);

+        Assert.False(sent);
        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Warning);
        Assert.DoesNotContain(logger.Entries, e => e.Level == LogLevel.Information);
    }
@@ -237,6 +237,22 @@ public class EndpointPolicyCatalogCompletenessTests
            string.Join("\n", missing.Select(m => $"  - {m}")));
    }

+    /// <summary>
+    /// AllowedDuringOffboarding punches a hole in the tenant suspension gate (offboarding tombstone only).
+    /// It exists for exactly one route — the farewell feedback a departing admin submits after the offboard
+    /// endpoint has already tombstoned their tenant. Any second route here needs the same justification.
+    /// </summary>
+    [Fact]
+    public void AllowedDuringOffboarding_IsOnlyTheFarewellFeedbackRoute()
+    {
+        var routes = EndpointAccessPolicyCatalog.Entries
+            .Where(e => e.AllowedDuringOffboarding)
+            .Select(e => $"{e.HttpMethod} {e.RouteTemplate}")
+            .ToList();
+
+        Assert.Equal(new[] { "POST tenants/{tenantId}/offboard/feedback" }, routes);
+    }
+
    /// <summary>
    /// Every entry with TenantScoping.RouteParam must have {tenantId} in its route template.
    /// Prevents misattributed scoping declarations.
@@ -441,6 +441,96 @@ public class ImeMsiArchiverTests
        Assert.Equal(0, archiver.ProvenanceCalls);
    }

+    // =========================================================================
+    // Archive already holds the version before the walk (operator backfill of a
+    // build no host serves any more). The 409 path can never be reached for it —
+    // without the pre-walk check the row stays Failed:VersionMismatch forever.
+    // =========================================================================
+
+    [Fact]
+    public async Task ArchiveAsync_VersionAlreadyInArchive_NoHostServesIt_ArchivedWithoutDownload()
+    {
+        var archivedPayload = new byte[1024];
+        new Random(11).NextBytes(archivedPayload);
+        var expectedSha = Convert.ToHexString(SHA256.HashData(archivedPayload)).ToLowerInvariant();
+        var archiver = new RecordingArchiver
+        {
+            ArchivedMsiExists = true,
+            ArchivedPayload = archivedPayload,
+            DefaultProductVersion = "9.9.9.0", // every host has moved on
+        };
+        archiver.ProductVersionByUrl[RecordingArchiver.ArchivedOrigin] = Version;
+
+        var result = await archiver.ArchiveAsync(Envelope());
+
+        Assert.True(result.Success);
+        Assert.Equal(ImeMsiArchiver.Statuses.Archived, result.Status);
+        Assert.False(result.Retryable);
+        Assert.Equal($"{Version}/IntuneWindowsAgent.msi", result.BlobPath);
+        // The row must describe the archived bytes; the source URL of a backfill is unknown.
+        Assert.Equal(expectedSha, result.Sha256);
+        Assert.Equal(archivedPayload.Length, result.SizeBytes);
+        Assert.Null(result.SourceUrl);
+        Assert.Equal(0, archiver.DownloadCalls);
+        Assert.Equal(0, archiver.UploadCalls);
+        Assert.Equal(0, archiver.ProvenanceCalls); // sidecar came with the backfill
+    }
+
+    [Fact]
+    public async Task ArchiveAsync_VersionAlreadyInArchive_MissingSidecar_IsWrittenWithoutSourceUrl()
+    {
+        var archiver = new RecordingArchiver { ArchivedMsiExists = true, ProvenanceExists = false };
+
+        var result = await archiver.ArchiveAsync(Envelope());
+
+        Assert.True(result.Success);
+        Assert.Equal(0, archiver.DownloadCalls);
+        Assert.Equal(1, archiver.ProvenanceCalls);
+        Assert.Equal($"{Version}/provenance.json", archiver.ProvenanceLastPath);
+        using var doc = System.Text.Json.JsonDocument.Parse(archiver.ProvenanceLastJson);
+        Assert.Equal(System.Text.Json.JsonValueKind.Null, doc.RootElement.GetProperty("url").ValueKind);
+        // A null source must not compare equal to a null event URL.
+        Assert.False(doc.RootElement.GetProperty("urlFromEvent").GetBoolean());
+        Assert.Equal(0, doc.RootElement.GetProperty("candidates").GetArrayLength());
+    }
+
+    [Theory]
+    [InlineData("1.103.101.0")] // another ring's build filed under this version
+    [InlineData(null)]          // not a readable package
+    public async Task ArchiveAsync_ArchiveEntryIsNotTheObservedVersion_NotAccepted_WalkRuns(string? archivedProductVersion)
+    {
+        var archiver = new RecordingArchiver
+        {
+            ArchivedMsiExists = true,
+            DefaultProductVersion = "9.9.9.0",
+        };
+        archiver.ProductVersionByUrl[RecordingArchiver.ArchivedOrigin] = archivedProductVersion;
+
+        var result = await archiver.ArchiveAsync(Envelope());
+
+        Assert.False(result.Success);
+        Assert.Equal(ImeMsiArchiver.Statuses.FailedVersionMismatch, result.Status);
+        Assert.Equal(ImeMsiArchiver.BuildCandidateUrls(EventUrl).Count, archiver.DownloadCalls);
+        Assert.Equal(0, archiver.ProvenanceCalls);
+    }
+
+    [Fact]
+    public async Task ArchiveAsync_ArchiveCheckFails_RetryableError_NoDownload()
+    {
+        var archiver = new RecordingArchiver
+        {
+            ArchivedMsiExists = true,
+            ArchivedOpenException = new RequestFailedException(500, "read failed"),
+        };
+
+        var result = await archiver.ArchiveAsync(Envelope());
+
+        Assert.False(result.Success);
+        Assert.Equal(ImeMsiArchiver.Statuses.FailedError, result.Status);
+        Assert.True(result.Retryable);
+        Assert.Equal(0, archiver.DownloadCalls);
+    }
+
    // =========================================================================
    // Provenance-write gap (daily review 2026-08-18): MSI upload is write-once,
    // so a first attempt that dies between the MSI and the provenance upload
@@ -660,6 +750,10 @@ public class ImeMsiArchiverTests
        public Exception? UploadException { get; set; }
        public Exception? ProvenanceException { get; set; }
        public bool ProvenanceExists { get; set; } = true;
+        /// <summary>Whether the archive already holds an installer for the version BEFORE the walk (operator backfill).</summary>
+        public bool ArchivedMsiExists { get; set; }
+        /// <summary>Key into <see cref="ProductVersionByUrl"/> for the archived bytes — they have no URL of their own.</summary>
+        public const string ArchivedOrigin = "archive://existing";
        public byte[]? ArchivedPayload { get; set; }
        public Exception? ArchivedOpenException { get; set; }

@@ -722,12 +816,15 @@ public class ImeMsiArchiverTests
            return Task.CompletedTask;
        }

-        protected override Task<bool> ProvenanceExistsAsync(string blobPath, CancellationToken cancellationToken)
-            => Task.FromResult(ProvenanceExists);
+        protected override Task<bool> ArchiveBlobExistsAsync(string blobPath, CancellationToken cancellationToken)
+            => Task.FromResult(blobPath.EndsWith("provenance.json", StringComparison.Ordinal)
+                ? ProvenanceExists
+                : ArchivedMsiExists);

        protected override Task<Stream> OpenArchivedMsiAsync(string blobPath, CancellationToken cancellationToken)
        {
            if (ArchivedOpenException is not null) throw ArchivedOpenException;
+            _currentUrl = ArchivedOrigin;
            return Task.FromResult<Stream>(new MemoryStream(ArchivedPayload ?? Payload));
        }
    }
@@ -116,6 +116,53 @@ public class MaintenanceServiceExcessiveEventAutoActionTests
        Assert.False(MaintenanceService.IsAutoActionEligible(status));
    }

+    // ── Recount gate ──────────────────────────────────────────────────────────
+    // The stored counter doubles on replayed batches, so every warn and every block is
+    // decided on a recount. The gate keeps that Events-partition scan to candidates that
+    // still have something to fire.
+
+    [Fact]
+    public void HasPendingAction_WarnNotYetFired_IsPending()
+    {
+        Assert.True(MaintenanceService.HasPendingExcessiveEventAction(
+            storedEventCount: 2001, SessionStatus.Succeeded, alreadyAlerted: false, alreadyAutoActioned: false,
+            warnThreshold: 2000, autoMode: "Off", autoThreshold: 2500));
+    }
+
+    [Fact]
+    public void HasPendingAction_BlockNotYetFiredOnRunningSession_IsPending()
+    {
+        Assert.True(MaintenanceService.HasPendingExcessiveEventAction(
+            storedEventCount: 2501, SessionStatus.InProgress, alreadyAlerted: true, alreadyAutoActioned: false,
+            warnThreshold: 2000, autoMode: "Block", autoThreshold: 2500));
+    }
+
+    [Fact]
+    public void HasPendingAction_FinishedSessionAboveBlockThreshold_IsNotRescannedForever()
+    {
+        // Warned long ago, can never be blocked any more: without the eligibility term this
+        // row would cost a full partition scan on every sweep until retention removes it.
+        Assert.False(MaintenanceService.HasPendingExcessiveEventAction(
+            storedEventCount: 9000, SessionStatus.Incomplete, alreadyAlerted: true, alreadyAutoActioned: false,
+            warnThreshold: 2000, autoMode: "Block", autoThreshold: 2500));
+    }
+
+    [Fact]
+    public void HasPendingAction_BothAlreadyFired_IsNotPending()
+    {
+        Assert.False(MaintenanceService.HasPendingExcessiveEventAction(
+            storedEventCount: 9000, SessionStatus.InProgress, alreadyAlerted: true, alreadyAutoActioned: true,
+            warnThreshold: 2000, autoMode: "Block", autoThreshold: 2500));
+    }
+
+    [Fact]
+    public void HasPendingAction_WarnDisabledAndModeOff_IsNotPending()
+    {
+        Assert.False(MaintenanceService.HasPendingExcessiveEventAction(
+            storedEventCount: 9000, SessionStatus.InProgress, alreadyAlerted: false, alreadyAutoActioned: false,
+            warnThreshold: 0, autoMode: "Off", autoThreshold: 2500));
+    }
+
    // ── Status parsing feeding that gate ──────────────────────────────────────
    // The runaway query projects a subset of columns. SessionStatus.InProgress is ordinal 0,
    // so an unparsed Status would leave every row looking in-progress and the gate above
@@ -7,18 +7,20 @@ namespace AutopilotMonitor.Functions.Tests.Offboarding;
 /// <summary>
 /// Test double for <see cref="IOffboardFarewellEmailSender"/>. Records every invocation so
 /// the handler-side tests can assert "did the farewell send fire after History → Completed?"
-/// without booting the real mail provider client. Default = silent noop; set <see cref="ThrowOnSend"/>
-/// to simulate downstream failures and prove the handler's fail-soft contract.
+/// without booting the real mail provider client. Default = accepted (<see cref="Result"/> true);
+/// set <see cref="Result"/> false to simulate a refused send, or <see cref="ThrowOnSend"/> to
+/// simulate downstream failures and prove the handler's fail-soft contract.
 /// </summary>
 internal sealed class FakeOffboardFarewellEmailSender : IOffboardFarewellEmailSender
 {
    public readonly List<(string ToEmail, string DomainName, string TenantId)> Calls = new();
+    public bool Result { get; set; } = true;
    public System.Exception? ThrowOnSend { get; set; }

-    public Task SendAsync(string toEmail, string domainName, string tenantId, CancellationToken ct = default)
+    public Task<bool> SendAsync(string toEmail, string domainName, string tenantId, CancellationToken ct = default)
    {
        Calls.Add((toEmail, domainName, tenantId));
        if (ThrowOnSend is { } ex) throw ex;
-        return Task.CompletedTask;
+        return Task.FromResult(Result);
    }
 }
@@ -383,6 +383,77 @@ public class TenantOffboardingHandlerDrainContractTests
            Times.Never(), "Drain-skip-gate must also bypass the enumerate+enqueue phase");
    }

+    // ── Farewell mail record (Side-effect 6) ────────────────────────────────────
+    // The send fails soft and its success log never reaches Application Insights, so the ops
+    // event is the only record of whether the departing customer got the farewell mail.
+
+    [Fact]
+    public async Task Completed_WithCapturedAddress_ProviderAccepts_RecordsFarewellEmailSent()
+    {
+        var harness = Harness.New();
+        harness.Repo.History[HistoryRowKey].NotificationEmail = "it@contoso.invalid";
+
+        await harness.Sut.HandleAsync(harness.Envelope(drainPollCount: 0));
+
+        Assert.Equal("Completed", harness.Repo.History[HistoryRowKey].Status);
+        var call = Assert.Single(harness.Farewell.Calls);
+        Assert.Equal(("it@contoso.invalid", "contoso.invalid", TenantId), call);
+        var evt = Assert.Single(harness.OpsEvents, e => e.EventType.StartsWith("FarewellEmail", StringComparison.Ordinal));
+        Assert.Equal(OpsEventTypes.FarewellEmailSent, evt.EventType);
+        Assert.Equal(OpsEventSeverity.Info, evt.Severity);
+        Assert.Equal(TenantId, evt.TenantId);
+        Assert.Contains("it@contoso.invalid", evt.Message);
+    }
+
+    [Fact]
+    public async Task Completed_WithoutCapturedAddress_RecordsFarewellEmailSkipped_AndNeverCallsSender()
+    {
+        var harness = Harness.New();
+        harness.Repo.History[HistoryRowKey].NotificationEmail = null;
+
+        await harness.Sut.HandleAsync(harness.Envelope(drainPollCount: 0));
+
+        Assert.Equal("Completed", harness.Repo.History[HistoryRowKey].Status);
+        Assert.Empty(harness.Farewell.Calls);
+        var evt = Assert.Single(harness.OpsEvents, e => e.EventType.StartsWith("FarewellEmail", StringComparison.Ordinal));
+        Assert.Equal(OpsEventTypes.FarewellEmailSkipped, evt.EventType);
+        Assert.Equal(OpsEventSeverity.Warning, evt.Severity);
+        Assert.Contains("no contact address", evt.Message);
+    }
+
+    [Fact]
+    public async Task Completed_ProviderRefuses_RecordsFarewellEmailFailed()
+    {
+        var harness = Harness.New();
+        harness.Repo.History[HistoryRowKey].NotificationEmail = "it@contoso.invalid";
+        harness.Farewell.Result = false;
+
+        await harness.Sut.HandleAsync(harness.Envelope(drainPollCount: 0));
+
+        var evt = Assert.Single(harness.OpsEvents, e => e.EventType.StartsWith("FarewellEmail", StringComparison.Ordinal));
+        Assert.Equal(OpsEventTypes.FarewellEmailFailed, evt.EventType);
+        Assert.Equal(OpsEventSeverity.Error, evt.Severity);
+        Assert.Contains("did not accept", evt.Message);
+    }
+
+    [Fact]
+    public async Task Completed_SenderThrows_RecordsFarewellEmailFailed_AndStillCompletes()
+    {
+        // Fail-soft contract: the History row is already Completed when the mail goes out; a
+        // throwing sender must neither propagate nor stop the TenantConfiguration delete after it.
+        var harness = Harness.New();
+        harness.Repo.History[HistoryRowKey].NotificationEmail = "it@contoso.invalid";
+        harness.Farewell.ThrowOnSend = new HttpRequestException("simulated provider outage");
+
+        await harness.Sut.HandleAsync(harness.Envelope(drainPollCount: 0));
+
+        Assert.Equal("Completed", harness.Repo.History[HistoryRowKey].Status);
+        Assert.Equal("Completed", harness.Repo.Markers[TenantId].Status);
+        var evt = Assert.Single(harness.OpsEvents, e => e.EventType.StartsWith("FarewellEmail", StringComparison.Ordinal));
+        Assert.Equal(OpsEventTypes.FarewellEmailFailed, evt.EventType);
+        Assert.Contains("HttpRequestException", evt.Message);
+    }
+
    [Fact]
    public async Task History_AlreadyCompleted_IsNoOp()
    {
@@ -436,6 +507,9 @@ public class TenantOffboardingHandlerDrainContractTests
        public CountingSafeWipeService SafeWipeProbe { get; } = new();
        public Mock<IMaintenanceRepository> Maintenance { get; } = new();
        public Mock<IConfigRepository> ConfigRepo { get; } = new();
+        public FakeOffboardFarewellEmailSender Farewell { get; } = new();
+        /// <summary>Every ops event the handler recorded, in order (the repository is a capturing mock).</summary>
+        public List<OpsEventEntry> OpsEvents { get; } = new();
        public List<string> EnumeratorYields { get; } = new();
        public Exception? EnumeratorThrow { get; set; }

@@ -475,7 +549,7 @@ public class TenantOffboardingHandlerDrainContractTests
                    It.IsAny<string>(), It.IsAny<string>(), It.IsAny<Dictionary<string, string>?>()))
                .ReturnsAsync(true);

-            var opsService = BuildRealOpsService();
+            var opsService = BuildRealOpsService(h.OpsEvents);

            var unusedTableStorage = new Mock<TableStorageService>(
                Mock.Of<TableServiceClient>(),
@@ -494,7 +568,7 @@ public class TenantOffboardingHandlerDrainContractTests
                opsService,
                Mock.Of<ITenantCustomsArchiveRepository>(),
                h.ConfigRepo.Object,
-                new FakeOffboardFarewellEmailSender(),
+                h.Farewell,
                NullLogger<TenantOffboardingHandler>.Instance);

            return h;
@@ -578,10 +652,12 @@ public class TenantOffboardingHandlerDrainContractTests
            }, "\"0xFAKE_PTR_1\"");
        }

-        private static OpsEventService BuildRealOpsService()
+        private static OpsEventService BuildRealOpsService(List<OpsEventEntry> captured)
        {
            var opsRepo = new Mock<IOpsEventRepository>();
-            opsRepo.Setup(r => r.SaveOpsEventAsync(It.IsAny<OpsEventEntry>())).Returns(Task.CompletedTask);
+            opsRepo.Setup(r => r.SaveOpsEventAsync(It.IsAny<OpsEventEntry>()))
+                .Callback<OpsEventEntry>(captured.Add)
+                .Returns(Task.CompletedTask);
            var memCache = new MemoryCache(new MemoryCacheOptions());
            var adminConfig = new Mock<AdminConfigurationService>(
                Mock.Of<IConfigRepository>(), NullLogger<AdminConfigurationService>.Instance, memCache);
@@ -1,4 +1,5 @@
 using System.Security.Claims;
+using AutopilotMonitor.Functions.Functions.Admin;
 using AutopilotMonitor.Functions.Functions.Config;
 using AutopilotMonitor.Functions.Middleware;
 using AutopilotMonitor.Functions.Security;
@@ -1623,6 +1624,82 @@ public class PolicyEnforcementMiddlewareTests
        h.ConfigRepo.Verify(r => r.GetTenantConfigurationAsync(It.IsAny<string>()), Times.Never);
    }

+    // ── Offboarding tombstone vs. the farewell feedback route (AllowedDuringOffboarding) ──────
+    // The offboard endpoint tombstones the tenant (Disabled=true, offboarding reason) BEFORE it answers
+    // 202, so the departing admin submits the farewell feedback from an already-suspended tenant. That
+    // one route opts out of the tombstone gate; every other route and every other suspension stay closed.
+
+    private static void AsOffboardingTombstone(Harness h, string tenantId) =>
+        AsSuspended(h, tenantId, reason: TenantOffboardFunction.OffboardingDisabledReason);
+
+    [Fact]
+    public async Task OffboardingTombstone_FeedbackRoute_IsAllowed_ForDepartingTenantAdmin()
+    {
+        const string upn = "admin@contoso.com";
+        var h = BuildHarness();
+        h.AsTenantAdmin(TenantA, upn);
+        AsOffboardingTombstone(h, TenantA);
+
+        var result = await h.Middleware.DecideAsync(
+            "POST", $"/api/tenants/{TenantA}/offboard/feedback", null, AuthedPrincipal(TenantA, upn));
+
+        Assert.True(result.Allowed);
+        Assert.Equal(TenantA, result.Context!.TargetTenantId);
+    }
+
+    [Fact]
+    public async Task OffboardingTombstone_OtherRoutes_StayForbidden()
+    {
+        // The opt-out is per route: the same tombstone still closes the rest of the API.
+        const string upn = "admin@contoso.com";
+        var h = BuildHarness();
+        h.AsTenantAdmin(TenantA, upn);
+        AsOffboardingTombstone(h, TenantA);
+
+        var read = await h.Middleware.DecideAsync("GET", "/api/sessions", null, AuthedPrincipal(TenantA, upn));
+        var write = await h.Middleware.DecideAsync("DELETE", $"/api/tenants/{TenantA}/offboard", null, AuthedPrincipal(TenantA, upn));
+
+        Assert.False(read.Allowed);
+        Assert.Equal("TenantSuspended", read.ErrorCode);
+        Assert.Equal(TenantOffboardFunction.OffboardingDisabledReason, read.ErrorMessage);
+        Assert.False(write.Allowed);
+        Assert.Equal("TenantSuspended", write.ErrorCode);
+    }
+
+    [Fact]
+    public async Task OperatorSuspension_FeedbackRoute_StaysForbidden()
+    {
+        // The opt-out is for the offboarding tombstone only: a tenant an operator suspended (any other
+        // reason) cannot reach the feedback route either — nothing in the flag grants access.
+        const string upn = "admin@contoso.com";
+        var h = BuildHarness();
+        h.AsTenantAdmin(TenantA, upn);
+        AsSuspended(h, TenantA, reason: "Abuse investigation");
+
+        var result = await h.Middleware.DecideAsync(
+            "POST", $"/api/tenants/{TenantA}/offboard/feedback", null, AuthedPrincipal(TenantA, upn));
+
+        Assert.False(result.Allowed);
+        Assert.Equal("TenantSuspended", result.ErrorCode);
+    }
+
+    [Fact]
+    public async Task OffboardingTombstone_FeedbackRoute_NonMember_StillNeedsTenantAdmin()
+    {
+        // Policy tier is untouched by the flag: a plain member (no tenant admin role) is denied by the
+        // TenantAdminOrGA tier before the suspension gate is even reached.
+        const string upn = "viewer@contoso.com";
+        var h = BuildHarness();
+        AsOffboardingTombstone(h, TenantA);
+
+        var result = await h.Middleware.DecideAsync(
+            "POST", $"/api/tenants/{TenantA}/offboard/feedback", null, AuthedPrincipal(TenantA, upn));
+
+        Assert.False(result.Allowed);
+        Assert.Equal(403, result.StatusCode);
+        Assert.NotEqual("TenantSuspended", result.ErrorCode);
+    }
+
    // ── Tenant MCP switch (TenantConfiguration.McpDisabled) — the per-request half ────────────
    // The MCP front door (McpUserService) already denies a caller whose home tenant is closed; this gate
    // is what makes the switch hold per request (front-door verdicts are cached) and what keeps a closed
@@ -71,4 +71,67 @@ public class QueryParamGuardTests
            "Baseline entries without a TryParse any more — remove them (the ratchet only shrinks):\n  " +
            string.Join("\n  ", stale));
    }
+
+    // ── One source of the query collection ──────────────────────────────────────────────
+    // `req.Query` IS `HttpUtility.ParseQueryString(req.Url.Query)`, cached per request (the
+    // fact below pins that against a worker update). A second spelling of the same call is
+    // only a pattern for the next function to copy, so the request query is read through
+    // `req.Query` and ParseQueryString stays for strings that are not the request's query.
+
+    private static readonly Regex ParseQueryStringCall = new(@"\bParseQueryString\(", RegexOptions.Compiled);
+
+    /// <summary>ParseQueryString over something other than the request query: file → why.</summary>
+    private static readonly IReadOnlyDictionary<string, string> ParseQueryStringBaseline = new Dictionary<string, string>(StringComparer.Ordinal)
+    {
+        ["Functions/Config/GetTenantConfigurationFunction.cs"] = "ShouldRedact takes the raw query string so the redaction decision is unit-testable without a request",
+        ["Functions/Diagnostics/GetDiagnosticsUploadUrlFunction.cs"] = "query of the tenant's stored SAS URL",
+        ["Services/Diagnostics/SasPermissionParser.cs"] = "query of a SAS URL",
+    };
+
+    [Fact]
+    public void The_request_query_is_read_through_req_Query_only()
+    {
+        var root = FunctionsRoot();
+        var offenders = new List<string>();
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+
+        var files = Directory.EnumerateFiles(root, "*.cs", SearchOption.AllDirectories)
+            .Select(p => Path.GetRelativePath(root, p).Replace('\\', '/'))
+            .Where(rel => !rel.StartsWith("bin/", StringComparison.Ordinal) && !rel.StartsWith("obj/", StringComparison.Ordinal))
+            .OrderBy(p => p, StringComparer.Ordinal);
+
+        foreach (var rel in files)
+        {
+            if (!ParseQueryStringCall.IsMatch(File.ReadAllText(Path.Combine(root, rel)))) continue;
+            seen.Add(rel);
+            if (!ParseQueryStringBaseline.ContainsKey(rel)) offenders.Add(rel);
+        }
+
+        Assert.True(offenders.Count == 0,
+            "HttpUtility.ParseQueryString in the Functions project — read the request query through " +
+            "req.Query, or add the file to the baseline with what it parses instead:\n  " + string.Join("\n  ", offenders));
+
+        var stale = ParseQueryStringBaseline.Keys.Where(k => !seen.Contains(k)).ToList();
+        Assert.True(stale.Count == 0,
+            "Baseline entries without a ParseQueryString any more — remove them:\n  " + string.Join("\n  ", stale));
+    }
+
+    [Fact]
+    public void Req_Query_is_ParseQueryString_over_the_request_url()
+    {
+        var url = new Uri("https://localhost/api/x?a=1&a=2&b=%20x%2B&c&=orphan&D=Case");
+        var req = new Moq.Mock<Microsoft.Azure.Functions.Worker.Http.HttpRequestData>(
+            Moq.Mock.Of<Microsoft.Azure.Functions.Worker.FunctionContext>()) { CallBase = true };
+        req.SetupGet(r => r.Url).Returns(url);
+
+        var viaRequest = req.Object.Query;
+        var viaHelper = System.Web.HttpUtility.ParseQueryString(url.Query);
+
+        Assert.Equal(viaHelper.AllKeys, viaRequest.AllKeys);
+        foreach (var key in viaHelper.AllKeys)
+            Assert.Equal(viaHelper.GetValues(key), viaRequest.GetValues(key));
+        Assert.Equal("1,2", viaRequest["a"]);   // repeated key: comma-joined on both paths
+        Assert.Equal(" x+", viaRequest["b"]);
+        Assert.Same(viaRequest, req.Object.Query); // parsed once per request
+    }
 }
@@ -208,6 +208,8 @@ public class SessionAnnotationFunctionsTests
        var req = BuildRequest(Principal(("tid", TenantId)), requestCtx, new { });
        Mock.Get(req).SetupGet(r => r.Url)
            .Returns(new Uri("https://localhost/api/global/session-annotations"));
+        // Query is virtual: without CallBase a loose mock answers null instead of parsing Url.
+        Mock.Get(req).SetupGet(r => r.Query).CallBase();

        var res = await function.Run(req);

@@ -107,6 +107,7 @@ public sealed class SharedManifestParityTests
            ["apiErrorCodes"] = ConstStrings(typeof(Constants.ApiErrorCodes))
                .Concat(ConstStrings(typeof(Constants.DelegationCodes)))
                .Concat(ConstStrings(typeof(Constants.DelegatedSlots)))
+                .Concat(ConstStrings(typeof(Constants.BackupErrorCodes)))
                .ToArray(),
            ["tenantRoles"] = ConstStrings(typeof(Constants.TenantRoles)),
            ["globalRoles"] = ConstStrings(typeof(Constants.GlobalRoles)),
@@ -53,14 +53,16 @@ public class TypedResponseGuardTests
    private static readonly Dictionary<string, int> WriteBaseline = new(StringComparer.OrdinalIgnoreCase);

    // ── Bypass-shape guards (closed 2026-08-31) ─────────────────────────────────────────
-    // Regexes A/B only see the INLINE literal `...(new { ... })`. Three bypass shapes let a
+    // Regexes A/B only see the INLINE literal `...(new { ... })`. Four bypass shapes let a
    // response ship untyped anyway and are ratcheted here with EMPTY baselines:
    //   C: the literal parked in a variable first (`var result = new { ... };` →
    //      `WriteAsJsonAsync(result)`), which is how rule-stats escaped the 08-31 migration,
    //   D: hand-serialized bodies (`WriteStringAsync(JsonSerializer.Serialize(new { ... }))`),
    //   E: builder methods declared `object` / `Task<object>` returning `new { ... }`
-    //      (verdict-calibration's Build). A fourth shape — local `WriteJson(req, object)`
-    //      wrappers — is closed structurally: wrappers take a `T : IApiResponse` generic.
+    //      (verdict-calibration's Build),
+    //   F: local response wrappers taking the body as `object` (`WriteJsonAsync(req, status,
+    //      object body)`) — every call site behind one is invisible to A–D, which is how the
+    //      backup, session-restore and delegation bodies stayed anonymous until 2026-09-21.

    /// <summary>Identifier passed to WriteAsJsonAsync — flagged when the SAME file assigns that identifier an anonymous object.</summary>
    private static readonly Regex WriteAsJsonIdentifier =
@@ -72,6 +74,15 @@ public class TypedResponseGuardTests
    private static readonly Regex ObjectReturningBuilder =
        new(@"\b(?:object|Task<object>)\s+\w*(?:Build|Compute|Payload|Response)\w*\s*\(", RegexOptions.Compiled);

+    private static readonly Regex ObjectBodyResponseWrapper =
+        new(@"\b(?:Task<HttpResponseData>|HttpResponseData)\s+\w+\s*\([^)]*\bobject\??\s+\w+[^)]*\)", RegexOptions.Compiled);
+
+    /// <summary>
+    /// EMPTY. A response writer takes <c>T : IApiResponse</c> / <c>T : IApiErrorResponse</c>
+    /// (ResponseHelper), never <c>object</c>.
+    /// </summary>
+    private static readonly Dictionary<string, int> ObjectWrapperBaseline = new(StringComparer.OrdinalIgnoreCase);
+
    /// <summary>EMPTY — an anonymous object smuggled through a local variable is the same regression as an inline one.</summary>
    private static readonly Dictionary<string, int> IdentifierBaseline = new(StringComparer.OrdinalIgnoreCase);

@@ -140,6 +151,15 @@ public class TypedResponseGuardTests
            "object/Task<object>-returning Build*/Compute*/*Payload/*Response method");
    }

+    [Fact]
+    public void Response_wrappers_taking_an_object_body_are_flagged()
+    {
+        AssertRatchet(
+            text => ObjectBodyResponseWrapper.Matches(text).Count,
+            ObjectWrapperBaseline,
+            "HttpResponseData-returning wrapper with an object parameter");
+    }
+
    /// <summary>
    /// Wire DTOs must be flat: System.Text.Json serializes derived properties BEFORE base
    /// properties, so any base class would silently reorder JSON keys — and key order is part
@@ -92,7 +92,7 @@ public class AutopilotDeviceValidationConsentFunction
            return await req.ErrorAsync(HttpStatusCode.InternalServerError, Constants.ApiErrorCodes.InternalError, "Validator app client ID is not configured on the backend.");
        }

-        var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+        var query = req.Query;
        var redirectUri = query["redirectUri"];
        if (string.IsNullOrWhiteSpace(redirectUri))
        {
@@ -48,7 +48,7 @@ public class CustomsArchiveQueryFunction
    public async Task<HttpResponseData> ListRuns(
        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "global/customs-archive")] HttpRequestData req)
    {
-        var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+        var query = req.Query;
        var filterTenantId = query["tenantId"];

        var summaries = new Dictionary<string, CustomsArchiveRunSummary>(System.StringComparer.Ordinal);
@@ -41,7 +41,7 @@ public class DelegationSelfServiceFunction
        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = "delegations/slots")] HttpRequestData req)
    {
        var usage = await _slots.GetUsageAsync(req.GetRequestContext().TenantId);
-        return await OkAsync(req, DelegatedSlotManagementFunction.ToResponse(usage));
+        return await req.OkAsync(DelegatedSlotManagementFunction.ToResponse(usage));
    }

    /// <summary>GET /api/delegations/managed — the tenants the caller's tenant manages.</summary>
@@ -66,7 +66,7 @@ public class DelegationSelfServiceFunction
            });
        }

-        return await OkAsync(req, new ManagedTenantListResponse
+        return await req.OkAsync(new ManagedTenantListResponse
        {
            HomeTenantId = home,
            Slots = DelegatedSlotManagementFunction.ToResponse(view.Slots),
@@ -88,7 +88,7 @@ public class DelegationSelfServiceFunction
            return await BadAsync(req, "a valid tenantId (GUID) is required");

        var result = await _svc.RemoveManagedAsync(ctx.TenantId, body.TenantId, ctx.UserPrincipalName);
-        return result.Ok ? await OkAsync(req, new { message = "Delegation ended" }) : await FailAsync(req, result.Failure!);
+        return result.Ok ? await req.OkAsync(new MessageResponse { Message = "Delegation ended" }) : await FailAsync(req, result.Failure!);
    }

    // ── Invitations ──────────────────────────────────────────────────────────────
@@ -118,7 +118,7 @@ public class DelegationSelfServiceFunction
                HoldUntilUtc = r.HoldUntilUtc,
            });
        }
-        return await OkAsync(req, new DelegationInvitationListResponse { HomeTenantId = home, Invitations = items });
+        return await req.OkAsync(new DelegationInvitationListResponse { HomeTenantId = home, Invitations = items });
    }

    /// <summary>POST /api/delegations/invitations — mint a single-use invitation link (token shown once). TenantAdminOrGA.</summary>
@@ -147,7 +147,7 @@ public class DelegationSelfServiceFunction
    {
        var ctx = req.GetRequestContext();
        var result = await _svc.CancelInvitationAsync(ctx.TenantId, invitationId, ctx.UserPrincipalName);
-        return result.Ok ? await OkAsync(req, new { message = "Invitation cancelled" }) : await FailAsync(req, result.Failure!);
+        return result.Ok ? await req.OkAsync(new MessageResponse { Message = "Invitation cancelled" }) : await FailAsync(req, result.Failure!);
    }

    // ── Assignees (the managing tenant's own users) ──────────────────────────────
@@ -160,7 +160,7 @@ public class DelegationSelfServiceFunction
    {
        var home = req.GetRequestContext().TenantId;
        var assignees = await _svc.ListAssigneesAsync(home);
-        return await OkAsync(req, new DelegationAssigneeListResponse
+        return await req.OkAsync(new DelegationAssigneeListResponse
        {
            HomeTenantId = home,
            GroupId = Constants.TenantGroupIds.ForHomeTenant(home),
@@ -200,7 +200,7 @@ public class DelegationSelfServiceFunction
    {
        var ctx = req.GetRequestContext();
        var result = await _svc.UnassignAsync(ctx.TenantId, upn, ctx.UserPrincipalName);
-        return result.Ok ? await OkAsync(req, new { message = "Unassigned" }) : await FailAsync(req, result.Failure!);
+        return result.Ok ? await req.OkAsync(new MessageResponse { Message = "Unassigned" }) : await FailAsync(req, result.Failure!);
    }

    // ── Accept (the customer's tenant admin) ─────────────────────────────────────
@@ -217,7 +217,7 @@ public class DelegationSelfServiceFunction
        if (!result.Ok)
            return await FailAsync(req, result.Failure!);
        var p = result.Value!;
-        return await OkAsync(req, new DelegationAcceptPreviewResponse
+        return await req.OkAsync(new DelegationAcceptPreviewResponse
        {
            HomeTenantId = p.HomeTenantId,
            HomeTenantDomain = p.HomeTenantDomain,
@@ -245,7 +245,7 @@ public class DelegationSelfServiceFunction
        if (!result.Ok)
            return await FailAsync(req, result.Failure!);
        var o = result.Value!;
-        return await OkAsync(req, new AcceptDelegationInvitationResponse { HomeTenantId = o.HomeTenantId, HomeTenantDomain = o.HomeTenantDomain, ManagedTenantId = o.ManagedTenantId });
+        return await req.OkAsync(new AcceptDelegationInvitationResponse { HomeTenantId = o.HomeTenantId, HomeTenantDomain = o.HomeTenantDomain, ManagedTenantId = o.ManagedTenantId });
    }

    // ── Helpers ─────────────────────────────────────────────────────────────────
@@ -257,13 +257,6 @@ public class DelegationSelfServiceFunction
        return await req.ErrorAsync((HttpStatusCode)failure.Status, failure.Code, failure.Message);
    }

-    private static async Task<HttpResponseData> OkAsync(HttpRequestData req, object body)
-    {
-        var response = req.CreateResponse(HttpStatusCode.OK);
-        await response.WriteAsJsonAsync(body);
-        return response;
-    }
-
    private static async Task<HttpResponseData> BadAsync(HttpRequestData req, string error)
    {
        return await req.BadRequestAsync(error);
@@ -1,4 +1,3 @@
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Shared.DataAccess;
 using AutopilotMonitor.Shared.Models;
@@ -35,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Admin
        {
            try
            {
-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var windowMinutes = QueryParams.Int(query["windowMinutes"], DefaultWindowMinutes, MinWindowMinutes, MaxWindowMinutes);

                var now = DateTime.UtcNow;
@@ -1,7 +1,6 @@
 using System;
 using System.Net;
 using System.Threading.Tasks;
-using System.Web;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Functions.Helpers;
@@ -40,7 +39,7 @@ namespace AutopilotMonitor.Functions.Functions.Admin
            {
                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware

-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var (filterKind, tenantId) = ParseTenantFilter(query["tenantId"]);

                if (filterKind == TenantFilterKind.Invalid)
@@ -1,5 +1,4 @@
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Shared.DataAccess;
@@ -34,7 +33,7 @@ namespace AutopilotMonitor.Functions.Functions.Admin
                string tenantId = TenantHelper.GetTenantId(req);
                string userIdentifier = TenantHelper.GetUserIdentifier(req);

-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var parsed = DateWindowPagination.ParseQuery(query);
                if (parsed.Error != null)
                {
@@ -1,5 +1,4 @@
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Shared.DataAccess;
@@ -36,7 +35,7 @@ namespace AutopilotMonitor.Functions.Functions.Admin
                var userEmail = TenantHelper.GetUserIdentifier(req);
                var callerTenantId = TenantHelper.GetTenantId(req);

-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var parsed = DateWindowPagination.ParseQuery(query);
                if (parsed.Error != null)
                {
@@ -1,6 +1,5 @@
 using System.Collections.Generic;
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Shared.DataAccess;
@@ -45,7 +44,7 @@ namespace AutopilotMonitor.Functions.Functions.Admin
            try
            {
                var callerTenantId = TenantHelper.GetTenantId(req);
-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var category = query["category"];
                var filterTenantId = query["tenantId"];

@@ -1,7 +1,6 @@
 using System;
 using System.Linq;
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Shared.DataAccess;
@@ -41,7 +40,7 @@ namespace AutopilotMonitor.Functions.Functions.Annotations
                var requestCtx = req.GetRequestContext();
                var callerTenantId = TenantHelper.GetTenantId(req);

-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var parsed = SessionAnnotationsPagination.ParseQuery(query);
                if (parsed.Error != null)
                {
@@ -1,7 +1,6 @@
 using System;
 using System.Linq;
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Shared.DataAccess;
@@ -47,7 +46,7 @@ namespace AutopilotMonitor.Functions.Functions.Annotations
                var requestCtx = req.GetRequestContext();
                var callerTenantId = TenantHelper.GetTenantId(req);

-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var parsedRaw = SessionAnnotationsPagination.ParseQuery(query);
                if (parsedRaw.Error != null)
                {
@@ -46,7 +46,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
                    return await req.BadRequestAsync("appName is required");
                }

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var summaries = await AppsAnalyticsHelper.LoadSummariesAsync(_metricsRepo, tenantId, days);
@@ -45,7 +45,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
                    return await req.BadRequestAsync("appName is required");
                }

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var statusFilter = (query["status"] ?? "all").Trim().ToLowerInvariant();
@@ -33,7 +33,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
                // Authentication + MemberRead authorization enforced by PolicyEnforcementMiddleware
                var tenantId = TenantHelper.GetTenantId(req);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var paging = AppsAnalyticsHelper.ParseAppsPaging(query);
@@ -46,7 +46,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
                    return await req.BadRequestAsync("appName is required");
                }

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var scopedTenantId = query["tenantId"];
                if (!AppsAnalyticsHelper.IsValidOptionalTenantIdQueryParam(scopedTenantId))
                {
@@ -45,7 +45,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
                    return await req.BadRequestAsync("appName is required");
                }

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var scopedTenantId = query["tenantId"];
                if (!AppsAnalyticsHelper.IsValidOptionalTenantIdQueryParam(scopedTenantId))
                {
@@ -32,7 +32,7 @@ namespace AutopilotMonitor.Functions.Functions.Apps
            try
            {
                var userEmail = TenantHelper.GetUserIdentifier(req);
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;

                var scopedTenantId = query["tenantId"];
                if (!AppsAnalyticsHelper.IsValidOptionalTenantIdQueryParam(scopedTenantId))
@@ -1,7 +1,7 @@
-using System.Net;
-using System.Text.Json;
 using System.Threading.Tasks;
 using AutopilotMonitor.Functions.DataAccess.TableStorage;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models.Backup;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
@@ -36,18 +36,9 @@ namespace AutopilotMonitor.Functions.Functions.Backup
            var (job, _) = await _jobs.GetWithETagAsync(jobId, req.FunctionContext.CancellationToken);
            if (job is null)
            {
-                return await WriteJsonAsync(req, HttpStatusCode.NotFound, new { error = "JobNotFound", jobId });
+                return await req.NotFoundAsync($"Backup job {jobId} not found.", Constants.BackupErrorCodes.JobNotFound);
            }
-            return await WriteJsonAsync(req, HttpStatusCode.OK, job);
-        }
-
-        private static async Task<HttpResponseData> WriteJsonAsync(HttpRequestData req, HttpStatusCode status, object body)
-        {
-            var response = req.CreateResponse(status);
-            response.Headers.Add("Content-Type", "application/json; charset=utf-8");
-            var json = JsonSerializer.Serialize(body, BackupManifestJson.SerializerOptions);
-            await response.WriteStringAsync(json);
-            return response;
+            return await req.OkAsync(job);
        }
    }
 }
@@ -1,10 +1,10 @@
 using System;
 using System.Net;
-using System.Text.Json;
 using System.Threading.Tasks;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Functions.Services.Backup;
+using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models.Backup;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
@@ -61,7 +61,7 @@ namespace AutopilotMonitor.Functions.Functions.Backup
            }
            catch (BackupTerminalException ex)
            {
-                return await WriteErrorAsync(req, HttpStatusCode.BadRequest, ex.Code, ex.Message).ConfigureAwait(false);
+                return await req.BadRequestAsync(ex.Message, ex.Code).ConfigureAwait(false);
            }

            // 3. Dispatch on mode
@@ -71,7 +71,7 @@ namespace AutopilotMonitor.Functions.Functions.Backup
                {
                    var preview = await _restoreService.PreviewRowAsync(
                        backupId, body.TableName, body.PartitionKey, body.RowKey, ct).ConfigureAwait(false);
-                    return await WriteJsonAsync(req, HttpStatusCode.OK, preview).ConfigureAwait(false);
+                    return await req.OkAsync(preview).ConfigureAwait(false);
                }
                else
                {
@@ -92,13 +92,13 @@ namespace AutopilotMonitor.Functions.Functions.Backup
                        _logger.LogWarning(evtEx, "RestoreRow: ops event recording failed — write itself succeeded");
                    }

-                    return await WriteJsonAsync(req, HttpStatusCode.OK, commit).ConfigureAwait(false);
+                    return await req.OkAsync(commit).ConfigureAwait(false);
                }
            }
            catch (BackupTerminalException ex)
            {
                var status = MapErrorCodeToStatus(ex.Code);
-                return await WriteErrorAsync(req, status, ex.Code, ex.Message).ConfigureAwait(false);
+                return await req.ErrorAsync(status, ex.Code, ex.Message).ConfigureAwait(false);
            }
            catch (OperationCanceledException) when (ct.IsCancellationRequested)
            {
@@ -107,39 +107,26 @@ namespace AutopilotMonitor.Functions.Functions.Backup
            }
            catch (Exception ex)
            {
-                _logger.LogError(ex, "RestoreRow: unexpected failure for backupId={BackupId} table={Table}", backupId, body.TableName);
-                return await WriteErrorAsync(req, HttpStatusCode.InternalServerError, "InternalError", ex.Message).ConfigureAwait(false);
+                // Sanitized envelope: the raw exception text stays in the log, the correlation id is the handle.
+                return await req.InternalServerErrorAsync(
+                    _logger, ex, $"RestoreRow backupId={backupId} table={body.TableName}").ConfigureAwait(false);
            }
        }

        private static HttpStatusCode MapErrorCodeToStatus(string code) => code switch
        {
-            "BackupNotFound"                => HttpStatusCode.NotFound,
-            "RowNotInBackup"                => HttpStatusCode.NotFound,
-            "TableNotInBackup"              => HttpStatusCode.Conflict,
-            "ManifestCorrupt"               => HttpStatusCode.Conflict,
-            "ManifestSchemaUnsupported"     => HttpStatusCode.Conflict,
-            "IntegrityCheckFailed"          => HttpStatusCode.Conflict,
-            "BlobChangedSinceValidation"    => HttpStatusCode.Conflict,
-            "RowChangedSinceValidation"     => HttpStatusCode.Conflict,
-            "CurrentRowChanged"             => HttpStatusCode.Conflict,
-            "MaintenanceInProgress"         => HttpStatusCode.Conflict,
-            "MaintenanceLeaseLost"          => HttpStatusCode.Conflict,
-            _                               => HttpStatusCode.BadRequest,
+            Constants.BackupErrorCodes.BackupNotFound               => HttpStatusCode.NotFound,
+            Constants.BackupErrorCodes.RowNotInBackup               => HttpStatusCode.NotFound,
+            Constants.BackupErrorCodes.TableNotInBackup             => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.ManifestCorrupt              => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.ManifestSchemaUnsupported    => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.IntegrityCheckFailed         => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.BlobChangedSinceValidation   => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.RowChangedSinceValidation    => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.CurrentRowChanged            => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.MaintenanceInProgress        => HttpStatusCode.Conflict,
+            Constants.BackupErrorCodes.MaintenanceLeaseLost         => HttpStatusCode.Conflict,
+            _                                                       => HttpStatusCode.BadRequest,
        };
-
-        private static async Task<HttpResponseData> WriteJsonAsync(HttpRequestData req, HttpStatusCode status, object body)
-        {
-            var response = req.CreateResponse(status);
-            response.Headers.Add("Content-Type", "application/json; charset=utf-8");
-            var json = JsonSerializer.Serialize(body, BackupManifestJson.SerializerOptions);
-            await response.WriteStringAsync(json).ConfigureAwait(false);
-            return response;
-        }
-
-        private static async Task<HttpResponseData> WriteErrorAsync(HttpRequestData req, HttpStatusCode status, string code, string message)
-        {
-            return await WriteJsonAsync(req, status, new { error = code, message }).ConfigureAwait(false);
-        }
    }
 }
@@ -1,10 +1,10 @@
 using System;
 using System.Net;
-using System.Text.Json;
 using System.Threading.Tasks;
 using AutopilotMonitor.Functions.DataAccess.TableStorage;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services.Backup.Queue;
+using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models.Backup;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
@@ -63,11 +63,9 @@ namespace AutopilotMonitor.Functions.Functions.Backup
            if (!inserted)
            {
                // Guid-N collision (effectively impossible) — surface so the operator can retry.
-                return await WriteJsonAsync(req, HttpStatusCode.Conflict, new
-                {
-                    error = "JobIdCollision",
-                    message = "Failed to allocate a unique jobId — please retry.",
-                });
+                return await req.ConflictAsync(
+                    "Failed to allocate a unique jobId — please retry.",
+                    Constants.BackupErrorCodes.JobIdCollision);
            }

            try
@@ -91,28 +89,17 @@ namespace AutopilotMonitor.Functions.Functions.Backup
                    await _jobs.TryUpdateWithCasAsync(fresh, etag.Value, req.FunctionContext.CancellationToken);
                }

-                return await WriteJsonAsync(req, HttpStatusCode.InternalServerError, new
-                {
-                    error = "EnqueueFailed",
-                    message = "Failed to enqueue backup job — job status has been marked Failed.",
-                    jobId,
-                });
+                return await req.ErrorAsync(
+                    HttpStatusCode.InternalServerError,
+                    Constants.ApiErrorCodes.EnqueueFailed,
+                    $"Failed to enqueue backup job {jobId} — job status has been marked Failed.");
            }

-            return await WriteJsonAsync(req, HttpStatusCode.Accepted, new
+            return await req.JsonAsync(HttpStatusCode.Accepted, new BackupTriggerResponse
            {
-                jobId,
-                statusUrl = $"/api/global/backups/jobs/{jobId}",
+                JobId = jobId,
+                StatusUrl = $"/api/global/backups/jobs/{jobId}",
            });
        }
-
-        private static async Task<HttpResponseData> WriteJsonAsync(HttpRequestData req, HttpStatusCode status, object body)
-        {
-            var response = req.CreateResponse(status);
-            response.Headers.Add("Content-Type", "application/json; charset=utf-8");
-            var json = JsonSerializer.Serialize(body, BackupManifestJson.SerializerOptions);
-            await response.WriteStringAsync(json);
-            return response;
-        }
    }
 }
@@ -62,7 +62,7 @@ namespace AutopilotMonitor.Functions.Functions.Bootstrap
                    return await req.UnauthorizedAsync("X-Bootstrap-Token header is required");
                }

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var tenantId = query["tenantId"];

                if (string.IsNullOrEmpty(tenantId))
@@ -65,7 +65,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
            try
            {
                // Get tenantId from query parameter
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var tenantId = query["tenantId"];

                if (string.IsNullOrEmpty(tenantId))
@@ -3,7 +3,6 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Net;
 using System.Threading.Tasks;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Pagination;
 using AutopilotMonitor.Functions.Services;
@@ -46,7 +45,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
                string userIdentifier = TenantHelper.GetUserIdentifier(req);

-                var query = HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty);
+                var query = req.Query;
                var parsed = TenantConfigPagination.ParseQuery(query);
                if (parsed.Error != null)
                {
@@ -41,7 +41,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
                // Optional ?agentVersion= selects the hash-oracle line like the agent's
                // X-Agent-Version header would; absent → the current (V2) line, never the
                // legacy fallback an absent header means on the agent channel.
-                var agentVersion = System.Web.HttpUtility.ParseQueryString(req.Url.Query)["agentVersion"];
+                var agentVersion = req.Query["agentVersion"];
                var agentMajor = string.IsNullOrWhiteSpace(agentVersion)
                    ? AgentConfigResolver.CurrentAgentMajor
                    : AgentConfigResolver.ParseAgentMajor(agentVersion);
@@ -1,7 +1,6 @@
 using System;
 using System.Net;
 using System.Threading.Tasks;
-using System.Web;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Functions.Helpers;
@@ -35,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
        {
            try
            {
-                var query = HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var refreshRaw = query["refresh"];
                var forceRefresh = !string.IsNullOrEmpty(refreshRaw)
                    && (refreshRaw.Equals("true", StringComparison.OrdinalIgnoreCase) || refreshRaw == "1");
@@ -43,7 +43,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware.
                var requestCtx = req.GetRequestContext();

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var max = QueryParams.Int(query["max"], MaxListSize, 1, MaxListSize);

                var backups = await _backupRepo.ListByPartitionAsync(requestCtx.TargetTenantId, max);
@@ -1,5 +1,4 @@
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services.Diagnostics;
 using AutopilotMonitor.Shared;
@@ -49,7 +48,7 @@ namespace AutopilotMonitor.Functions.Functions.Diagnostics
                // ?tenantId= query param (GA bypass already applied).
                var requestCtx = req.GetRequestContext();

-                var query = HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var rawBlobName = query["blobName"];

                if (string.IsNullOrEmpty(query["tenantId"]) || string.IsNullOrEmpty(rawBlobName))
@@ -1,5 +1,4 @@
 using System.Net;
-using System.Web;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services.Diagnostics;
 using AutopilotMonitor.Shared.Diagnostics;
@@ -57,7 +56,7 @@ namespace AutopilotMonitor.Functions.Functions.Diagnostics
                if (read.Error != null) return read.Error;
                var blobName = read.Value?.BlobName;
                if (string.IsNullOrEmpty(blobName))
-                    blobName = HttpUtility.ParseQueryString(req.Url.Query)["blobName"];
+                    blobName = req.Query["blobName"];

                if (string.IsNullOrEmpty(blobName))
                {
@@ -54,7 +54,7 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
            [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = "ops/alert-webhook")] HttpRequestData req)
        {
            var configuredSecret = Environment.GetEnvironmentVariable(SecretSettingName);
-            var providedSecret = System.Web.HttpUtility.ParseQueryString(req.Url.Query ?? string.Empty)["secret"];
+            var providedSecret = req.Query["secret"];

            if (!SecretMatches(providedSecret, configuredSecret))
            {
@@ -1,10 +1,11 @@
 using System;
 using System.Net;
-using System.Text.Json;
 using System.Threading.Tasks;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services.Backup;
 using AutopilotMonitor.Functions.Services.Deletion;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
 using Microsoft.Extensions.Logging;
@@ -65,11 +66,9 @@ namespace AutopilotMonitor.Functions.Functions.Maintenance
            }
            catch (LeaseHeldException)
            {
-                return await WriteJsonAsync(req, HttpStatusCode.Conflict, new
-                {
-                    error = "RunAlreadyActive",
-                    message = "A session-deletion maintenance run is already active — check the Session Cleanup page for progress.",
-                });
+                return await req.ConflictAsync(
+                    "A session-deletion maintenance run is already active — check the Session Cleanup page for progress.",
+                    Constants.ApiErrorCodes.RunAlreadyActive);
            }

            try
@@ -79,27 +78,18 @@ namespace AutopilotMonitor.Functions.Functions.Maintenance
            catch (Exception ex)
            {
                _logger.LogError(ex, "TriggerSessionDeletionMaintenance: enqueue failed (triggeredBy={TriggeredBy})", actor);
-                return await WriteJsonAsync(req, HttpStatusCode.InternalServerError, new
-                {
-                    error = "EnqueueFailed",
-                    message = "Failed to enqueue the maintenance run — please retry.",
-                });
+                return await req.ErrorAsync(
+                    HttpStatusCode.InternalServerError,
+                    Constants.ApiErrorCodes.EnqueueFailed,
+                    "Failed to enqueue the maintenance run — please retry.");
            }

            _logger.LogInformation("TriggerSessionDeletionMaintenance: run queued (triggeredBy={TriggeredBy})", actor);
-            return await WriteJsonAsync(req, HttpStatusCode.Accepted, new
+            return await req.JsonAsync(HttpStatusCode.Accepted, new SessionDeletionMaintenanceTriggerResponse
            {
-                message = "Maintenance run queued — progress surfaces as SessionDeletionMaintenance* ops events.",
-                triggeredBy = actor,
+                Message = "Maintenance run queued — progress surfaces as SessionDeletionMaintenance* ops events.",
+                TriggeredBy = actor,
            });
        }
-
-        private static async Task<HttpResponseData> WriteJsonAsync(HttpRequestData req, HttpStatusCode status, object body)
-        {
-            var response = req.CreateResponse(status);
-            response.Headers.Add("Content-Type", "application/json; charset=utf-8");
-            await response.WriteStringAsync(JsonSerializer.Serialize(body));
-            return response;
-        }
    }
 }
@@ -30,7 +30,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics

                // Optional time filter: ?days=7 (default: 30, clamped to [1, 365] for consistency
                // with metrics/summary, metrics/usage, and metrics/platform).
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var cutoff = DateTime.UtcNow.AddDays(-days);
@@ -48,7 +48,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                // Authentication + MemberRead authorization enforced by PolicyEnforcementMiddleware;
                // cross-tenant access via TargetTenantId (TenantScoping.QueryParam).
                var requestCtx = req.GetRequestContext();
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var rawSerial = query["serialNumber"];
                var sessionId = query["sessionId"];

@@ -123,7 +123,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
            {
                // Authentication + MemberRead authorization enforced by PolicyEnforcementMiddleware
                var tenantId = TenantHelper.GetTenantId(req);
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], DeviceJourneyMetricsResponseBuilder.DefaultWindowDays, 1, DeviceJourneyMetricsResponseBuilder.MaxWindowDays);

                var response = req.CreateResponse(HttpStatusCode.OK);
@@ -167,7 +167,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
            try
            {
                // Authentication + GlobalReadOrAdmin authorization enforced by PolicyEnforcementMiddleware
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var tenantIdFilter = query["tenantId"];
                var days = QueryParams.Int(query["days"], DeviceJourneyMetricsResponseBuilder.DefaultWindowDays, 1, DeviceJourneyMetricsResponseBuilder.MaxWindowDays);
                var partition = string.IsNullOrWhiteSpace(tenantIdFilter) ? "global" : tenantIdFilter!;
@@ -34,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                // Authentication + MemberRead authorization enforced by PolicyEnforcementMiddleware
                var tenantId = TenantHelper.GetTenantId(req);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                _logger.LogInformation("Fetching fleet health for tenant {TenantId} (days={Days})", tenantId, days);
@@ -34,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                // Authentication + MemberRead authorization enforced by PolicyEnforcementMiddleware
                var tenantId = TenantHelper.GetTenantId(req);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var locationKey = query["locationKey"];
                var country = query["country"];
                // Accept either the legacy opaque locationKey (still used by the web UI,
@@ -35,7 +35,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                var tenantId = TenantHelper.GetTenantId(req);
                _logger.LogInformation("Fetching geographic metrics for tenant {TenantId}", tenantId);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var groupBy = query["groupBy"] ?? "city";
@@ -34,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
            {
                // Authentication + GlobalReadOrAdmin authorization enforced by PolicyEnforcementMiddleware

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);
                var limit = QueryParams.Int(query["limit"], @default: 500, min: 1, max: 2000);

@@ -31,7 +31,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics

                _logger.LogInformation($"Fetching global app metrics (User: {userEmail})");

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                // Clamped to [1, 365] like the tenant variant and the other metrics endpoints — an
                // unbounded days= here was the one way to request an unlimited cross-tenant scan.
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);
@@ -34,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
                var userEmail = TenantHelper.GetUserIdentifier(req);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var tenantIdFilter = query["tenantId"];
@@ -34,7 +34,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware
                var userEmail = TenantHelper.GetUserIdentifier(req);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var locationKey = query["locationKey"];
                var country = query["country"];
                // Accept either the legacy opaque locationKey (web UI pairs it with groupBy)
@@ -35,7 +35,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics

                _logger.LogInformation("Fetching global geographic metrics (User: {UserEmail})", userEmail);

-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var days = QueryParams.Int(query["days"], @default: 30, min: 1, max: 365);

                var groupBy = query["groupBy"] ?? "city";
@@ -42,7 +42,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics

            try
            {
-                var qs = System.Web.HttpUtility.ParseQueryString(req.Url.Query ?? "");
+                var qs = req.Query;
                tenantId = qs.Get("tenantId");

                if (string.IsNullOrWhiteSpace(tenantId))
@@ -121,7 +121,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
            try
            {
                // Authentication + GlobalReadOrAdmin authorization enforced by PolicyEnforcementMiddleware
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var tenantIdFilter = query["tenantId"];
                var partition = string.IsNullOrWhiteSpace(tenantIdFilter) ? "global" : tenantIdFilter!;

@@ -40,7 +40,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
            try
            {
                // Authentication + GlobalReadOrAdmin authorization enforced by PolicyEnforcementMiddleware
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var tenantIdFilter = query["tenantId"];
                var days = QueryParams.Int(query["days"], VerdictCalibrationResponseBuilder.DefaultWindowDays, 1, VerdictCalibrationResponseBuilder.MaxWindowDays);
                var partition = "global";
@@ -48,7 +48,7 @@ public class MetricsSummaryFunction
            var days = QueryParams.Int(req.Query["days"], @default: 30, min: 1, max: 365);
            // Optional tenantId filter — when set, GA scopes the cross-tenant summary to one
            // tenant. When absent, returns the full cross-tenant view (null → all tenants).
-            var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+            var query = req.Query;
            var filterTenantId = query["tenantId"];
            if (!string.IsNullOrWhiteSpace(filterTenantId))
            {
@@ -39,7 +39,7 @@ namespace AutopilotMonitor.Functions.Functions.Metrics
                // Authentication + GlobalAdminOnly authorization enforced by PolicyEnforcementMiddleware

                // Optional tenantId query parameter: when provided, return tenant-specific metrics
-                var query = System.Web.HttpUtility.ParseQueryString(req.Url.Query);
+                var query = req.Query;
                var tenantId = query["tenantId"];
                var days = QueryParams.Int(query["days"], @default: 90, min: 1, max: 365);

--- a/Show More
+++ b/Show More