bump pointer: internal (lessons: analysis vs build plan)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bump pointer: internal, .claude/commands (D-338: inventory keys, fail-closed reads, audit/ops analysis)
2026-10-25 05:00:07 +00:00 · 2026-10-09 21:35:16 +02:00 · 2026-10-09 21:34:20 +02:00 · 2026-10-09 21:34:07 +02:00 · 2026-10-09 21:33:29 +02:00 · 2026-10-09 21:33:00 +02:00
506 changed files with 36997 additions and 3561 deletions
@@ -65,7 +65,7 @@ updates:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

-  # Validator tooling for rules/ (ajv-cli); combine-rules.yml installs it from this
+  # Validator tooling for rules/ (ajv for validate.js); combine-rules.yml installs it from this
  # lockfile with contents:write in hand, so the pins must not go stale.
  - package-ecosystem: npm
    directory: /rules/scripts
@@ -11,6 +11,7 @@
    Identity comes from whatever `az login` established: the federated GitHub OIDC principal
    in CI (azure/login, subject repo:okieselbach/AutopilotMonitor:ref:refs/heads/main), the
    operator's own account for the local build. No secret is read, stored or passed around.
+    Under GitHub Actions the token is masked in the run log before it is returned.

    x-ms-version is MANDATORY here, not decoration: Entra-authorized requests are rejected
    below 2017-11-09, and Table requests without a SAS must carry the header at all. 2021-08-06
@@ -45,6 +46,15 @@ if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
           'on the table -- a missing role shows up later as HTTP 403 AuthorizationPermissionMismatch.')
 }

+# GitHub masks only secrets.* on its own; a token minted at run time is clear text in the
+# (public) run log the moment anything prints it -- an uncaptured call of this script, or
+# Get-Error / Format-List on a failed request, whose TargetObject carries this header.
+# Write-Host, never Write-Output: the output stream is this script's return value. Only
+# under Actions -- anywhere else the line would print the token instead of hiding it.
+if ($env:GITHUB_ACTIONS -eq 'true') {
+    Write-Host "::add-mask::$token"
+}
+
 return @{
    'Authorization' = "Bearer $token"
    'x-ms-version'  = '2021-08-06'
@@ -26,7 +26,10 @@ name: Workflow gates
 #
 # The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
 # PR that rewrites both the SHA and the trailing version comment. The comment is
-# therefore required too: it is what makes a pinned line reviewable.
+# therefore required too: it is what makes a pinned line reviewable. It names the exact
+# release tag (# v7.0.1), never the floating major (# v7): a major tag moves with every
+# upstream release, after which the comment no longer names the pinned commit and
+# zizmor's ref-version-mismatch flags every line that carries it.

 on:
  push:
@@ -45,7 +48,7 @@ jobs:
    name: Verify action pins
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -59,13 +62,15 @@ jobs:
            # nothing to pin.
            case "$ref" in ./*|\$/*) continue ;; esac

-            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*v?[0-9]+\.[0-9]+\.[0-9]+([[:space:]]|$) ]]; then
              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
              continue
            fi

            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
-              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vX.Y.Z' so the line stays reviewable."
+            elif [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+# ]]; then
+              echo "::error file=$file,line=$line::The version comment must name the exact release tag the SHA resolves to ('# vX.Y.Z'), not a floating major: '$ref'. Find it with: gh api repos/<owner>/<action>/git/matching-refs/tags/vN"
            else
              echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
            fi
@@ -89,7 +94,7 @@ jobs:
      security-events: write   # SARIF upload: findings land in the Code scanning tab next to CodeQL
      actions: read
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -18,7 +18,7 @@ jobs:
    name: Bootstrap guard tests (PS 5.1)
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -72,7 +72,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -124,7 +124,7 @@ jobs:

      # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
      - name: Setup .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'

@@ -464,7 +464,7 @@ jobs:
      # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
      - name: Attest build provenance
        if: inputs.upload_blob || inputs.create_release
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            ${{ steps.artifact.outputs.versioned_zip_release }}
@@ -472,13 +472,13 @@ jobs:
            staging/agent/AutopilotMonitor.SummaryDialog.exe

      - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
          path: ${{ steps.artifact.outputs.versioned_zip_release }}

      - name: Upload version metadata
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: version-metadata
          path: ${{ env.MANIFEST_NAME }}
@@ -40,7 +40,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -240,12 +240,12 @@ jobs:
      # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
      - name: Attest build provenance (MSI)
        if: inputs.upload_blob
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: ${{ env.STABLE_MSI }}

      - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
          path: ${{ env.STABLE_MSI }}
@@ -98,11 +98,11 @@ jobs:
    # windows-latest is required: the agent test projects target net48.
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'

@@ -124,6 +124,9 @@ jobs:
      - name: Summary Dialog tests
        run: dotnet test src/Agent/AutopilotMonitor.SummaryDialog.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"

+      - name: Push tests
+        run: dotnet test src/Push/AutopilotMonitor.Push.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
+
  web:
    name: Web (typecheck + tests)
    runs-on: ubuntu-latest
@@ -131,11 +134,11 @@ jobs:
      run:
        working-directory: src/Web/autopilot-monitor-web
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: npm
@@ -167,11 +170,11 @@ jobs:
      run:
        working-directory: src/McpServer/autopilot-monitor-mcp
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: npm
@@ -189,7 +192,7 @@ jobs:
      # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
      # is honored by vector-search-provider.ts.
      - name: Cache embedding model
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ github.workspace }}/.hf-cache
          key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -203,11 +206,11 @@ jobs:
    name: Generated guardrails match rules/guardrails.json
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

@@ -226,11 +229,11 @@ jobs:
    name: Generated wire types match shared-manifests.json
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

@@ -104,11 +104,11 @@ jobs:
            build-mode: none

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'
@@ -24,49 +24,26 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

      # Lockfile and no lifecycle scripts: this job holds contents:write and pushes to
      # main, so an install-time script from a hijacked package would run with a token that
-      # can rewrite the repository. rules/scripts/package-lock.json pins ajv-cli, ajv-formats
+      # can rewrite the repository. rules/scripts/package-lock.json pins ajv, ajv-formats
      # and every transitive package (Dependabot keeps it current); ajv is pure JS and
      # needs no install hooks.
-      - name: Install ajv-cli from the lockfile
+      - name: Install the rules validator from the lockfile
        working-directory: rules/scripts
-        run: |
-          npm ci --ignore-scripts
-          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
+        run: npm ci --ignore-scripts

-      - name: Validate Gather Rules
-        run: |
-          for f in rules/gather/*.json; do
-            echo "Validating $f..."
-            ajv validate -s rules/schema/gather-rule.schema.json -d "$f" --spec=draft2020 -c ajv-formats
-          done
-
-      - name: Validate Analyze Rules
-        run: |
-          for f in rules/analyze/*.json; do
-            echo "Validating $f..."
-            ajv validate -s rules/schema/analyze-rule.schema.json -d "$f" --spec=draft2020 -c ajv-formats
-          done
-
-      - name: Validate IME Log Patterns
-        run: |
-          for f in rules/ime-log-patterns/*.json; do
-            echo "Validating $f..."
-            ajv validate -s rules/schema/ime-log-pattern.schema.json -d "$f" --spec=draft2020 -c ajv-formats
-          done
-
-      # guardrails.json values are baked verbatim into generated TypeScript that is
-      # auto-committed to main and shipped to the portal - the schema forbids control
-      # and line-terminator characters so a "data" PR can never become code.
-      - name: Validate Guardrails
-        run: ajv validate -s rules/schema/guardrails.schema.json -d rules/guardrails.json --spec=draft2020 -c ajv-formats
+      # Gather, analyze and IME log pattern files plus guardrails.json, each against its
+      # schema; the guardrails schema is what keeps a "data" PR from becoming code in the
+      # generated TypeScript (see validate.js).
+      - name: Validate rules and guardrails against their schemas
+        run: node rules/scripts/validate.js

      - name: Combine rules into dist/
        run: node rules/scripts/combine.js
@@ -19,7 +19,7 @@ jobs:
    name: Build and Deploy Backend

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -31,7 +31,7 @@ jobs:
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup .NET 10
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0.x'

@@ -67,7 +67,7 @@ jobs:
        run: dotnet publish ${{ env.CSPROJ_PATH }} --configuration Release --output ./publish --no-build -p:SourceRevisionId=${{ github.sha }} -p:BuildNumber=${{ steps.version.outputs.build_number }} -p:BuildTimestampUtc=${{ steps.version.outputs.build_utc }}

      - name: Deploy to Azure Functions
-        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1
+        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7
        with:
          app-name: ${{ env.FUNCTION_APP }}
          package: ./publish
@@ -26,7 +26,7 @@ jobs:
    name: Build and Deploy MCP Server

    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -38,7 +38,7 @@ jobs:
      # re-run actually rolls a new revision). /health reports the SHA captured
      # below so that staleness is checkable.
      - name: Check out documentation bundle
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: autopilotmonitor/autopilotmonitor-docs
@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Build and Deploy Job
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          lfs: false
@@ -57,7 +57,7 @@ jobs:
      # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
      # records which docs commit is live.
      - name: Check out documentation bundle
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: autopilotmonitor/autopilotmonitor-docs
@@ -68,7 +68,7 @@ jobs:
        id: docs
        run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"

-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: npm
@@ -108,6 +108,8 @@ jobs:
          NEXT_PUBLIC_ENTRA_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_REDIRECT_URI }}
          NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI }}
          NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
+          # Browsers load the live stats through it, and the build reads it once to bake the
+          # numbers of this moment into the landing page's static HTML (lib/platformStats.ts).
          NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL: ${{ vars.NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL }}
          NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING: ${{ secrets.NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING }}
          # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
@@ -121,6 +123,9 @@ jobs:
          npm run build
          test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }
          test -f out/whats-new.json || { echo "out/whats-new.json missing - whats-new prebuild did not run"; exit 1; }
+          # Fail-soft like the star count: browsers still load the stats live; only crawlers and
+          # LLM fetchers, which run no JS, see no numbers until the next deploy.
+          grep -q 'data-stats-snapshot=' out/index.html || echo "::warning::Platform stats were not baked into the landing page (reason in the build log) - crawlers and LLM fetchers see no numbers until the next deploy"

      # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
      - name: Package export
@@ -135,12 +140,12 @@ jobs:
      # commit, workflow file) in a public transparency log.
      # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
      - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: ${{ steps.package.outputs.archive }}

      - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: portal-${{ github.sha }}
          path: ${{ steps.package.outputs.archive }}
@@ -60,7 +60,7 @@ jobs:
      contents: read
      id-token: write   # OIDC federated login for the storage writes (secret-less)
    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

@@ -135,7 +135,7 @@ jobs:
      # when someone wants to look at the file.
      - name: Upload signed scripts
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: signed-scripts
          path: ${{ runner.temp }}/signed-scripts
@@ -31,6 +31,12 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.Agent.V2.C
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.SummaryDialog.Tests", "src\Agent\AutopilotMonitor.SummaryDialog.Tests\AutopilotMonitor.SummaryDialog.Tests.csproj", "{4F1234C1-9387-4D2C-93E0-713698A2DFCB}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Push", "Push", "{09266D87-DDB8-2F61-A22F-10D1DD295F4F}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.Push", "src\Push\AutopilotMonitor.Push\AutopilotMonitor.Push.csproj", "{2C3E71E4-0049-45A5-839D-F4171B47D5F3}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.Push.Tests", "src\Push\AutopilotMonitor.Push.Tests\AutopilotMonitor.Push.Tests.csproj", "{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -161,6 +167,30 @@ Global
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB}.Release|x64.Build.0 = Release|Any CPU
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB}.Release|x86.ActiveCfg = Release|Any CPU
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB}.Release|x86.Build.0 = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x64.Build.0 = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x86.Build.0 = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x64.ActiveCfg = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x64.Build.0 = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x86.ActiveCfg = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x86.Build.0 = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x64.Build.0 = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x86.Build.0 = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x64.ActiveCfg = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x64.Build.0 = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x86.ActiveCfg = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -179,5 +209,8 @@ Global
 		{11B36E5C-B512-4D1E-A76B-E5AD866B033C} = {096B6098-F141-7114-B090-72D1899D8853}
 		{95A09BF0-4E22-41D9-9B43-8D6ECC2C8AD0} = {096B6098-F141-7114-B090-72D1899D8853}
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB} = {096B6098-F141-7114-B090-72D1899D8853}
+		{09266D87-DDB8-2F61-A22F-10D1DD295F4F} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3} = {09266D87-DDB8-2F61-A22F-10D1DD295F4F}
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302} = {09266D87-DDB8-2F61-A22F-10D1DD295F4F}
 	EndGlobalSection
 EndGlobal
@@ -5,7 +5,7 @@
  "description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts.",
  "severity": "warning",
  "category": "device",
-  "version": "1.1.0",
+  "version": "1.1.1",
  "author": "Autopilot Monitor",
  "enabled": true,
  "evaluateOn": [
@@ -17,7 +17,7 @@
  "confidenceThreshold": 50,
  "conditions": [
    {
-      "signal": "clock_ahead",
+      "signal": "clock_behind",
      "source": "event_data",
      "eventType": "ntp_time_check",
      "dataField": "offsetSeconds",
@@ -26,7 +26,7 @@
      "required": false
    },
    {
-      "signal": "clock_behind",
+      "signal": "clock_ahead",
      "source": "event_data",
      "eventType": "ntp_time_check",
      "dataField": "offsetSeconds",
@@ -0,0 +1,118 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-013",
+  "title": "OOBE Quality Update Failed",
+  "description": "Detects that the Windows quality update page at the end of OOBE (Enrollment Status Page setting \"Install Windows quality updates\") reported a failed download or install and recorded no successful install afterwards — the page's own failure names on the oobe_update_page events. Setup usually continues, so the failure is otherwise invisible: the device finishes OOBE without the monthly security update. An OS build change across a restart (os_build_changed) vetoes the finding, and so does the agent's names_capped marker — once the page's event names were capped, a missing success name proves nothing. A downloadInstallFailureHelper entry alone is no failure: updates that installed fine log it too.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "update_failure",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "in",
+      "value": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+      "required": true
+    },
+    {
+      "signal": "no_install_success",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+      "required": true
+    },
+    {
+      "signal": "os_build_unchanged",
+      "source": "event_type",
+      "eventType": "os_build_changed",
+      "operator": "not_exists",
+      "value": "",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    },
+    {
+      "signal": "update_page_failed",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "result",
+      "operator": "equals",
+      "value": "fail",
+      "filterField": "page",
+      "filterOperator": "equals",
+      "filterValue": "OobeNDUP",
+      "required": false
+    },
+    {
+      "signal": "update_skipped",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "regex",
+      "value": "SkipDownloadInstallButtonClicked$",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "update_page_failed",
+      "condition": "exists",
+      "weight": 10
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE reported `{{update_failure}}`, and no successful install was recorded afterwards. When the download or install of the update fails, the page gives up and setup continues, so the enrollment itself can still succeed — but the device most likely finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. Selecting Skip on the page after the failure leads to the same result.",
+  "remediation": [
+    {
+      "title": "Find out why the update failed",
+      "steps": [
+        "Open the oobe_update_page events around the failure in the session timeline: the download progress before it shows how far the download got, and a Skip after it shows that someone chose to continue.",
+        "Check the network path the device uses during OOBE for Windows Update and Delivery Optimization: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+        "Compare with other devices: the same failure on many devices of one site points at the network path, on one model at the device, and across the fleet at the update itself."
+      ]
+    },
+    {
+      "title": "Make sure the device gets the update",
+      "steps": [
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule.",
+        "Where the OOBE quality update keeps failing for one network or device group, decide per Enrollment Status Page profile whether \"Install Windows quality updates\" should stay on."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}
@@ -0,0 +1,119 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-014",
+  "title": "OOBE Quality Update Not Offered After an Earlier Failure",
+  "description": "Detects that the Windows quality update page at the end of OOBE found no update to install although the device is out of date, on a device whose update page counts an earlier failed download or install (oobe_update_page: NDUPDownloadInstallPreviousFailureCount above 0, osUpdatesWithNDUPPI false, getDaysOutOfDateSucceeded above 0). No failure and no install success are recorded in this session — a failure in this session is ANALYZE-DEV-013 — and the agent's names_capped marker vetoes the finding, because a missing name proves nothing once the page's names were capped. The device finishes OOBE without the monthly security update.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "previous_failures",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "SdxWebAppCloudNDUP_initialize_NDUPDownloadInstallPreviousFailureCount",
+      "required": true
+    },
+    {
+      "signal": "nothing_offered",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "equals",
+      "value": "false",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "SdxWebAppCloudNDUP_updateManager_processUpdatesMetadata_osUpdatesWithNDUPPI",
+      "required": true
+    },
+    {
+      "signal": "days_out_of_date",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+      "required": true
+    },
+    {
+      "signal": "no_update_failure",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "in",
+      "filterValue": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+      "required": true
+    },
+    {
+      "signal": "no_install_success",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE checked for updates and found none to install, although Windows reports the device as {{days_out_of_date}} days out of date. The page's failure counter for this device stands at {{previous_failures}}: an earlier download or install of an OOBE quality update on this device failed. The device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment.",
+  "remediation": [
+    {
+      "title": "Check the earlier attempt",
+      "steps": [
+        "Look at the device's earlier enrollment sessions — the failed attempt and its ANALYZE-DEV-013 finding are usually there.",
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+      ]
+    },
+    {
+      "title": "Reduce how far behind devices start",
+      "steps": [
+        "Devices that start OOBE many months behind need a long update during setup; a current OS image or factory build shortens it and gives a failed attempt less to repeat."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}
@@ -0,0 +1,117 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-015",
+  "title": "OOBE Update Check Ended Without a Result",
+  "description": "Detects that the Windows quality update page at the end of OOBE started its Windows Update scan but ended without a scan result (oobe_update_page: startWUScanStartedSuccedded, an OobeNDUP stop and no ExpeditedUpdate_getUpdateResults name), on a device that is out of date and allowed to update. In the observed sessions the page ended two minutes after the scan started, on devices more than a year behind. The device finishes OOBE without the monthly security update. The agent's names_capped marker vetoes the finding: once the page's event names were capped, a missing scan result proves nothing.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "update_allowed",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "equals",
+      "value": "true",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded",
+      "required": true
+    },
+    {
+      "signal": "scan_started",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "equals",
+      "value": "ExpeditedUpdate_startWUScanStartedSuccedded",
+      "required": true
+    },
+    {
+      "signal": "no_scan_result",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "^ExpeditedUpdate_getUpdateResults",
+      "required": true
+    },
+    {
+      "signal": "update_page_ended",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "equals",
+      "value": "page_stopped",
+      "filterField": "page",
+      "filterOperator": "equals",
+      "filterValue": "OobeNDUP",
+      "required": true
+    },
+    {
+      "signal": "days_out_of_date",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE started a Windows Update scan, but no scan result arrived before the page ended. The device is {{days_out_of_date}} days out of date, so an update was due — the device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. The page waits only a short time for the scan (two minutes in the observed sessions): a scan that takes longer, or cannot reach Windows Update, ends the page without an update.",
+  "remediation": [
+    {
+      "title": "Check the path to Windows Update during OOBE",
+      "steps": [
+        "Verify that devices in OOBE reach the Windows Update service: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+        "Check whether an update policy applied during the Enrollment Status Page points the scan at another source, such as WSUS."
+      ]
+    },
+    {
+      "title": "Shorten the scan",
+      "steps": [
+        "Devices far behind scan longer; a current OS image or factory build keeps the OOBE scan short.",
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}
@@ -1654,7 +1654,7 @@
      "description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts.",
      "severity": "warning",
      "category": "device",
-      "version": "1.1.0",
+      "version": "1.1.1",
      "author": "Autopilot Monitor",
      "enabled": true,
      "evaluateOn": [
@@ -1666,7 +1666,7 @@
      "confidenceThreshold": 50,
      "conditions": [
        {
-          "signal": "clock_ahead",
+          "signal": "clock_behind",
          "source": "event_data",
          "eventType": "ntp_time_check",
          "dataField": "offsetSeconds",
@@ -1675,7 +1675,7 @@
          "required": false
        },
        {
-          "signal": "clock_behind",
+          "signal": "clock_ahead",
          "source": "event_data",
          "eventType": "ntp_time_check",
          "dataField": "offsetSeconds",
@@ -1930,6 +1930,357 @@
        "environment"
      ]
    },
+    {
+      "ruleId": "ANALYZE-DEV-013",
+      "title": "OOBE Quality Update Failed",
+      "description": "Detects that the Windows quality update page at the end of OOBE (Enrollment Status Page setting \"Install Windows quality updates\") reported a failed download or install and recorded no successful install afterwards — the page's own failure names on the oobe_update_page events. Setup usually continues, so the failure is otherwise invisible: the device finishes OOBE without the monthly security update. An OS build change across a restart (os_build_changed) vetoes the finding, and so does the agent's names_capped marker — once the page's event names were capped, a missing success name proves nothing. A downloadInstallFailureHelper entry alone is no failure: updates that installed fine log it too.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "update_failure",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "in",
+          "value": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+          "required": true
+        },
+        {
+          "signal": "no_install_success",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+          "required": true
+        },
+        {
+          "signal": "os_build_unchanged",
+          "source": "event_type",
+          "eventType": "os_build_changed",
+          "operator": "not_exists",
+          "value": "",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        },
+        {
+          "signal": "update_page_failed",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "result",
+          "operator": "equals",
+          "value": "fail",
+          "filterField": "page",
+          "filterOperator": "equals",
+          "filterValue": "OobeNDUP",
+          "required": false
+        },
+        {
+          "signal": "update_skipped",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "regex",
+          "value": "SkipDownloadInstallButtonClicked$",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "update_page_failed",
+          "condition": "exists",
+          "weight": 10
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE reported `{{update_failure}}`, and no successful install was recorded afterwards. When the download or install of the update fails, the page gives up and setup continues, so the enrollment itself can still succeed — but the device most likely finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. Selecting Skip on the page after the failure leads to the same result.",
+      "remediation": [
+        {
+          "title": "Find out why the update failed",
+          "steps": [
+            "Open the oobe_update_page events around the failure in the session timeline: the download progress before it shows how far the download got, and a Skip after it shows that someone chose to continue.",
+            "Check the network path the device uses during OOBE for Windows Update and Delivery Optimization: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+            "Compare with other devices: the same failure on many devices of one site points at the network path, on one model at the device, and across the fleet at the update itself."
+          ]
+        },
+        {
+          "title": "Make sure the device gets the update",
+          "steps": [
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule.",
+            "Where the OOBE quality update keeps failing for one network or device group, decide per Enrollment Status Page profile whether \"Install Windows quality updates\" should stay on."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-014",
+      "title": "OOBE Quality Update Not Offered After an Earlier Failure",
+      "description": "Detects that the Windows quality update page at the end of OOBE found no update to install although the device is out of date, on a device whose update page counts an earlier failed download or install (oobe_update_page: NDUPDownloadInstallPreviousFailureCount above 0, osUpdatesWithNDUPPI false, getDaysOutOfDateSucceeded above 0). No failure and no install success are recorded in this session — a failure in this session is ANALYZE-DEV-013 — and the agent's names_capped marker vetoes the finding, because a missing name proves nothing once the page's names were capped. The device finishes OOBE without the monthly security update.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "previous_failures",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "SdxWebAppCloudNDUP_initialize_NDUPDownloadInstallPreviousFailureCount",
+          "required": true
+        },
+        {
+          "signal": "nothing_offered",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "equals",
+          "value": "false",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "SdxWebAppCloudNDUP_updateManager_processUpdatesMetadata_osUpdatesWithNDUPPI",
+          "required": true
+        },
+        {
+          "signal": "days_out_of_date",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+          "required": true
+        },
+        {
+          "signal": "no_update_failure",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "in",
+          "filterValue": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+          "required": true
+        },
+        {
+          "signal": "no_install_success",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE checked for updates and found none to install, although Windows reports the device as {{days_out_of_date}} days out of date. The page's failure counter for this device stands at {{previous_failures}}: an earlier download or install of an OOBE quality update on this device failed. The device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment.",
+      "remediation": [
+        {
+          "title": "Check the earlier attempt",
+          "steps": [
+            "Look at the device's earlier enrollment sessions — the failed attempt and its ANALYZE-DEV-013 finding are usually there.",
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+          ]
+        },
+        {
+          "title": "Reduce how far behind devices start",
+          "steps": [
+            "Devices that start OOBE many months behind need a long update during setup; a current OS image or factory build shortens it and gives a failed attempt less to repeat."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-015",
+      "title": "OOBE Update Check Ended Without a Result",
+      "description": "Detects that the Windows quality update page at the end of OOBE started its Windows Update scan but ended without a scan result (oobe_update_page: startWUScanStartedSuccedded, an OobeNDUP stop and no ExpeditedUpdate_getUpdateResults name), on a device that is out of date and allowed to update. In the observed sessions the page ended two minutes after the scan started, on devices more than a year behind. The device finishes OOBE without the monthly security update. The agent's names_capped marker vetoes the finding: once the page's event names were capped, a missing scan result proves nothing.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "update_allowed",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "equals",
+          "value": "true",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded",
+          "required": true
+        },
+        {
+          "signal": "scan_started",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "equals",
+          "value": "ExpeditedUpdate_startWUScanStartedSuccedded",
+          "required": true
+        },
+        {
+          "signal": "no_scan_result",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "^ExpeditedUpdate_getUpdateResults",
+          "required": true
+        },
+        {
+          "signal": "update_page_ended",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "equals",
+          "value": "page_stopped",
+          "filterField": "page",
+          "filterOperator": "equals",
+          "filterValue": "OobeNDUP",
+          "required": true
+        },
+        {
+          "signal": "days_out_of_date",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE started a Windows Update scan, but no scan result arrived before the page ended. The device is {{days_out_of_date}} days out of date, so an update was due — the device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. The page waits only a short time for the scan (two minutes in the observed sessions): a scan that takes longer, or cannot reach Windows Update, ends the page without an update.",
+      "remediation": [
+        {
+          "title": "Check the path to Windows Update during OOBE",
+          "steps": [
+            "Verify that devices in OOBE reach the Windows Update service: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+            "Check whether an update policy applied during the Enrollment Status Page points the scan at another source, such as WSUS."
+          ]
+        },
+        {
+          "title": "Shorten the scan",
+          "steps": [
+            "Devices far behind scan longer; a current OS image or factory build keeps the OOBE scan short.",
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
    {
      "ruleId": "ANALYZE-ENRL-001",
      "title": "Enrollment Failed",
@@ -1,3 +0,0 @@
-# ajv-cli declares ts-node as a peer dependency it never needs for JSON schemas; do not
-# pull ts-node + typescript into a job that pushes to main.
-legacy-peer-deps=true
@@ -6,7 +6,7 @@
    "": {
      "name": "autopilot-monitor-rules-tooling",
      "devDependencies": {
-        "ajv-cli": "5.0.0",
+        "ajv": "8.20.0",
        "ajv-formats": "3.0.1"
      }
    },
@@ -27,33 +27,6 @@
        "url": "https://github.com/sponsors/epoberezkin"
      }
    },
-    "node_modules/ajv-cli": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ajv-cli/-/ajv-cli-5.0.0.tgz",
-      "integrity": "sha512-LY4m6dUv44HTyhV+u2z5uX4EhPYTM38Iv1jdgDJJJCyOOuqB8KtZEGjPZ2T+sh5ZIJrXUfgErYx/j3gLd3+PlQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0",
-        "fast-json-patch": "^2.0.0",
-        "glob": "^7.1.0",
-        "js-yaml": "^3.14.0",
-        "json-schema-migrate": "^2.0.0",
-        "json5": "^2.1.3",
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "ajv": "dist/index.js"
-      },
-      "peerDependencies": {
-        "ts-node": ">=9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ts-node": {
-          "optional": true
-        }
-      }
-    },
    "node_modules/ajv-formats": {
      "version": "3.0.1",
      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
@@ -72,55 +45,6 @@
        }
      }
    },
-    "node_modules/argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
    "node_modules/fast-deep-equal": {
      "version": "3.1.3",
      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -128,13 +52,6 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/fast-json-patch": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz",
-      "integrity": "sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==",
-      "dev": true,
-      "license": "MIT"
-    },
    "node_modules/fast-uri": {
      "version": "3.1.8",
      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
@@ -152,78 +69,6 @@
      ],
      "license": "BSD-3-Clause"
    },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/js-yaml": {
-      "version": "3.15.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
-      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/json-schema-migrate": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-migrate/-/json-schema-migrate-2.0.0.tgz",
-      "integrity": "sha512-r38SVTtojDRp4eD6WsCqiE0eNDt4v1WalBXb9cyZYw9ai5cGtBwzRNWjHzJl38w6TxFkXAIA7h+fyX3tnrAFhQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0"
-      }
-    },
    "node_modules/json-schema-traverse": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
@@ -231,62 +76,6 @@
      "dev": true,
      "license": "MIT"
    },
-    "node_modules/json5": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "json5": "lib/cli.js"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
    "node_modules/require-from-string": {
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@ -296,20 +85,6 @@
      "engines": {
        "node": ">=0.10.0"
      }
-    },
-    "node_modules/sprintf-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
-      "license": "ISC"
    }
  }
 }
@@ -3,10 +3,7 @@
  "private": true,
  "description": "Validator tooling for rules/ - combine-rules.yml installs from the lockfile so nothing unpinned reaches a job that pushes to main.",
  "devDependencies": {
-    "ajv-cli": "5.0.0",
+    "ajv": "8.20.0",
    "ajv-formats": "3.0.1"
-  },
-  "overrides": {
-    "fast-json-patch": "3.1.1"
  }
 }
@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * Validates every rule file and rules/guardrails.json against its JSON Schema
+ * (draft 2020-12). combine-rules.yml runs this before combine.js; any invalid
+ * file fails the run with exit code 1.
+ *
+ * Run: node rules/scripts/validate.js   (after `npm ci --ignore-scripts` in rules/scripts)
+ */
+
+const fs = require('fs');
+const path = require('path');
+const Ajv2020 = require('ajv/dist/2020');
+const addFormats = require('ajv-formats');
+
+const rulesRoot = path.resolve(__dirname, '..');
+
+const jsonFilesIn = (dir) =>
+  fs.readdirSync(path.join(rulesRoot, dir)).filter(f => f.endsWith('.json')).sort().map(f => `${dir}/${f}`);
+
+const sets = [
+  { schema: 'gather-rule.schema.json', files: jsonFilesIn('gather') },
+  { schema: 'analyze-rule.schema.json', files: jsonFilesIn('analyze') },
+  { schema: 'ime-log-pattern.schema.json', files: jsonFilesIn('ime-log-patterns') },
+  // guardrails.json values are baked verbatim into generated TypeScript that is
+  // auto-committed to main and shipped to the portal - the schema forbids control
+  // and line-terminator characters so a "data" PR can never become code.
+  { schema: 'guardrails.schema.json', files: ['guardrails.json'] }
+];
+
+const ajv = new Ajv2020({ allErrors: true });
+addFormats(ajv);
+
+let invalid = 0;
+
+for (const set of sets) {
+  const validate = ajv.compile(JSON.parse(fs.readFileSync(path.join(rulesRoot, 'schema', set.schema), 'utf8')));
+
+  for (const file of set.files) {
+    let data;
+    try {
+      data = JSON.parse(fs.readFileSync(path.join(rulesRoot, file), 'utf8'));
+    } catch (err) {
+      invalid++;
+      console.error(`INVALID rules/${file}: ${err.message}`);
+      continue;
+    }
+
+    if (!validate(data)) {
+      invalid++;
+      console.error(`INVALID rules/${file}`);
+      for (const e of validate.errors) {
+        console.error(`  ${e.instancePath || '(root)'} ${e.message} ${JSON.stringify(e.params)}`);
+      }
+    }
+  }
+
+  console.log(`${set.schema}: ${set.files.length} files checked`);
+}
+
+if (invalid > 0) {
+  console.error(`ERROR: ${invalid} file(s) failed schema validation`);
+  process.exit(1);
+}
@@ -144,7 +144,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
            Assert.Equal(4, svc.LastFetchAttempts);
        }

-        // ── Network-link gate (tenant aebdce78 audit 2026-08-24) ────────────
+        // ── Network-link gate (kiosk-tenant audit 2026-08-24) ────────────

        [Fact]
        public async Task FetchConfig_InitialFetch_WaitsForNetworkLink()
@@ -0,0 +1,31 @@
+#nullable enable
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Analyzers
+{
+    /// <summary>
+    /// Uninstall-key strings are read the way Windows shows them: up to the first NUL. Installers
+    /// that pad REG_SZ data with NULs otherwise leak them into the normalized vendor/name, which
+    /// the backend turns into a table key.
+    /// </summary>
+    public sealed class SoftwareInventoryRegistryTextTests
+    {
+        [Theory]
+        [InlineData("Contoso Widget", "Contoso Widget")]
+        [InlineData("Contoso Widget\0\0\0\0\0", "Contoso Widget")]
+        [InlineData("Contoso\0stale buffer", "Contoso")]
+        [InlineData("\0\0\0", "")]
+        [InlineData("", "")]
+        public void CutAtNul_KeepsTheTextBeforeTheFirstNul(string raw, string expected)
+        {
+            Assert.Equal(expected, SoftwareInventoryAnalyzer.CutAtNul(raw));
+        }
+
+        [Fact]
+        public void CutAtNul_Null_StaysNull()
+        {
+            Assert.Null(SoftwareInventoryAnalyzer.CutAtNul(null!));
+        }
+    }
+}
@@ -174,7 +174,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
        [Fact]
        public void Reevaluate_does_not_re_emit_starved_warnings()
        {
-            // sits-d Cloud-PC fix (2026-08-19): the synthesis re-check now runs on EVERY IME
+            // Cloud-PC fix (2026-08-19): the synthesis re-check now runs on EVERY IME
            // app-state transition. It must not turn the one-shot starvation warning into a
            // per-transition stream — the re-check path suppresses the emission entirely
            // (the per-appId dedupe would swallow the duplicates, but walking the probe
@@ -198,7 +198,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
        [Fact]
        public void Starved_apps_that_settle_later_still_complete_the_enrollment()
        {
-            // The real sits-d shape: the ESP exits with apps still starved (warning emitted),
+            // The real field shape: the ESP exits with apps still starved (warning emitted),
            // the apps then all settle, and the re-check must open the gate — the warning
            // already on the timeline is history, not a permanent veto.
            using var f = new Fixture();
@@ -172,8 +172,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
        }

        // ------------------------------------------------------------------------------
-        // sits-d Cloud-PC fix (2026-08-19) — the synthesis is no longer edge-only.
-        // Sessions 8110e262 / a89aac2d: the ESP page exited while 138 required user-ESP apps
+        // Cloud-PC fix (2026-08-19) — the synthesis is no longer edge-only.
+        // Two field sessions: the ESP page exited while 138 required user-ESP apps
        // were still in flight, they all reached a terminal state (0 failed) minutes later,
        // and because nothing re-checked, the enrollment never completed.
        // ------------------------------------------------------------------------------
@@ -140,6 +140,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
            Assert.Equal(1, fired); // the persisted flag suppressed the second emission
        }

+        [Fact]
+        public void Registry_reconciliation_counters_survive_a_restart()
+        {
+            using var h = new Harness();
+            h.Tracker.ScriptRuns.CountVerified();
+            h.Tracker.ScriptRuns.CountVerified();
+            h.Tracker.ScriptRuns.CountCorrected();
+            h.Tracker.SaveStateForTest();
+
+            h.Restart();
+
+            var health = h.Tracker.GetHealthSnapshot();
+            Assert.Equal(2, health.PlatformOutputVerified);
+            Assert.Equal(1, health.PlatformOutputCorrected);
+        }
+
        [Fact]
        public async Task Handler_time_does_not_count_against_the_line_budget()
        {
@@ -0,0 +1,336 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// B-96m: IME re-runs a failed platform script on later check-ins, so AgentExecutor.log can hold several runs of one
+    /// policy before the tracker has read IME's result of the first — always on the agent's first pass (the agent starts
+    /// mid-enrollment and reads all of AgentExecutor.log before IntuneManagementExtension.log), after a restart, and
+    /// whenever a result line surfaces late. With one slot per policy the second executor start reused the first run's
+    /// slot and its end block overwrote the first one: the first IME result went out with the LAST run's exit code and
+    /// output (session eff1b413: the bootstrap script "Failed (exit 0)" with the stdout of its successful retry), every
+    /// later result without an end block. These tests pin one run per executor start, each IME result paired with the
+    /// run of its policy that started last before it, each run carrying its own end block.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private const string RetryPolicyId = "4c2d8e1a-7b3f-4a9e-8d21-6f0b5c3e9a74";
+        private const string RetryUser = "00000000-0000-0000-0000-000000000000";
+
+        private static string ImeEntryAt(string time, string message)
+            => $"<![LOG[{message}]LOG]!><time=\"{time}\" date=\"9-10-2026\" component=\"IntuneManagementExtension\" context=\"\" type=\"1\" thread=\"12\" file=\"\">\r\n";
+
+        /// <summary>One executor run's start block: banner, the platform argument line, paths, launch.</summary>
+        private static string RunStart(string time, string pid, string policyId = RetryPolicyId, string userId = RetryUser)
+        {
+            var path = $@"{ImeDir}\Policies\Scripts\{userId}_{policyId}.ps1";
+            var results = $@"{ImeDir}\Policies\Results\{userId}_{policyId}";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershell with value {path} to the named argument list.")
+                + EntryAt(time, "Powershell option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, results + ".output")
+                + EntryAt(time, results + ".error")
+                + EntryAt(time, results + ".timeout")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        /// <summary>
+        /// One executor run's end block in AgentExecutor's order. "error from script =" logs the stderr buffer before the
+        /// output readers finished (<paramref name="stderrSnapshot"/>); "write output done" logs the final texts, the
+        /// error part being exactly the error file IME judges.
+        /// </summary>
+        private static string RunEnd(string time, int exitCode, string stdout, string stderr, string? stderrSnapshot = null)
+            => EntryAt(time, $"Powershell exit code is {exitCode}")
+            + EntryAt(time, $"length of out={stdout.Length}")
+            + EntryAt(time, $"length of error={stderr.Length}")
+            + EntryAt(time, "error from script =" + (stderrSnapshot ?? stderr))
+            + EntryAt(time, exitCode == 0 ? "Powershell script is successfully executed." : "Powershell script is failed to execute")
+            + EntryAt(time, $"write output done. output = {stdout}, error = {stderr}")
+            + EntryAt(time, "Revert Wow64FsRedirection")
+            + EntryAt(time, "Agent executor completed.");
+
+        private static string ImeRunStart(string time, string policyId = RetryPolicyId, string userId = RetryUser)
+            => ImeEntryAt(time, $@"Script file {ImeDir}\Policies\Scripts\{userId}_{policyId}.ps1 is generated.");
+
+        private static string ImeRunResult(string time, string result, string policyId = RetryPolicyId, string userId = RetryUser)
+            => ImeEntryAt(time, $"[PowerShell] User Id = {userId}, Policy id = {policyId}, policy result = {result}");
+
+        private static void AppendImeLog(Harness h, string text)
+            => File.AppendAllText(Path.Combine(Path.GetDirectoryName(h.LogPath)!, "IntuneManagementExtension.log"), text, new UTF8Encoding(false));
+
+        /// <summary>Result | exit | stdout | stderr — readable in an assertion failure; "-" no exit code, "~" never read.</summary>
+        private static string Shape(ScriptExecutionState s)
+            => $"{s.Result}|{(s.ExitCode.HasValue ? s.ExitCode.Value.ToString() : "-")}|{s.Stdout ?? "~"}|{s.Stderr ?? "~"}";
+
+        /// <summary>
+        /// Two poll passes as the agent runs them (read the files, then the flushes), the second past the result hold:
+        /// a result missing its end block goes out by then.
+        /// </summary>
+        private static async Task PassAndSettle(Harness h)
+        {
+            await h.Tracker.RunPollPassAsync(default);
+            h.Now = h.Now.AddSeconds(6);
+            await h.Tracker.RunPollPassAsync(default);
+        }
+
+        [Fact]
+        public async Task First_pass_pairs_each_ime_result_with_the_end_block_of_its_own_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // IME's first run and two retries on later check-ins, all written before the agent started.
+            h.Append(RunStart("12:00:10.0000000", "1001") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "1002") + RunEnd("12:10:12.0000000", 1, "Run B output", "")
+                + RunStart("12:20:10.0000000", "1003") + RunEnd("12:20:12.0000000", 0, "Run C output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success")
+                + ImeRunStart("12:20:08.0000000") + ImeRunResult("12:20:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|1||Run A failed", "Success|1|Run B output|", "Success|0|Run C output|" },
+                h.Completed.Select(Shape).ToArray());
+            Assert.All(h.Completed, s => Assert.Equal("ime_policy_result", s.ResultSource));
+            Assert.True(h.Completed[0].StartedAtUtc < h.Completed[1].StartedAtUtc && h.Completed[1].StartedAtUtc < h.Completed[2].StartedAtUtc);
+            Assert.Equal(3, h.Completed.Select(s => s.RunId).Distinct().Count());
+        }
+
+        [Fact]
+        public async Task Retry_of_the_bootstrap_script_never_lends_its_success_output_to_the_failed_first_attempt()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "2001") + RunEnd("12:00:20.0000000", 1, "attempt 1: download failed", "Invoke-WebRequest : The remote name could not be resolved")
+                + RunStart("12:10:10.0000000", "2002") + RunEnd("12:10:20.0000000", 0, "===== Bootstrap Completed Successfully =====", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:20.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:20.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[]
+            {
+                "Failed|1|attempt 1: download failed|Invoke-WebRequest : The remote name could not be resolved",
+                "Success|0|===== Bootstrap Completed Successfully =====|",
+            }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_killed_at_the_timeout_reports_failed_without_the_next_runs_end_block()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // IME killed the first executor after 1800 s: its start block is all AgentExecutor.log holds of it.
+            h.Append(RunStart("12:00:10.0000000", "3001")
+                + RunStart("12:40:10.0000000", "3002") + RunEnd("12:40:12.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:30:10.5000000", "Failed")
+                + ImeRunStart("12:40:08.0000000") + ImeRunResult("12:40:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|-|~|~", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_whose_result_never_surfaced_falls_back_on_imes_rule_before_the_next_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "4001") + RunEnd("12:00:12.0000000", 0, "Run A output", "Run A wrote an error")
+                + RunStart("12:10:10.0000000", "4002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // Run A's result line was lost; run B's is there.
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|0|Run A output|Run A wrote an error", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.Equal(new[] { "agentexecutor_fallback", "ime_policy_result" }, h.Completed.Select(s => s.ResultSource).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_in_flight_survives_the_emit_of_the_run_before_it()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "5001") + RunEnd("12:00:12.0000000", 0, "Run A output", "")
+                + RunStart("12:10:10.0000000", "5002"));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Success") + ImeRunStart("12:10:08.0000000"));
+            await PassAndSettle(h);
+            h.Now = h.Now.AddSeconds(30);
+            await h.Pass();
+
+            // Run B ends minutes later.
+            h.Append(RunEnd("12:10:40.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunResult("12:10:40.1000000", "Success"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Success|0|Run A output|", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Shutdown_between_the_two_logs_flushes_each_run_with_its_own_end_block()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "6001") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "6002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // The pass is cancelled after AgentExecutor.log; the shutdown flush follows.
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now, force: true);
+
+            h.Restart();
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+            await PassAndSettle(h);
+
+            // Each run went out with its own block and IME's verdict on it; the results read after the restart are
+            // the same runs and change nothing.
+            Assert.Equal(new[] { "Failed|1||Run A failed", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.All(h.Completed, s => Assert.Equal("agentexecutor_fallback", s.ResultSource));
+        }
+
+        [Fact]
+        public async Task End_block_line_recovered_after_the_next_run_started_stays_with_its_own_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "7001"));
+            var exitLineAt = h.Length;
+            h.Append(RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "7002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            await h.Pass();
+
+            // A stale writer rewrites run A's exit line in place: the ledger check re-reads it behind run B's start.
+            h.Overwrite(exitLineAt, EntryAt("12:00:12.0000000", "Powershell exit code is 7"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|7||Run A failed", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_without_result_or_end_block_is_dropped_once_a_later_run_has_its_result()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9001")
+                + RunStart("12:10:10.0000000", "9002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.Equal(0, h.Tracker.ParkedPlatformScriptCountForTest);
+        }
+
+        [Fact]
+        public void Reading_the_same_executor_start_line_again_never_parks_its_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            var line = $@"Adding argument powershell with value {ImeDir}\Policies\Scripts\{RetryUser}_{RetryPolicyId}.ps1 to the named argument list.";
+            var at = T0.AddMinutes(-30);
+
+            h.Tracker.ProcessLogMessageForTest(line, at, "AgentExecutor.log");
+            h.Tracker.ProcessLogMessageForTest(line, at, "AgentExecutor.log");
+            Assert.Equal(0, h.Tracker.ParkedPlatformScriptCountForTest);
+
+            h.Tracker.ProcessLogMessageForTest(line, at.AddMinutes(10), "AgentExecutor.log");
+            Assert.Equal(1, h.Tracker.ParkedPlatformScriptCountForTest);
+        }
+
+        [Fact]
+        public async Task Run_without_end_block_keeps_waiting_for_its_result_across_a_shutdown()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9101") + RunStart("12:40:10.0000000", "9102"));
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now, force: true);
+            Assert.Empty(h.Completed);
+
+            h.Restart();
+            Assert.Equal(1, h.Tracker.ParkedPlatformScriptCountForTest);
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:30:10.5000000", "Failed"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|-|~|~" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Earlier_run_emitted_while_a_later_one_runs_never_takes_the_later_runs_register_entry()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9201") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "9202"));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed") + ImeRunStart("12:10:08.0000000"));
+            await PassAndSettle(h);
+            Assert.Single(h.Completed);
+
+            // A save of this key is the latest run's, and that one is still running.
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+            Assert.Equal(PlatformRunClaim.Wait, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out _));
+
+            h.Append(RunEnd("12:10:40.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunResult("12:10:40.1000000", "Success"));
+            await PassAndSettle(h);
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out var run));
+            Assert.Equal(h.Completed[1].RunId, run!.RunId);
+            Assert.Equal("Run B output", run.Stdout);
+        }
+
+        [Fact]
+        public async Task Run_of_another_user_keeps_its_own_register_entry_when_it_waited_for_its_result()
+        {
+            const string otherUser = "2b7e5c91-3d4a-4f80-b6e2-9a1c7d3f5e08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9301") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "9302", userId: otherUser));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000", userId: otherUser));
+            await PassAndSettle(h);
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out var run));
+            Assert.Equal(h.Completed[0].RunId, run!.RunId);
+            Assert.Equal(PlatformRunClaim.Wait, h.Tracker.ScriptRuns.TryClaim(otherUser, RetryPolicyId, h.Now.AddSeconds(-10), out _));
+        }
+
+        [Fact]
+        public async Task Start_line_read_again_stays_a_late_line_after_an_earlier_run_of_another_user_went_out()
+        {
+            const string otherUser = "2b7e5c91-3d4a-4f80-b6e2-9a1c7d3f5e08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9401") + RunEnd("12:00:12.0000000", 0, "Run A output", "")
+                + RunStart("12:10:10.0000000", "9402", userId: otherUser) + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // Run A's result surfaces after run B's (its line was hidden by a concurrent writer).
+            AppendImeLog(h, ImeRunResult("12:10:12.1000000", "Success", userId: otherUser) + ImeRunResult("12:00:12.1000000", "Success"));
+            await PassAndSettle(h);
+            Assert.Equal(new[] { "Success|0|Run B output|", "Success|0|Run A output|" }, h.Completed.Select(Shape).ToArray());
+
+            // Run B's executor start line read again (a rewind): a late line of the emitted run B, never a new run.
+            var started = 0;
+            h.Tracker.OnScriptStarted = _ => started++;
+            h.Tracker.ProcessLogMessageForTest(
+                $@"Adding argument powershell with value {ImeDir}\Policies\Scripts\{otherUser}_{RetryPolicyId}.ps1 to the named argument list.",
+                h.Completed[0].StartedAtUtc, "AgentExecutor.log");
+            Assert.Equal(0, started);
+        }
+
+        [Fact]
+        public async Task Final_stderr_of_the_end_block_replaces_the_early_snapshot_even_without_stdout()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // The snapshot was taken before the error reader finished; IME judged the full error file.
+            h.Append(RunStart("12:00:10.0000000", "8001") + RunEnd("12:00:12.0000000", 0, "", "Remove-AppxPackage : Cannot process argument", stderrSnapshot: ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|0||Remove-AppxPackage : Cannot process argument" }, h.Completed.Select(Shape).ToArray());
+        }
+    }
+}
@@ -0,0 +1,139 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Sessions d29e27e3 and 4377911b: a concurrent IME writer overwrote the result line of a platform script, and the
+    /// overwrite check recovered it one pass later. Recovered lines were never fresh, so they resolved in the agent's own
+    /// cached zone (+60) instead of anchoring themselves (+120): the end stamp landed an hour ahead of the clock and the
+    /// run duration was omitted. Bytes that read differently at a position than at the last look were written after that
+    /// look, so when the replaced bytes were confirmed seconds ago the new line's age is bounded like an appended line's —
+    /// these tests pin that it anchors itself then, and only then.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private static void AppendExecutorLog(Harness h, string text)
+            => File.AppendAllText(Path.Combine(Path.GetDirectoryName(h.LogPath)!, "AgentExecutor.log"), text, new UTF8Encoding(false));
+
+        /// <summary>An IME log entry with the byte length of <paramref name="sameLengthAs"/>: what a stale writer's line replaces exactly.</summary>
+        private static string FillerLike(string time, string sameLengthAs)
+        {
+            var bare = ImeEntryAt(time, "[Win32App] checking ");
+            Assert.True(sameLengthAs.Length > bare.Length);
+            return ImeEntryAt(time, "[Win32App] checking " + new string('x', sameLengthAs.Length - bare.Length));
+        }
+
+        /// <summary>
+        /// A platform run whose IME writer lives in +120 (local = UTC + 2 h; the harness clock is 19:30Z): both logs are
+        /// observed empty first, so what follows is read fresh. Returns the IME log position where the filler line sits.
+        /// </summary>
+        private static async Task<long> StartRunAndReadFiller(Harness h, string fillerTime, string resultEntry)
+        {
+            h.Append(string.Empty);
+            AppendExecutorLog(h, string.Empty);
+            await h.Tracker.RunPollPassAsync(default);
+
+            AppendExecutorLog(h, RunStart("21:29:50.0000000", "1001"));
+            h.Append(ImeRunStart("21:29:48.0000000"));
+            await h.Tracker.RunPollPassAsync(default);
+
+            // Another IME writer appends a line; the tracker reads it.
+            var at = h.Length;
+            h.Append(FillerLike(fillerTime, resultEntry));
+            h.Now = h.Now.AddSeconds(1);
+            await h.Tracker.RunPollPassAsync(default);
+            return at;
+        }
+
+        [Fact]
+        public async Task Result_line_recovered_seconds_after_its_bytes_were_read_anchors_itself_like_a_fresh_line()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:01.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+
+            // The script ends: its end block, then the stale IME service writes the result over the filler.
+            AppendExecutorLog(h, RunEnd("21:30:01.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.ResultProvenance!.Origin);
+            Assert.Equal(120, script.ResultProvenance.OffsetMinutes);
+            Assert.Equal(ImeLogTrackerAdapter.DurationPairVerdict.Verified, ImeLogTrackerAdapter.JudgeDurationPair(
+                script.StartedAtProvenance, script.ResultProvenance, false, script.ResultObservedAtUtc!.Value - script.StartedAtUtc!.Value, out _));
+        }
+
+        [Fact]
+        public async Task Verification_passes_keep_the_replaced_bytes_current_for_a_script_that_runs_longer()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:41.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+
+            // The script runs 40 s; the cadence check verifies the ledger every 10 s while the run is in flight.
+            for (var i = 0; i < 4; i++)
+            {
+                h.Now = h.Now.AddSeconds(10);
+                await h.Tracker.RunPollPassAsync(default);
+            }
+
+            AppendExecutorLog(h, RunEnd("21:30:41.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.ResultProvenance!.Origin);
+            Assert.Equal(120, script.ResultProvenance.OffsetMinutes);
+        }
+
+        [Fact]
+        public async Task Overwrite_does_not_move_the_files_measured_writer_offset()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:01.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out var before));
+
+            AppendExecutorLog(h, RunEnd("21:30:01.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out var after));
+            Assert.Equal(before, after);
+        }
+
+        [Theory]
+        // Replaced bytes confirmed 1 s / 30 s ago: written since, age bounded like an appended line's.
+        [InlineData(true, true, 1, true)]
+        [InlineData(true, true, 30, true)]
+        // Confirmed longer ago: the new bytes could be minutes old — their age may round onto the 15-minute grid.
+        [InlineData(true, true, 31, false)]
+        // The clock stepped back since the confirmation: the age is unknown.
+        [InlineData(true, true, -1, false)]
+        // The divergence lies in bytes the ledger never held (dropped by a cap): nothing dates them.
+        [InlineData(true, false, 1, false)]
+        // The pass itself is not fresh — the first pass after a restart never anchors.
+        [InlineData(false, true, 1, false)]
+        // Nothing was replaced.
+        [InlineData(true, true, null, false)]
+        public void Rewound_entry_is_fresh_only_when_the_bytes_it_replaced_were_confirmed_within_the_fresh_window(
+            bool passLinesAreFresh, bool entryAtRewindPointReplaced, int? secondsSinceConfirmed, bool expected)
+        {
+            var now = new DateTime(2026, 10, 4, 19, 2, 0, DateTimeKind.Utc);
+            DateTime? confirmed = secondsSinceConfirmed.HasValue ? now.AddSeconds(-secondsSinceConfirmed.Value) : (DateTime?)null;
+            Assert.Equal(expected, ImeLogTracker.RewoundEntryIsFresh(passLinesAreFresh, entryAtRewindPointReplaced, confirmed, now));
+        }
+    }
+}
@@ -0,0 +1,368 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Session 756970cf: IME launched a Win32 detection executor and a platform-script executor 15 ms apart, and both
+    /// opened AgentExecutor.log at the same end-of-file offset. The platform executor's shorter start block overwrote
+    /// the detection executor's, whose identity line the tracker never saw; the detection's end block (exit 1 and its
+    /// stdout), written at its own position behind its own start block, then sat behind the PLATFORM start block, and
+    /// "the nearest preceding marker owns the line" handed another script's output and exit code to the platform
+    /// script. These tests pin the writer boundary: an entry that is not exactly one CMTrace record is where one
+    /// writer's bytes end and another's begin, and nothing behind it belongs to the invocation in front of it.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private const string RaceUserId = "00000000-0000-0000-0000-000000000000";
+        private const string RacePlatformId = "1d6f0a52-3c4e-4b7a-9e21-5f8c7d2b9a10";
+        private const string RaceDetectionAppId = "8b2e4c71-6a9d-4f03-b5e8-2c7a1d9f4e36";
+        private const string RaceFillerAppId = "5e1c2b7d-0a4f-4c8e-9d36-7b2f1e8a4c50";
+        private const string ImeDir = @"C:\Program Files (x86)\Microsoft Intune Management Extension";
+        private const string DetectionStdout = "VERBOSE: === Sample Suite Detection Started ===\r\nWARNING: === DETECTION FAILED: Sample Suite is not installed ===";
+        private const string PlatformStdout = "=== bootstrap loader started ===\r\nInstaller finished (exit code 0).";
+
+        private static string EntryAt(string time, string message)
+            => $"<![LOG[{message}]LOG]!><time=\"{time}\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n";
+
+        /// <summary>The four lines every AgentExecutor invocation starts with — identical length for every executor.</summary>
+        private static string ExecutorBanner(string time)
+            => EntryAt(time, "ExecutorLog AgentExecutor gets invoked")
+            + EntryAt(time, "Creating command line parser, name delimiter is - and value separator is  .")
+            + EntryAt(time, "Getting Ordered Parameters")
+            + EntryAt(time, "Parsing Ordered Parameters.");
+
+        private static string ExecutorLaunch(string time, string scriptPath, string pid)
+            => EntryAt(time, "Prepare to run Powershell Script ..")
+            + EntryAt(time, $"cmd line for running powershell is -NoProfile -executionPolicy bypass -file  \"{scriptPath}\" ")
+            + EntryAt(time, "runAs32BitOn64 = False, so Disable Wow64FsRedirection")
+            + EntryAt(time, @"PowerShell path is C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe")
+            + EntryAt(time, $"[Executor] created powershell with process id {pid}");
+
+        private static string PlatformStartBlock(string time, string policyId, string pid)
+        {
+            var path = $@"{ImeDir}\Policies\Scripts\{RaceUserId}_{policyId}.ps1";
+            var results = $@"{ImeDir}\Policies\Results\{RaceUserId}_{policyId}";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershell with value {path} to the named argument list.")
+                + EntryAt(time, "Powershell option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, results + ".output")
+                + EntryAt(time, results + ".error")
+                + EntryAt(time, results + ".timeout")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        private static string DetectionStartBlock(string time, string appId, string pid)
+        {
+            var path = $@"{ImeDir}\Content\DetectionScripts\{appId}_2.ps1";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershellDetection with value {path} to the named argument list.")
+                + EntryAt(time, "PowershellDetection option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, path + "quotedResultFilePath.txt")
+                + EntryAt(time, path + "quotedErrorFilePath.txt")
+                + EntryAt(time, path + "quotedTimeoutFilePath.txt")
+                + EntryAt(time, path + "quotedExitCodeFilePath.txt")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        private static string ExecutorEndBlock(string time, int exitCode, string stdout)
+            => EntryAt(time, $"Powershell exit code is {exitCode}")
+            + EntryAt(time, $"length of out={stdout.Length}")
+            + EntryAt(time, "length of error=0")
+            + EntryAt(time, "error from script =")
+            + EntryAt(time, exitCode == 0 ? "Powershell script is successfully executed." : "Powershell script is failed to execute")
+            + EntryAt(time, $"write output done. output = {stdout}, error = ")
+            + EntryAt(time, "Revert Wow64FsRedirection")
+            + EntryAt(time, "Agent executor completed.");
+
+        private static string PlatformResultLine(string policyId)
+            => $"[PowerShell] User Id = {RaceUserId}, Policy id = {policyId}, policy result = Success";
+
+        /// <summary>The file offsets at which the entries of an ASCII <paramref name="block"/> start when it is written at <paramref name="at"/>.</summary>
+        private static HashSet<long> EntryStarts(string block, long at)
+        {
+            Assert.True(block.All(c => c < 128), "offset arithmetic assumes ASCII test content");
+            var starts = new HashSet<long>();
+            for (var i = block.IndexOf("<![LOG[", StringComparison.Ordinal); i >= 0; i = block.IndexOf("<![LOG[", i + 1, StringComparison.Ordinal))
+                starts.Add(at + i);
+            return starts;
+        }
+
+        [Fact]
+        public async Task Executor_that_opened_at_the_same_offset_never_lends_its_end_block_to_the_platform_script()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // An earlier, finished detection run: the race starts mid-file like in the field log.
+            h.Append(DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1548") + ExecutorEndBlock("12:00:00.5000000", 0, "detected"));
+            await h.Pass();
+            var x = h.Length;
+
+            // Detection executor C and platform executor D open the file at the same end x. C writes first; the tracker
+            // reads C's banner, then D writes its own start block over C's.
+            var cStart = DetectionStartBlock("12:00:01.0000000", RaceDetectionAppId, "6416");
+            var dStart = PlatformStartBlock("12:00:01.2000000", RacePlatformId, "2524");
+            var cHead = cStart.Substring(0, cStart.IndexOf("<![LOG[Getting Ordered Parameters", StringComparison.Ordinal));
+            h.Append(cHead);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Append(cStart.Substring(cHead.Length));
+            h.Overwrite(x, dStart);
+
+            // The field geometry: D's start block is shorter and ends inside one of C's lines, so the tail of that line
+            // sits between D's start block and C's remaining bytes.
+            Assert.True(dStart.Length < cStart.Length);
+            Assert.DoesNotContain(x + dStart.Length, EntryStarts(cStart, x));
+            h.Now = h.Now.AddMilliseconds(150);
+            await h.Pass();
+            Assert.True(h.Health.OverwriteRewinds >= 1);
+
+            // C ends: its end block lands at its own position, right behind its own (overwritten) start block.
+            Assert.Equal(x + cStart.Length, h.Length);
+            var cEnd = ExecutorEndBlock("12:00:07.0000000", 1, DetectionStdout);
+            h.Append(cEnd);
+            h.Now = h.Now.AddSeconds(6);
+            await h.Pass();
+
+            // IME's result for D reaches the tracker before D's own end block: the completion must wait for it.
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            Assert.Empty(h.Completed);
+
+            // D ends: its end block lands at ITS position, over the fragment and C's bytes; C's last line survives.
+            var dEnd = ExecutorEndBlock("12:00:09.5000000", 0, PlatformStdout);
+            Assert.True(dEnd.Length < cStart.Length - dStart.Length + cEnd.Length);
+            h.Overwrite(x + dStart.Length, dEnd);
+            h.Now = h.Now.AddMilliseconds(130);
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(RacePlatformId, script.PolicyId);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal(PlatformStdout.Replace("\r\n", "\n"), script.Stdout);
+            Assert.DoesNotContain(h.Completed, s => (s.Stdout ?? string.Empty).Contains("Detection"));
+
+            // The run is known to the registry reconciliation under the user id of its own lines (D-316).
+            Assert.Equal(RaceUserId, script.UserId);
+            Assert.False(string.IsNullOrEmpty(script.RunId));
+            h.Tracker.ScriptRuns.NotePassCompleted(DateTime.MaxValue.AddDays(-1));
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RaceUserId, RacePlatformId, h.Now, out var run));
+            Assert.Equal(script.RunId, run!.RunId);
+        }
+
+        /// <summary>
+        /// The mirror image: a foreign executor whose stream position lies inside the platform start block (it opened
+        /// at the same end with a shorter start block) writes its end block there. Its first line merges with the head of
+        /// a platform line — cut inside the message or inside the trailer, which the parser would otherwise read up to
+        /// the foreign trailer — and its output line follows without any marker in between.
+        /// </summary>
+        [Theory]
+        [InlineData(15)]
+        [InlineData(-30)]
+        public async Task Foreign_end_block_merged_into_the_platform_start_block_never_reaches_the_platform_script(int cut)
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1548") + ExecutorEndBlock("12:00:00.5000000", 0, "detected"));
+            await h.Pass();
+            var x = h.Length;
+
+            var dStart = PlatformStartBlock("12:00:01.0000000", RacePlatformId, "2524");
+            h.Append(dStart);
+            await h.Pass();
+
+            // The foreign end block starts inside the line after D's argument line.
+            var lineAfterArgument = x + dStart.IndexOf("<![LOG[Powershell option gets invoked", StringComparison.Ordinal);
+            var lineLength = EntryAt("12:00:01.0000000", "Powershell option gets invoked").Length;
+            var at = lineAfterArgument + (cut > 0 ? cut : lineLength + cut);
+            var foreignEnd = ExecutorEndBlock("12:00:03.0000000", 1, "foreign output");
+            Assert.True(at + foreignEnd.Length < x + dStart.Length, "the foreign block must end inside D's start block");
+            h.Overwrite(at, foreignEnd);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            // No owner is provable behind the cut: the completion goes out without end-block data, never with the foreign one.
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("Success", script.Result);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Entry_read_unchanged_after_a_rewind_keeps_its_platform_marker()
+        {
+            const string platformId = "2b7d9e41-8c3a-4f60-a5d2-9e1b7c4f3a08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Detection W waits for its script; detection X runs completely behind it; platform F starts behind X.
+            var wStart = DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1111");
+            var xRun = DetectionStartBlock("12:00:00.2000000", RaceDetectionAppId, "2222") + ExecutorEndBlock("12:00:00.4000000", 0, "x detected");
+            h.Append(wStart + xRun + PlatformStartBlock("12:00:01.0000000", platformId, "3333"));
+            await h.Pass();
+
+            // W ends at its own position, over the head of X's run; F's start block keeps its bytes and offset.
+            var wEnd = ExecutorEndBlock("12:00:02.0000000", 0, "w detected");
+            Assert.True(wEnd.Length < xRun.Length);
+            h.Overwrite(wStart.Length, wEnd);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+
+            // F's end block lands behind its start block: still F's, because F's marker survived with its bytes.
+            h.Append(ExecutorEndBlock("12:00:05.0000000", 7, "Hello from F"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(platformId), sourceFileName: "IntuneManagementExtension.log");
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(platformId, script.PolicyId);
+            Assert.Equal(7, script.ExitCode);
+            Assert.Equal("Hello from F", script.Stdout);
+        }
+
+        [Fact]
+        public async Task Writer_boundary_read_unchanged_after_a_rewind_still_closes_the_platform_invocation()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+
+            // Detection Q waits for its script while detection R runs completely behind it.
+            var qStart = DetectionStartBlock("12:00:00.0000000", RaceFillerAppId, "1111");
+            var rRun = DetectionStartBlock("12:00:00.2000000", "6c3f8a20-1d5e-4b97-8f4a-0e2d6b9c7a13", "2222") + ExecutorEndBlock("12:00:00.4000000", 0, "r detected");
+            h.Append(qStart + rRun);
+            await h.Pass();
+            var x = h.Length;
+
+            // The race of the field case behind them: the boundary closes D.
+            var cStart = DetectionStartBlock("12:00:01.0000000", RaceDetectionAppId, "6416");
+            var dStart = PlatformStartBlock("12:00:01.2000000", RacePlatformId, "2524");
+            h.Append(cStart);
+            h.Overwrite(x, dStart);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // Q ends at its own position, over R's run: the rewind starts in front of the race, whose bytes read unchanged.
+            var qEnd = ExecutorEndBlock("12:00:02.0000000", 0, "q detected");
+            Assert.True(qEnd.Length < rRun.Length);
+            h.Overwrite(qStart.Length, qEnd);
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            // C's end block behind the boundary stays unowned; D's own end block completes D.
+            var cEnd = ExecutorEndBlock("12:00:07.0000000", 1, DetectionStdout);
+            h.Append(cEnd);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            Assert.Empty(h.Completed);
+
+            h.Overwrite(x + dStart.Length, ExecutorEndBlock("12:00:09.5000000", 0, PlatformStdout));
+            h.Now = h.Now.AddMilliseconds(130);
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal(PlatformStdout.Replace("\r\n", "\n"), script.Stdout);
+        }
+
+        [Fact]
+        public async Task Raw_text_in_the_executor_log_is_never_matched_and_closes_the_platform_invocation()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(PlatformStartBlock("12:00:00.0000000", RacePlatformId, "2524"));
+            await h.Pass();
+
+            // The tail of a cut line that happens to read like an exit line, then a foreign end block.
+            h.Append("Powershell exit code is 5\r\n" + ExecutorEndBlock("12:00:02.0000000", 6, "foreign output"));
+            // A fragment right at the bookmark stops the first pass for a check; the second one reads it.
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId), sourceFileName: "IntuneManagementExtension.log");
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Null(script.ExitCode);
+            Assert.Null(script.Stdout);
+        }
+
+        [Fact]
+        public async Task Fragment_in_the_ime_log_does_not_close_the_platform_run_context()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            // In the IME log the service writes the platform marker and the context line itself; the fragment in
+            // between is the tail of an executor's telemetry line and separates nothing.
+            h.Append(Entry(@"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\" + RaceUserId + "_" + RacePlatformId + ".ps1 is generated.", "17")
+                + "ing mananger...]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">\r\n"
+                + Entry("Launch powershell executor in user session", "17"));
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(PlatformResultLine(RacePlatformId));
+            h.Now = h.Now.Add(ImeLogTracker.PlatformScriptEndBlockGrace);
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal("User", script.RunContext);
+        }
+
+        [Fact]
+        public async Task Cut_multi_line_output_adds_one_boundary_not_one_per_line()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(PlatformStartBlock("12:00:00.0000000", RacePlatformId, "2524"));
+            await h.Pass();
+            var markersBefore = h.Tracker.InvocationMarkerCountForTest("AgentExecutor.log");
+
+            var lines = string.Concat(Enumerable.Range(1, 600).Select(i => $"orphaned output line {i}\r\n"));
+            h.Append(lines);
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(markersBefore + 1, h.Tracker.InvocationMarkerCountForTest("AgentExecutor.log"));
+        }
+
+        [Theory]
+        [InlineData("<![LOG[Powershell exit code is 0]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", true)]
+        [InlineData("<![LOG[write output done. output = line one\nline two, error = ]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", true)]
+        [InlineData("\uFEFF<![LOG[ExecutorLog AgentExecutor gets invoked]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", true)]
+        [InlineData("t code is 3]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        [InlineData("", false)]
+        [InlineData("<![LOG[Powe<![LOG[Powershell exit code is 1]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        [InlineData("<![LOG[Powershell option gets invoked]LOG]!><time=\"12:00:00.0000000\" da<![LOG[Powershell exit code is 1]LOG]!><time=\"12:00:01.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        [InlineData("<![LOG[write output done. output = line one\nline<![LOG[Agent executor completed.]LOG]!><time=\"12:00:00.0000000\" date=\"9-10-2026\" component=\"AgentExecutor\" context=\"\" type=\"1\" thread=\"1\" file=\"\">", false)]
+        public void Single_cmtrace_record_is_told_apart_from_the_cut_of_two_writers(string text, bool expected)
+        {
+            Assert.Equal(expected, ImeLogTracker.IsSingleCmTraceRecord(text));
+        }
+
+        [Theory]
+        [InlineData("AgentExecutor.log", true)]
+        [InlineData("AgentExecutor-20261003-233348.log", true)]
+        [InlineData("IntuneManagementExtension.log", false)]
+        [InlineData("IntuneManagementExtension-20261003-233348.log", false)]
+        [InlineData("HealthScripts.log", false)]
+        [InlineData("AppWorkload.log", false)]
+        public void Writer_boundaries_apply_to_the_executor_log_live_and_rotated(string fileName, bool expected)
+        {
+            Assert.Equal(expected, ImeLogTracker.IsWriterBoundaryLogFile(fileName));
+        }
+    }
+}
@@ -25,7 +25,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
    /// contract: unchanged bytes never rewind, changed bytes are processed exactly once, and the
    /// executor lines a rewind uncovers belong to the invocation that owns their file position.
    /// </summary>
-    public sealed class ImeLogTrackerOverwriteRewindTests
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
    {
        private static readonly DateTime T0 = new DateTime(2026, 9, 10, 19, 30, 0, DateTimeKind.Utc);

@@ -42,7 +42,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
        private static readonly string[] ScriptPatternIds =
        {
            "PS-AGENT-INVOCATION", "PS-AGENT-ARG", "PS-AGENT-SCRIPT-START", "PS-AGENT-EXITCODE",
-            "PS-AGENT-OUTPUT", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT", "PS-SCRIPT-RESULT",
+            "PS-AGENT-OUTPUT", "PS-AGENT-ERROR", "PS-AGENT-COMPLETED", "PS-SCRIPT-GENERATED", "PS-SCRIPT-CONTEXT", "PS-SCRIPT-RESULT",
        };

        /// <summary>The shipped pattern JSON — the same source combine.js embeds — so the contract is the real one.</summary>
@@ -502,6 +502,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
        public async Task Ime_result_line_hidden_by_an_executor_start_line_is_recovered_from_the_ime_log()
        {
            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            // Seen empty first: the start lines are fresh and anchor themselves like the recovered result line will,
+            // so start and result sit on one timeline whatever the host's own zone is.
+            h.Append(string.Empty);
+            await h.Pass();
            h.Append(Entry(GeneratedLine, "17") + Entry("Launch powershell executor in user session", "17") + Entry("process id = 10608", "17"));
            await h.Pass();
            var servicePosition = h.Length;
@@ -83,8 +83,33 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
            Assert.Single(emitted);
        }

+        [Theory]
+        // IME's verdict is Success exactly when the error file is empty, whatever the exit code. Judged by the exit
+        // code, session 67ae751c showed exit 0 with the script's own stderr as Success, and 46a41a0a an exit 1 without
+        // stderr as Failed, a run IME reported as Success one cycle earlier.
+        [InlineData(0, "Invoke-WebRequest : The remote name could not be resolved", "Failed")]
+        [InlineData(1, "", "Success")]
+        [InlineData(1, "  \n", "Success")]
+        [InlineData(0, "", "Success")]
+        [InlineData(1, null, "Failed")]
+        [InlineData(0, null, "Success")]
+        public void Fallback_judges_like_ime_by_the_stderr_it_read(int exitCode, string? stderr, string expected)
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+            var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
+
+            tracker.SeedPendingPlatformScriptForTesting("0d2294bf", exitCode: exitCode, exitObservedAtUtc: observedAt, stderr: stderr);
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
+
+            var script = Assert.Single(emitted);
+            Assert.Equal(expected, script.Result);
+            Assert.Equal(exitCode, script.ExitCode);
+            Assert.Equal("agentexecutor_fallback", script.ResultSource);
+        }
+
        [Fact]
-        public void Nonzero_exit_code_emits_failed_result()
+        public void Nonzero_exit_code_without_a_stderr_line_emits_failed_result()
        {
            using var tmp = new TempDirectory();
            var tracker = BuildTracker(tmp, out var emitted);
@@ -108,6 +108,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime

            var tracker = BuildTracker(tmp, out var emitted);
            tracker.LoadStateForTest(); // must not throw
+            Assert.Equal(0, tracker.ParkedPlatformScriptCountForTest);

            // Degrades to pre-fix behavior: no markers restored, normal emission works (the
            // result waits for its end block until the shutdown flush).
@@ -116,6 +117,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
            Assert.Single(emitted);
        }

+        [Fact]
+        public void Pending_slot_from_a_state_file_without_executor_start_loads_and_completes()
+        {
+            using var tmp = new TempDirectory();
+            var started = new DateTime(2026, 10, 4, 9, 0, 0, DateTimeKind.Utc);
+
+            // A pending slot written by an agent before runs carried their executor start and run id.
+            var persistence = new ImeTrackerStatePersistence(tmp.Path, new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            persistence.Save(new ImeTrackerStateData
+            {
+                PendingPlatformScripts = new List<ScriptExecutionState>
+                {
+                    new ScriptExecutionState { PolicyId = "policyF", ScriptType = "platform", StartedAtUtc = started, ExitCode = 0, ExitObservedAtUtc = started.AddSeconds(5), Stdout = "done", Stderr = "" },
+                },
+            });
+
+            var tracker = BuildTracker(tmp, out var emitted);
+            tracker.LoadStateForTest();
+            tracker.CompletePlatformScriptFromImeResultForTesting("policyF", "Success", started.AddSeconds(6));
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal(0, script.ExitCode);
+            Assert.False(string.IsNullOrEmpty(script.RunId));
+        }
+
        [Fact]
        public void Stale_result_older_than_current_run_start_is_dropped()
        {
@@ -11,6 +11,7 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
 using Newtonsoft.Json;
 using Xunit;

@@ -173,16 +174,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
        public void UpdatePageRecords_ArePageStartsStopsAndNames_OfTheUpdatePageOnly()
        {
            var start = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, lastPage: null);
-            Assert.Equal(OobeUpdatePageRecord.PageStarted, start!.CxhEvent);
+            Assert.Equal(OobeUpdateVocabulary.PageStarted, start!.CxhEvent);
            Assert.Equal("OobeNDUP", start.Page);

            var stop = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, lastPage: "RebootNDUP");
-            Assert.Equal(OobeUpdatePageRecord.PageStopped, stop!.CxhEvent);
+            Assert.Equal(OobeUpdateVocabulary.PageStopped, stop!.CxhEvent);
            Assert.Equal("RebootNDUP", stop.Page);
            Assert.Equal("success", stop.Result);

            var name = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, lastPage: null);
-            Assert.Equal(OobeUpdatePageRecord.EventName, name!.CxhEvent);
+            Assert.Equal(OobeUpdateVocabulary.EventName, name!.CxhEvent);
            Assert.Equal("ExpeditedUpdate_startWUScanStarted", name.Name);
            Assert.Null(name.Value);

@@ -0,0 +1,225 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// The first run's update page backfill (<see cref="ShellCoreTracker.BackfillUpdatePageTelemetry"/>)
+    /// and the page a stop belongs to across backfill and live records. The first run has no
+    /// replay — its backfill is telemetry and nothing else, so a Hello-wizard start, an ESP exit
+    /// or an ESP failure in the window must not leave the tracker on any rail.
+    /// </summary>
+    public sealed class ShellCoreTrackerUpdatePageBackfillTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 10, 5, 13, 10, 0, DateTimeKind.Utc);
+
+        private const string NdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'OobeNDUP'.";
+        private const string RebootNdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'RebootNDUP'.";
+        private const string AadHelloStarted = "CloudExperienceHost Web App Activity started. CXID: 'AADHello'.";
+        private const string PageStopped = "CloudExperienceHost Web App Activity stopped. Result: 'success'.";
+        private const string DownloadSucceeded =
+            "CloudExperienceHost Web App Event 1. Name: 'SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadSucceeded'.";
+        private const string EspExit = "CommercialOOBE_ESPProgress_Page_Exiting";
+        private const string EspFailure = "CommercialOOBE_ESPProgress_Failure";
+        private const string WhiteGloveSuccess = "CommercialOOBE_ESPProgress_WhiteGlove_Success";
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private int _registryReads;
+
+        public void Dispose() => _tmp.Dispose();
+
+        private ShellCoreTracker Build() =>
+            new ShellCoreTracker("S1", "T1",
+                new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                helloTracker: null,
+                oobeUpdateRegistryReader: () => { _registryReads++; return Array.Empty<OobeUpdateRegistrySnapshot.KeyState>(); },
+                stateDirectory: Path.Combine(_tmp.Path, "state"));
+
+        private static void Live(ShellCoreTracker tracker, int eventId, string description, DateTime at, long recordId) =>
+            tracker.ProcessEvent(eventId, description, at, "Microsoft-Windows-Shell-Core", isBackfill: false, recordId: recordId);
+
+        private static ShellCoreRecord Record(int eventId, string description, DateTime at, long recordId) =>
+            new ShellCoreRecord(eventId, description, at, recordId);
+
+        private IReadOnlyList<IReadOnlyDictionary<string, object>> Pages() =>
+            _sink.Posted
+                .Where(p => p.Kind == DecisionSignalKind.InformationalEvent
+                    && p.Payload != null
+                    && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                    && et == Constants.EventTypes.OobeUpdatePage)
+                .Select(p => (IReadOnlyDictionary<string, object>)p.TypedPayload!)
+                .ToList();
+
+        // ------------------------------------------------------------ first run ----
+
+        [Fact]
+        public void FirstRunBackfill_ReportsTheUpdatePage_AndNothingElse()
+        {
+            using var tracker = Build();
+            var raised = new List<string>();
+            tracker.HelloWizardStarted += (_, _) => raised.Add("hello");
+            tracker.FinalizingSetupPhaseTriggered += (_, reason) => raised.Add($"finalizing:{reason}");
+            tracker.EspExited += (_, _) => raised.Add("exit");
+            tracker.EspFailureDetected += (_, _) => raised.Add("failure");
+            tracker.WhiteGloveCompleted += (_, _) => raised.Add("whiteglove");
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, EspExit, At.AddMinutes(-41), 95),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, EspFailure, At.AddSeconds(-2430), 96),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, WhiteGloveSuccess, At.AddSeconds(-2420), 97),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEventName, DownloadSucceeded, At.AddMinutes(-30), 101),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, AadHelloStarted, At.AddMinutes(-2), 110),
+            });
+
+            Assert.Empty(raised);
+            Assert.False(tracker.IsEspExitedForTest);
+            Assert.False(tracker.IsWhiteGloveDetectedForTest);
+            var pages = Pages();
+            Assert.Equal(new object[] { "page_started", "event_name" }, pages.Select(d => d["cxhEvent"]).ToArray());
+            Assert.All(pages, d => Assert.Equal(true, d["backfill"]));
+            // No agent_trace, no ESP or Hello event — only the two page rows.
+            Assert.Equal(2, _sink.Posted.Count);
+            // The registry shows the state now, not at the records' time.
+            Assert.Equal(0, _registryReads);
+        }
+
+        [Fact]
+        public void FirstRunBackfill_KeepsTheEventTimes()
+        {
+            using var tracker = Build();
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+            });
+
+            var posted = Assert.Single(_sink.Posted);
+            Assert.Equal(At.AddMinutes(-40), posted.OccurredAtUtc);
+        }
+
+        [Fact]
+        public void LiveStop_FindsThePageThatStartedBeforeTheAgent()
+        {
+            using var tracker = Build();
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(5), 120);
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("OobeNDUP", stop["page"]);
+            Assert.Equal(false, stop["backfill"]);
+        }
+
+        [Fact]
+        public void SameRecord_FromTheLiveWatcherAndTheFirstRunBackfill_IsReportedOnce()
+        {
+            // The live watcher is armed before the backfill reads, so both can deliver a record.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 700);
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 700),
+            });
+
+            Assert.Single(Pages(), d => (string)d["cxhEvent"] == "page_started");
+        }
+
+        // ---------------------------------------------------- the page of a stop ----
+
+        [Fact]
+        public void ReplayedOlderStart_DoesNotTakeOverTheNextLiveStop()
+        {
+            // A restart replay reads records older than the live watcher's; before, its page start
+            // overwrote the live page and the next live stop was attributed to the old page.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At, 900);
+            tracker.ReplayBackfillRecords(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-20), 850),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEventName, DownloadSucceeded, At.AddMinutes(-19), 851),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), 901);
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("RebootNDUP", stop["page"]);
+        }
+
+        [Fact]
+        public void BackfilledStop_BelongsToTheStartOfItsOwnBatch()
+        {
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At, 900);
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-20), 850),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-18), 852),
+            });
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("OobeNDUP", stop["page"]);
+            Assert.Equal(true, stop["backfill"]);
+        }
+
+        [Fact]
+        public void BackfilledStopWithoutItsStart_IsNotGivenTheLivePage()
+        {
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 900);
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-18), 852),
+            });
+
+            Assert.DoesNotContain(Pages(), d => (string)d["cxhEvent"] == "page_stopped");
+        }
+
+        [Fact]
+        public void NewerBackfilledStart_MovesTheLivePageForward()
+        {
+            // Records written between arming the watcher and the backfill's read are newer than
+            // the last live start the watcher delivered before them.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 900);
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At.AddSeconds(30), 905),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), 906);
+
+            Assert.Equal("RebootNDUP", Pages().Last()["page"]);
+        }
+
+        [Fact]
+        public void UpdatePageLookback_IsInsideTheReplayClamp()
+        {
+            Assert.Equal(ShellCoreTracker.UpdatePageBackfillLookbackMinutes,
+                ShellCoreTracker.ClampLookbackMinutes(ShellCoreTracker.UpdatePageBackfillLookbackMinutes));
+        }
+    }
+}
@@ -0,0 +1,411 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using Xunit;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// D-316: IME saves every platform script's result under Policies\&lt;user&gt;\&lt;policy&gt; after reporting the
+    /// batch; the observer checks the tracker's emitted run against it. The field case (session 756970cf): the run
+    /// had been given a Win32 detection script's end block — exit 1 and "Detection Started" output — while IME saved
+    /// the bootstrap output of the platform script itself.
+    /// </summary>
+    public sealed class ImeRegistryScriptResultObserverTests
+    {
+        private const string DeviceUser = "00000000-0000-0000-0000-000000000000";
+        private const string PolicyA = "1d6f0a52-3c4e-4b7a-9e21-5f8c7d2b9a10";
+        private const string PolicyB = "2b7d9e41-8c3a-4f60-a5d2-9e1b7c4f3a08";
+        private const string OwnStdout = "=== bootstrap loader started ===\nInstaller finished (exit code 0).";
+        private const string ForeignStdout = "VERBOSE: === Sample Suite Detection Started ===\nWARNING: === DETECTION FAILED ===";
+        private static readonly DateTime T0 = new DateTime(2026, 10, 3, 20, 59, 0, DateTimeKind.Utc);
+
+        // ── PlatformOutputJudge ─────────────────────────────────────────────────
+
+        private static PlatformScriptRun Run(string? stdout, string? stderr = null, int? exitCode = 0, string result = "Success", string resultSource = "ime_policy_result")
+            => new PlatformScriptRun { PolicyId = PolicyA, UserId = DeviceUser, RunId = "run-1", Emitted = true, Result = result, ResultSource = resultSource, ExitCode = exitCode, Stdout = stdout, Stderr = stderr };
+
+        private static string Details(string executionMessage)
+            => "{\"Version\":1,\"SigningCode\":15,\"EncryptionCode\":19,\"ExecutionMsg\":" + System.Text.Json.JsonSerializer.Serialize(executionMessage) + "}";
+
+        private static SavedScriptResult Saved(string? executionMessage, string result = "Success", int errorCode = 0, string user = DeviceUser, string policy = PolicyA, string stamp = "10/3/2026 9:00:00 PM")
+            => new SavedScriptResult
+            {
+                UserId = user,
+                PolicyId = policy,
+                Result = result,
+                ErrorCode = errorCode,
+                ResultDetails = executionMessage == null ? null : Details(executionMessage),
+                LastUpdatedTimeUtc = stamp,
+            };
+
+        [Fact]
+        public void Field_case_detection_output_on_the_platform_run_is_foreign_and_the_saved_stdout_replaces_it()
+        {
+            var judgement = PlatformOutputJudge.Judge(Run(ForeignStdout, string.Empty, exitCode: 1), Saved(OwnStdout.Replace("\n", "\r\n")));
+            Assert.Equal(PlatformOutputVerdict.Foreign, judgement.Verdict);
+            Assert.Equal("stdout_differs", judgement.Reason);
+            Assert.Equal(OwnStdout, judgement.Stdout);
+            Assert.Equal(string.Empty, judgement.Stderr);
+        }
+
+        [Fact]
+        public void Matching_output_is_verified_across_line_ending_and_trim_differences()
+        {
+            var judgement = PlatformOutputJudge.Judge(Run(OwnStdout, string.Empty), Saved("  " + OwnStdout.Replace("\n", "\r\n") + "\r\n"));
+            Assert.Equal(PlatformOutputVerdict.Verified, judgement.Verdict);
+        }
+
+        [Fact]
+        public void Output_cut_by_the_tracker_is_verified_against_the_longer_saved_text()
+        {
+            var full = string.Concat(Enumerable.Repeat("line of output\n", 1000)).TrimEnd();
+            var emitted = ImeLogTracker.TruncateOutput(full);
+            Assert.EndsWith(ImeLogTracker.OutputTruncationMarker, emitted);
+            Assert.Equal(PlatformOutputVerdict.Verified, PlatformOutputJudge.Judge(Run(emitted), Saved(full)).Verdict);
+        }
+
+        [Fact]
+        public void Both_empty_is_verified_but_stderr_on_a_success_is_another_executors()
+        {
+            Assert.Equal(PlatformOutputVerdict.Verified, PlatformOutputJudge.Judge(Run(string.Empty), Saved(string.Empty)).Verdict);
+            var judgement = PlatformOutputJudge.Judge(Run(string.Empty, "Get-Item : not found"), Saved(string.Empty));
+            Assert.Equal(PlatformOutputVerdict.Foreign, judgement.Verdict);
+            Assert.Equal("stderr_on_success", judgement.Reason);
+        }
+
+        [Fact]
+        public void Explicitly_empty_emitted_output_against_saved_text_is_foreign()
+        {
+            Assert.Equal(PlatformOutputVerdict.Foreign, PlatformOutputJudge.Judge(Run(string.Empty), Saved(OwnStdout)).Verdict);
+            Assert.Equal(PlatformOutputVerdict.Foreign, PlatformOutputJudge.Judge(Run(OwnStdout), Saved(string.Empty)).Verdict);
+        }
+
+        [Fact]
+        public void Output_never_read_is_completed_from_the_saved_text_and_the_exit_code_stands()
+        {
+            var judgement = PlatformOutputJudge.Judge(Run(null), Saved(OwnStdout));
+            Assert.Equal(PlatformOutputVerdict.Repaired, judgement.Verdict);
+            Assert.Equal("stdout_missing", judgement.Reason);
+            Assert.Equal(OwnStdout, judgement.Stdout);
+            Assert.Equal(PlatformOutputVerdict.NotComparable, PlatformOutputJudge.Judge(Run(null), Saved(string.Empty)).Verdict);
+        }
+
+        [Fact]
+        public void Stdout_containing_the_output_error_separator_is_repaired_not_foreign()
+        {
+            // "write output done. output = X, error = " with X = "Copying files, error = 0 errors\nDone": the
+            // lazy split leaves "Copying files" as stdout and the rest as stderr.
+            var judgement = PlatformOutputJudge.Judge(
+                Run("Copying files", "0 errors\nDone, error ="),
+                Saved("Copying files, error = 0 errors\r\nDone"));
+            Assert.Equal(PlatformOutputVerdict.Repaired, judgement.Verdict);
+            Assert.Equal("stdout_split", judgement.Reason);
+            Assert.Equal("Copying files, error = 0 errors\nDone", judgement.Stdout);
+            Assert.Equal(string.Empty, judgement.Stderr);
+        }
+
+        [Fact]
+        public void A_prefix_without_the_split_explanation_is_foreign()
+        {
+            Assert.Equal(PlatformOutputVerdict.Foreign, PlatformOutputJudge.Judge(Run("Detected"), Saved("Detected and repaired")).Verdict);
+        }
+
+        [Fact]
+        public void Failed_with_stderr_is_judged_on_stderr()
+        {
+            Assert.Equal(PlatformOutputVerdict.Verified,
+                PlatformOutputJudge.Judge(Run("partial", "Access denied", 1, "Failed"), Saved("Access denied\r\n", "Failed", 99)).Verdict);
+
+            var missing = PlatformOutputJudge.Judge(Run(null, null, 1, "Failed"), Saved("Access denied", "Failed", 99));
+            Assert.Equal(PlatformOutputVerdict.Repaired, missing.Verdict);
+            Assert.Null(missing.Stdout);
+            Assert.Equal("Access denied", missing.Stderr);
+
+            var foreign = PlatformOutputJudge.Judge(Run("Detected", string.Empty, 0, "Failed"), Saved("Access denied", "Failed", 99));
+            Assert.Equal(PlatformOutputVerdict.Foreign, foreign.Verdict);
+            Assert.Equal(string.Empty, foreign.Stdout);
+            Assert.Equal("Access denied", foreign.Stderr);
+        }
+
+        [Fact]
+        public void Results_without_saved_output_or_from_another_run_are_not_compared()
+        {
+            Assert.Equal("no_saved_output", PlatformOutputJudge.Judge(Run(OwnStdout, null, 1, "Failed"), Saved("1", "Failed", 1)).Reason);
+            var hashMismatch = new SavedScriptResult { UserId = DeviceUser, PolicyId = PolicyA, Result = "Failed", ErrorCode = 2, ResultDetails = "Hash mismatch" };
+            Assert.Equal("no_execution_message", PlatformOutputJudge.Judge(Run(OwnStdout, null, 1, "Failed"), hashMismatch).Reason);
+            Assert.Equal("result_differs", PlatformOutputJudge.Judge(Run(OwnStdout), Saved("Access denied", "Failed", 99)).Reason);
+            // A result derived from the exit code (fallback) is not IME's — the saved one is.
+            Assert.Equal(PlatformOutputVerdict.Verified,
+                PlatformOutputJudge.Judge(Run(OwnStdout, null, 1, "Failed", "agentexecutor_fallback"), Saved(OwnStdout)).Verdict);
+        }
+
+        // ── PlatformScriptRunRegister ───────────────────────────────────────────
+
+        private static ScriptExecutionState Emitted(string policyId, string? stdout, int? exitCode = 0, string? userId = DeviceUser, string runId = "run-1")
+            => new ScriptExecutionState { PolicyId = policyId, ScriptType = "platform", UserId = userId, RunId = runId, Result = "Success", ResultSource = "ime_policy_result", ExitCode = exitCode, Stdout = stdout };
+
+        [Fact]
+        public void A_save_is_paired_only_after_the_tracker_read_past_it_and_the_run_was_emitted()
+        {
+            var runs = new PlatformScriptRunRegister();
+            runs.NoteStarted(DeviceUser, PolicyA, T0);
+            var seen = T0.AddSeconds(30);
+
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(DeviceUser, PolicyA, seen, out _));
+            runs.NotePassCompleted(seen.AddSeconds(1));
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(DeviceUser, PolicyA, seen, out _)); // pass started too early
+            runs.NotePassCompleted(seen + PlatformScriptRunRegister.TrackerCatchUp);
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(DeviceUser, PolicyA, seen, out _)); // run not emitted yet
+
+            runs.NoteEmitted(Emitted(PolicyA, OwnStdout), T0.AddSeconds(40));
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, seen, out var run));
+            Assert.Equal("run-1", run!.RunId);
+            Assert.Equal(OwnStdout, run.Stdout);
+            Assert.Equal(PlatformRunClaim.None, runs.TryClaim(DeviceUser, PolicyA, seen, out _)); // never twice
+        }
+
+        [Fact]
+        public void A_new_start_replaces_the_latest_run_of_its_key_and_other_users_stay_apart()
+        {
+            var runs = new PlatformScriptRunRegister();
+            runs.NoteStarted(DeviceUser, PolicyA, T0);
+            runs.NoteEmitted(Emitted(PolicyA, "first run"), T0.AddSeconds(5));
+            runs.NoteStarted(DeviceUser, PolicyA, T0.AddMinutes(30));
+            runs.NoteEmitted(Emitted(PolicyA, "second run", runId: "run-2"), T0.AddMinutes(30).AddSeconds(5));
+            const string user = "6c3f8a20-1d5e-4b97-8f4a-0e2d6b9c7a13";
+            runs.NoteStarted(user, PolicyA, T0.AddMinutes(31));
+            runs.NotePassCompleted(T0.AddHours(1));
+
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, T0.AddMinutes(31), out var run));
+            Assert.Equal("second run", run!.Stdout);
+            Assert.Equal(PlatformRunClaim.Wait, runs.TryClaim(user, PolicyA, T0.AddMinutes(32), out _));
+            Assert.Equal(PlatformRunClaim.None, runs.TryClaim(DeviceUser, PolicyB, T0.AddMinutes(32), out _));
+        }
+
+        [Fact]
+        public void A_run_without_a_readable_user_id_is_claimed_by_its_policy()
+        {
+            var runs = new PlatformScriptRunRegister();
+            runs.NoteStarted(null, PolicyA, T0);
+            runs.NoteEmitted(Emitted(PolicyA, OwnStdout, userId: null), T0.AddSeconds(5));
+            runs.NotePassCompleted(T0.AddMinutes(5));
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, T0.AddMinutes(1), out _));
+        }
+
+        [Fact]
+        public void Register_keeps_the_newest_runs_and_its_counters_report_each_change_once()
+        {
+            var runs = new PlatformScriptRunRegister();
+            for (var i = 0; i <= PlatformScriptRunRegister.MaxRuns; i++)
+                runs.NoteStarted(DeviceUser, Guid.NewGuid().ToString("D"), T0.AddSeconds(i));
+            runs.NoteStarted(DeviceUser, PolicyA, T0.AddHours(1));
+            runs.NoteEmitted(Emitted(PolicyA, OwnStdout), T0.AddHours(1));
+            runs.NotePassCompleted(T0.AddHours(2));
+            Assert.Equal(PlatformRunClaim.Claimed, runs.TryClaim(DeviceUser, PolicyA, T0.AddHours(1), out _));
+
+            Assert.False(runs.ConsumeCountersChanged());
+            runs.CountVerified();
+            runs.CountCorrected();
+            Assert.True(runs.ConsumeCountersChanged());
+            Assert.False(runs.ConsumeCountersChanged());
+            Assert.Equal(1, runs.Verified);
+            runs.RestoreCounters(7, 3);
+            Assert.Equal(7, runs.Verified);
+            Assert.Equal(3, runs.Corrected);
+        }
+
+        // ── observer flow ───────────────────────────────────────────────────────
+
+        private sealed class Fixture
+        {
+            public readonly FakeSignalIngressSink Sink = new FakeSignalIngressSink();
+            public readonly VirtualClock Clock = new VirtualClock(T0);
+            public readonly PlatformScriptRunRegister Runs = new PlatformScriptRunRegister();
+            public Dictionary<string, SavedScriptResult> Registry = new Dictionary<string, SavedScriptResult>(StringComparer.OrdinalIgnoreCase);
+            public readonly ImeRegistryScriptResultObserver Observer;
+
+            public Fixture()
+            {
+                Observer = new ImeRegistryScriptResultObserver(Runs, new InformationalEventPost(Sink, Clock), null, Clock,
+                    () => new Dictionary<string, SavedScriptResult>(Registry, StringComparer.OrdinalIgnoreCase));
+            }
+
+            public void Save(SavedScriptResult saved) => Registry[ImeRegistryScriptResultObserver.KeyOf(saved.UserId, saved.PolicyId)] = saved;
+
+            /// <summary>The tracker emitted a run, then kept polling past the save.</summary>
+            public void EmitRun(string policyId, string? stdout, int? exitCode, string runId)
+            {
+                Runs.NoteStarted(DeviceUser, policyId, Clock.UtcNow);
+                Runs.NoteEmitted(Emitted(policyId, stdout, exitCode, runId: runId), Clock.UtcNow);
+            }
+
+            public void TrackerCaughtUp() => Runs.NotePassCompleted(Clock.UtcNow);
+
+            public IReadOnlyList<FakeSignalIngressSink.PostedSignal> Corrections()
+                => Sink.Posted.Where(p => p.Payload != null
+                    && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                    && et == SharedEventTypes.ScriptOutputReconciliation).ToList();
+        }
+
+        [Fact]
+        public void Field_case_end_to_end_the_save_corrects_the_run_with_a_warning_naming_it()
+        {
+            var f = new Fixture();
+            f.Save(Saved("an older run of another policy", policy: PolicyB, stamp: "10/2/2026 8:00:00 AM"));
+            f.Observer.Tick("baseline");
+
+            f.EmitRun(PolicyA, ForeignStdout, 1, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.Clock.Advance(TimeSpan.FromSeconds(1));
+            f.Observer.Tick("registry_change");
+            Assert.Empty(f.Corrections()); // the tracker has not read past the save yet
+
+            f.Clock.Advance(PlatformScriptRunRegister.TrackerCatchUp);
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            var correction = Assert.Single(f.Corrections());
+            var data = correction.Payload!;
+            Assert.Equal(PolicyA, data["policyId"]);
+            Assert.Equal("platform", data["scriptType"]);
+            Assert.Equal("run-a", data["runId"]);
+            Assert.Equal("foreign", data["outcome"]);
+            Assert.Equal("stdout_differs", data["reason"]);
+            Assert.Equal("Success", data["result"]);
+            Assert.Equal(OwnStdout, data["stdout"]);
+            Assert.Equal(string.Empty, data["stderr"]);
+            Assert.Equal("1", data["previousExitCode"]);
+            Assert.Equal("0", data["registryErrorCode"]);
+            Assert.Equal("Warning", data[SignalPayloadKeys.Severity]);
+            Assert.Equal("true", data[SignalPayloadKeys.ImmediateUpload]);
+            Assert.DoesNotContain("exitCode", data.Keys);
+            Assert.Equal(1, f.Runs.Corrected);
+            Assert.Equal(0, f.Runs.Verified);
+
+            // The same save read again changes nothing.
+            f.Clock.Advance(TimeSpan.FromMinutes(1));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+            Assert.Single(f.Corrections());
+        }
+
+        [Fact]
+        public void Confirmed_output_is_counted_and_emits_nothing()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.EmitRun(PolicyA, OwnStdout, 0, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.Clock.Advance(TimeSpan.FromSeconds(1));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            Assert.Empty(f.Corrections());
+            Assert.Equal(1, f.Runs.Verified);
+        }
+
+        [Fact]
+        public void Completed_output_is_an_info_event_that_keeps_the_exit_code()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.EmitRun(PolicyA, null, 0, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.Clock.Advance(TimeSpan.FromSeconds(1));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            var data = Assert.Single(f.Corrections()).Payload!;
+            Assert.Equal("repaired", data["outcome"]);
+            Assert.Equal("Info", data[SignalPayloadKeys.Severity]);
+            Assert.DoesNotContain("previousExitCode", data.Keys);
+        }
+
+        [Fact]
+        public void A_save_seen_before_its_run_was_emitted_waits_for_the_emit()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.Runs.NoteStarted(DeviceUser, PolicyA, f.Clock.UtcNow); // result held for its end block
+            f.Save(Saved(OwnStdout));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+            Assert.Equal(0, f.Runs.Verified + f.Runs.Corrected);
+
+            f.Runs.NoteEmitted(Emitted(PolicyA, ForeignStdout, 1, runId: "run-a"), f.Clock.UtcNow);
+            f.Clock.Advance(TimeSpan.FromSeconds(60));
+            f.Observer.Tick("periodic");
+            Assert.Equal("foreign", Assert.Single(f.Corrections()).Payload!["outcome"]);
+        }
+
+        [Fact]
+        public void A_save_no_run_claims_within_the_expiry_is_dropped()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            f.Save(Saved(OwnStdout));
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(ImeRegistryScriptResultObserver.PendingExpiry);
+            f.TrackerCaughtUp();
+            f.Runs.NoteStarted(DeviceUser, PolicyA, f.Clock.UtcNow);
+            f.Observer.Tick("periodic"); // waits for the emit — and expires
+
+            f.Runs.NoteEmitted(Emitted(PolicyA, ForeignStdout, 1, runId: "run-a"), f.Clock.UtcNow);
+            f.Clock.Advance(TimeSpan.FromSeconds(60));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+            Assert.Empty(f.Corrections());
+        }
+
+        [Fact]
+        public void Saves_from_before_the_agent_started_are_the_silent_baseline()
+        {
+            var f = new Fixture();
+            f.EmitRun(PolicyA, ForeignStdout, 1, "run-a");
+            f.Save(Saved(OwnStdout));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("baseline");
+            f.Clock.Advance(TimeSpan.FromMinutes(1));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            Assert.Empty(f.Corrections());
+            Assert.Equal(0, f.Runs.Verified + f.Runs.Corrected);
+        }
+
+        [Fact]
+        public void Corrections_beyond_the_cap_are_counted_but_not_emitted()
+        {
+            var f = new Fixture();
+            f.Observer.Tick("baseline");
+            var policies = Enumerable.Range(0, ImeRegistryScriptResultObserver.MaxCorrectionsPerSession + 3).Select(_ => Guid.NewGuid().ToString("D")).ToList();
+            foreach (var policy in policies)
+            {
+                f.EmitRun(policy, ForeignStdout, 1, "run-" + policy);
+                f.Save(Saved(OwnStdout, policy: policy));
+            }
+            f.Observer.Tick("registry_change");
+            f.Clock.Advance(TimeSpan.FromSeconds(3));
+            f.TrackerCaughtUp();
+            f.Observer.Tick("periodic");
+
+            Assert.Equal(ImeRegistryScriptResultObserver.MaxCorrectionsPerSession, f.Corrections().Count);
+            Assert.Equal(policies.Count, f.Runs.Corrected);
+        }
+    }
+}
@@ -10,6 +10,7 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
 using Xunit;

 namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
@@ -56,7 +57,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
        public void Page_IsReported_WithItsEventTime_AndFields()
        {
            Build().ReportPage(
-                new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "OobeNDUP", result: "success"),
+                new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, 62405, page: "OobeNDUP", result: "success"),
                At.AddMinutes(-3), isBackfill: true);

            var page = Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage));
@@ -75,7 +76,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
        public void EventName_CarriesItsSafeValue()
        {
            Build().ReportPage(
-                new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62407, name: "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", value: "true"),
+                new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62407, name: "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", value: "true"),
                At, isBackfill: false);

            var data = Data(Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage)));
@@ -89,9 +90,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
            var telemetry = Build();
            for (var i = 0; i < 10; i++)
            {
-                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_progress"), At.AddSeconds(i), isBackfill: false);
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_progress"), At.AddSeconds(i), isBackfill: false);
            }
-            telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "OobeNDUP", result: "success"), At.AddMinutes(1), isBackfill: false);
+            telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, 62405, page: "OobeNDUP", result: "success"), At.AddMinutes(1), isBackfill: false);

            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey + 1, pages.Count);
@@ -101,15 +102,41 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
        }

        [Fact]
-        public void PageEvents_AreCappedPerRun()
+        public void PageEvents_AreCappedPerRun_AndTheCapIsMarkedOnce()
        {
            var telemetry = Build();
            for (var i = 0; i < OobeUpdateTelemetry.MaxPageEventsPerRun + 20; i++)
            {
-                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false);
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At.AddSeconds(i), isBackfill: false);
            }

-            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun, ByType(Constants.EventTypes.OobeUpdatePage).Count);
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 1, pages.Count);
+            // A name missing after the marker proves nothing — the rules check for it.
+            var marker = Data(pages.Last());
+            Assert.Equal(OobeUpdateVocabulary.NamesCapped, marker["cxhEvent"]);
+            Assert.Equal(false, marker["backfill"]);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun, marker["limit"]);
+            Assert.Equal(At.AddSeconds(OobeUpdateTelemetry.MaxPageEventsPerRun), pages.Last().OccurredAtUtc); // the first name over the budget
+        }
+
+        [Fact]
+        public void BackfilledNames_HaveTheirOwnBudget()
+        {
+            // The records from before the agent started cannot spend the live page's budget.
+            var telemetry = Build();
+            for (var i = 0; i < OobeUpdateTelemetry.MaxBackfillPageEventsPerRun + 5; i++)
+            {
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: $"ExpeditedUpdate_old{i}"), At.AddMinutes(-30), isBackfill: true);
+            }
+
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_live"), At, isBackfill: false));
+
+            var markers = ByType(Constants.EventTypes.OobeUpdatePage)
+                .Where(p => (string)Data(p)["cxhEvent"] == OobeUpdateVocabulary.NamesCapped).ToList();
+            var marker = Assert.Single(markers);
+            Assert.Equal(true, Data(marker)["backfill"]);
+            Assert.Equal(OobeUpdateTelemetry.MaxBackfillPageEventsPerRun, Data(marker)["limit"]);
        }

        [Fact]
@@ -119,16 +146,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
            var telemetry = Build();
            for (var i = 0; i < OobeUpdateTelemetry.MaxPageEventsPerRun; i++)
            {
-                Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false));
+                Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false));
            }

-            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_late"), At, isBackfill: false));
-            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, 62404, page: "RebootNDUP"), At.AddMinutes(1), isBackfill: false));
-            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "RebootNDUP", result: "success"), At.AddMinutes(2), isBackfill: false));
+            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_late"), At, isBackfill: false));
+            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_later"), At, isBackfill: false));
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStarted, 62404, page: "RebootNDUP"), At.AddMinutes(1), isBackfill: false));
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, 62405, page: "RebootNDUP", result: "success"), At.AddMinutes(2), isBackfill: false));

            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
-            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 2, pages.Count);
-            Assert.Equal(new object[] { "page_started", "page_stopped" },
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 3, pages.Count);
+            Assert.Equal(new object[] { OobeUpdateVocabulary.NamesCapped, "page_started", "page_stopped" },
                pages.Skip(OobeUpdateTelemetry.MaxPageEventsPerRun).Select(p => Data(p)["cxhEvent"]).ToArray());
        }

@@ -138,7 +166,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
            // Outside the run budget, but a page that restarts in a loop still cannot flood.
            var telemetry = Build();
            var reported = Enumerable.Range(0, 10)
-                .Count(i => telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, 62404, page: "OobeNDUP"), At.AddMinutes(i), isBackfill: false));
+                .Count(i => telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStarted, 62404, page: "OobeNDUP"), At.AddMinutes(i), isBackfill: false));

            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey, reported);
        }
@@ -145,7 +145,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
        [Fact]
        public void Ime_app_state_callback_is_chained_into_the_user_apps_settled_recheck()
        {
-            // sits-d Cloud-PC fix (2026-08-19): the AccountSetup synthesis is re-evaluated on every
+            // Cloud-PC fix (2026-08-19): the AccountSetup synthesis is re-evaluated on every
            // terminal IME app transition, which only works while the factory keeps this chain
            // wired. It is five lines that a refactor can drop silently and whose absence costs a
            // whole class of sessions their completion — so pin it here.
@@ -11,7 +11,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
 {
    /// <summary>
    /// Contract tests for <see cref="AgentBootstrap.RetrySelfUpdateAfterEnrollment"/> —
-    /// the post-cert one-shot self-update retry (field case sits-d.cloud, 2026-08-09):
+    /// the post-cert one-shot self-update retry (field case 2026-08-09):
    /// guard on <see cref="SelfUpdater.LastVersionCheckSucceeded"/>, the relaxed
    /// timeouts/trigger it passes to the updater, and the swallow-everything exception
    /// contract (bootstrap must continue on any updater failure). Uses the
@@ -182,7 +182,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
            Assert.Equal("FromCache", data["outcome"]);
        }

-        // ── Post-registration recovery (Phase 6.5, tenant aebdce78 audit 2026-08-24) ─
+        // ── Post-registration recovery (Phase 6.5, kiosk-tenant audit 2026-08-24) ─

        [Fact]
        public void EmitFetchFailedIfAny_AfterRecovery_MarksRecoveredAndDemotesToInfo()
@@ -0,0 +1,54 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
+{
+    /// <summary>
+    /// D-316: every emitted platform-script completion carries a run id, and the tracker's run register holds what
+    /// was emitted for it under the IME user id — what the registry reconciliation pairs IME's saved result with.
+    /// </summary>
+    public sealed class ImeLogTrackerAdapterPlatformRunTests
+    {
+        private static readonly DateTime ClockNow = new DateTime(2026, 10, 3, 21, 0, 0, DateTimeKind.Utc);
+        private const string DeviceUser = "00000000-0000-0000-0000-000000000000";
+        private const string PolicyId = "1d6f0a52-3c4e-4b7a-9e21-5f8c7d2b9a10";
+
+        [Fact]
+        public void Platform_completion_carries_its_run_id_and_the_register_holds_the_emitted_run()
+        {
+            using var f = new ImeLogTrackerAdapterFixture(ClockNow);
+            using var adapter = new ImeLogTrackerAdapter(f.Tracker, f.Ingress, f.Clock);
+
+            f.Tracker.LastMatchedLogTimestamp = ClockNow.AddSeconds(-10);
+            f.Tracker.HandlePlatformScriptStarted(PolicyId, "ime", DeviceUser);
+            f.Tracker.RecordPlatformScriptExitCodeForTesting(PolicyId, 0, ClockNow.AddSeconds(-1));
+            f.Tracker.LastMatchedLogTimestamp = ClockNow;
+            f.Tracker.CompletePlatformScriptFromImeResultForTesting(PolicyId, "Success", ClockNow);
+
+            var info = f.InfoEvent(SharedEventTypes.ScriptCompleted);
+            Assert.True(Guid.TryParse(info.Payload!["runId"], out _));
+
+            f.Tracker.ScriptRuns.NotePassCompleted(ClockNow.AddMinutes(1));
+            Assert.Equal(PlatformRunClaim.Claimed, f.Tracker.ScriptRuns.TryClaim(DeviceUser, PolicyId, ClockNow.AddSeconds(5), out var run));
+            Assert.Equal(info.Payload["runId"], run!.RunId);
+            Assert.Equal(0, run.ExitCode);
+            Assert.Equal("Success", run.Result);
+        }
+
+        [Theory]
+        [InlineData("[PowerShell] User Id = 00000000-0000-0000-0000-000000000000, Policy id = d94468af-6ebe-4e94-9901-2a62d33ea6c1, policy result = Success", "00000000-0000-0000-0000-000000000000")]
+        [InlineData(@"Adding argument powershell with value C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\6C3F8A20-1D5E-4B97-8F4A-0E2D6B9C7A13_d94468af-6ebe-4e94-9901-2a62d33ea6c1.ps1", "6c3f8a20-1d5e-4b97-8f4a-0e2d6b9c7a13")]
+        [InlineData(@"Script file C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_d94468af-6ebe-4e94-9901-2a62d33ea6c1.ps1 is generated", "00000000-0000-0000-0000-000000000000")]
+        [InlineData(@"Adding argument powershellDetection with value C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\8b2e4c71-6a9d-4f03-b5e8-2c7a1d9f4e36_2.ps1", null)]
+        [InlineData("[PowerShell] User Id = not-a-guid, Policy id = d94468af", null)]
+        [InlineData("", null)]
+        public void Ime_user_id_is_read_from_the_result_line_and_the_script_path(string text, string? expected)
+        {
+            Assert.Equal(expected, ImeLogTracker.ImeUserIdFrom(text));
+        }
+    }
+}
@@ -107,7 +107,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
        [Fact]
        public void Succeeded_outcome_is_an_info_about_tail_only_coverage_without_alarm_framing()
        {
-            // The 659c3a90 shape: healthy enrollment, bootstrap merely ran late in the ESP queue.
+            // The field shape: healthy enrollment, bootstrap merely ran late in the ESP queue.
            Describe(EnrollmentTerminationOutcome.Succeeded, "in_progress",
                out var severity, out _, out var note);

@@ -14,7 +14,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
    /// 401/403 classification in <see cref="BackendApiClient"/>: a backend JSON 403 is a real
    /// device-authorization verdict, while an HTML body means the response came from the Azure
    /// platform / an edge proxy (stopped or retired app) and must NOT be reported as
-    /// "device is not authorized". Field case sits-d.cloud 2026-08-09: a pre-cutover agent hit
+    /// "device is not authorized". Field case 2026-08-09: a pre-cutover agent hit
    /// the stopped legacy Function App and support chased a non-existent authorization problem.
    /// </summary>
    public sealed class BackendApiClientAuthClassificationTests
@@ -46,7 +46,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
        /// Upper bound for the pre-fetch network-link wait on the initial startup fetch.
        /// Deliberately longer than the registration gate's 15s: the fetch runs FIRST after a
        /// boot-time relaunch, when Wi-Fi may still be associating (802.1X, OOBE), and a fetch
-        /// burned into a dead link strands the whole session on built-in defaults — tenant aebdce78
+        /// burned into a dead link strands the whole session on built-in defaults — kiosk-tenant
        /// audit 2026-08-24: ~50% of sessions lost their tenant config exactly this way.
        /// </summary>
        internal static readonly TimeSpan InitialFetchNetworkLinkWaitMax = TimeSpan.FromSeconds(60);
@@ -271,17 +271,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            }
            else
            {
-                HandlePlatformScriptStarted(id, source);
+                HandlePlatformScriptStarted(id, source, ImeUserIdFrom(match.Value));
            }
        }

+        /// <summary>
+        /// The IME user id on a platform-script line — <c>User Id = {id}</c> on the result line,
+        /// <c>…\Policies\Scripts\{id}_{policy}.ps1</c> on the start lines — or null. Read from the
+        /// matched text, not from a capture group, so it works with every pattern pack the agent may
+        /// be served.
+        /// </summary>
+        internal static string ImeUserIdFrom(string text)
+        {
+            if (string.IsNullOrEmpty(text)) return null;
+            const string resultTag = "User Id = ";
+            const string pathTag = @"\Policies\Scripts\";
+            var i = text.IndexOf(resultTag, StringComparison.OrdinalIgnoreCase);
+            if (i >= 0) return GuidAt(text, i + resultTag.Length);
+            i = text.IndexOf(pathTag, StringComparison.OrdinalIgnoreCase);
+            return i >= 0 ? GuidAt(text, i + pathTag.Length) : null;
+        }
+
+        private static string GuidAt(string text, int start)
+        {
+            if (start + 36 > text.Length) return null;
+            var candidate = text.Substring(start, 36);
+            return Guid.TryParse(candidate, out _) ? candidate.ToLowerInvariant() : null;
+        }
+
        // Platform script: AgentExecutor.log entries create/enrich, IME log entries also create.
        // Internal so the stale-slot hardening is directly testable (the public path arrives via
        // a regex Match).
-        internal void HandlePlatformScriptStarted(string id, string source = null)
+        internal void HandlePlatformScriptStarted(string id, string source = null, string userId = null)
        {
            var currentStartTs = LastMatchedLogTimestamp ?? UtcNowProvider();
            var currentStartProvenance = CaptureLastMatchedProvenance();
+            var fromExecutor = string.Equals(source, "agentexecutor", StringComparison.OrdinalIgnoreCase);

            // A start line older than the result this policy already emitted is the late start
            // line of THAT run: its AgentExecutor block surfaced after the IME result — the two
@@ -294,7 +319,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            // never tie; a low-resolution clock in a test may).
            if (_platformScriptResultEmitted.TryGetValue(id, out var emittedResultTs) && currentStartTs < emittedResultTs)
            {
-                RecordInvocationMarker(id, isClose: false);
+                RecordInvocationMarker(id, isClose: false, EmittedRunId);
                NoteInvocationActivity();
                _logger.Debug($"ImeLogTracker: platform script start line for {id} (source: {source ?? "ime"}) predates its emitted result — late line of that run, not a new one");
                return;
@@ -302,7 +327,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

            if (_pendingPlatformScripts.TryGetValue(id, out var pendingSlot))
            {
-                if (pendingSlot.StartedAtUtc.HasValue && currentStartTs - pendingSlot.StartedAtUtc.Value > TimeSpan.FromHours(24))
+                if (pendingSlot.StartedAtUtc.HasValue && currentStartTs - pendingSlot.StartedAtUtc.Value > StalePlatformRunAge)
                {
                    // Stale-slot hardening (session eaf3d8c4): a replayed start line from a previous
                    // enrollment whose matching result never appeared (script was mid-run when that
@@ -319,6 +344,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    // Emit what the held run has; its end block did not surface in time.
                    EmitPlatformScriptResult(pendingSlot, "the next run of this policy started");
                }
+                else if (fromExecutor && LastMatchedLogTimestamp.HasValue && pendingSlot.Result == null
+                    && pendingSlot.ExecutorStartedAtUtc.HasValue && pendingSlot.ExecutorStartedAtUtc.Value < currentStartTs)
+                {
+                    // Every executor process writes its start line once: a later one is the next run
+                    // (IME re-runs a failed script on a later check-in), whose end block must not
+                    // overwrite this one's. This run waits for its IME result — on the first pass
+                    // AgentExecutor.log is read in full before the IME log (session eff1b413).
+                    ParkPlatformRun(pendingSlot);
+                }
                else if (!pendingSlot.StartedAtUtc.HasValue)
                {
                    // The slot was opened by its result while the start block was still hidden;
@@ -328,7 +362,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    _stateDirty = true;
                }
            }
-            if (!_pendingPlatformScripts.ContainsKey(id))
+            if (_pendingPlatformScripts.TryGetValue(id, out var slot))
+            {
+                if (slot.UserId == null && userId != null) slot.UserId = userId;
+                if (fromExecutor && !slot.ExecutorStartedAtUtc.HasValue)
+                {
+                    slot.ExecutorStartedAtUtc = currentStartTs;
+                    _stateDirty = true;
+                }
+            }
+            else
            {
                // A fresh start for this policy (no pending entry) begins a NEW execution.
                // Clear any emitted-marker from a prior run so IME re-evaluations / retries of
@@ -336,24 +379,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                // deduped away. A start line of the emitted run itself never reaches this point
                // (the guard above), so this never clears the current run's own marker.
                _platformScriptResultEmitted.Remove(id);
-                _pendingPlatformScripts[id] = new ScriptExecutionState
+                slot = new ScriptExecutionState
                {
                    PolicyId = id,
                    ScriptType = "platform",
+                    UserId = userId,
+                    RunId = NewRunId(),
                    // Prefer the source CMTrace timestamp so a script that started before the
                    // agent launched (replayed log content) is dated to its real start, not now.
                    // Set only at slot creation: the start line fires twice (agentexecutor + ime
                    // source) but the earliest wins.
                    StartedAtUtc = currentStartTs,
                    StartedAtProvenance = currentStartProvenance,
+                    ExecutorStartedAtUtc = fromExecutor ? currentStartTs : (DateTime?)null,
                };
+                _pendingPlatformScripts[id] = slot;
+                ScriptRuns.NoteStarted(userId, id, UtcNowProvider());
                // Live "running" indicator — same signal health scripts emit. Gated on slot
                // creation so the duplicate start line (agentexecutor + ime source) doesn't
                // double-emit for the same execution.
                try { OnScriptStarted?.Invoke(new ScriptStartedInfo { PolicyId = id, ScriptType = "platform" }); }
                catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptStarted handler threw: {ex.Message}"); }
            }
-            RecordInvocationMarker(id, isClose: false);
+            RecordInvocationMarker(id, isClose: false, LastMatchedLogTimestamp.HasValue ? RunIdOfStartLine(slot, fromExecutor, currentStartTs) : slot.RunId);
            NoteInvocationActivity();
            // Started lines fire twice per script (agentexecutor + ime source) and carry no
            // outcome — the matching `platform script completed` line below carries result+exit
@@ -361,6 +409,34 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            _logger.Debug($"ImeLogTracker: platform script started: {id} (source: {source ?? "ime"})");
        }

+        /// <summary>How long after IME's "Script file … is generated" line its executor writes its start line (about 2 s).</summary>
+        private static readonly TimeSpan ImeLaunchWindow = TimeSpan.FromMinutes(1);
+
+        /// <summary>
+        /// The run a timestamped start line belongs to, for its invocation marker. An executor start line belongs to the
+        /// slot unless it is older than the slot's executor start — re-read behind a later run — then to the parked run
+        /// it started. IME's "Script file … is generated" precedes its executor: it belongs to the live run whose
+        /// executor started within <see cref="ImeLaunchWindow"/> after it, else to a slot whose executor has not
+        /// started yet; otherwise its run is not known (yet) and the lines behind it go nowhere.
+        /// </summary>
+        private string RunIdOfStartLine(ScriptExecutionState slot, bool fromExecutor, DateTime lineTs)
+        {
+            if (fromExecutor)
+            {
+                if (!slot.ExecutorStartedAtUtc.HasValue || slot.ExecutorStartedAtUtc.Value <= lineTs) return slot.RunId;
+                var parked = _parkedPlatformScripts.FirstOrDefault(r =>
+                    string.Equals(r.PolicyId, slot.PolicyId, StringComparison.OrdinalIgnoreCase) && r.ExecutorStartedAtUtc == lineTs);
+                return parked?.RunId ?? EmittedRunId;
+            }
+
+            var launched = LivePlatformRuns(slot.PolicyId)
+                .Where(r => r.ExecutorStartedAtUtc.HasValue && r.ExecutorStartedAtUtc.Value >= lineTs && r.ExecutorStartedAtUtc.Value - lineTs <= ImeLaunchWindow)
+                .OrderBy(r => r.ExecutorStartedAtUtc.Value)
+                .FirstOrDefault();
+            if (launched != null) return launched.RunId;
+            return slot.ExecutorStartedAtUtc.HasValue ? EmittedRunId : slot.RunId;
+        }
+
        // Routes line-by-line script-data handlers (context / exitCode / output) to the right
        // accumulator based on the pattern's scriptType parameter. Health-script lines feed the
        // single-slot _pendingHealthScript (the HS-NEW-RESULT JSON delivers the full cycle in one
@@ -439,6 +515,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                ApplyExitCode(script, exitCode, LastMatchedLogTimestamp ?? UtcNowProvider(), CaptureLastMatchedProvenance());
            else if (ownerPolicyId != null)
                _logger.Debug($"ImeLogTracker: exit code {exitCode} belongs to platform script {ownerPolicyId}, whose completion was already emitted — dropped");
+            else
+                LogLineBehindWriterBoundary($"exit code {exitCode}");
            // An exit code means the executor just wrote its end block and IME is about to
            // write the result — both land at a stale stream position when another process
            // appended meanwhile. Check the ledgers on the next pass.
@@ -465,17 +543,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        {
            var outputType = parameters != null && parameters.TryGetValue("outputType", out var ot) ? ot : null;
            var script = GetCurrentScriptForLineUpdate(parameters);
-            if (script == null) return;
+            if (script == null)
+            {
+                LogLineBehindWriterBoundary($"script output ({outputType ?? "combined"})");
+                return;
+            }

            // PS-AGENT-OUTPUT captures both stdout and stderr in one pattern
            var output = match.Groups["output"]?.Value;
-            var error = match.Groups["error"]?.Value;
+            var error = match.Groups["error"];

-            if (!string.IsNullOrEmpty(output) && !string.IsNullOrEmpty(error))
+            if (error != null && error.Success)
            {
-                // Combined pattern (write output done. output = ..., error = ...)
-                script.Stdout = TruncateOutput(output.Trim());
-                script.Stderr = TruncateOutput(error.Trim());
+                // Combined pattern (write output done. output = ..., error = ...): both texts as
+                // AgentExecutor wrote them to the result files — the error part is the error file
+                // IME judges. The "error from script" line before it is a snapshot taken before the
+                // output readers finished, so this one replaces it, an empty stdout included.
+                script.Stdout = TruncateOutput(output?.Trim());
+                script.Stderr = TruncateOutput(error.Value.Trim());
            }
            else if (string.Equals(outputType, "stderr", StringComparison.OrdinalIgnoreCase))
            {
@@ -507,7 +592,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

            if (string.IsNullOrEmpty(id)) return;

-            CompletePlatformScriptFromImeResult(id, result, LastMatchedLogTimestamp, LastMatchedPatternId, CaptureLastMatchedProvenance());
+            CompletePlatformScriptFromImeResult(id, result, LastMatchedLogTimestamp, LastMatchedPatternId, CaptureLastMatchedProvenance(), ImeUserIdFrom(match.Value));
        }

        /// <summary>
@@ -521,48 +606,46 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// line reopened the slot, produced a fallback duplicate (session e7f3c910).
        /// <see cref="FlushPendingPlatformScriptResults"/> emits the held completion.
        /// </summary>
-        internal void CompletePlatformScriptFromImeResult(string policyId, string result, DateTime? resultLineTimestampUtc, string patternId, CmTraceLineProvenance resultProvenance)
+        internal void CompletePlatformScriptFromImeResult(string policyId, string result, DateTime? resultLineTimestampUtc, string patternId, CmTraceLineProvenance resultProvenance, string userId = null)
        {
-            // Dedup: the deadline-based fallback (FlushPendingPlatformScriptResults) may already have
-            // emitted this script from its AgentExecutor exit code because IME's authoritative
-            // PS-SCRIPT-RESULT line arrived late. The fallback carries the same exit code + stdout,
-            // so re-emitting here would duplicate the timeline entry and inflate counts. Drop the
-            // now-redundant pending entry and skip.
-            if (_platformScriptResultEmitted.ContainsKey(policyId))
+            // The result belongs to the run of this policy that started last before its line —
+            // the run in flight, or an earlier one that waits for its result while a later run
+            // already started (ParkPlatformRun).
+            var script = FindRunForResult(policyId, userId, resultLineTimestampUtc);
+            if (script == null)
            {
-                _logger.Debug($"ImeLogTracker: platform script {policyId} PS-SCRIPT-RESULT arrived after fallback emit — skipping duplicate");
-                _pendingPlatformScripts.Remove(policyId);
-                return;
-            }
+                // Dedup: the deadline-based fallback (FlushPendingPlatformScriptResults) may already
+                // have emitted this run from its AgentExecutor end block because IME's authoritative
+                // PS-SCRIPT-RESULT line arrived late, or the same result line is read again.
+                // Re-emitting would duplicate the timeline entry and inflate counts.
+                if (_platformScriptResultEmitted.ContainsKey(policyId))
+                {
+                    _logger.Debug($"ImeLogTracker: platform script {policyId} PS-SCRIPT-RESULT arrived after its run was emitted — skipping duplicate");
+                    return;
+                }

-            // Merge with pending AgentExecutor data if available
-            if (_pendingPlatformScripts.TryGetValue(policyId, out var script))
-            {
-                // Stale-result guard: on an intra-lifetime re-run of the same policy, run 1's
-                // late PS-SCRIPT-RESULT can arrive after run 2's start line already created a
-                // fresh slot (the start clears the emitted-marker). Merging would pair run 2's
-                // StartedAtUtc/state with run 1's result and then drop run 2's genuine result at
-                // the marker check above. A result line always postdates its own run's start
-                // line in the source log, so a result older than the pending slot's start
-                // belongs to a previous run — drop it and keep the live slot intact.
-                if (script.StartedAtUtc.HasValue
-                    && resultLineTimestampUtc.HasValue
-                    && resultLineTimestampUtc.Value < script.StartedAtUtc.Value)
+                // Stale-result guard: every run of this policy in flight started after the result
+                // line — a result line always postdates its own run's start line in the source log,
+                // so it belongs to a previous run. Keep the live runs intact.
+                if (HasLivePlatformRun(policyId))
                {
                    _logger.Debug($"ImeLogTracker: platform script {policyId} result predates the current run's start — stale result from a previous run, skipping");
                    return;
                }
-            }
-            else
-            {
+
                script = new ScriptExecutionState
                {
                    PolicyId = policyId,
-                    ScriptType = "platform"
+                    ScriptType = "platform",
+                    UserId = userId,
+                    RunId = NewRunId(),
                };
                _pendingPlatformScripts[policyId] = script;
+                ScriptRuns.NoteStarted(userId, policyId, UtcNowProvider());
            }

+            if (script.UserId == null && userId != null) script.UserId = userId;
+            ResolveParkedRunsBefore(script);
            script.Result = result;
            script.ResultSource = "ime_policy_result";
            script.ResultObservedAtUtc = resultLineTimestampUtc ?? UtcNowProvider();
@@ -591,19 +674,150 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        private void EmitPlatformScriptResult(ScriptExecutionState script, string note = null)
        {
            _logger.Info($"ImeLogTracker: platform script completed: {script.PolicyId}, result={script.Result}, exit={script.ExitCode}{(note != null ? $" ({note})" : string.Empty)}");
+            if (string.IsNullOrEmpty(script.RunId)) script.RunId = NewRunId();
            EmitScriptEvent(script);
+            // The register keeps the latest run per (user, policy) for the registry reconciliation:
+            // a run that waited for its result while a later one started must not take that later
+            // run's entry.
+            if (!HasLaterLivePlatformRun(script)) ScriptRuns.NoteEmitted(script, UtcNowProvider());
            // The run's source stamp, capped at the clock: a result line cannot be read before it
            // was written, so a stamp ahead of the clock is a wrong zone assumption on that line
            // (a rewound result resolved in the reader's zone, session 4377911b: +1 h). Left
            // uncapped, the marker made the genuine NEXT run's start line read as a late line of
-            // this run and its result a duplicate.
+            // this run and its result a duplicate. Only ever raised: a run emitted after a later
+            // one must not move the reference back.
            var runStamp = script.ResultObservedAtUtc ?? script.ExitObservedAtUtc ?? UtcNowProvider();
            var nowUtc = UtcNowProvider();
-            _platformScriptResultEmitted[script.PolicyId] = runStamp > nowUtc ? nowUtc : runStamp;
-            _pendingPlatformScripts.Remove(script.PolicyId);
+            var stamp = runStamp > nowUtc ? nowUtc : runStamp;
+            if (!_platformScriptResultEmitted.TryGetValue(script.PolicyId, out var previousStamp) || stamp > previousStamp)
+                _platformScriptResultEmitted[script.PolicyId] = stamp;
+            if (_pendingPlatformScripts.TryGetValue(script.PolicyId, out var current) && ReferenceEquals(current, script))
+                _pendingPlatformScripts.Remove(script.PolicyId);
+            else
+                _parkedPlatformScripts.Remove(script);
            _stateDirty = true;
        }

+        private static string NewRunId() => Guid.NewGuid().ToString("D");
+
+        /// <summary>A run older than this by source time is from a previous enrollment, not a run in flight.</summary>
+        private static readonly TimeSpan StalePlatformRunAge = TimeSpan.FromHours(24);
+
+        private static bool SameUserOrUnknown(string a, string b)
+            => a == null || b == null || string.Equals(a, b, StringComparison.OrdinalIgnoreCase);
+
+        private static DateTime StartOf(ScriptExecutionState run) => run.StartedAtUtc ?? DateTime.MinValue;
+
+        /// <summary>The runs of a policy that are not emitted yet: the earlier ones waiting for their IME result, then the one in flight.</summary>
+        private IEnumerable<ScriptExecutionState> LivePlatformRuns(string policyId)
+        {
+            foreach (var run in _parkedPlatformScripts)
+            {
+                if (string.Equals(run.PolicyId, policyId, StringComparison.OrdinalIgnoreCase)) yield return run;
+            }
+            if (_pendingPlatformScripts.TryGetValue(policyId, out var current)) yield return current;
+        }
+
+        private bool HasLivePlatformRun(string policyId) => LivePlatformRuns(policyId).Any();
+
+        /// <summary>The live run a start marker names, or null once that run was emitted.</summary>
+        private ScriptExecutionState FindLivePlatformRun(string policyId, string runId)
+            => LivePlatformRuns(policyId).FirstOrDefault(r => string.Equals(r.RunId, runId, StringComparison.Ordinal));
+
+        private bool HasLaterLivePlatformRun(ScriptExecutionState script)
+            => LivePlatformRuns(script.PolicyId).Any(r => !ReferenceEquals(r, script)
+                && SameUserOrUnknown(r.UserId, script.UserId) && StartOf(r) > StartOf(script));
+
+        /// <summary>
+        /// The live run an IME result line belongs to: of the runs of its policy that started at or before the line,
+        /// the latest — one of the same IME user when there is one.
+        /// </summary>
+        private ScriptExecutionState FindRunForResult(string policyId, string userId, DateTime? resultLineTimestampUtc)
+        {
+            ScriptExecutionState sameUser = null, anyUser = null;
+            foreach (var run in LivePlatformRuns(policyId))
+            {
+                if (resultLineTimestampUtc.HasValue && run.StartedAtUtc.HasValue && run.StartedAtUtc.Value > resultLineTimestampUtc.Value) continue;
+                if (anyUser == null || StartOf(run) > StartOf(anyUser)) anyUser = run;
+                if (SameUserOrUnknown(run.UserId, userId) && (sameUser == null || StartOf(run) > StartOf(sameUser))) sameUser = run;
+            }
+            return sameUser ?? anyUser;
+        }
+
+        /// <summary>
+        /// Moves the run in flight aside when the next executor run of its policy starts: it keeps its own end block and
+        /// waits for its IME result (<see cref="FindRunForResult"/>), the exit-code fallback, or a later run's result.
+        /// </summary>
+        private void ParkPlatformRun(ScriptExecutionState run)
+        {
+            _pendingPlatformScripts.Remove(run.PolicyId);
+            _parkedPlatformScripts.Add(run);
+            _stateDirty = true;
+            if (_parkedPlatformScripts.Count > MaxParkedPlatformScripts)
+            {
+                var oldest = _parkedPlatformScripts.OrderBy(StartOf).First();
+                _logger.Warning($"ImeLogTracker: more than {MaxParkedPlatformScripts} platform runs wait for their IME result — resolving the oldest ({oldest.PolicyId}, started {oldest.StartedAtUtc:o}) now");
+                ResolveParkedRun(oldest, "too many runs waiting for their IME result");
+            }
+            _logger.Debug($"ImeLogTracker: platform script {run.PolicyId}: the next executor run started before IME's result of run {run.RunId} was read — that run keeps its end block and waits for its result");
+        }
+
+        /// <summary>
+        /// Results arrive in run order: a parked run of the same IME user that started before the run a result belongs to
+        /// gets none any more (its result line was lost) — it goes out now, ahead of the later run.
+        /// </summary>
+        private void ResolveParkedRunsBefore(ScriptExecutionState owner)
+        {
+            if (_parkedPlatformScripts.Count == 0 || !owner.StartedAtUtc.HasValue) return;
+            var earlier = _parkedPlatformScripts
+                .Where(r => !ReferenceEquals(r, owner)
+                    && string.Equals(r.PolicyId, owner.PolicyId, StringComparison.OrdinalIgnoreCase)
+                    && SameUserOrUnknown(r.UserId, owner.UserId)
+                    && r.StartedAtUtc.HasValue && r.StartedAtUtc.Value < owner.StartedAtUtc.Value)
+                .OrderBy(StartOf)
+                .ToList();
+            foreach (var run in earlier) ResolveParkedRun(run, "a later run of this policy got its IME result first");
+        }
+
+        /// <summary>A parked run that will not get its IME result: out with what it has, or dropped when it has nothing.</summary>
+        private void ResolveParkedRun(ScriptExecutionState run, string why)
+        {
+            if (run.Result != null)
+            {
+                EmitPlatformScriptResult(run, why);
+            }
+            else if (run.ExitCode.HasValue)
+            {
+                EmitFromExecutorEndBlock(run, why);
+            }
+            else
+            {
+                _parkedPlatformScripts.Remove(run);
+                _stateDirty = true;
+                _logger.Debug($"ImeLogTracker: platform script {run.PolicyId} run {run.RunId} has neither IME result nor executor end block — dropped ({why})");
+            }
+        }
+
+        /// <summary>
+        /// IME's own verdict from a run's end block: Success exactly when the error file was empty
+        /// (<c>IsNullOrEmpty(errorFile.Trim())</c> in IME), whatever the exit code — PowerShell returns 0 after a
+        /// non-terminating error and any code a script exits with. Only when the stderr line was never read does the
+        /// exit code stand in.
+        /// </summary>
+        internal static string ImeResultFromEndBlock(ScriptExecutionState script)
+        {
+            if (script.Stderr != null) return string.IsNullOrWhiteSpace(script.Stderr) ? "Success" : "Failed";
+            return script.ExitCode == 0 ? "Success" : "Failed";
+        }
+
+        private void EmitFromExecutorEndBlock(ScriptExecutionState script, string why)
+        {
+            script.Result = ImeResultFromEndBlock(script);
+            script.ResultSource = "agentexecutor_fallback";
+            var basis = script.Stderr == null ? $"exit code {script.ExitCode}, stderr not read" : script.Stderr.Trim().Length == 0 ? "empty stderr" : "stderr present";
+            EmitPlatformScriptResult(script, $"{why} — {script.Result} from the executor end block ({basis}) (fallback)");
+        }
+
        /// <summary>
        /// Grace period after a platform script's AgentExecutor exit code is observed before
        /// <see cref="FlushPendingPlatformScriptResults"/> emits a completion from that exit code.
@@ -641,29 +855,48 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// out once its executor end block has been read — the block arrives within one pass, so
        /// stdout/stderr are in by now — or after <see cref="PlatformScriptEndBlockGrace"/>.</item>
        /// <item>A script with a known AgentExecutor exit code but no IME <c>PS-SCRIPT-RESULT</c>
-        /// line within <see cref="PlatformScriptResultGrace"/> is emitted from the exit code
-        /// (0 → Success, else Failed), tagged <c>resultSource=agentexecutor_fallback</c> so the
-        /// data is honest about its provenance. Without this, scripts that completed shortly
-        /// before the agent terminates were silently dropped.</item>
+        /// line within <see cref="PlatformScriptResultGrace"/> is emitted from its end block by
+        /// IME's own rule (<see cref="ImeResultFromEndBlock"/>), tagged
+        /// <c>resultSource=agentexecutor_fallback</c> so the data is honest about its provenance.
+        /// Without this, scripts that completed shortly before the agent terminates were silently
+        /// dropped.</item>
        /// </list>
+        /// Parked runs go first, oldest first, so a policy's runs leave in run order; one without
+        /// result and end block keeps waiting — across a shutdown too — until a later run's result
+        /// resolves it or it is a day old.
        /// Runs on the single-threaded polling loop (no locking needed, same as the handlers).
        /// <paramref name="force"/> bypasses both grace checks for the final pass on shutdown.
        /// </summary>
        internal void FlushPendingPlatformScriptResults(DateTime nowUtc, bool force = false)
        {
-            if (_pendingPlatformScripts.Count == 0) return;
+            if (_pendingPlatformScripts.Count == 0 && _parkedPlatformScripts.Count == 0) return;

            var fallbackEmitted = false;
-            foreach (var script in _pendingPlatformScripts.Values.ToList())
+            foreach (var run in _parkedPlatformScripts.OrderBy(StartOf).ToList())
            {
-                // Already emitted by the authoritative path — just drop the stale buffer entry.
-                if (_platformScriptResultEmitted.ContainsKey(script.PolicyId))
+                if (run.Result != null)
                {
-                    _pendingPlatformScripts.Remove(script.PolicyId);
-                    _stateDirty = true;
+                    if (run.ExitCode.HasValue || force || !run.ResultHeldSinceUtc.HasValue || nowUtc - run.ResultHeldSinceUtc.Value >= PlatformScriptEndBlockGrace)
+                        EmitPlatformScriptResult(run, run.ExitCode.HasValue ? "executor end block read after the result" : $"no executor end block within {PlatformScriptEndBlockGrace.TotalSeconds:F0}s");
                    continue;
                }
+                if (run.ExitCode.HasValue)
+                {
+                    if (!force && (!run.ExitObservedAtUtc.HasValue || nowUtc - run.ExitObservedAtUtc.Value < PlatformScriptResultGrace)) continue;
+                    EmitFromExecutorEndBlock(run, $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)}");
+                    fallbackEmitted = true;
+                    continue;
+                }
+                if (run.StartedAtUtc.HasValue && nowUtc - run.StartedAtUtc.Value > StalePlatformRunAge)
+                {
+                    _parkedPlatformScripts.Remove(run);
+                    _stateDirty = true;
+                    _logger.Debug($"ImeLogTracker: platform script {run.PolicyId} run {run.RunId} waited a day without IME result or executor end block — dropped");
+                }
+            }

+            foreach (var script in _pendingPlatformScripts.Values.ToList())
+            {
                if (script.Result != null)
                {
                    if (script.ExitCode.HasValue)
@@ -682,10 +915,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    if (nowUtc - script.ExitObservedAtUtc.Value < PlatformScriptResultGrace) continue;
                }

-                script.Result = script.ExitCode.Value == 0 ? "Success" : "Failed";
-                script.ResultSource = "agentexecutor_fallback";
-                EmitPlatformScriptResult(script,
-                    $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)} — emitted from AgentExecutor exit code {script.ExitCode.Value} (fallback)");
+                EmitFromExecutorEndBlock(script, $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)}");
                fallbackEmitted = true;
            }

@@ -697,7 +927,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// <summary>Test seam: inject a pending platform script as if AgentExecutor.log had reported
        /// its start + exit code, without an IME PS-SCRIPT-RESULT line.</summary>
        internal void SeedPendingPlatformScriptForTesting(string policyId, int? exitCode, DateTime? exitObservedAtUtc, string stdout = null, DateTime? startedAtUtc = null,
-            CmTraceLineProvenance startedAtProvenance = null, CmTraceLineProvenance exitProvenance = null)
+            CmTraceLineProvenance startedAtProvenance = null, CmTraceLineProvenance exitProvenance = null, string stderr = null)
        {
            // Mirrors a fresh execution start: a new run clears any prior emitted-marker (see
            // HandleScriptStarted) so re-runs of the same policy within one lifetime emit again.
@@ -706,9 +936,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            {
                PolicyId = policyId,
                ScriptType = "platform",
+                RunId = NewRunId(),
                ExitCode = exitCode,
                ExitObservedAtUtc = exitObservedAtUtc,
                Stdout = stdout,
+                Stderr = stderr,
                StartedAtUtc = startedAtUtc,
                StartedAtProvenance = startedAtProvenance,
                ExitProvenance = exitProvenance,
@@ -717,6 +949,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            RecordInvocationMarker(policyId, isClose: false);
        }

+        /// <summary>Test seam: earlier runs waiting for their IME result while a later run of their policy is in flight.</summary>
+        internal int ParkedPlatformScriptCountForTest => _parkedPlatformScripts.Count;
+
        /// <summary>Test seam: the authoritative IME PS-SCRIPT-RESULT path for a platform script
        /// (the production handler minus regex extraction). <paramref name="resultLineTimestampUtc"/>
        /// stands in for the CMTrace timestamp of the PS-SCRIPT-RESULT line (production reads it
@@ -1163,11 +1398,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        internal static readonly TimeSpan HeldScriptStartGrace = TimeSpan.FromMinutes(30);
        internal static readonly TimeSpan HeldScriptStartShutdownGrace = TimeSpan.FromMinutes(5);

-        private static string TruncateOutput(string output)
+        internal static string TruncateOutput(string output)
        {
            if (string.IsNullOrEmpty(output) || output.Length <= MaxScriptOutputLength)
                return output;
-            return output.Substring(0, MaxScriptOutputLength) + "...[truncated]";
+            return output.Substring(0, MaxScriptOutputLength) + OutputTruncationMarker;
        }

        // -----------------------------------------------------------------------
@@ -123,16 +123,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            var ledger = IsMultiWriterLogFile(fileName) ? GetLedger(fileName) : null;

            // Set by a rewind: entries that still read unchanged behind the old bookmark are
-            // skipped, and nothing below the old bookmark is fresh or a calibration anchor.
-            HashSet<LedgerEntry> rewoundEntries = null;
+            // skipped (their invocation markers are given back); a changed entry below the old
+            // bookmark is fresh only when the bytes it replaced were seen moments ago, and never a
+            // calibration anchor.
+            RewindState rewind = null;
            long oldBookmark = -1;
+            var writerBoundaries = IsWriterBoundaryLogFile(fileName);

            if (ledger != null)
            {
                var rewindTo = await PrepareLedgerAsync(filePath, fileName, ledger, startPos, passNowUtc, token);
                if (rewindTo >= 0)
                {
-                    rewoundEntries = ApplyRewind(filePath, fileName, ledger, rewindTo, startPos);
+                    rewind = ApplyRewind(filePath, fileName, ledger, rewindTo, startPos);
                    oldBookmark = startPos;
                    startPos = rewindTo;
                }
@@ -164,21 +167,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            {
                // Guard zone: the file grew and is open anyway — re-check the entries just behind
                // the bookmark, where a stale writer's block lands when it is short.
-                if (ledger != null && rewoundEntries == null && ledger.Entries.Count > 0)
+                if (ledger != null && rewind == null && ledger.Entries.Count > 0)
                {
                    var guardFrom = ledger.OffsetOfEntryAtOrAfter(startPos - OverwriteGuardBytes);
                    if (guardFrom >= 0 && guardFrom < startPos)
                    {
-                        var divergence = await FindOverwriteAsync(stream, ledger, guardFrom, startPos, token);
+                        var divergence = await FindOverwriteAsync(stream, ledger, guardFrom, startPos, passNowUtc, token);
                        _verifiedBytes += startPos - guardFrom;
                        if (divergence >= 0)
                        {
                            // The guard saw only the tail of the ledger; the block may start earlier.
-                            var earliest = await FindOverwriteAsync(stream, ledger, ledger.StartOffset, startPos, token);
+                            var earliest = await FindOverwriteAsync(stream, ledger, ledger.StartOffset, startPos, passNowUtc, token);
                            _verifiedBytes += startPos - ledger.StartOffset;
                            _verifyPasses++;
                            if (earliest >= 0) divergence = earliest;
-                            rewoundEntries = ApplyRewind(filePath, fileName, ledger, divergence, startPos);
+                            rewind = ApplyRewind(filePath, fileName, ledger, divergence, startPos);
                            oldBookmark = startPos;
                            startPos = divergence;
                        }
@@ -259,7 +262,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                        // A fragment right at the bookmark of a multi-writer file (the previous
                        // entry ended exactly here, this one does not open an entry) is the tail of
                        // a block a stale writer laid over already-read bytes: verify before reading on.
-                        if (ledger != null && rewoundEntries == null && entry.Offset == ledger.EndOffset
+                        if (ledger != null && rewind == null && entry.Offset == ledger.EndOffset
                            && ledger.LastFragmentOffset != entry.Offset && !entry.Text.StartsWith("<![LOG["))
                        {
                            ledger.VerifyRequested = true;
@@ -269,11 +272,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                        }
                    }

-                    if (ledger != null) ledger.Record(entry);
-                    if (rewoundEntries != null && rewoundEntries.Contains(new LedgerEntry { Offset = entry.Offset, Hash = entry.Hash }))
-                        continue; // unchanged behind the old bookmark — processed before the rewind
+                    if (ledger != null) ledger.Record(entry, passNowUtc);
+                    var unchanged = rewind != null && rewind.IsUnchanged(entry);
+                    if (unchanged) RestoreInvocationMarkers(rewind, entry.Offset);

-                    _currentPassLinesAreFresh = passLinesAreFresh && entry.Offset >= oldBookmark;
+                    // Writer boundary (see ImeLogTracker.Overwrite.cs): an AgentExecutor.log entry that is
+                    // not exactly one CMTrace record ends the bytes of the executor in front of it. Never
+                    // matched — its text is the cut of two writers. Evaluated for unchanged entries too:
+                    // what owns the position in front of them may have changed with the rewind.
+                    if (writerBoundaries && !IsSingleCmTraceRecord(entry.Text))
+                    {
+                        CloseAtWriterBoundary(fileName, entry.Offset, entry.Text);
+                        continue;
+                    }
+
+                    if (unchanged) continue; // unchanged behind the old bookmark — processed before the rewind
+
+                    // Behind the old bookmark only changed entries arrive here: fresh when the bytes they replaced
+                    // were seen moments ago (RewoundEntryIsFresh), never a calibration anchor.
+                    _currentPassLinesAreFresh = entry.Offset >= oldBookmark
+                        ? passLinesAreFresh
+                        : rewind != null && RewoundEntryIsFresh(passLinesAreFresh, rewind.EntryAtRewindPointReplaced, rewind.OldestReplacedSeenUtc, passNowUtc);

                    // --- Normal processing (single-line or completed multiline) ---
                    CmTraceLogEntry parsed;
@@ -62,6 +62,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            public long Offset;
            public int Length;
            public ulong Hash;
+            /// <summary>
+            /// When these bytes were last seen as they are (read, seeded or verified unchanged): bytes found different
+            /// at this position later were written after it. Not part of the identity.
+            /// </summary>
+            public DateTime SeenUtc;

            // Identity is (offset, hash): a tail first read unterminated and later completed
            // keeps its hash but grows by its terminator.
@@ -100,11 +105,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                return idx < Entries.Count ? Entries[idx].Offset : -1;
            }

-            public void Record(AssembledEntry e)
+            public void Record(AssembledEntry e, DateTime seenUtc)
            {
                var idx = IndexOfFirstAtOrAfter(e.Offset);
                if (idx < Entries.Count) Entries.RemoveRange(idx, Entries.Count - idx);
-                Entries.Add(new LedgerEntry { Offset = e.Offset, Length = e.Length, Hash = e.Hash });
+                Entries.Add(new LedgerEntry { Offset = e.Offset, Length = e.Length, Hash = e.Hash, SeenUtc = seenUtc });
            }

            /// <summary>Drops everything from <paramref name="offset"/> on and returns it — the entries a rewind must not process twice.</summary>
@@ -197,7 +202,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            {
                ledger.Seeded = true;
                if (ledger.Entries.Count == 0 && bookmark > 0)
-                    await SeedLedgerAsync(filePath, ledger, bookmark, token).ConfigureAwait(false);
+                    await SeedLedgerAsync(filePath, ledger, bookmark, nowUtc, token).ConfigureAwait(false);
            }

            var due = ledger.VerifyRequested || (InContention(nowUtc) && nowUtc >= ledger.NextCadenceVerifyUtc);
@@ -213,7 +218,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime

            long divergence;
            using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
-                divergence = await FindOverwriteAsync(stream, ledger, from, bookmark, token).ConfigureAwait(false);
+                divergence = await FindOverwriteAsync(stream, ledger, from, bookmark, nowUtc, token).ConfigureAwait(false);
            if (token.IsCancellationRequested) return -1;

            ledger.VerifyRequested = false;
@@ -228,8 +233,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// Re-reads [fromOffset, toOffset) with the read loop's assembler and compares against the
        /// ledger. Returns the offset of the first entry whose bytes changed — a ledger entry not
        /// reproduced, or an entry the ledger never had — or -1 when everything reads as before.
+        /// Every entry found unchanged is stamped seen at <paramref name="nowUtc"/>.
        /// </summary>
-        private async Task<long> FindOverwriteAsync(FileStream stream, FileLedger ledger, long fromOffset, long toOffset, CancellationToken token)
+        private async Task<long> FindOverwriteAsync(FileStream stream, FileLedger ledger, long fromOffset, long toOffset, DateTime nowUtc, CancellationToken token)
        {
            var entries = ledger.Entries;
            var idx = ledger.IndexOfFirstAtOrAfter(fromOffset);
@@ -255,6 +261,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                if (idx < entries.Count && entries[idx].Offset == e.Offset)
                {
                    if (entries[idx].Hash != e.Hash) return e.Offset;
+                    var confirmed = entries[idx];
+                    confirmed.SeenUtc = nowUtc;
+                    entries[idx] = confirmed;
                    idx++;
                    continue;
                }
@@ -265,7 +274,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        }

        /// <summary>After a restart the ledger is empty: fingerprint the entries just behind the persisted bookmark without processing them.</summary>
-        private async Task SeedLedgerAsync(string filePath, FileLedger ledger, long bookmark, CancellationToken token)
+        private async Task SeedLedgerAsync(string filePath, FileLedger ledger, long bookmark, DateTime nowUtc, CancellationToken token)
        {
            var from = Math.Max(0, bookmark - RestartSeedBytes);
            using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
@@ -288,18 +297,69 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    if (assembler.Feed(line, reader.LastLineStart, reader.Position, reader.LastLineTruncated, reader.LastLineHash, out e)
                            == CmTraceEntryAssembler.Outcome.Entry
                        && e.Offset + e.Length <= bookmark)
-                        ledger.Record(e);
+                        ledger.Record(e, nowUtc);
                }
            }
        }

-        /// <summary>Moves the bookmark back to the first changed entry; returns the entries to skip if they still read unchanged behind it.</summary>
-        private HashSet<LedgerEntry> ApplyRewind(string filePath, string fileName, FileLedger ledger, long rewindTo, long bookmark)
+        /// <summary>
+        /// What one rewind pass carries: the entries to skip if they still read unchanged behind the rewind point, and
+        /// the invocation markers set aside there until their entries prove unchanged. Pass-local by design — whatever
+        /// is not given back dies with the pass on every exit path.
+        /// </summary>
+        private sealed class RewindState
+        {
+            public RewindState(string fileName, HashSet<LedgerEntry> unchanged, List<InvocationMarker> markers, InvocationMarker lastPlatformMarker, long rewindTo)
+            {
+                FileName = fileName;
+                Unchanged = unchanged;
+                Markers = markers;
+                LastPlatformMarker = lastPlatformMarker;
+                foreach (var replaced in unchanged)
+                {
+                    if (replaced.Offset == rewindTo) EntryAtRewindPointReplaced = true;
+                    if (!OldestReplacedSeenUtc.HasValue || replaced.SeenUtc < OldestReplacedSeenUtc.Value) OldestReplacedSeenUtc = replaced.SeenUtc;
+                }
+            }
+
+            public string FileName { get; }
+            public HashSet<LedgerEntry> Unchanged { get; }
+            /// <summary>Set aside at the rewind, ascending by offset.</summary>
+            public List<InvocationMarker> Markers { get; }
+            /// <summary>The tracker-wide last platform marker, when it was among the set-aside ones.</summary>
+            public InvocationMarker LastPlatformMarker { get; }
+            public int Next { get; set; }
+            /// <summary>The ledger held the entry at the rewind point: the changed bytes lie where something was seen before.</summary>
+            public bool EntryAtRewindPointReplaced { get; }
+            /// <summary>The earliest time any of the replaced bytes was last seen as it was: every changed byte was written after it.</summary>
+            public DateTime? OldestReplacedSeenUtc { get; }
+
+            public bool IsUnchanged(AssembledEntry entry) => Unchanged.Contains(new LedgerEntry { Offset = entry.Offset, Hash = entry.Hash });
+        }
+
+        /// <summary>
+        /// Whether an entry a rewind re-processes (it reads differently than before) is fresh. Its bytes were written after
+        /// the bytes it replaced were last seen as they were — IME stamps a line when it writes it — so when that was at
+        /// most <see cref="FreshLineMaxAge"/> ago the entry's age is bounded like an appended line's and it may anchor
+        /// itself (session d29e27e3: recovered result lines fell back to the agent's stale zone and lost their duration).
+        /// Not fresh when the pass is not (the first pass after a restart never anchors), when the divergence lies in bytes
+        /// the ledger never held (nothing dates them), or when the clock stepped back since.
+        /// </summary>
+        internal static bool RewoundEntryIsFresh(bool passLinesAreFresh, bool entryAtRewindPointReplaced, DateTime? oldestReplacedSeenUtc, DateTime passNowUtc)
+        {
+            if (!passLinesAreFresh || !entryAtRewindPointReplaced || !oldestReplacedSeenUtc.HasValue) return false;
+            var sinceSeen = passNowUtc - oldestReplacedSeenUtc.Value;
+            return sinceSeen >= TimeSpan.Zero && sinceSeen <= FreshLineMaxAge;
+        }
+
+        /// <summary>Moves the bookmark back to the first changed entry; returns what the re-read needs to skip and to give back.</summary>
+        private RewindState ApplyRewind(string filePath, string fileName, FileLedger ledger, long rewindTo, long bookmark)
        {
            var removed = ledger.TruncateFrom(rewindTo);
            _positionTracker.SetPosition(filePath, rewindTo);
            _heldTails.Remove(filePath);
-            InvalidateInvocationMarkersFrom(fileName, rewindTo);
+            var lastPlatformMarker = _lastPlatformMarker;
+            var markers = TakeInvocationMarkersFrom(fileName, rewindTo, out var tookLastPlatformMarker);
            _overwriteRewinds++;
            _overwriteBytesReprocessed += bookmark - rewindTo;

@@ -314,7 +374,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            {
                _logger.Debug(message);
            }
-            return removed;
+            return new RewindState(fileName, removed, markers, tookLastPlatformMarker ? lastPlatformMarker : null, rewindTo);
        }

        private long RetentionFloor(string fileName, long bookmark)
@@ -331,20 +391,44 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        // -----------------------------------------------------------------------
        //
        // AgentExecutor.log carries "Powershell exit code is N" / "write output done" without a
-        // policy id. Their owner is decided by FILE POSITION, not by the order lines were read:
-        // an executor writes its end block at its own stream position, i.e. directly after its
-        // own start block in the final bytes, so the nearest preceding invocation marker names
-        // it — and stays right after a rewind re-reads that region. A marker is a platform start
-        // (policy id), some other invocation (detection, remediation, requirement: null) or a
-        // close ("gets invoked" banner, "Agent executor completed").
+        // policy id. Their owner is decided by FILE POSITION: the nearest preceding marker — a
+        // platform start (policy id), some other invocation (detection, remediation, requirement:
+        // null), a close ("gets invoked" banner, "Agent executor completed") or a writer boundary.
+        //
+        // Every executor writes its lines contiguously from its own stream position, so its end
+        // block follows its own start block — but that start block may be gone. Two executors that
+        // open the file at the same end write their start blocks over each other, and the end block
+        // of the one that lost then sits behind the OTHER executor's start block (session 756970cf:
+        // a detection script's exit code and output on a platform script). Where one writer's bytes
+        // meet another's, the cut leaves an entry that is not exactly one CMTrace record — a
+        // fragment, a merged line or an empty line — unless the line boundaries of both writers
+        // coincide byte-exactly. That writer boundary closes the platform invocation in front of it.
+        // AgentExecutor.log only: in the IME log the service writes the markers and the lines they
+        // own itself, and its fragments are executor telemetry lines.
+        //
+        // A marker lives exactly as long as the bytes of its entry: a rewind sets the markers from
+        // the rewind point on aside, and an entry that reads unchanged gets its markers back.

        private sealed class InvocationMarker
        {
            public long Offset;
            public string PolicyId;
+            /// <summary>
+            /// The platform run the start line belongs to: the lines behind it go to that run while it is pending or
+            /// waits for its IME result, and nowhere once it was emitted — never to a later run of the same policy.
+            /// Null only on seeded test markers, which resolve by policy.
+            /// </summary>
+            public string RunId;
            public bool IsClose;
+            /// <summary>Set on a writer boundary: the platform invocation it closed.</summary>
+            public string ClosedPolicyId;
        }

+        /// <summary>Run id of a start line whose run was emitted already (a late line): owns its lines, matches no live run.</summary>
+        private const string EmittedRunId = "emitted";
+
+        private const string ExecutorLogFileName = "AgentExecutor.log";
+
        private readonly Dictionary<string, List<InvocationMarker>> _invocationMarkers =
            new Dictionary<string, List<InvocationMarker>>(StringComparer.OrdinalIgnoreCase);
        private InvocationMarker _lastPlatformMarker;
@@ -354,24 +438,62 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        private readonly HashSet<string> _platformMarkerFiles = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
        private long _testEntryOrdinal;

-        private void RecordInvocationMarker(string policyId, bool isClose)
+        /// <summary>
+        /// The executor log, live or rotated (<c>AgentExecutor-yyyyMMdd-HHmmss.log</c>): its invocations are one process
+        /// each, so a writer boundary ends an invocation — in the final bytes of a rotation as much as in the live file.
+        /// </summary>
+        internal static bool IsWriterBoundaryLogFile(string fileName)
+            => string.Equals(fileName, ExecutorLogFileName, StringComparison.OrdinalIgnoreCase)
+            || (fileName != null
+                && fileName.StartsWith("AgentExecutor-", StringComparison.OrdinalIgnoreCase)
+                && fileName.EndsWith(".log", StringComparison.OrdinalIgnoreCase));
+
+        /// <summary>
+        /// True when the entry is exactly one CMTrace record: it opens with <c>&lt;![LOG[</c> (culture-sensitive like
+        /// <c>CmTraceLogParser.TryParseLine</c>, so a BOM is ignorable) and holds no second one — the parser takes the
+        /// message up to the LAST trailer, so a line cut anywhere, its trailer included, would swallow the record
+        /// written over it. An empty entry is the terminator of a cut line. A script whose own output contains the
+        /// open tag loses that output line: the bytes cannot tell it from a merged line.
+        /// </summary>
+        internal static bool IsSingleCmTraceRecord(string text)
+        {
+            if (string.IsNullOrEmpty(text) || !text.StartsWith(LogOpenTag)) return false;
+            var first = text.IndexOf(LogOpenTag, StringComparison.Ordinal);
+            return first >= 0 && text.IndexOf(LogOpenTag, first + LogOpenTag.Length, StringComparison.Ordinal) < 0;
+        }
+
+        private List<InvocationMarker> GetOrCreateMarkerList(string file)
        {
-            if (_currentEntryOffset < 0) return;
-            var file = _currentSourceFileName ?? TestSourceFileName;
            List<InvocationMarker> list;
            if (!_invocationMarkers.TryGetValue(file, out list))
            {
                list = new List<InvocationMarker>();
                _invocationMarkers[file] = list;
            }
+            return list;
+        }
+
+        private static void AppendInvocationMarker(List<InvocationMarker> list, InvocationMarker marker)
+        {
+            if (list.Count >= MaxInvocationMarkersPerFile) list.RemoveAt(0);
+            list.Add(marker);
+        }
+
+        private void RecordInvocationMarker(string policyId, bool isClose, string runId = null)
+        {
+            if (_currentEntryOffset < 0) return;
+            var file = _currentSourceFileName ?? TestSourceFileName;
+            var list = GetOrCreateMarkerList(file);

            if (list.Count > 0 && list[list.Count - 1].Offset == _currentEntryOffset)
            {
                // Two patterns on one line: the platform start outranks the generic argument line.
+                // A writer boundary is never upgraded.
                var last = list[list.Count - 1];
-                if (!isClose && policyId != null)
+                if (!isClose && policyId != null && last.ClosedPolicyId == null)
                {
                    last.PolicyId = policyId;
+                    last.RunId = runId;
                    last.IsClose = false;
                    _lastPlatformMarker = last;
                    _platformMarkerFiles.Add(file);
@@ -379,9 +501,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                return;
            }

-            if (list.Count >= MaxInvocationMarkersPerFile) list.RemoveAt(0);
-            var marker = new InvocationMarker { Offset = _currentEntryOffset, PolicyId = policyId, IsClose = isClose };
-            list.Add(marker);
+            var marker = new InvocationMarker { Offset = _currentEntryOffset, PolicyId = policyId, RunId = runId, IsClose = isClose };
+            AppendInvocationMarker(list, marker);
            if (!isClose && policyId != null)
            {
                _lastPlatformMarker = marker;
@@ -390,21 +511,34 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        }

        /// <summary>
-        /// The pending platform script that owns the entry being processed, or null.
-        /// <paramref name="ownerPolicyId"/> names the owning platform script even when its slot is
-        /// gone (completion already emitted); null when no platform invocation owns the entry.
+        /// An entry of <paramref name="fileName"/> at <paramref name="offset"/> that is not exactly one CMTrace record:
+        /// the bytes behind it were written by another process than the bytes in front of it. Closes the platform
+        /// invocation that owns the position; records nothing when none is open there (a cut multi-line output yields
+        /// one fragment per line). Idempotent at the same offset.
        /// </summary>
-        private ScriptExecutionState ResolvePlatformScriptForCurrentEntry(out string ownerPolicyId)
+        private void CloseAtWriterBoundary(string fileName, long offset, string text)
+        {
+            var owner = FindOwningMarker(fileName, offset);
+            if (owner == null || owner.IsClose || owner.PolicyId == null) return;
+
+            var list = GetOrCreateMarkerList(fileName);
+            if (list.Count > 0 && list[list.Count - 1].Offset >= offset) return;
+            AppendInvocationMarker(list, new InvocationMarker { Offset = offset, IsClose = true, ClosedPolicyId = owner.PolicyId });
+
+            var kind = string.IsNullOrEmpty(text) ? "empty line" : text.StartsWith(LogOpenTag) ? "merged line" : "fragment";
+            _logger.Debug($"ImeLogTracker: writer boundary in {fileName} at offset {offset} ({kind}, {text?.Length ?? 0} chars) closes platform script {owner.PolicyId} (opened at {owner.Offset}) — the bytes behind it belong to another executor");
+        }
+
+        /// <summary>The marker that owns <paramref name="offset"/> in <paramref name="file"/>, or null.</summary>
+        private InvocationMarker FindOwningMarker(string file, long offset)
        {
-            ownerPolicyId = null;
-            var file = _currentSourceFileName ?? TestSourceFileName;
            InvocationMarker marker = null;
            List<InvocationMarker> list = null;
-            if (_currentEntryOffset >= 0 && _invocationMarkers.TryGetValue(file, out list))
+            if (offset >= 0 && _invocationMarkers.TryGetValue(file, out list))
            {
                for (var i = list.Count - 1; i >= 0; i--)
                {
-                    if (list[i].Offset <= _currentEntryOffset)
+                    if (list[i].Offset <= offset)
                    {
                        marker = list[i];
                        break;
@@ -420,24 +554,52 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            // (session 24dc69d1: the health-script worker's exit line pre-filled a platform slot's
            // exit code, its launch line the slot's context).
            if (marker == null && (list == null || list.Count == 0) && _platformMarkerFiles.Contains(file)) marker = _lastPlatformMarker;
+            return marker;
+        }
+
+        /// <summary>
+        /// The pending platform script that owns the entry being processed, or null.
+        /// <paramref name="ownerPolicyId"/> names the owning platform script even when its slot is
+        /// gone (completion already emitted); null when no platform invocation owns the entry.
+        /// </summary>
+        private ScriptExecutionState ResolvePlatformScriptForCurrentEntry(out string ownerPolicyId)
+        {
+            ownerPolicyId = null;
+            var marker = FindOwningMarker(_currentSourceFileName ?? TestSourceFileName, _currentEntryOffset);
            if (marker == null || marker.IsClose || marker.PolicyId == null) return null;

            ownerPolicyId = marker.PolicyId;
+            if (marker.RunId != null) return FindLivePlatformRun(marker.PolicyId, marker.RunId);
            ScriptExecutionState state;
            return _pendingPlatformScripts.TryGetValue(marker.PolicyId, out state) ? state : null;
        }

-        private void InvalidateInvocationMarkersFrom(string fileName, long offset)
+        /// <summary>Debug trace for an executor line that a writer boundary kept away from a platform script.</summary>
+        private void LogLineBehindWriterBoundary(string what)
        {
+            var marker = FindOwningMarker(_currentSourceFileName ?? TestSourceFileName, _currentEntryOffset);
+            if (marker?.ClosedPolicyId == null) return;
+            _logger.Debug($"ImeLogTracker: {what} at offset {_currentEntryOffset} lies behind the writer boundary at {marker.Offset} that closed platform script {marker.ClosedPolicyId} — another executor's end block, not attributed");
+        }
+
+        /// <summary>Removes the markers from <paramref name="offset"/> on and returns them in offset order.</summary>
+        private List<InvocationMarker> TakeInvocationMarkersFrom(string fileName, long offset, out bool tookLastPlatformMarker)
+        {
+            tookLastPlatformMarker = false;
+            var taken = new List<InvocationMarker>();
            List<InvocationMarker> list;
-            if (!_invocationMarkers.TryGetValue(fileName, out list) || list.Count == 0) return;
-            var removedLast = false;
-            for (var i = list.Count - 1; i >= 0 && list[i].Offset >= offset; i--)
+            if (!_invocationMarkers.TryGetValue(fileName, out list) || list.Count == 0) return taken;
+
+            var from = list.Count;
+            while (from > 0 && list[from - 1].Offset >= offset) from--;
+            for (var i = from; i < list.Count; i++)
            {
-                if (ReferenceEquals(list[i], _lastPlatformMarker)) removedLast = true;
-                list.RemoveAt(i);
+                if (ReferenceEquals(list[i], _lastPlatformMarker)) tookLastPlatformMarker = true;
+                taken.Add(list[i]);
            }
-            if (removedLast)
+            list.RemoveRange(from, list.Count - from);
+
+            if (tookLastPlatformMarker)
            {
                _lastPlatformMarker = null;
                for (var i = list.Count - 1; i >= 0; i--)
@@ -449,6 +611,28 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    }
                }
            }
+            return taken;
+        }
+
+        private void InvalidateInvocationMarkersFrom(string fileName, long offset) => TakeInvocationMarkersFrom(fileName, offset, out _);
+
+        /// <summary>
+        /// An entry that reads unchanged after a rewind keeps its markers: gives back the set-aside markers at exactly
+        /// <paramref name="entryOffset"/>. Set-aside markers in front of it belonged to entries that changed and stay
+        /// gone with their bytes.
+        /// </summary>
+        private void RestoreInvocationMarkers(RewindState rewind, long entryOffset)
+        {
+            var markers = rewind.Markers;
+            while (rewind.Next < markers.Count && markers[rewind.Next].Offset < entryOffset) rewind.Next++;
+            while (rewind.Next < markers.Count && markers[rewind.Next].Offset == entryOffset)
+            {
+                var marker = markers[rewind.Next++];
+                var list = GetOrCreateMarkerList(rewind.FileName);
+                if (list.Count > 0 && list[list.Count - 1].Offset >= marker.Offset) continue;
+                AppendInvocationMarker(list, marker);
+                if (ReferenceEquals(marker, rewind.LastPlatformMarker)) _lastPlatformMarker = marker;
+            }
        }

        private long OldestPendingScriptMarkerOffset(string fileName)
@@ -474,6 +658,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// <summary>What a rollover of the file does to its invocation markers.</summary>
        internal void ClearInvocationMarkersForTest(string fileName) => InvalidateInvocationMarkersFrom(fileName, 0);

+        internal int InvocationMarkerCountForTest(string fileName)
+            => _invocationMarkers.TryGetValue(fileName, out var list) ? list.Count : 0;
+
        internal int LedgerEntryCountForTest(string fileName)
        {
            FileLedger ledger;
@@ -182,6 +182,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        private readonly Dictionary<string, ScriptExecutionState> _pendingPlatformScripts =
            new Dictionary<string, ScriptExecutionState>(StringComparer.OrdinalIgnoreCase);

+        // Earlier runs of a policy whose next executor run started before IME's result of them was
+        // read (IME re-runs a failed script on later check-ins; the first pass reads all of
+        // AgentExecutor.log before the IME log). Each keeps its own end block until its result
+        // arrives — session eff1b413 lost that and paired the first result with the last run's block.
+        private readonly List<ScriptExecutionState> _parkedPlatformScripts = new List<ScriptExecutionState>();
+        private const int MaxParkedPlatformScripts = 64;
+
+        /// <summary>
+        /// The platform runs this tracker started and emitted, for the registry reconciliation that
+        /// checks them against IME's saved results (D-316). Shared with the registry host's thread.
+        /// </summary>
+        internal PlatformScriptRunRegister ScriptRuns { get; } = new PlatformScriptRunRegister();
+
        // Health-script (remediation) line-by-line accumulator — single slot because IME
        // executes health scripts SEQUENTIALLY within a session (verified across multiple
        // diagnostic captures: ProcessScript → context → exit → stdout → stderr → compliance,
@@ -240,7 +253,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        // the 32K-char Table Storage property limit that bounds the event downstream. Growth
        // driver is the number of log lines the bootstrap chain writes, so re-measure before
        // adding a chatty step rather than raising this again.
-        private const int MaxScriptOutputLength = 8192;
+        internal const int MaxScriptOutputLength = 8192;
+        internal const string OutputTruncationMarker = "...[truncated]";
        private const int MaxMultiLineBufferLines = 100;
        // Size cap for ONE entry — a single physical line (enforced by BoundedLineReader before
        // the line is materialized) and an assembled multiline entry alike. Any process able to
@@ -389,6 +403,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    VerifiedBytes = _verifiedBytes,
                    PassMaxMs = _passMaxMs,
                    PassGapMaxMs = _passGapMaxMs,
+                    PlatformOutputVerified = ScriptRuns.Verified,
+                    PlatformOutputCorrected = ScriptRuns.Corrected,
                    PatternHits = new Dictionary<string, int>(_patternHits, StringComparer.OrdinalIgnoreCase),
                };
            }
@@ -1034,6 +1050,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        internal async Task RunPollPassAsync(CancellationToken token)
        {
            var startMs = MonotonicMillisProvider();
+            var passStartedUtc = UtcNowProvider();
            if (_lastPassEndMs >= 0 && startMs - _lastPassEndMs > _passGapMaxMs)
            {
                _passGapMaxMs = startMs - _lastPassEndMs;
@@ -1045,6 +1062,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
            FlushRecurringScripts(UtcNowProvider(), shuttingDown: false);
            CheckPendingTokenFailure(UtcNowProvider());

+            // The lines written before this pass started are read now — a held tail or a fragment
+            // awaiting its check follows a pass or two later, which TrackerCatchUp covers. The
+            // registry reconciliation waits for such a pass before it pairs an IME save with a run.
+            if (!token.IsCancellationRequested) ScriptRuns.NotePassCompleted(passStartedUtc);
+            if (ScriptRuns.ConsumeCountersChanged()) _stateDirty = true;
+
            var endMs = MonotonicMillisProvider();
            if (endMs - startMs > _passMaxMs)
            {
@@ -1175,6 +1198,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                }
            }

+            _parkedPlatformScripts.Clear();
+            if (state.ParkedPlatformScripts != null)
+            {
+                foreach (var parked in state.ParkedPlatformScripts)
+                {
+                    if (!string.IsNullOrEmpty(parked?.PolicyId) && _parkedPlatformScripts.Count < MaxParkedPlatformScripts)
+                        _parkedPlatformScripts.Add(parked);
+                }
+            }
+
            _scriptTimeoutSuspectedPosted.Clear();
            if (state.ScriptTimeoutSuspectedPosted != null)
            {
@@ -1207,6 +1240,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    _verifiedBytes = state.Health.VerifiedBytes;
                    _passMaxMs = state.Health.PassMaxMs;
                    _passGapMaxMs = state.Health.PassGapMaxMs;
+                    ScriptRuns.RestoreCounters(state.Health.PlatformOutputVerified, state.Health.PlatformOutputCorrected);
                }
                if (state.PatternHits != null)
                {
@@ -1259,6 +1293,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                // must survive restarts — see the LoadState comment for the duplicate scenario.
                PlatformScriptResultEmittedAt = new Dictionary<string, DateTime>(_platformScriptResultEmitted, StringComparer.OrdinalIgnoreCase),
                PendingPlatformScripts = _pendingPlatformScripts.Values.ToList(),
+                ParkedPlatformScripts = _parkedPlatformScripts.ToList(),
                ScriptTimeoutSuspectedPosted = _scriptTimeoutSuspectedPosted.ToList(),
                RecurringScripts = _recurringScripts.ToPersisted(),
            };
@@ -1283,6 +1318,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                    VerifiedBytes = _verifiedBytes,
                    PassMaxMs = _passMaxMs,
                    PassGapMaxMs = _passGapMaxMs,
+                    PlatformOutputVerified = ScriptRuns.Verified,
+                    PlatformOutputCorrected = ScriptRuns.Corrected,
                };
                state.PatternHits = new Dictionary<string, int>(_patternHits, StringComparer.OrdinalIgnoreCase);
            }
@@ -81,6 +81,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        /// </summary>
        public long PassGapMaxMs { get; set; }

+        /// <summary>
+        /// Platform-script runs whose emitted output IME's saved result (registry, after the batch
+        /// report) confirmed — the exit code of the same end block with it. Together with
+        /// <see cref="PlatformOutputCorrected"/> the field measure of the registry reconciliation (D-316).
+        /// </summary>
+        public long PlatformOutputVerified { get; set; }
+
+        /// <summary>Platform-script runs whose emitted output IME's saved result corrected (script_output_reconciliation).</summary>
+        public long PlatformOutputCorrected { get; set; }
+
        /// <summary>Match count per enabled pattern ID — every enabled pattern is present, zeros included.</summary>
        public IReadOnlyDictionary<string, int> PatternHits { get; set; }

@@ -151,6 +151,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        // that run from the start of the next one.
        public Dictionary<string, DateTime> PlatformScriptResultEmittedAt { get; set; }
        public List<ScriptExecutionState> PendingPlatformScripts { get; set; }
+        // Earlier runs that wait for their IME result while a later run of the same policy is in
+        // flight; a restart between reading AgentExecutor.log and the IME log must keep them. Null on
+        // older state files → none.
+        public List<ScriptExecutionState> ParkedPlatformScripts { get; set; }
        public List<string> ScriptTimeoutSuspectedPosted { get; set; }

        // Recurring health-script runs collapsed per policy. Saved in the same write as
@@ -185,6 +189,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
        // Poll-loop timing maxima (null-defaulting on older state files).
        public long PassMaxMs { get; set; }
        public long PassGapMaxMs { get; set; }
+        // Registry reconciliation of platform-script output (null-defaulting on older state files).
+        public long PlatformOutputVerified { get; set; }
+        public long PlatformOutputCorrected { get; set; }
    }

    public class PackageStateData
@@ -0,0 +1,196 @@
+using System;
+using System.Collections.Generic;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>What the registry reconciliation may do with a saved IME result right now.</summary>
+    internal enum PlatformRunClaim
+    {
+        /// <summary>The run is handed out for reconciliation; it is never handed out again.</summary>
+        Claimed,
+        /// <summary>Not decidable yet: the tracker has not read past the save, or the run is not emitted yet.</summary>
+        Wait,
+        /// <summary>No run of this agent owns the save (none seen, or already reconciled).</summary>
+        None,
+    }
+
+    /// <summary>One platform-script run as the tracker emitted it; the register hands out copies.</summary>
+    internal sealed class PlatformScriptRun
+    {
+        public string PolicyId;
+        public string UserId;
+        public string RunId;
+        public DateTime StartSeenUtc;
+        public bool Emitted;
+        public bool Claimed;
+        public string Result;
+        public string ResultSource;
+        public int? ExitCode;
+        /// <summary>As emitted: null when no output line of the run was read, empty when it said so.</summary>
+        public string Stdout;
+        public string Stderr;
+
+        public PlatformScriptRun Clone() => (PlatformScriptRun)MemberwiseClone();
+    }
+
+    /// <summary>
+    /// The platform-script runs the tracker has seen, the latest per (IME user id, policy id), for the
+    /// registry reconciliation (D-316). IME saves a run's output under
+    /// <c>Policies\&lt;UserId&gt;\&lt;PolicyId&gt;</c> only after it reported the whole script batch, so the
+    /// observer reading it must know which run a changed key belongs to and what was emitted for it.
+    /// Written on the tracker's poll thread, claimed on the registry host's timer thread: every member
+    /// locks, and nothing calls out while holding the lock.
+    /// <para>
+    /// A save belongs to the latest run of its key: IME runs a policy at most once per check-in and
+    /// saves after reporting that check-in's batch, so the next run of the key comes with a later
+    /// check-in. (Overlapping check-ins can run a key twice at once; then IME itself shares the key's
+    /// result files and the judge's foreign verdict is the safety net.) A run that waited for its IME
+    /// result while a later run of its key already started is emitted without touching that later
+    /// run's entry. A save is paired only after the tracker completed a pass that started
+    /// <see cref="TrackerCatchUp"/> after the save was seen — every line written before the save, the
+    /// run's start among them, has been read by then, a stalled poll loop included.
+    /// </para>
+    /// </summary>
+    internal sealed class PlatformScriptRunRegister
+    {
+        /// <summary>
+        /// How far behind a seen save the tracker must have started a completed pass before the save
+        /// is paired; covers the ledger's verify cadence (1 s) for a start line hidden by an overwrite.
+        /// </summary>
+        internal static readonly TimeSpan TrackerCatchUp = TimeSpan.FromSeconds(2);
+
+        internal const int MaxRuns = 256;
+
+        private readonly object _sync = new object();
+        private readonly Dictionary<string, PlatformScriptRun> _latest =
+            new Dictionary<string, PlatformScriptRun>(StringComparer.OrdinalIgnoreCase);
+        private DateTime _lastCompletedPassStartUtc = DateTime.MinValue;
+        private long _verified;
+        private long _corrected;
+        private bool _countersChanged;
+
+        private static string KeyOf(string userId, string policyId) => (userId ?? string.Empty) + "|" + policyId;
+
+        /// <summary>A platform run began: its start line, or its result when no start line was seen.</summary>
+        public void NoteStarted(string userId, string policyId, DateTime seenUtc)
+        {
+            if (string.IsNullOrEmpty(policyId)) return;
+            lock (_sync)
+            {
+                _latest[KeyOf(userId, policyId)] = new PlatformScriptRun { PolicyId = policyId, UserId = userId, StartSeenUtc = seenUtc };
+                TrimLocked();
+            }
+        }
+
+        /// <summary>The tracker emitted the run with these end-block values.</summary>
+        public void NoteEmitted(ScriptExecutionState script, DateTime emittedUtc)
+        {
+            if (script == null || string.IsNullOrEmpty(script.PolicyId)) return;
+            lock (_sync)
+            {
+                var key = KeyOf(script.UserId, script.PolicyId);
+                if (!_latest.TryGetValue(key, out var run) || run.Emitted)
+                {
+                    run = new PlatformScriptRun { PolicyId = script.PolicyId, UserId = script.UserId, StartSeenUtc = emittedUtc };
+                    _latest[key] = run;
+                }
+                run.Emitted = true;
+                run.RunId = script.RunId;
+                run.Result = script.Result;
+                run.ResultSource = script.ResultSource;
+                run.ExitCode = script.ExitCode;
+                run.Stdout = script.Stdout;
+                run.Stderr = script.Stderr;
+                TrimLocked();
+            }
+        }
+
+        /// <summary>The tracker finished a poll pass that started at <paramref name="passStartedUtc"/>.</summary>
+        public void NotePassCompleted(DateTime passStartedUtc)
+        {
+            lock (_sync)
+            {
+                if (passStartedUtc > _lastCompletedPassStartUtc) _lastCompletedPassStartUtc = passStartedUtc;
+            }
+        }
+
+        /// <summary>
+        /// Hands out the run a save of (<paramref name="userId"/>, <paramref name="policyId"/>) seen at
+        /// <paramref name="savedSeenUtc"/> belongs to — once. A run whose user id the tracker could not
+        /// read is keyed without one.
+        /// </summary>
+        public PlatformRunClaim TryClaim(string userId, string policyId, DateTime savedSeenUtc, out PlatformScriptRun run)
+        {
+            run = null;
+            lock (_sync)
+            {
+                if (_lastCompletedPassStartUtc < savedSeenUtc + TrackerCatchUp) return PlatformRunClaim.Wait;
+
+                if (!_latest.TryGetValue(KeyOf(userId, policyId), out var latest)
+                    && !_latest.TryGetValue(KeyOf(null, policyId), out latest))
+                    return PlatformRunClaim.None;
+                if (latest.Claimed) return PlatformRunClaim.None;
+                if (!latest.Emitted) return PlatformRunClaim.Wait;
+
+                latest.Claimed = true;
+                run = latest.Clone();
+                return PlatformRunClaim.Claimed;
+            }
+        }
+
+        public void CountVerified()
+        {
+            lock (_sync) { _verified++; _countersChanged = true; }
+        }
+
+        public void CountCorrected()
+        {
+            lock (_sync) { _corrected++; _countersChanged = true; }
+        }
+
+        /// <summary>Runs whose emitted output IME's saved result confirmed (restart-safe, session-cumulative).</summary>
+        public long Verified { get { lock (_sync) return _verified; } }
+
+        /// <summary>Runs whose emitted output IME's saved result corrected (restart-safe, session-cumulative).</summary>
+        public long Corrected { get { lock (_sync) return _corrected; } }
+
+        public void RestoreCounters(long verified, long corrected)
+        {
+            lock (_sync)
+            {
+                _verified = verified;
+                _corrected = corrected;
+            }
+        }
+
+        /// <summary>True once after a counter moved — the tracker then persists its state.</summary>
+        public bool ConsumeCountersChanged()
+        {
+            lock (_sync)
+            {
+                var changed = _countersChanged;
+                _countersChanged = false;
+                return changed;
+            }
+        }
+
+        private void TrimLocked()
+        {
+            while (_latest.Count > MaxRuns)
+            {
+                string oldestKey = null;
+                var oldest = DateTime.MaxValue;
+                foreach (var kv in _latest)
+                {
+                    if (kv.Value.StartSeenUtc < oldest)
+                    {
+                        oldest = kv.Value.StartSeenUtc;
+                        oldestKey = kv.Key;
+                    }
+                }
+                if (oldestKey == null) return;
+                _latest.Remove(oldestKey);
+            }
+        }
+    }
+}
@@ -15,6 +15,28 @@ public class ScriptExecutionState
    /// <summary>"platform" or "remediation".</summary>
    public string ScriptType { get; set; }

+    /// <summary>
+    /// IME user id a platform script ran for (the all-zero GUID in device context), read from its
+    /// script path or its result line. Keys IME's saved result
+    /// (<c>Policies\&lt;UserId&gt;\&lt;PolicyId&gt;</c>) that the registry reconciliation compares against.
+    /// </summary>
+    public string UserId { get; set; }
+
+    /// <summary>
+    /// Identity of one platform-script run, given when its slot opens and surfaced as <c>runId</c> on
+    /// the event: the invocation markers bind the run's executor lines to it, and a later
+    /// <c>script_output_reconciliation</c> names it when it corrects that run.
+    /// </summary>
+    public string RunId { get; set; }
+
+    /// <summary>
+    /// Source timestamp of the run's AgentExecutor start line (<c>Adding argument powershell with
+    /// value …</c>). Every executor process writes that line once, so a later one for the same
+    /// policy starts the next run, never this one. Null until the line is read, and on state files
+    /// from before the field.
+    /// </summary>
+    public System.DateTime? ExecutorStartedAtUtc { get; set; }
+
    /// <summary>
    /// UTC timestamp of the script's first observed start line, taken from the source CMTrace log
    /// timestamp (so it dates correctly even when the agent replays historic IME log content that
@@ -50,12 +50,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals

        // Session caa6cf50 gate-starvation fix (2026-06-11) — fire-once guard for the
        // user-ESP-apps-settled AccountSetup synthesis (see MaybeSynthesizeAccountSetupComplete).
-        // Interlocked rather than a plain bool: since the sits-d Cloud-PC fix the synthesis is
+        // Interlocked rather than a plain bool: since the Cloud-PC fix the synthesis is
        // ALSO re-evaluated from the IME app-state-change thread, so two threads can reach the
        // guard concurrently (Shell-Core watcher thread + IME log thread).
        private int _userAppsSettledSynthesisFired;

-        // sits-d Cloud-PC fix (2026-08-19) — set once a CONFIRMED post-AccountSetup Shell-Core
+        // Cloud-PC fix (2026-08-19) — set once a CONFIRMED post-AccountSetup Shell-Core
        // exit has been observed (live OR backfill). The synthesis needs two facts: the ESP exit
        // is an EDGE that happens once, the settled user-ESP apps are a LEVEL that may only be
        // reached minutes later. Recording the edge lets ReevaluateUserAppsSettledSynthesis
@@ -367,7 +367,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            => _shellCoreTracker?.BackfillRecentHelloWizardStart(lookbackMinutes);

        /// <summary>
-        /// sits-d Cloud-PC fix (2026-08-19) — re-check the user-apps-settled AccountSetup
+        /// First run only: the update page's records from before the agent started, as telemetry
+        /// and nothing else — see <see cref="ShellCoreTracker.BackfillUpdatePageTelemetry"/>.
+        /// </summary>
+        public void BackfillUpdatePageTelemetry(int lookbackMinutes)
+            => _shellCoreTracker?.BackfillUpdatePageTelemetry(lookbackMinutes);
+
+        /// <summary>
+        /// Cloud-PC fix (2026-08-19) — re-check the user-apps-settled AccountSetup
        /// synthesis after the ESP exit has already been observed. Wired to the IME tracker's
        /// app-state-change callback in <c>DefaultComponentFactory</c>.
        /// <para>
@@ -0,0 +1,401 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.Json;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Win32;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
+{
+    /// <summary>
+    /// Registry second pillar for platform scripts (D-316). After IME reported a script batch to
+    /// Intune it saves every run of the batch under
+    /// <c>HKLM\SOFTWARE\Microsoft\IntuneManagementExtension\Policies\&lt;UserId&gt;\&lt;PolicyId&gt;</c>:
+    /// <c>Result</c>, <c>ErrorCode</c> and <c>ResultDetails</c>, whose <c>ExecutionMsg</c> is what IME read
+    /// from the result file of exactly that policy — the stdout when the run succeeded (IME's Success
+    /// means an empty stderr file, whatever the exit code), the stderr when it failed with ErrorCode 99.
+    /// The log tracker assigns a run's exit code and output by file position in AgentExecutor.log, where
+    /// no policy id anchors them; this observer checks what was emitted against the keyed value and
+    /// emits <c>script_output_reconciliation</c> when they disagree.
+    /// <para>
+    /// Snapshot-and-diff like <see cref="ImeRegistryAppStateObserver"/>, ticked by the same host: the
+    /// first tick is the silent baseline, a later save is paired with its run through
+    /// <see cref="PlatformScriptRunRegister"/>. No exit code lives in the registry: a run whose output
+    /// matches proves the exit code of the same end block; a contradicted run loses its exit code.
+    /// </para>
+    /// </summary>
+    internal sealed class ImeRegistryScriptResultObserver
+    {
+        public const string SourceLabel = "RegistryScriptResult";
+
+        internal const string PoliciesKeyPath = ImeRegistryAppStateObserver.ImeRootKeyPath + @"\Policies";
+
+        /// <summary>A save whose run never became claimable is dropped after this long (send failure of a later batch, agent restart).</summary>
+        internal static readonly TimeSpan PendingExpiry = TimeSpan.FromMinutes(10);
+
+        /// <summary>Safety cap on correction events per agent run; corrections beyond it are counted only.</summary>
+        internal const int MaxCorrectionsPerSession = 100;
+
+        private readonly PlatformScriptRunRegister _runs;
+        private readonly Func<IReadOnlyDictionary<string, SavedScriptResult>> _snapshotSource;
+        private readonly InformationalEventPost _post;
+        private readonly AgentLogger? _logger;
+        private readonly IClock _clock;
+        private readonly object _sync = new object();
+
+        private IReadOnlyDictionary<string, SavedScriptResult>? _last;
+        private readonly Dictionary<string, (SavedScriptResult Saved, DateTime SeenUtc)> _pending =
+            new Dictionary<string, (SavedScriptResult, DateTime)>(StringComparer.OrdinalIgnoreCase);
+        private int _correctionsEmitted;
+
+        /// <param name="snapshotSource">Replaces the live registry walk in tests; per instance, so parallel test classes never share it.</param>
+        public ImeRegistryScriptResultObserver(
+            PlatformScriptRunRegister runs,
+            InformationalEventPost post,
+            AgentLogger? logger,
+            IClock clock,
+            Func<IReadOnlyDictionary<string, SavedScriptResult>>? snapshotSource = null)
+        {
+            _runs = runs ?? throw new ArgumentNullException(nameof(runs));
+            _post = post ?? throw new ArgumentNullException(nameof(post));
+            _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+            _logger = logger;
+            _snapshotSource = snapshotSource ?? ReadSnapshot;
+        }
+
+        /// <summary>One observation pass: snapshot → new saves → pair → judge → correct. Fail-soft: never throws.</summary>
+        public void Tick(string reason)
+        {
+            try
+            {
+                lock (_sync)
+                {
+                    var snapshot = _snapshotSource();
+                    var nowUtc = _clock.UtcNow;
+
+                    if (_last == null)
+                    {
+                        // Saves that predate this agent run belong to runs it never emitted.
+                        _last = snapshot;
+                        _logger?.Info($"RegistryScriptResult: baseline captured ({snapshot.Count} saved platform-script results, trigger={reason})");
+                        return;
+                    }
+
+                    foreach (var kv in snapshot)
+                    {
+                        if (_last.TryGetValue(kv.Key, out var previous) && previous.SameSaveAs(kv.Value)) continue;
+                        _pending[kv.Key] = (kv.Value, nowUtc); // a newer save of the key replaces a waiting one
+                    }
+                    _last = snapshot;
+
+                    ProcessPending(nowUtc);
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger?.Debug($"RegistryScriptResult: tick failed (fail-soft): {ex.Message}");
+            }
+        }
+
+        private void ProcessPending(DateTime nowUtc)
+        {
+            foreach (var key in _pending.Keys.ToList())
+            {
+                var (saved, seenUtc) = _pending[key];
+                var claim = _runs.TryClaim(saved.UserId, saved.PolicyId, seenUtc, out var run);
+                if (claim == PlatformRunClaim.Wait)
+                {
+                    if (nowUtc - seenUtc >= PendingExpiry) _pending.Remove(key);
+                    continue;
+                }
+
+                _pending.Remove(key);
+                if (claim == PlatformRunClaim.Claimed && run != null) Reconcile(run, saved, nowUtc);
+            }
+        }
+
+        private void Reconcile(PlatformScriptRun run, SavedScriptResult saved, DateTime nowUtc)
+        {
+            var judgement = PlatformOutputJudge.Judge(run, saved);
+            switch (judgement.Verdict)
+            {
+                case PlatformOutputVerdict.Verified:
+                    _runs.CountVerified();
+                    _logger?.Debug($"RegistryScriptResult: platform script {run.PolicyId} output confirmed by IME's saved result");
+                    return;
+                case PlatformOutputVerdict.NotComparable:
+                    _logger?.Debug($"RegistryScriptResult: platform script {run.PolicyId} not comparable ({judgement.Reason})");
+                    return;
+            }
+
+            _runs.CountCorrected();
+            if (_correctionsEmitted >= MaxCorrectionsPerSession)
+            {
+                _logger?.Warning($"RegistryScriptResult: correction for {run.PolicyId} not emitted — cap of {MaxCorrectionsPerSession} per agent run reached");
+                return;
+            }
+            _correctionsEmitted++;
+
+            var foreign = judgement.Verdict == PlatformOutputVerdict.Foreign;
+            var culture = CultureInfo.InvariantCulture;
+            var data = new Dictionary<string, string>(StringComparer.Ordinal)
+            {
+                ["policyId"] = run.PolicyId,
+                ["scriptType"] = "platform",
+                ["outcome"] = foreign ? "foreign" : "repaired",
+                ["reason"] = judgement.Reason,
+            };
+            if (!string.IsNullOrEmpty(run.RunId)) data["runId"] = run.RunId!;
+            if (!string.IsNullOrEmpty(saved.Result)) data["result"] = saved.Result!;
+            if (saved.ErrorCode.HasValue) data["registryErrorCode"] = saved.ErrorCode.Value.ToString(culture);
+            // A present key replaces the emitted value, an empty one clears it; an absent key keeps it.
+            if (judgement.Stdout != null) data["stdout"] = judgement.Stdout;
+            if (judgement.Stderr != null) data["stderr"] = judgement.Stderr;
+            if (foreign && run.ExitCode.HasValue) data["previousExitCode"] = run.ExitCode.Value.ToString(culture);
+
+            var shortId = run.PolicyId.Length > 8 ? run.PolicyId.Substring(0, 8) : run.PolicyId;
+            var message = foreign
+                ? $"Platform script {shortId}: output corrected from IME's saved result; the log had attributed another script's output, exit code unverified"
+                : $"Platform script {shortId}: output completed from IME's saved result";
+
+            _post.Emit(
+                eventType: SharedEventTypes.ScriptOutputReconciliation,
+                source: SourceLabel,
+                message: message,
+                severity: foreign ? EventSeverity.Warning : EventSeverity.Info,
+                immediateUpload: foreign,
+                data: data,
+                occurredAtUtc: nowUtc);
+
+            if (foreign)
+                _logger?.Warning($"RegistryScriptResult: platform script {run.PolicyId} run {run.RunId} carried another script's end block ({judgement.Reason}) — corrected from IME's saved result");
+            else
+                _logger?.Info($"RegistryScriptResult: platform script {run.PolicyId} run {run.RunId} output completed from IME's saved result ({judgement.Reason})");
+        }
+
+        // ── snapshot ────────────────────────────────────────────────────────────
+
+        internal static string KeyOf(string userId, string policyId) => userId + "|" + policyId;
+
+        internal static IReadOnlyDictionary<string, SavedScriptResult> ReadSnapshot()
+        {
+            var snapshot = new Dictionary<string, SavedScriptResult>(StringComparer.OrdinalIgnoreCase);
+            using var baseKey = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64);
+            using var policies = baseKey.OpenSubKey(PoliciesKeyPath);
+            if (policies == null) return snapshot;
+
+            foreach (var userId in policies.GetSubKeyNames())
+            {
+                if (!Guid.TryParse(userId, out _)) continue;
+                using var userKey = policies.OpenSubKey(userId);
+                if (userKey == null) continue;
+
+                foreach (var policyId in userKey.GetSubKeyNames())
+                {
+                    if (!Guid.TryParse(policyId, out _)) continue;
+                    using var policyKey = userKey.OpenSubKey(policyId);
+                    if (policyKey == null) continue;
+
+                    snapshot[KeyOf(userId, policyId)] = new SavedScriptResult
+                    {
+                        UserId = userId,
+                        PolicyId = policyId,
+                        Result = policyKey.GetValue("Result") as string,
+                        ErrorCode = TryReadInt(policyKey.GetValue("ErrorCode")),
+                        ResultDetails = policyKey.GetValue("ResultDetails") as string,
+                        LastUpdatedTimeUtc = policyKey.GetValue("LastUpdatedTimeUtc") as string,
+                    };
+                }
+            }
+            return snapshot;
+        }
+
+        private static int? TryReadInt(object? value)
+        {
+            switch (value)
+            {
+                case int i: return i;
+                case long l when l >= int.MinValue && l <= int.MaxValue: return (int)l;
+                case string s when int.TryParse(s, NumberStyles.Integer, CultureInfo.InvariantCulture, out var parsed): return parsed;
+                default: return null;
+            }
+        }
+    }
+
+    /// <summary>One platform-script result as IME saved it under <c>Policies\&lt;UserId&gt;\&lt;PolicyId&gt;</c>.</summary>
+    internal sealed class SavedScriptResult
+    {
+        public string UserId { get; set; } = string.Empty;
+        public string PolicyId { get; set; } = string.Empty;
+        public string? Result { get; set; }
+        public int? ErrorCode { get; set; }
+        public string? ResultDetails { get; set; }
+        public string? LastUpdatedTimeUtc { get; set; }
+
+        /// <summary>The same save: IME stamps every save with a new <c>LastUpdatedTimeUtc</c>.</summary>
+        public bool SameSaveAs(SavedScriptResult other)
+            => string.Equals(LastUpdatedTimeUtc, other.LastUpdatedTimeUtc, StringComparison.Ordinal)
+            && string.Equals(Result, other.Result, StringComparison.Ordinal)
+            && ErrorCode == other.ErrorCode
+            && string.Equals(ResultDetails, other.ResultDetails, StringComparison.Ordinal);
+
+        /// <summary>
+        /// <c>ExecutionMsg</c> of the CryptoResult JSON in <c>ResultDetails</c> (IME 1.73 and later), or null
+        /// when the value is not that JSON ("Hash mismatch", a launch failure).
+        /// </summary>
+        public string? ExecutionMessage()
+        {
+            if (string.IsNullOrWhiteSpace(ResultDetails)) return null;
+            try
+            {
+                using var doc = JsonDocument.Parse(ResultDetails!);
+                if (doc.RootElement.ValueKind != JsonValueKind.Object) return null;
+                return doc.RootElement.TryGetProperty("ExecutionMsg", out var msg) && msg.ValueKind == JsonValueKind.String
+                    ? msg.GetString()
+                    : null;
+            }
+            catch (JsonException)
+            {
+                return null;
+            }
+        }
+    }
+
+    internal enum PlatformOutputVerdict
+    {
+        /// <summary>IME's saved result cannot confirm or contradict the run (no output saved, other failure kind).</summary>
+        NotComparable,
+        /// <summary>The emitted output is what IME saved: the end block, its exit code included, is the run's own.</summary>
+        Verified,
+        /// <summary>The log delivered the run's output incomplete; IME's saved text completes it, the exit code stands.</summary>
+        Repaired,
+        /// <summary>The emitted output contradicts IME's saved result: the end block was another executor's.</summary>
+        Foreign,
+    }
+
+    internal sealed class PlatformOutputJudgement
+    {
+        public PlatformOutputVerdict Verdict { get; set; }
+        public string Reason { get; set; } = string.Empty;
+        /// <summary>Value to publish (Repaired/Foreign): null keeps the emitted stdout, empty clears it.</summary>
+        public string? Stdout { get; set; }
+        /// <summary>Value to publish (Repaired/Foreign): null keeps the emitted stderr, empty clears it.</summary>
+        public string? Stderr { get; set; }
+    }
+
+    /// <summary>
+    /// Compares a platform-script run as the tracker emitted it with IME's saved result. Comparable are
+    /// a Success (ExecutionMsg = stdout; IME's Success means the stderr file was empty) and a Failed with
+    /// ErrorCode 99 (ExecutionMsg = stderr). Both texts are compared after CR/LF normalisation and Trim;
+    /// the tracker's own 8192-character cut is a prefix of the saved text.
+    /// </summary>
+    internal static class PlatformOutputJudge
+    {
+        internal const int ImeStderrErrorCode = 99;
+        private const string OutputErrorSeparator = ", error =";
+
+        public static PlatformOutputJudgement Judge(PlatformScriptRun run, SavedScriptResult saved)
+        {
+            var executionMessage = saved.ExecutionMessage();
+            if (executionMessage == null) return NotComparable("no_execution_message");
+
+            // The run's IME result line and the save come from the same IME run.
+            if (string.Equals(run.ResultSource, "ime_policy_result", StringComparison.Ordinal)
+                && !string.Equals(run.Result, saved.Result, StringComparison.OrdinalIgnoreCase))
+                return NotComparable("result_differs");
+
+            if (string.Equals(saved.Result, "Success", StringComparison.OrdinalIgnoreCase))
+                return JudgeSuccess(run, Normalize(executionMessage)!);
+            if (string.Equals(saved.Result, "Failed", StringComparison.OrdinalIgnoreCase) && saved.ErrorCode == ImeStderrErrorCode)
+                return JudgeStderrFailure(run, Normalize(executionMessage)!);
+            return NotComparable("no_saved_output");
+        }
+
+        private static PlatformOutputJudgement JudgeSuccess(PlatformScriptRun run, string savedStdout)
+        {
+            var stdout = NormalizeEmitted(run.Stdout, out var stdoutCut);
+            var stderr = Normalize(run.Stderr);
+            var stderrClean = string.IsNullOrEmpty(stderr);
+
+            if (!string.IsNullOrEmpty(stdout) && Agrees(stdout!, stdoutCut, savedStdout))
+                return stderrClean ? Verified() : Correct(PlatformOutputVerdict.Repaired, "stderr_cleared", savedStdout, string.Empty);
+
+            if (stdout != null && stdout.Length == 0 && savedStdout.Length == 0)
+                return stderrClean ? Verified() : Correct(PlatformOutputVerdict.Foreign, "stderr_on_success", string.Empty, string.Empty);
+
+            if (stdout == null)
+            {
+                if (!stderrClean) return Correct(PlatformOutputVerdict.Foreign, "stderr_on_success", savedStdout, string.Empty);
+                return savedStdout.Length > 0
+                    ? Correct(PlatformOutputVerdict.Repaired, "stdout_missing", savedStdout, string.Empty)
+                    : NotComparable("nothing_read");
+            }
+
+            // "write output done. output = X, error = Y" splits at the first ", error =" — a stdout that
+            // contains the separator ends up partly in stderr. The saved text shows the cut right there.
+            if (stdout.Length > 0 && !stdoutCut && !stderrClean
+                && savedStdout.StartsWith(stdout, StringComparison.Ordinal)
+                && savedStdout.Substring(stdout.Length).TrimStart().StartsWith(OutputErrorSeparator, StringComparison.Ordinal))
+                return Correct(PlatformOutputVerdict.Repaired, "stdout_split", savedStdout, string.Empty);
+
+            return Correct(PlatformOutputVerdict.Foreign, "stdout_differs", savedStdout, string.Empty);
+        }
+
+        private static PlatformOutputJudgement JudgeStderrFailure(PlatformScriptRun run, string savedStderr)
+        {
+            var stderr = NormalizeEmitted(run.Stderr, out var stderrCut);
+            if (!string.IsNullOrEmpty(stderr) && Agrees(stderr!, stderrCut, savedStderr)) return Verified();
+
+            // Nothing of the end block read: complete the stderr, the run's stdout stays as emitted.
+            if (run.Stderr == null && run.Stdout == null)
+                return Correct(PlatformOutputVerdict.Repaired, "stderr_missing", null, savedStderr);
+
+            // The end block read said something else — an empty stderr included: IME read stderr from this
+            // run's error file. The block's stdout is the other executor's as well.
+            return Correct(PlatformOutputVerdict.Foreign, "stderr_differs", string.Empty, savedStderr);
+        }
+
+        private static bool Agrees(string emitted, bool emittedCut, string saved)
+            => string.Equals(emitted, saved, StringComparison.Ordinal)
+            || (emittedCut && saved.StartsWith(emitted, StringComparison.Ordinal));
+
+        /// <summary>CR LF and lone CR to LF, then Trim — what the tracker's line reader and handlers make of a text.</summary>
+        internal static string? Normalize(string? text)
+            => text?.Replace("\r\n", "\n").Replace('\r', '\n').Trim();
+
+        private static string? NormalizeEmitted(string? text, out bool cut)
+        {
+            cut = false;
+            if (text == null) return null;
+            if (text.EndsWith(ImeLogTracker.OutputTruncationMarker, StringComparison.Ordinal))
+            {
+                cut = true;
+                text = text.Substring(0, text.Length - ImeLogTracker.OutputTruncationMarker.Length);
+            }
+            return Normalize(text);
+        }
+
+        private static PlatformOutputJudgement Verified()
+            => new PlatformOutputJudgement { Verdict = PlatformOutputVerdict.Verified, Reason = "match" };
+
+        private static PlatformOutputJudgement NotComparable(string reason)
+            => new PlatformOutputJudgement { Verdict = PlatformOutputVerdict.NotComparable, Reason = reason };
+
+        private static PlatformOutputJudgement Correct(PlatformOutputVerdict verdict, string reason, string? stdout, string? stderr)
+            => new PlatformOutputJudgement
+            {
+                Verdict = verdict,
+                Reason = reason,
+                // The tracker's own output cap: a corrected value is never longer than an emitted one.
+                Stdout = stdout == null ? null : ImeLogTracker.TruncateOutput(stdout),
+                Stderr = stderr == null ? null : ImeLogTracker.TruncateOutput(stderr),
+            };
+    }
+}
@@ -14,10 +14,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
    /// </summary>
    internal sealed class OobeUpdatePageRecord
    {
-        public const string PageStarted = "page_started";
-        public const string PageStopped = "page_stopped";
-        public const string EventName = "event_name";
-
        public OobeUpdatePageRecord(string cxhEvent, int windowsEventId, string page = null, string result = null, string name = null, string value = null)
        {
            CxhEvent = cxhEvent;
@@ -28,7 +24,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            Value = value;
        }

-        /// <summary><see cref="PageStarted"/>, <see cref="PageStopped"/> or <see cref="EventName"/>.</summary>
+        /// <summary>
+        /// <see cref="OobeUpdateVocabulary.PageStarted"/>, <see cref="OobeUpdateVocabulary.PageStopped"/> or
+        /// <see cref="OobeUpdateVocabulary.EventName"/> (the shared vocabulary the backend and the portal read).
+        /// </summary>
        public string CxhEvent { get; }
        public int WindowsEventId { get; }

@@ -54,6 +53,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
    internal sealed class OobeUpdateTelemetry
    {
        internal const int MaxPageEventsPerRun = 150;
+
+        /// <summary>
+        /// Event names the backfills (first run, restart) report per run — their own budget, so
+        /// the records from before the agent started cannot spend the live page's.
+        /// </summary>
+        internal const int MaxBackfillPageEventsPerRun = 150;
+
        internal const int MaxPageEventsPerKey = 3;
        internal const int MaxStateEventsPerRun = 6;
        internal const int MaxStateLineLength = 1000;
@@ -67,7 +73,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            public const string AgentStop = "agent_stop";
        }

-        private const string Source = "ShellCoreTracker";
+        private const string Source = Constants.EventSources.ShellCoreTracker;

        private readonly string _sessionId;
        private readonly string _tenantId;
@@ -77,8 +83,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals

        private readonly object _lock = new object();
        private readonly Dictionary<string, int> _pageEventsPerKey = new Dictionary<string, int>(StringComparer.Ordinal);
-        private int _pageEvents;
-        private bool _pageCapLogged;
+        private int _livePageEvents;
+        private int _backfillPageEvents;
+        private bool _liveCapReported;
+        private bool _backfillCapReported;
        private int _stateEvents;
        private string _lastStateContent;

@@ -99,33 +107,49 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        /// <summary>
        /// One <c>oobe_update_page</c> per update-page record, at most
        /// <see cref="MaxPageEventsPerKey"/> per page/name — a page that logs the same name in a
-        /// loop cannot flood the session. Event names also share <see cref="MaxPageEventsPerRun"/>
-        /// per run; a page start or stop is outside that budget, because the time attribution
-        /// reads the update's span from them. True when the record was reported.
+        /// loop cannot flood the session. Event names also share a budget per run: live ones
+        /// <see cref="MaxPageEventsPerRun"/>, backfilled ones <see cref="MaxBackfillPageEventsPerRun"/>;
+        /// the first name over a budget sends the <see cref="OobeUpdateVocabulary.NamesCapped"/>
+        /// marker. A page start or stop is outside the budgets, because the time attribution reads
+        /// the update's span from them. True when the record was reported.
        /// </summary>
        public bool ReportPage(OobeUpdatePageRecord record, DateTime occurredAtUtc, bool isBackfill)
        {
            if (record == null) return false;

-            var isEventName = record.CxhEvent == OobeUpdatePageRecord.EventName;
+            var isEventName = record.CxhEvent == OobeUpdateVocabulary.EventName;
            var key = $"{record.CxhEvent}:{record.Page ?? record.Name}";
-            int occurrence;
+            var budget = isBackfill ? MaxBackfillPageEventsPerRun : MaxPageEventsPerRun;
+            var occurrence = 0;
+            bool overBudget;
+            var firstOverBudget = false;
            lock (_lock)
            {
-                if (isEventName && _pageEvents >= MaxPageEventsPerRun)
+                overBudget = isEventName && (isBackfill ? _backfillPageEvents : _livePageEvents) >= budget;
+                if (overBudget)
                {
-                    if (!_pageCapLogged)
-                    {
-                        _pageCapLogged = true;
-                        _logger.Info($"OOBE update page telemetry: {MaxPageEventsPerRun} event names reached, the rest of this run stays in agent.log");
-                    }
-                    return false;
+                    firstOverBudget = isBackfill ? !_backfillCapReported : !_liveCapReported;
+                    if (isBackfill) _backfillCapReported = true;
+                    else _liveCapReported = true;
                }
-                _pageEventsPerKey.TryGetValue(key, out occurrence);
-                if (occurrence >= MaxPageEventsPerKey) return false;
-                occurrence++;
-                _pageEventsPerKey[key] = occurrence;
-                if (isEventName) _pageEvents++;
+                else
+                {
+                    _pageEventsPerKey.TryGetValue(key, out occurrence);
+                    if (occurrence >= MaxPageEventsPerKey) return false;
+                    occurrence++;
+                    _pageEventsPerKey[key] = occurrence;
+                    if (isEventName)
+                    {
+                        if (isBackfill) _backfillPageEvents++;
+                        else _livePageEvents++;
+                    }
+                }
+            }
+
+            if (overBudget)
+            {
+                if (firstOverBudget) ReportNamesCapped(budget, occurredAtUtc, isBackfill);
+                return false;
            }

            var data = new Dictionary<string, object>
@@ -141,6 +165,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            if (record.Name != null) data["name"] = record.Name;
            if (record.Value != null) data["value"] = record.Value;

+            return EmitPage(occurredAtUtc, DescribePage(record), data);
+        }
+
+        /// <summary>
+        /// The marker that a budget is spent: from here on this run's live or backfilled event
+        /// names stay in agent.log, so a name missing from the session proves nothing — the
+        /// analyze rules that read an absent name check for this marker first.
+        /// </summary>
+        private void ReportNamesCapped(int budget, DateTime occurredAtUtc, bool isBackfill)
+        {
+            var kind = isBackfill ? "backfilled " : string.Empty;
+            _logger.Info($"OOBE update page telemetry: {budget} {kind}event names reached, the rest of this run stays in agent.log");
+
+            EmitPage(occurredAtUtc,
+                $"OOBE update page: {budget} {kind}event names reached, later ones of this agent run are not sent",
+                new Dictionary<string, object>
+                {
+                    { "cxhEvent", OobeUpdateVocabulary.NamesCapped },
+                    { "eventTime", occurredAtUtc.ToString("o") },
+                    { "backfill", isBackfill },
+                    { "limit", budget },
+                });
+        }
+
+        private bool EmitPage(DateTime occurredAtUtc, string message, Dictionary<string, object> data)
+        {
            try
            {
                _post.Emit(new EnrollmentEvent
@@ -152,7 +202,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                    Severity = EventSeverity.Debug,
                    Source = Source,
                    Phase = EnrollmentPhase.Unknown,
-                    Message = DescribePage(record),
+                    Message = message,
                    Data = data,
                    ImmediateUpload = false,
                });
@@ -236,9 +286,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        {
            switch (record.CxhEvent)
            {
-                case OobeUpdatePageRecord.PageStarted:
+                case OobeUpdateVocabulary.PageStarted:
                    return $"OOBE update page started: {record.Page}";
-                case OobeUpdatePageRecord.PageStopped:
+                case OobeUpdateVocabulary.PageStopped:
                    return $"OOBE update page stopped: {record.Page} (result: {record.Result})";
                default:
                    return record.Value == null
@@ -224,27 +224,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            switch (eventId)
            {
                case EventId_InitiatingChanges:
-                    step = "initiating";
-                    osStep = IsState(targetState, "Installed") ? OsUpdateSteps.InstallStarted
+                    step = OobeUpdateVocabulary.StepInitiating;
+                    osStep = IsState(targetState, OobeUpdateVocabulary.InstalledState) ? OsUpdateSteps.InstallStarted
                        : IsState(targetState, "Staged") ? OsUpdateSteps.StagingStarted
                        : null;
                    message = $"Servicing started for {pkg}: {(string.IsNullOrEmpty(initialState) ? "?" : initialState)} → {target}";
                    break;
                case EventId_StateReached:
-                    step = "state_reached";
-                    osStep = IsState(targetState, "Installed") ? OsUpdateSteps.Installed
+                    step = OobeUpdateVocabulary.StepStateReached;
+                    osStep = IsState(targetState, OobeUpdateVocabulary.InstalledState) ? OsUpdateSteps.Installed
                        : IsState(targetState, "Staged") ? OsUpdateSteps.Staged
                        : null;
                    message = $"Servicing finished for {pkg}: now {target}";
                    break;
                case EventId_RebootRequired:
-                    step = "reboot_required";
+                    step = OobeUpdateVocabulary.StepRebootRequired;
                    osStep = OsUpdateSteps.RebootRequired;
                    message = $"Servicing needs a restart to finish {pkg} → {target}";
                    break;
                case EventId_ChangeFailed:
                case EventId_PartiallyInstalled:
-                    step = "failed";
+                    step = OobeUpdateVocabulary.StepFailed;
                    osStep = OsUpdateSteps.Failed;
                    severity = EventSeverity.Warning;
                    message = $"Servicing FAILED for {pkg} → {target}" +
@@ -280,7 +280,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                Timestamp = timeCreatedUtc ?? DateTime.UtcNow,
                EventType = Constants.EventTypes.WindowsUpdateServicing,
                Severity = severity,
-                Source = "ServicingWatcher",
+                Source = Constants.EventSources.ServicingWatcher,
                Phase = EnrollmentPhase.Unknown,
                Message = message,
                Data = data,
@@ -51,6 +51,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        /// </summary>
        internal const int BackfillLookbackMaxMinutes = 360;

+        /// <summary>
+        /// Lookback of the first run's update page backfill (<see cref="BackfillUpdatePageTelemetry"/>)
+        /// — the hour the servicing watcher reads back, so the page's records and the update's
+        /// servicing steps cover the same time.
+        /// </summary>
+        internal const int UpdatePageBackfillLookbackMinutes = 60;
+
        private static readonly HashSet<int> TrackedShellCoreEventIds = new HashSet<int>
        {
            EventId_ShellCore_WebAppStarted,
@@ -100,7 +107,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        private bool _espExitDetected;
        private bool _whiteGloveDetected;
        private bool _helloWizardStartDetected;
-        private string _lastCxhPage; // 62405 names no page, it ends the last one started
+        // 62405 names no page, it ends the last one started. The live watcher's page; a backfill
+        // moves it only with a newer record (see ObserveCxhRecord).
+        private string _lastCxhPage;
+        private long _lastCxhPageRecordId = -1;
        private readonly object _stateLock = new object();

        /// <summary>
@@ -194,7 +204,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                // WhiteGlove success — indistinguishable on the backend from a real no-signal
                // enrollment. Surface it as one-shot telemetry.
                CollectorDegradationReporter.Report(_post, _sessionId, _tenantId,
-                    collectorName: "ShellCoreTracker", reason: "watcher_arm_failed", ex: ex);
+                    collectorName: Constants.EventSources.ShellCoreTracker, reason: "watcher_arm_failed", ex: ex);
            }
        }

@@ -258,7 +268,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            IReadOnlyList<string> properties = null)
        {
            var fields = ReadCxhFields(eventId, description, properties);
-            ObserveCxhRecord(eventId, fields, timestamp, isBackfill, recordId);
+            ObserveCxhRecord(eventId, fields, timestamp, isBackfill, recordId, backfillPage: null);
            if (eventId == EventId_ShellCore_WebAppStopped || eventId == EventId_ShellCore_WebAppEventName) return;

            string eventType;
@@ -459,31 +469,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        {
            try
            {
-                var lookbackMs = ClampLookbackMinutes(lookbackMinutes) * 60 * 1000;
-                var query = new EventLogQuery(
-                    ShellCoreEventLogChannel,
-                    PathType.LogName,
-                    $"*[System[{WatchedEventIdsXPath} and TimeCreated[timediff(@SystemTime) <= {lookbackMs}]]]");
-
-                var records = new List<ShellCoreRecord>();
-                using (var reader = new EventLogReader(query))
-                {
-                    for (EventRecord record = reader.ReadEvent(); record != null; record = reader.ReadEvent())
-                    {
-                        using (record)
-                        {
-                            var description = record.FormatDescription() ?? "";
-                            // Preserve the historical event time across backfill so subscribers
-                            // (EspAndHelloTrackerAdapter) can stamp signals with the source time
-                            // rather than collapsing to wall-clock-now.
-                            var timestamp = (record.TimeCreated ?? DateTime.UtcNow).ToUniversalTime();
-                            records.Add(new ShellCoreRecord(record.Id, description, timestamp,
-                                record.RecordId ?? -1, ReadProperties(record)));
-                        }
-                    }
-                }
-
-                ReplayBackfillRecords(records);
+                ReplayBackfillRecords(ReadRecentRecords(lookbackMinutes));
            }
            catch (Exception ex)
            {
@@ -491,6 +477,76 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            }
        }

+        /// <summary>
+        /// The FIRST run's counterpart of the restart replay, for telemetry only: the update
+        /// page's records of the last <paramref name="lookbackMinutes"/> minutes (clamped like
+        /// the replay) become <c>oobe_update_page</c> rows. The agent is installed during the ESP
+        /// and can start after the update page began; without this its time attribution has no
+        /// page start to begin the update with (field: a first run 7 min after the update's
+        /// restart saw neither the page start nor the update's first half).
+        /// <para>
+        /// Nothing else is looked at: no Hello-wizard replay, no ESP exit or failure count, no
+        /// <c>agent_trace</c>. The first run keeps its decision behaviour exactly — see
+        /// <see cref="ReplayBackfillRecords"/> for why no replayed record may reach the engine and
+        /// <c>DefaultComponentFactory.ResolveEspExitBackfillLookbackMinutes</c> for why the first
+        /// run has no replay. No boot bound: an agent that first starts after the update's restart
+        /// is exactly the case to cover; the RecordId watermark keeps it from re-sending.
+        /// </para>
+        /// </summary>
+        public void BackfillUpdatePageTelemetry(int lookbackMinutes)
+        {
+            try
+            {
+                ReplayUpdatePageTelemetry(ReadRecentRecords(lookbackMinutes));
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"Shell-Core update page backfill failed: {ex.Message}");
+            }
+        }
+
+        /// <summary>The update page telemetry of a chronological batch of Shell-Core records — nothing else.</summary>
+        internal void ReplayUpdatePageTelemetry(IReadOnlyList<ShellCoreRecord> records)
+        {
+            if (records == null || records.Count == 0) return;
+
+            var page = new BackfillPageCursor();
+            foreach (var record in records)
+            {
+                var fields = ReadCxhFields(record.Id, record.Description ?? string.Empty, record.Properties);
+                ObserveCxhRecord(record.Id, fields, record.OccurredAtUtc, isBackfill: true, recordId: record.RecordId, backfillPage: page);
+            }
+        }
+
+        /// <summary>The watched Shell-Core records of the last minutes, oldest first, with their original event time.</summary>
+        private List<ShellCoreRecord> ReadRecentRecords(int lookbackMinutes)
+        {
+            var lookbackMs = ClampLookbackMinutes(lookbackMinutes) * 60 * 1000;
+            var query = new EventLogQuery(
+                ShellCoreEventLogChannel,
+                PathType.LogName,
+                $"*[System[{WatchedEventIdsXPath} and TimeCreated[timediff(@SystemTime) <= {lookbackMs}]]]");
+
+            var records = new List<ShellCoreRecord>();
+            using (var reader = new EventLogReader(query))
+            {
+                for (EventRecord record = reader.ReadEvent(); record != null; record = reader.ReadEvent())
+                {
+                    using (record)
+                    {
+                        var description = record.FormatDescription() ?? "";
+                        // Preserve the historical event time across backfill so subscribers
+                        // (EspAndHelloTrackerAdapter) can stamp signals with the source time
+                        // rather than collapsing to wall-clock-now.
+                        var timestamp = (record.TimeCreated ?? DateTime.UtcNow).ToUniversalTime();
+                        records.Add(new ShellCoreRecord(record.Id, description, timestamp,
+                            record.RecordId ?? -1, ReadProperties(record)));
+                    }
+                }
+            }
+            return records;
+        }
+
        /// <summary>
        /// Replays a chronological batch of Shell-Core records. <b>Only the Hello-wizard start
        /// (62404) is replayed.</b> ESP exits and ESP failures (62407) are counted and reported,
@@ -546,12 +602,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            var skippedFailures = 0;
            DateTime? oldestSkipped = null;
            DateTime? newestSkipped = null;
+            var page = new BackfillPageCursor();

            foreach (var record in records)
            {
                var description = record.Description ?? string.Empty;
                var fields = ReadCxhFields(record.Id, description, record.Properties);
-                ObserveCxhRecord(record.Id, fields, record.OccurredAtUtc, isBackfill: true, recordId: record.RecordId);
+                ObserveCxhRecord(record.Id, fields, record.OccurredAtUtc, isBackfill: true, recordId: record.RecordId, backfillPage: page);

                if (record.Id == EventId_ShellCore_WebAppStarted)
                {
@@ -594,7 +651,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                    TenantId = _tenantId,
                    EventType = Constants.EventTypes.AgentTrace,
                    Severity = EventSeverity.Info,
-                    Source = "ShellCoreTracker",
+                    Source = Constants.EventSources.ShellCoreTracker,
                    Phase = EnrollmentPhase.Unknown,
                    Message =
                        $"Shell-Core replay skipped {skippedExits} ESP exit(s) and {skippedFailures} ESP failure(s) " +
@@ -662,6 +719,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        // CloudExperienceHost navigation: breadcrumbs and OOBE update page telemetry (D-310)
        // =====================================================================

+        /// <summary>The last page started within one backfill batch.</summary>
+        private sealed class BackfillPageCursor
+        {
+            public string Page;
+        }
+
        /// <summary>
        /// Writes one agent.log line per CloudExperienceHost page start/stop and per update-page
        /// event name, so a diagnostics package shows the OOBE navigation. Records of the update
@@ -669,8 +732,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        /// are also reported as <c>oobe_update_page</c> — once across agent runs, by RecordId — and
        /// at the page's live start and stop the registry state behind it as
        /// <c>oobe_update_state</c>. No decision.
+        /// <para>
+        /// A stop (62405) belongs to the page started last. A backfill batch
+        /// (<paramref name="backfillPage"/>) reads records older than the live watcher's, which is
+        /// armed first, so it keeps its own last page; it moves the live watcher's only with a
+        /// record of a higher RecordId — a replayed older start must not take over the next live
+        /// stop, and a first run's live stop still finds the page that started before the agent.
+        /// </para>
        /// </summary>
-        private void ObserveCxhRecord(int eventId, CxhFields fields, DateTime occurredAtUtc, bool isBackfill, long recordId)
+        private void ObserveCxhRecord(int eventId, CxhFields fields, DateTime occurredAtUtc, bool isBackfill, long recordId,
+            BackfillPageCursor backfillPage)
        {
            try
            {
@@ -678,8 +749,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                lock (_stateLock)
                {
                    if (eventId == EventId_ShellCore_WebAppStarted && fields.Primary != null)
-                        _lastCxhPage = fields.Primary;
-                    page = _lastCxhPage;
+                    {
+                        if (backfillPage != null) backfillPage.Page = fields.Primary;
+                        if (backfillPage == null || (recordId >= 0 && recordId > _lastCxhPageRecordId))
+                        {
+                            _lastCxhPage = fields.Primary;
+                            if (recordId >= 0) _lastCxhPageRecordId = recordId;
+                        }
+                    }
+                    page = backfillPage != null ? backfillPage.Page : _lastCxhPage;
                }

                var crumb = FormatCxhBreadcrumb(eventId, fields, page);
@@ -698,10 +776,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                    _pageWatermark.MarkEmitted(recordId);

                // The registry is read now — only a live page boundary is the page's moment.
-                if (!isBackfill && record.CxhEvent != OobeUpdatePageRecord.EventName)
+                if (!isBackfill && record.CxhEvent != OobeUpdateVocabulary.EventName)
                {
                    _oobeUpdate.ReportState(
-                        record.CxhEvent == OobeUpdatePageRecord.PageStarted
+                        record.CxhEvent == OobeUpdateVocabulary.PageStarted
                            ? OobeUpdateTelemetry.Moments.UpdatePageStarted
                            : OobeUpdateTelemetry.Moments.UpdatePageStopped,
                        record.Page);
@@ -801,11 +879,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            {
                case EventId_ShellCore_WebAppStarted:
                    return IsUpdatePageToken(fields.Primary)
-                        ? new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, eventId, page: fields.Primary)
+                        ? new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStarted, eventId, page: fields.Primary)
                        : null;
                case EventId_ShellCore_WebAppStopped:
                    return IsUpdatePageToken(lastPage)
-                        ? new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, eventId,
+                        ? new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, eventId,
                            page: lastPage, result: fields.Primary ?? "?")
                        : null;
                case EventId_ShellCore_WebAppEventName:
@@ -813,7 +891,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                {
                    if (!IsUpdatePageToken(fields.Primary)) return null;
                    var value = eventId == EventId_ShellCore_WebAppEvent ? SafeValue(fields.Value) : null;
-                    return new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, eventId, name: fields.Primary, value: value);
+                    return new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, eventId, name: fields.Primary, value: value);
                }
                default:
                    return null;
@@ -138,7 +138,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        //   - Explicit "Required app failed" lines from the ESP required-app enforcer
        //
        // TODO(stall-probe-imelog-scan): Also scan IntuneManagementExtension.log (not just
-        // AppWorkload.log). Learning from the Oriflame session b4b5d37e-a993-453e-b16b-9b75098022e4
+        // AppWorkload.log). Learning from a field session
        // (MS Intune AAD token service outage 2026-04-08): the ESP blocker was
        //   "Failed to get AAD token. errorCode = 3399548929"  (= 0xCAA90001 AADSTS_SERVER_ERROR)
        // and this string lives in IntuneManagementExtension.log, NOT AppWorkload.log. Add a third
@@ -340,7 +340,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                Timestamp = timeCreatedUtc ?? DateTime.UtcNow,
                EventType = Constants.EventTypes.SystemClockChanged,
                Severity = isLargeStep ? EventSeverity.Warning : EventSeverity.Info,
-                Source = "SystemTimelineWatcher",
+                Source = Constants.EventSources.SystemTimelineWatcher,
                Phase = EnrollmentPhase.Unknown,
                Message = message,
                Data = data,
@@ -467,7 +467,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                Timestamp = timeCreatedUtc ?? DateTime.UtcNow,
                EventType = Constants.EventTypes.SystemSleepEpisode,
                Severity = EventSeverity.Info,
-                Source = "SystemTimelineWatcher",
+                Source = Constants.EventSources.SystemTimelineWatcher,
                Phase = EnrollmentPhase.Unknown,
                Message = message,
                Data = data,
@@ -405,7 +405,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                Timestamp = timeCreatedUtc ?? DateTime.UtcNow,
                EventType = shape.EventType,
                Severity = shape.Severity,
-                Source = "WindowsUpdateWatcher",
+                Source = Constants.EventSources.WindowsUpdateWatcher,
                Phase = EnrollmentPhase.Unknown,
                Message = BuildMessage(eventId, title, updateCount, data),
                Data = data,
@@ -707,7 +707,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                    TenantId = _tenantId,
                    EventType = Constants.EventTypes.WindowsUpdateChannelCensus,
                    Severity = EventSeverity.Debug,
-                    Source = "WindowsUpdateWatcher",
+                    Source = Constants.EventSources.WindowsUpdateWatcher,
                    Phase = EnrollmentPhase.Unknown,
                    Message = "Windows Update channel census: OS build changed across restart but no targeted WU events were captured — EventID histogram attached",
                    Data = data,
@@ -254,9 +254,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
                                if (subKey == null)
                                    continue;

-                                var displayName = subKey.GetValue("DisplayName")?.ToString();
+                                var displayName = ReadRegistryText(subKey, "DisplayName");
                                var systemComponent = subKey.GetValue("SystemComponent");
-                                var parentKeyName = subKey.GetValue("ParentKeyName")?.ToString();
+                                var parentKeyName = ReadRegistryText(subKey, "ParentKeyName");

                                if (ShouldExclude(displayName, systemComponent, parentKeyName))
                                    continue;
@@ -264,11 +264,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
                                results.Add(new SoftwareEntry
                                {
                                    DisplayName = displayName,
-                                    DisplayVersion = subKey.GetValue("DisplayVersion")?.ToString(),
-                                    Publisher = subKey.GetValue("Publisher")?.ToString(),
-                                    InstallDate = subKey.GetValue("InstallDate")?.ToString(),
-                                    InstallLocation = subKey.GetValue("InstallLocation")?.ToString(),
-                                    UninstallString = subKey.GetValue("UninstallString")?.ToString(),
+                                    DisplayVersion = ReadRegistryText(subKey, "DisplayVersion"),
+                                    Publisher = ReadRegistryText(subKey, "Publisher"),
+                                    InstallDate = ReadRegistryText(subKey, "InstallDate"),
+                                    InstallLocation = ReadRegistryText(subKey, "InstallLocation"),
+                                    UninstallString = ReadRegistryText(subKey, "UninstallString"),
                                    IsWindowsInstaller = Convert.ToInt32(subKey.GetValue("WindowsInstaller") ?? 0) == 1,
                                    RegistrySource = source
                                });
@@ -287,6 +287,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
            }
        }

+        private static string ReadRegistryText(RegistryKey key, string name)
+            => CutAtNul(key.GetValue(name)?.ToString());
+
+        /// <summary>
+        /// A registry string the way Windows shows it: up to the first NUL. Some installers write
+        /// REG_SZ data padded with NULs, and .NET Framework drops only one terminator — the rest
+        /// would ride into the normalized identity and, server-side, into a table key.
+        /// </summary>
+        internal static string CutAtNul(string value)
+        {
+            if (value == null)
+                return null;
+            var nul = value.IndexOf('\0');
+            return nul < 0 ? value : value.Substring(0, nul);
+        }
+
        // -----------------------------------------------------------------------
        // HKU per-user profile enumeration
        // -----------------------------------------------------------------------
@@ -215,6 +215,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
                        data["ime_verified_bytes"] = health.VerifiedBytes;
                        data["ime_pass_max_ms"] = health.PassMaxMs;
                        data["ime_pass_gap_max_ms"] = health.PassGapMaxMs;
+                        data["ime_platform_output_verified"] = health.PlatformOutputVerified;
+                        data["ime_platform_output_corrected"] = health.PlatformOutputCorrected;
                    }
                }
                catch (Exception ex)
@@ -284,7 +284,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
        /// Throws <see cref="BackendAuthException"/> for 401/403 responses so callers can
        /// distinguish authentication failures from transient server errors.
        /// <para>
-        /// Field case (sits-d.cloud, 2026-08-09): a pre-cutover agent build pointed at a
+        /// Field case (2026-08-09): a pre-cutover agent build pointed at a
        /// retired Function App; Azure answers for a stopped app with a platform-level 403
        /// carrying an HTML error page ("Web App - Unavailable"). Our backend never returns
        /// HTML on 401/403 — an HTML body therefore means the response did not come from the
@@ -11,7 +11,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
    /// signal once per second for at most <paramref name="maxWait"/>. It cannot prove backend
    /// reachability — the callers' retry loops handle that — it only keeps retry budgets from
    /// being burned into a link that is provably still down (BootTrigger relaunch after a
-    /// mid-enrollment reboot, Wi-Fi still associating; tenant aebdce78 audits 2026-08-23/24).
+    /// mid-enrollment reboot, Wi-Fi still associating; kiosk-tenant audits 2026-08-23/24).
    /// Free on the normal path — a live link returns immediately. Probe errors end the wait,
    /// never the caller's operation.
    /// </summary>
@@ -258,7 +258,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            // on esp_exiting events long after Start.
            ImeLogHost? imeLogHostRef = null;

-            // sits-d Cloud-PC fix (2026-08-19), narrowed after review: the Shell-Core ESP-exit
+            // Cloud-PC fix (2026-08-19), narrowed after review: the Shell-Core ESP-exit
            // replay is restart recovery, so it stays OFF on a first run and the happy path keeps
            // its pre-fix behaviour exactly. See ResolveEspExitBackfillLookbackMinutes.
            var espExitBackfillLookbackMinutes = ResolveEspExitBackfillLookbackMinutes(
@@ -453,7 +453,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            imeLogHost.Tracker.OnUserTokenAcquired = lineUtc => aadJoinHost.NotifyUserTokenAcquired(lineUtc);
            imeLogHost.Tracker.OnTokenFailureLine = (code, lineUtc) => aadJoinHost.NotifyTokenFailureLine(code, lineUtc);

-            // sits-d Cloud-PC fix (2026-08-19): the user-apps-settled AccountSetup synthesis used
+            // Cloud-PC fix (2026-08-19): the user-apps-settled AccountSetup synthesis used
            // to run ONLY on the EspExited edge. On a tenant with a large required-app set the ESP
            // page exits while apps are still in flight, the single attempt misses, and nothing
            // ever re-checks — sessions 8110e262 / a89aac2d reached 138/138 apps with 0 failed and
@@ -524,14 +524,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            // EspTrackingWin32Apps, StatusServiceReports) via snapshot-and-diff. Emits
            // registry_app_state on real changes and app_state_reconciliation when the
            // registry outcome diverges from the IME-log-derived state (= built-in pattern-drift
-            // alarm). Always-on observability host; the tracker probe is read-only.
+            // alarm). Always-on observability host; the tracker probe is read-only. Under the same
+            // root IME saves each platform script's result after reporting the batch: the script
+            // observer checks the tracker's emitted runs against it (script_output_reconciliation).
            hosts.Add(new ImeRegistryAppStateHost(
                sessionId: sessionId,
                tenantId: tenantId,
                logger: logger,
                ingress: ingress,
                clock: clock,
-                trackerStateProbe: () => imeLogHost.AllKnownPackageStates));
+                trackerStateProbe: () => imeLogHost.AllKnownPackageStates,
+                scriptRuns: imeLogHost.Tracker.ScriptRuns));

            // Deterministic update corroboration — compares the persisted OS build (CurrentBuild.UBR)
            // across agent restarts and emits os_build_changed when it differs (session 7443317c:
@@ -118,7 +118,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
        /// the Shell-Core watcher only ever saw events written AFTER <see cref="Start"/>. Any
        /// agent restart therefore lost an ESP exit (62407) or Hello-wizard start (62404) that
        /// happened while the agent was down — and after a mid-ESP reboot that is exactly the
-        /// window the completion signal lands in (sits-d Cloud PCs, 2026-08-19: five sessions
+        /// window the completion signal lands in (Cloud PCs, 2026-08-19: five sessions
        /// hung in AccountSetup until the server-side timeout while the devices were fine).
        /// </para>
        /// <para>
@@ -142,6 +142,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
        /// replayed 62407 cannot be placed in time; see
        /// <c>ShellCoreTracker.ReplayBackfillRecords</c>.
        /// </para>
+        /// <para>
+        /// The first run reads the last hour for the OOBE update page telemetry instead — no
+        /// replay, nothing that reaches the decision engine; see
+        /// <c>ShellCoreTracker.BackfillUpdatePageTelemetry</c>.
+        /// </para>
        /// </summary>
        public void Start()
        {
@@ -149,6 +154,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration

            if (_espExitBackfillLookbackMinutes > 0)
                _tracker.BackfillRecentHelloWizardStart(_espExitBackfillLookbackMinutes);
+            else
+                _tracker.BackfillUpdatePageTelemetry(ShellCoreTracker.UpdatePageBackfillLookbackMinutes);
        }

        public void Stop() => _tracker.Stop();
@@ -15,9 +15,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
 {
    /// <summary>
    /// Hosts the <see cref="ImeRegistryAppStateObserver"/> (registry second pillar, audit
-    /// 2026-08-17): one recursive <see cref="RegistryWatcher"/> on the IME root — all three
-    /// observed surfaces (Win32Apps, EspTrackingWin32Apps, SideCarPolicies\StatusServiceReports)
-    /// live under it — debounced into snapshot-and-diff ticks, plus a 60-s periodic fallback
+    /// 2026-08-17) and the <see cref="ImeRegistryScriptResultObserver"/> (D-316): one recursive
+    /// <see cref="RegistryWatcher"/> on the IME root — every observed surface (Win32Apps,
+    /// EspTrackingWin32Apps, SideCarPolicies\StatusServiceReports, Policies) lives under it —
+    /// debounced into snapshot-and-diff ticks, plus a 60-s periodic fallback
    /// tick. The fallback both evaluates the reconciliation settle-delay when the registry goes
    /// quiet AND keeps the pillar alive if the watcher fails to arm (poll-only degraded mode,
    /// announced once via <c>collector_degraded</c>). Always-on observability host, no config
@@ -31,6 +32,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
        private static readonly TimeSpan PeriodicInterval = TimeSpan.FromSeconds(60);

        private readonly ImeRegistryAppStateObserver _observer;
+        // Platform-script results under the same root (D-316); null when no run register was supplied.
+        private readonly ImeRegistryScriptResultObserver? _scriptObserver;
        private readonly InformationalEventPost _post;
        private readonly AgentLogger? _logger;
        private readonly string _sessionId;
@@ -47,7 +50,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            AgentLogger? logger,
            ISignalIngressSink ingress,
            IClock clock,
-            Func<IReadOnlyList<AppPackageState>>? trackerStateProbe)
+            Func<IReadOnlyList<AppPackageState>>? trackerStateProbe,
+            PlatformScriptRunRegister? scriptRuns = null)
        {
            if (ingress == null) throw new ArgumentNullException(nameof(ingress));
            if (clock == null) throw new ArgumentNullException(nameof(clock));
@@ -56,6 +60,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            _logger = logger;
            _post = new InformationalEventPost(ingress, clock);
            _observer = new ImeRegistryAppStateObserver(_post, logger, clock, trackerStateProbe);
+            if (scriptRuns != null) _scriptObserver = new ImeRegistryScriptResultObserver(scriptRuns, _post, logger, clock);
        }

        public void Start()
@@ -63,6 +68,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            // Baseline immediately: pre-existing registry state must be captured silently
            // BEFORE the first change edge, or stale entries would replay as fresh events.
            _observer.Tick("baseline");
+            _scriptObserver?.Tick("baseline");

            try
            {
@@ -120,6 +126,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            try
            {
                _observer.Tick(reason);
+                _scriptObserver?.Tick(reason);
            }
            catch (Exception ex)
            {
@@ -197,7 +197,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                    TenantId = _tenantId,
                    EventType = SharedConstants.EventTypes.WindowsUpdateActivitySummary,
                    Severity = EventSeverity.Debug,
-                    Source = "WindowsUpdateWatcher",
+                    Source = SharedConstants.EventSources.WindowsUpdateWatcher,
                    Phase = EnrollmentPhase.Unknown,
                    Message = $"Update activity counted instead of listed: {total} event(s) " +
                        "(Store, Defender and other non-OS updates, repeated scan results, servicing of non-OS packages)",
@@ -223,7 +223,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            _ingress.Post(
                kind: DecisionSignalKind.OsUpdateActivity,
                occurredAtUtc: DateTime.SpecifyKind(occurredAtUtc, DateTimeKind.Utc),
-                sourceOrigin: source == "servicing" ? "ServicingWatcher" : "WindowsUpdateWatcher",
+                sourceOrigin: source == "servicing" ? SharedConstants.EventSources.ServicingWatcher : SharedConstants.EventSources.WindowsUpdateWatcher,
                evidence: new Evidence(
                    kind: EvidenceKind.Raw,
                    identifier: $"os-update-activity:{source}",
@@ -92,6 +92,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
            SharedConstants.EventTypes.ImePatternHits,
            // Bookkeeping of runs that were deliberately not reported as activity.
            SharedConstants.EventTypes.ScriptRecurrenceSummary,
+            // A correction of an already reported script run from IME's saved result (D-316):
+            // registry observation after the fact, not progress.
+            SharedConstants.EventTypes.ScriptOutputReconciliation,
            // Same for the update watchers' tally of Store/Defender/other update events (D-310):
            // emitted on stop, never progress. Windows/.NET update steps stay activity.
            SharedConstants.EventTypes.WindowsUpdateActivitySummary,
@@ -27,7 +27,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
    ///   <item>6 attempts total; between attempts <c>2^attempt</c> seconds (2s, 4s, 8s, 16s, 32s —
    ///     ~62 s of backoff). The original V1 budget of 5 attempts / ~30 s was too short for the
    ///     reboot-relaunch on Wi-Fi kiosks: the relaunched agent gave up and exited 7 before
-    ///     the network came back, leaving the session silent forever (tenant aebdce78,
+    ///     the network came back, leaving the session silent forever (kiosk-tenant
    ///     2026-08-23 audit). A relaunch that misses here is lost — nothing retries later.</item>
    ///   <item>On <c>response.Success == true</c> → stop immediately.</item>
    ///   <item>On <see cref="BackendAuthException"/> (401/403) → report to the
@@ -1263,6 +1263,8 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
            // logged its result line before the deadline). Lets the UI/MCP flag fallback-grounded
            // platform-script completions. Platform scripts only — null for health scripts.
            if (!string.IsNullOrEmpty(script.ResultSource)) data["resultSource"] = script.ResultSource!;
+            // The run a later script_output_reconciliation corrects names it by this id (platform only).
+            if (!string.IsNullOrEmpty(script.RunId)) data["runId"] = script.RunId!;
            if (!string.IsNullOrEmpty(script.ComplianceResult)) data["complianceResult"] = script.ComplianceResult!;
            if (script.RemediationStatus.HasValue) data["remediationStatus"] = script.RemediationStatus.Value.ToString(culture);
            if (script.TargetType.HasValue) data["targetType"] = script.TargetType.Value.ToString(culture);
@@ -599,6 +599,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                    ["verifiedBytes"] = health.VerifiedBytes,
                    ["passMaxMs"] = health.PassMaxMs,
                    ["passGapMaxMs"] = health.PassGapMaxMs,
+                    ["platformOutputVerified"] = health.PlatformOutputVerified,
+                    ["platformOutputCorrected"] = health.PlatformOutputCorrected,
                    ["agentVersion"] = _agentVersion ?? string.Empty,
                };
                if (!string.IsNullOrEmpty(health.ImeAgentVersion))
@@ -822,7 +824,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
        /// IME-log event) but the agent actually observed only the end-state. Severity and phrasing
        /// are outcome-calibrated via <see cref="ObservationCoverage.DescribeLateStart"/>: a failure
        /// stays a Warning with the post-mortem/hung-script note, a success is an Info about
-        /// tail-only coverage (fleet 2026-07-28: tenant 659c3a90 collected 12 Warnings on healthy
+        /// tail-only coverage (fleet 2026-07-28: one tenant collected 12 Warnings on healthy
        /// enrollments whose bootstrap merely ran late). No state mutation.
        /// </summary>
        private void MaybeEmitAgentLateStart(EnrollmentTerminatedEventArgs args)
@@ -188,7 +188,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
        /// network yet — its failure says nothing about the latest version. The certificate is
        /// proof of connectivity, and this is the last chance to swap a stranded old build
        /// (stale baked-in ApiBaseUrl) for a current one BEFORE session registration hits a
-        /// retired endpoint (field case sits-d.cloud, 2026-08-09). Timeouts are relaxed vs. the
+        /// retired endpoint (field case 2026-08-09). Timeouts are relaxed vs. the
        /// boot-speed-tuned startup check; enrollment is already past OOBE's critical path here.
        /// On update success the process restarts and this method never returns; the
        /// await-enrollment config was already removed, so the new binary proceeds normally.
@@ -76,7 +76,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime

        /// <summary>
        /// Phase 6.5 — config self-heal. When the Phase 4 fetch ran before the network link was
-        /// up (agent relaunched at boot, Wi-Fi still associating — tenant aebdce78 audit 2026-08-24:
+        /// up (agent relaunched at boot, Wi-Fi still associating — kiosk-tenant audit 2026-08-24:
        /// ~50% of sessions ran on ConfigVersion=0 exactly this way), a successful session
        /// registration has just proven the backend reachable. Retry the fetch once and apply
        /// the live tenant config instead of stranding the whole session on cache/defaults.
@@ -79,7 +79,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
            // write to the same state file; per-enrollment lifecycle like the other state files.
            var startupEventGate = new AutopilotMonitor.Agent.V2.Core.Persistence.StartupEventGate(stateSubdir, logger);

-            // sits-d Cloud-PC fix (2026-08-19): a reboot_kill means the agent was down across the
+            // Cloud-PC fix (2026-08-19): a reboot_kill means the agent was down across the
            // forced mid-ESP restart. Hand the boot timestamp to the factory so the Shell-Core
            // ESP-exit backfill can reach back over the whole downtime instead of 5 minutes.
            var previousBootUtc =
@@ -65,7 +65,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
            bool helloPolicyEnabledRead = false,
            bool allowContinueAnyway = false)
        {
-            var state = DecisionState.CreateInitial("sess-2dac8298", "tenant-047b2e1f", T0);
+            var state = DecisionState.CreateInitial("sess-2dac8298", "tenant-a", T0);
            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
            state = engine.Reduce(state, MakeSignal(
                5, DecisionSignalKind.EspConfigDetected, T0.AddMinutes(1),
@@ -74,7 +74,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
        /// </summary>
        private static DecisionState SetupSession(DecisionEngine engine)
        {
-            var state = DecisionState.CreateInitial("sess-4910a5a5", "tenant-e46bc88e", T0);
+            var state = DecisionState.CreateInitial("sess-4910a5a5", "tenant-a", T0);
            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
            state = engine.Reduce(state, MakeSignal(
                5, DecisionSignalKind.EspConfigDetected, T0.AddMinutes(1),
@@ -105,7 +105,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
                    ["failureType"] = "Provisioning_DeviceSetup_Apps_Failed",
                    ["failedSubcategory"] = "Apps",
                    ["category"] = "DeviceSetup",
-                    ["likelyCulpritApps"] = "Oriflame Cosmectics - Teams Backgroundsv v2",
+                    ["likelyCulpritApps"] = "Contoso Branding - Teams Backgrounds v2",
                    ["likelyCulpritAppCount"] = "1",
                }));

@@ -129,7 +129,7 @@ namespace AutopilotMonitor.DecisionCore.Tests

            var advisory = FindTimelineEffect(step, "esp_failure_advisory");
            Assert.NotNull(advisory);
-            Assert.Equal("Oriflame Cosmectics - Teams Backgroundsv v2", advisory!.Parameters!["likelyCulpritApps"]);
+            Assert.Equal("Contoso Branding - Teams Backgrounds v2", advisory!.Parameters!["likelyCulpritApps"]);
        }

        // ===================================================== recovery hook ====
@@ -102,7 +102,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
            var builder = DecisionState.CreateInitial("s", "t", Fixed.AddDays(-1))
                .ToBuilder()
                .WithStage(SessionStage.EspAccountSetup)
-                .WithStepIndex(452)             // the restored StepIndex the sits-d sessions showed
+                .WithStepIndex(452)             // the restored StepIndex the field sessions showed
                .WithLastAppliedSignalOrdinal(9);

            if (accountSetupEntered)
@@ -194,7 +194,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
            bool helloEnabled = false,
            bool includeDesktop = true)
        {
-            var state = DecisionState.CreateInitial("sess-caa6cf50", "tenant-e46bc88e", T0);
+            var state = DecisionState.CreateInitial("sess-caa6cf50", "tenant-a", T0);
            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0, null)).NewState;
            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "DeviceSetup" })).NewState;
@@ -8,8 +8,7 @@ using Xunit;
 namespace AutopilotMonitor.DecisionCore.Tests
 {
    /// <summary>
-    /// sits-d Cloud-PC fix (2026-08-20, sessions 8110e262 / a89aac2d / e7ba63c9 / cb4a485a /
-    /// 3d6278fb). On a SkipUser=true flow Windows never renders the user ESP page: Shell-Core
+    /// Cloud-PC fix (2026-08-20, five field sessions). On a SkipUser=true flow Windows never renders the user ESP page: Shell-Core
    /// 62407 does not fire and the AccountSetup provisioning categories are never written —
    /// verified live (Shell-Core watcher armed across three agent runs, zero 62407 in six
    /// hours; SkipUserStatusPage read 10+ times across all runs, True every time). Arm B of
@@ -20,14 +19,14 @@ namespace AutopilotMonitor.DecisionCore.Tests
    /// <para>
    /// The fix lets the observed skip stand in for the final-exit evidence inside
    /// <c>HandleImeUserSessionCompletedV1</c>'s completion attempt. These tests replay the real
-    /// 8110e262 signal ordering end to end (including the Fix-10 AccountSetup bounce-back a
+    /// field session's signal ordering end to end (including the Fix-10 AccountSetup bounce-back a
    /// restart re-emission triggers) and pin the negative space: no skip observed, no desktop,
    /// ghost IME completion, and Device Preparation flows are all unchanged.
    /// </para>
    /// </summary>
    public sealed class ClassicSkipUserEspUserSessionCompletionTests
    {
-        // 8110e262 run 1: agent_started 08:30:08Z.
+        // Field session run 1: agent_started 08:30:08Z.
        private static readonly DateTime T0 = new DateTime(2026, 8, 19, 8, 30, 8, DateTimeKind.Utc);

        [Fact]
@@ -35,7 +34,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
        {
            var engine = new DecisionEngine();
            var state = DecisionState.CreateInitial(
-                "8110e262-da57-4282-9290-bb0c96d05614", "5ca2b350", T0);
+                "33333333-3333-3333-3333-333333333333", "tenant-a", T0);

            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0, null)).NewState;

@@ -94,7 +93,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
        [Fact]
        public void Fix10_bounceback_is_healed_by_the_ime_reemission()
        {
-            // Restart shape (8110e262 run 3): the promoted AwaitingHello gets bounced back by a
+            // Restart shape (field session run 3): the promoted AwaitingHello gets bounced back by a
            // re-emitted AccountSetup phase line (Fix 10 cancels HelloSafety, deliberately — it
            // guards the premature-promotion case). The IME phase line always precedes the
            // user-session-complete line in log order, so the re-emitted completion re-knocks.
@@ -116,7 +115,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
        [Theory]
        // No EspConfigDetected at all — SkipUserEsp unknown.
        [InlineData(null)]
-        // Explicit SkipUser=false (the two sits-d machines that succeeded had this shape and
+        // Explicit SkipUser=false (the two field machines that succeeded had this shape and
        // a REAL page: exit + registry evidence. Without the exit the gate must stay shut.)
        [InlineData("false")]
        public void No_promotion_without_an_observed_skip(string? skipUser)
@@ -9,7 +9,7 @@ using Xunit;
 namespace AutopilotMonitor.DecisionCore.Tests
 {
    /// <summary>
-    /// Continue-Anyway observation mode (tenant c9787ba2, session 53d1e9f6, 2026-08-08).
+    /// Continue-Anyway observation mode (field case 2026-08-08).
    /// A Device-phase ESP terminal failure (AccountSetup never entered) on a
    /// Continue-Anyway-enabled profile is a hard fail by default; with the tenant opt-in
    /// (<c>EspContinueAnywayObservationEnabled</c> observation) it is defanged into a 60-min
@@ -72,7 +72,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
            bool continueAnyway = true,
            bool helloPolicyDisabled = true)
        {
-            var state = DecisionState.CreateInitial("sess-53d1e9f6", "tenant-c9787ba2", T0);
+            var state = DecisionState.CreateInitial("sess-53d1e9f6", "tenant-a", T0);
            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
            var espConfig = new Dictionary<string, string>
            {
@@ -409,7 +409,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
        [Fact]
        public void Timeout_fire_with_recent_first_deployment_activity_extends_instead_of_timing_out()
        {
-            // Report 55e6afd61c9d (Douglas): timer armed at detection (phase 0, RJ agent MSI
+            // Field report: timer armed at detection (phase 0, RJ agent MSI
            // install during DeviceSetup), first deployment only started 16 min later, Office
            // completed 3 s before the deadline — the hard cut truncated an actively working
            // deployment. The fire must now re-arm to lastActivity + 60 min instead.
@@ -70,7 +70,7 @@ namespace AutopilotMonitor.DecisionCore.Tests.Scenarios
        {
            // PR1 (Session 4fa5a2d4, 2026-05-22) — ContinueAnyway-aware ESP terminal-failure
            // defang. The fixture replays the canonical race that produced 199/202 false
-            // positives in tenant c9787ba2: ContinueAnyway=true profile, AccountSetup entered,
+            // positives in one tenant: ContinueAnyway=true profile, AccountSetup entered,
            // then DeviceSetup/Certificates registry-write flips to failed. Without PR1 this
            // would land in Failed; PR1 records EspAdvisoryFailureRecordedUtc and keeps the
            // stage at EspAccountSetup so the agent stays in monitoring.
@@ -222,7 +222,7 @@ public class AppHomingServiceTests
    [Fact]
    public async Task Probe_reports_only_add_on_roles_when_manifest_and_add_on_roles_are_both_missing()
    {
-        // Live 2026-09-03 shape (thesrgroup, 1 s after consent): validation role still
+        // Live 2026-09-03 shape (1 s after consent): validation role still
        // propagating AND the add-on missing. The add-on decides (permanent); the propagating
        // manifest role is not the admin's problem and must not appear in the to-do list.
        SetupProbe(GraphTokenResult.Success(Jwt()));
@@ -118,7 +118,7 @@ public class AppsAnalyticsFailureRateTests
        Assert.False(app.TryGetProperty("trendDelta", out _));
    }

-    // ── /apps/{appName}/analytics ───────────────────────────────────────────
+    // ── /apps/analytics ─────────────────────────────────────────────────────

    private static async Task<JsonElement> BuildAnalyticsAsync(
        List<AppInstallSummary> summaries, ISessionRepository? sessionRepo = null)
@@ -32,6 +32,7 @@ public class AuthFunctionSideEffectTests
    private readonly Mock<TenantConfigurationService> _tenantConfigMock;
    private readonly Mock<TenantAdminsService> _tenantAdminsMock;
    private readonly Mock<TelegramNotificationService> _telegramMock;
+    private readonly Mock<OpsEventService> _opsEventsMock;
    private readonly Mock<GlobalNotificationService> _globalNotificationMock;
    private readonly Mock<IMetricsRepository> _metricsRepoMock;
    private readonly Mock<AutopilotMonitor.Functions.Services.Activation.ITenantAutoApproveEnqueuer> _autoApproveEnqueuerMock;
@@ -96,6 +97,9 @@ public class AuthFunctionSideEffectTests
        _autoApproveEnqueuerMock = new Mock<AutopilotMonitor.Functions.Services.Activation.ITenantAutoApproveEnqueuer>();

        _signalR = new FakeSignalRNotificationService();
+        _opsEventsMock = new Mock<OpsEventService>(null!, null!, null!) { CallBase = false };
+        _opsEventsMock.Setup(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>())).Returns(Task.CompletedTask);
+
        _sut = new AuthFunction(
            Mock.Of<ILogger<AuthFunction>>(),
            globalAdminMock.Object,
@@ -115,7 +119,8 @@ public class AuthFunctionSideEffectTests
                _metricsRepoMock.Object, _tenantConfigMock.Object, Mock.Of<ILogger<AdminIdentityResolver>>()) { CallBase = false }.Object,
            _signalR,
            adminConfigService.Object,
-            _offboardingRepo);
+            _offboardingRepo,
+            opsEvents: _opsEventsMock.Object);

        // Writes go through UpdateAsync / CreateOrUpdateAsync over one stored row (none by default:
        // a brand-new tenant). Default: all fire-and-forget calls succeed.
@@ -163,7 +168,7 @@ public class AuthFunctionSideEffectTests
        Assert.Empty(_signalR.DisconnectedUsers);
    }

-    private static (HttpRequestData Req, FunctionContext Ctx) BuildAuthenticatedRequest(string callerUpn)
+    private static (HttpRequestData Req, FunctionContext Ctx) BuildAuthenticatedRequest(string callerUpn, string? tenantId = null)
    {
        var services = new ServiceCollection();
        services.AddOptions();
@@ -172,8 +177,9 @@ public class AuthFunctionSideEffectTests
                new System.Text.Json.JsonSerializerOptions(System.Text.Json.JsonSerializerDefaults.Web)));
        var provider = services.BuildServiceProvider();

-        var principal = new ClaimsPrincipal(new ClaimsIdentity(
-            new[] { new Claim("preferred_username", callerUpn) }, "test"));
+        var claims = new List<Claim> { new("preferred_username", callerUpn) };
+        if (tenantId != null) claims.Add(new Claim("tid", tenantId));
+        var principal = new ClaimsPrincipal(new ClaimsIdentity(claims, "test"));

        var context = new Mock<FunctionContext>();
        context.SetupGet(c => c.Items).Returns(
@@ -226,14 +232,19 @@ public class AuthFunctionSideEffectTests
        // OnboardedBy is the immutable copy of the first-login UPN that auto-promote on
        // preview approval reads — UpdatedBy may later be clobbered by background syncs.
        Assert.Equal(Upn, config.OnboardedBy);
-        // The DPA version rides along in the same onboarding write (D-252).
-        Assert.Equal(CurrentDpa, config.DpaVersion);
+        // A first sign-in without the get-started tick leaves the Terms + DPA pending: the portal asks.
+        Assert.True(config.DpaAcceptancePending);
+        Assert.Null(config.DpaVersion);
        var (written, source, _) = Assert.Single(_store.Writes);
        Assert.Equal("contoso.com", written.DomainName);
        Assert.Equal(Upn, written.OnboardedBy);
-        Assert.Equal(CurrentDpa, written.DpaVersion);
+        Assert.True(written.DpaAcceptancePending);
+        Assert.Null(written.DpaVersion);
+        Assert.Null(written.DpaAcceptedBy);
+        Assert.Null(written.DpaAcceptedAt);
        Assert.Equal("auth", source);
        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(TenantId, Upn), Times.Once);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(TenantId, Upn), Times.Once);   // the routable record next to the ping
        _globalNotificationMock.Verify(x => x.CreateNotificationAsync(
            "preview_signup", "New Tenant Signup",
            It.Is<string>(m => m.Contains(TenantId) && m.Contains("contoso.com") && m.Contains(Upn)),
@@ -437,20 +448,139 @@ public class AuthFunctionSideEffectTests
    private const string CurrentDpa = AutopilotMonitor.Shared.Constants.CurrentDpaVersion;

    [Fact]
-    public async Task HandleNewTenantDomain_WhenDomainAlreadySet_NeverStampsDpaVersion()
+    public async Task HandleNewTenantDomain_ThroughTheGetStartedTick_AcceptsWithTheOnboarding()
    {
-        // The DPA version is written once, with the onboarding (D-252): an existing tenant's
-        // login writes nothing — no stamp, no save.
+        var config = DefaultConfig();
+        config.DomainName = null!;
+
+        var before = DateTime.UtcNow;
+        await _sut.HandleNewTenantDomainAsync(config, TenantId, Upn, signupConsent: true);
+
+        var written = Assert.Single(_store.Writes).Row;
+        Assert.False(written.DpaAcceptancePending);
+        Assert.Equal(CurrentDpa, written.DpaVersion);
+        Assert.Equal(Upn, written.DpaAcceptedBy);
+        Assert.NotNull(written.DpaAcceptedAt);
+        Assert.True(written.DpaAcceptedAt >= before);
+        // This login's view follows the stored row, so its auth/me carries no dialog.
+        Assert.False(config.DpaAcceptancePending);
+        Assert.Equal(CurrentDpa, config.DpaVersion);
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task HandleNewTenantDomain_WhenDomainAlreadySet_NeverAsksOrStamps(bool signupConsent)
+    {
+        // Decided once, with the onboarding: an existing tenant's login writes nothing — no stamp,
+        // no pending flag, whichever button the user came through (tenants that pre-date the
+        // acceptance are never asked).
        var config = DefaultConfig();
        config.DomainName = "contoso.com";
        config.DpaVersion = null;

-        await _sut.HandleNewTenantDomainAsync(config, TenantId, Upn);
+        await _sut.HandleNewTenantDomainAsync(config, TenantId, Upn, signupConsent: signupConsent);

        Assert.Null(config.DpaVersion);
+        Assert.False(config.DpaAcceptancePending);
        Assert.Empty(_store.Writes);
    }

+    // -------------------------------------------------------------------------
+    // AcceptDpa — POST auth/dpa-acceptance (portal dialog)
+    // -------------------------------------------------------------------------
+
+    private static TenantConfiguration PendingTenant()
+    {
+        var config = DefaultConfig();
+        config.DomainName = "contoso.com";
+        config.OnboardedBy = "first@contoso.com";
+        config.DpaAcceptancePending = true;
+        return config;
+    }
+
+    [Fact]
+    public async Task AcceptDpa_PendingTenant_RecordsTheAcceptanceAndClearsTheDialog()
+    {
+        _store.Row = PendingTenant();
+        var (req, ctx) = BuildAuthenticatedRequest(callerUpn: Upn, tenantId: TenantId);
+
+        var before = DateTime.UtcNow;
+        var response = await _sut.AcceptDpa(req, ctx);
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        var (written, source, _) = Assert.Single(_store.Writes);
+        Assert.Equal("auth", source);
+        Assert.False(written.DpaAcceptancePending);
+        Assert.Equal(CurrentDpa, written.DpaVersion);
+        Assert.Equal(Upn, written.DpaAcceptedBy);
+        Assert.True(written.DpaAcceptedAt >= before);
+        Assert.Equal("first@contoso.com", written.OnboardedBy);
+    }
+
+    [Fact]
+    public async Task AcceptDpa_NothingPending_IsANoOp()
+    {
+        // Already accepted (a double click, a second user) or a tenant that was never asked.
+        var accepted = DefaultConfig();
+        accepted.DomainName = "contoso.com";
+        accepted.DpaVersion = "2026-01-1.0";
+        accepted.DpaAcceptedBy = "first@contoso.com";
+        _store.Row = accepted;
+        var (req, ctx) = BuildAuthenticatedRequest(callerUpn: Upn, tenantId: TenantId);
+
+        var response = await _sut.AcceptDpa(req, ctx);
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Empty(_store.Writes);
+        Assert.Equal("2026-01-1.0", _store.Row!.DpaVersion);
+        Assert.Equal("first@contoso.com", _store.Row.DpaAcceptedBy);
+    }
+
+    [Fact]
+    public async Task AcceptDpa_OnlyEverWritesTheCallersOwnTenant()
+    {
+        // The row is keyed by the token's tid: a caller from another tenant reaches no pending row.
+        const string otherTenant = "ffffffff-0000-1111-2222-333333333333";
+        var otherStore = _tenantConfigMock.StubWrites(otherTenant, row: null);
+        _store.Row = PendingTenant();
+        var (req, ctx) = BuildAuthenticatedRequest(callerUpn: "user@fabrikam.com", tenantId: otherTenant);
+
+        var response = await _sut.AcceptDpa(req, ctx);
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Empty(otherStore.Writes);
+        Assert.Empty(_store.Writes);
+        Assert.True(_store.Row!.DpaAcceptancePending);
+    }
+
+    [Fact]
+    public async Task AcceptDpa_OffboardingTombstone_IsRefused()
+    {
+        var tombstone = PendingTenant();
+        tombstone.Disabled = true;
+        tombstone.DisabledReason = AutopilotMonitor.Functions.Functions.Admin.TenantOffboardFunction.OffboardingDisabledReason;
+        _store.Row = tombstone;
+        var (req, ctx) = BuildAuthenticatedRequest(callerUpn: Upn, tenantId: TenantId);
+
+        var response = await _sut.AcceptDpa(req, ctx);
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Empty(_store.Writes);
+    }
+
+    [Fact]
+    public async Task AcceptDpa_LostWriteRace_AsksToRetry()
+    {
+        _store.Row = PendingTenant();
+        _store.Force = TenantConfigUpdateStatus.Conflict;
+        var (req, ctx) = BuildAuthenticatedRequest(callerUpn: Upn, tenantId: TenantId);
+
+        var response = await _sut.AcceptDpa(req, ctx);
+
+        Assert.Equal(HttpStatusCode.Conflict, response.StatusCode);
+    }
+
    [Fact]
    public async Task HandleNewTenantDomain_PreservesExistingOnboardedBy()
    {
@@ -75,6 +75,24 @@ public class AuthFunctionTests
        Assert.Equal(agentSeen, (DateTime)body.whatsNewSeenAgentUtc);
    }

+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public void HappyPath_CarriesThePendingTermsAndDpaAcceptance(bool pending)
+    {
+        var config = DefaultConfig();
+        config.DpaAcceptancePending = pending;
+
+        var result = AuthFunction.BuildAuthResult(
+            config, isGlobalAdmin: false, isGlobalReader: false, isPreviewApproved: true,
+            memberRole: AdminRole(), mcpCheck: McpAllowed(),
+            hasTenantAdmins: true,
+            TenantId, Upn, DisplayName, ObjectId);
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(pending, (bool)ToDynamic(result.Body).dpaAcceptancePending);
+    }
+
    [Theory]
    [InlineData("platform", "platform")]
    [InlineData("Platform", "platform")]
@@ -372,6 +372,9 @@ public class CascadeVerificationServiceTests
        public Task<TableEntity?> GetSessionRowAsync(string tenantId, string sessionId, CancellationToken ct = default)
            => Task.FromResult<TableEntity?>(null);

+        public Task<TableEntity?> GetSessionRowAsync(string tenantId, string sessionId, IEnumerable<string> select, CancellationToken ct = default)
+            => Task.FromResult<TableEntity?>(null);
+
        public Task<TableEntity?> GetSessionsIndexRowAsync(string tenantId, string indexRowKey, CancellationToken ct = default)
            => Task.FromResult<TableEntity?>(null);

@@ -86,7 +86,7 @@ public class ConfigBackupHookTests
        config.DomainName = "contoso.com";
        config.UpdatedBy = "admin@contoso.com";
        config.DataRetentionDays = 30;
-        config.TeamsWebhookUrl = "https://contoso.webhook.office.com/hook";
+        config.WebhookUrl = "https://hooks.example.com/secret-hook";
        return config;
    }

@@ -127,9 +127,9 @@ public class ConfigBackupHookTests
        // The snapshot holds the STORED row (retention 30), not the incoming one.
        Assert.Contains("\"DataRetentionDays\":30", snapshot.EntityJson);
        // Raw secrets ARE in EntityJson (full-fidelity restore source)…
-        Assert.Contains("contoso.webhook.office.com", snapshot.EntityJson);
+        Assert.Contains("hooks.example.com/secret-hook", snapshot.EntityJson);
        // …but the advisory diff masks them by property-name heuristics (ConfigDiffHelper).
-        Assert.DoesNotContain("contoso.webhook.office.com", snapshot.DiffJson ?? string.Empty);
+        Assert.DoesNotContain("hooks.example.com/secret-hook", snapshot.DiffJson ?? string.Empty);
        harness.Backup.Verify(
            b => b.PruneAsync(TenantId, Constants.ConfigBackupKeepCount, It.IsAny<CancellationToken>()),
            Times.Once);
@@ -93,7 +93,6 @@ public class ConfigRedactionTests
        var existing = new TenantConfiguration
        {
            DiagnosticsBlobSasUrl = "https://acct.blob.core.windows.net/c?sig=real",
-            TeamsWebhookUrl = "https://teams.example/real",
            WebhookUrl = "https://hooks.example/real",
            WebhookCustomHeadersJson = "{\"X-Api-Key\":\"real\"}",
            DomainName = "contoso.com",
@@ -106,7 +105,6 @@ public class ConfigRedactionTests
        incoming.RestoreRedactedSecretsFrom(existing);

        Assert.Equal(existing.DiagnosticsBlobSasUrl, incoming.DiagnosticsBlobSasUrl);
-        Assert.Equal(existing.TeamsWebhookUrl, incoming.TeamsWebhookUrl);
        Assert.Equal(existing.WebhookUrl, incoming.WebhookUrl);
        Assert.Equal(existing.WebhookCustomHeadersJson, incoming.WebhookCustomHeadersJson);
    }
@@ -1,7 +1,10 @@
+using Azure;
 using AutopilotMonitor.Functions.Functions.Metrics;
 using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
 using AutopilotMonitor.Shared.Models;
+using Moq;
 using Xunit;

 namespace AutopilotMonitor.Functions.Tests;
@@ -795,4 +798,38 @@ public class DeviceJourneyAndFtrTests
        Assert.DoesNotContain(selected, c => c.History.SerialKey == "dev-00");
        Assert.DoesNotContain(selected, c => c.History.SerialKey == "dev-01");
    }
+
+    // ── sweep merge: a failed history read is never "no history" ────────────
+
+    [Fact]
+    public async Task SweepMerge_HistoryReadFailure_SkipsTheDevice_AndKeepsOlderRefsOfTheOthers()
+    {
+        // A failed point read used to come back as null ("no history"): the sweep merged the
+        // window into an empty chain and replaced the row, dropping every older ref.
+        var repo = new Mock<IMetricsRepository>();
+        repo.Setup(r => r.GetDeviceHistoryAsync(TenantA, "broken"))
+            .ThrowsAsync(new RequestFailedException(503, "Server Busy"));
+        repo.Setup(r => r.GetDeviceHistoryAsync(TenantA, "healthy"))
+            .ReturnsAsync(History(TenantA, Ref("old-1", SessionStatus.Failed, T0.AddDays(-200))));
+        var upserted = new List<DeviceHistory>();
+        repo.Setup(r => r.UpsertDeviceHistoryAsync(It.IsAny<DeviceHistory>()))
+            .Callback<DeviceHistory>(upserted.Add)
+            .ReturnsAsync(true);
+
+        var byDevice = new Dictionary<(string TenantId, string SerialKey), List<SessionSummary>>
+        {
+            [(TenantA, "broken")] = new() { Session("w-1") },
+            [(TenantA, "healthy")] = new() { Session("w-2") },
+        };
+
+        var (merged, readFailures, firstError) = await MaintenanceService.MergeWindowIntoDeviceHistoriesAsync(
+            repo.Object, byDevice, new Dictionary<string, ISet<string>>());
+
+        Assert.Equal(1, readFailures);
+        Assert.IsType<RequestFailedException>(firstError);
+        var written = Assert.Single(upserted);
+        Assert.Equal("healthy", written.SerialKey);
+        Assert.Equal(new[] { "old-1", "w-2" }, written.Chain.Select(r => r.SessionId).ToArray());
+        Assert.Same(written, Assert.Single(merged));
+    }
 }
@@ -0,0 +1,273 @@
+using System.Net;
+using System.Net.Http;
+using AutopilotMonitor.Functions.Helpers;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Functions.Services.Notifications;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models.Notifications;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// E-mail as a notification-channel provider (D-332): dispatch routing (never the webhook path,
+/// never the bot), recipient validation, the Global-Admin gate, the rendered message, and the
+/// send against a stubbed provider endpoint.
+/// </summary>
+public class EmailChannelProviderTests
+{
+    private const int Email = (int)WebhookProviderType.Email;
+    private static readonly NotificationScope Platform = NotificationScope.Platform;
+
+    private static Mock<WebhookNotificationService> WebhookMock()
+        => new(new HttpClient(), NullLogger<WebhookNotificationService>.Instance) { CallBase = false };
+
+    private static Mock<TelegramNotificationService> TelegramMock()
+        => new(new HttpClient(), Mock.Of<IConfigRepository>(), NullLogger<TelegramNotificationService>.Instance) { CallBase = false };
+
+    private static NotificationChannel Channel(string? url, string id = "mail", bool enabled = true)
+        => new() { Id = id, Name = id, ProviderType = Email, Url = url, Enabled = enabled };
+
+    private static NotificationAlert Alert() => new()
+    {
+        EventType = "PushDeliveryFailed",
+        Title = "Ops Alert: Platform/PushDeliveryFailed",
+        Summary = "A push service refused the platform key",
+        Severity = NotificationSeverity.Error,
+        Facts = { new() { Name = "Category", Value = "Platform" }, new() { Name = "Tenant", Value = "11111111-1111-1111-1111-111111111111" } },
+        Sections = { new() { Title = "What happened", Text = "status 401 <kid=abc>" } },
+        Actions = { new() { Type = "openUrl", Title = "Open alerts", Url = "https://portal.example.invalid/admin/settings/alerts" } },
+    };
+
+    // ── Dispatch routing ──────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Email_channel_reaches_the_email_sender_with_its_recipients_and_never_the_webhook_path()
+    {
+        var webhook = WebhookMock();
+        var telegram = TelegramMock();
+        var email = new Mock<IEmailChannelSender>();
+        var dispatcher = new NotificationChannelDispatcher(webhook.Object, telegram.Object, Mock.Of<IPushChannelSender>(), email.Object);
+        var alert = Alert();
+
+        await dispatcher.SendToChannelsAsync(new[] { Channel("ops@example.invalid; two@example.invalid") }, alert, Platform);
+
+        email.Verify(e => e.SendOpsAlertAsync("ops@example.invalid; two@example.invalid", alert), Times.Once);
+        webhook.Verify(w => w.SendNotificationAsync(It.IsAny<string>(), It.IsAny<WebhookProviderType>(), It.IsAny<NotificationAlert>(),
+            It.IsAny<IReadOnlyDictionary<string, string>>(), It.IsAny<string>()), Times.Never);
+        telegram.Verify(t => t.SendOpsAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task Email_channel_without_recipients_is_skipped_and_the_test_path_reports_the_sender_result()
+    {
+        var email = new Mock<IEmailChannelSender>();
+        email.Setup(e => e.SendAlertWithResultAsync("ops@example.invalid", It.IsAny<NotificationAlert>()))
+            .ReturnsAsync(new WebhookTestResult { Success = true, Message = "Sent to 1 recipient(s)." });
+        var dispatcher = new NotificationChannelDispatcher(WebhookMock().Object, TelegramMock().Object, Mock.Of<IPushChannelSender>(), email.Object);
+
+        await dispatcher.SendToChannelsAsync(new[] { Channel(""), Channel(null, "n") }, Alert(), Platform);
+        email.Verify(e => e.SendOpsAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()), Times.Never);
+
+        var result = await dispatcher.SendWithResultAsync(Channel("ops@example.invalid"), Alert(), Platform);
+        Assert.True(result.Success);
+        Assert.Equal("Sent to 1 recipient(s).", result.Message);
+    }
+
+    [Fact]
+    public async Task Dispatcher_without_an_email_transport_skips_the_channel_and_says_so_on_test()
+    {
+        var dispatcher = new NotificationChannelDispatcher(WebhookMock().Object, TelegramMock().Object, Mock.Of<IPushChannelSender>());
+
+        await dispatcher.SendToChannelsAsync(new[] { Channel("ops@example.invalid") }, Alert(), Platform);   // no throw
+        var result = await dispatcher.SendWithResultAsync(Channel("ops@example.invalid"), Alert(), Platform);
+
+        Assert.False(result.Success);
+        Assert.Contains("not registered", result.Message);
+    }
+
+    // ── Validation and gate ───────────────────────────────────────────────
+
+    [Theory]
+    [InlineData("ops@example.invalid")]
+    [InlineData("ops@example.invalid; second@example.invalid")]
+    [InlineData("ops@example.invalid, second@example.invalid ,third@sub.example.invalid")]
+    [InlineData("  first.last+tag@example.invalid  ")]
+    public void ValidateEmailDestination_accepts_one_to_five_plain_addresses(string recipients)
+        => Assert.Null(TenantConfigValidation.ValidateEmailDestination(recipients));
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData(";,")]
+    [InlineData("not-an-address")]
+    [InlineData("Ops Team <ops@example.invalid>")]
+    [InlineData("ops@localhost")]
+    [InlineData("https://hooks.example.invalid/x")]
+    [InlineData("a@x.invalid;b@x.invalid;c@x.invalid;d@x.invalid;e@x.invalid;f@x.invalid")]
+    public void ValidateEmailDestination_rejects_blank_malformed_named_hostless_and_too_many(string? recipients)
+        => Assert.NotNull(TenantConfigValidation.ValidateEmailDestination(recipients));
+
+    [Fact]
+    public void ValidateNotificationChannels_uses_the_recipient_rule_not_the_ssrf_url_gate()
+    {
+        var ok = NotificationChannel.SerializeList(new[] { Channel("ops@example.invalid") });
+        Assert.Null(TenantConfigValidation.ValidateNotificationChannels(ok));
+
+        var bad = NotificationChannel.SerializeList(new[] { Channel("https://hooks.example.invalid/x") });
+        Assert.Contains("not a valid e-mail address", TenantConfigValidation.ValidateNotificationChannels(bad));
+    }
+
+    [Fact]
+    public void Email_provider_is_global_admin_only()
+    {
+        Assert.True(NotificationChannel.IsGlobalAdminOnlyProvider(Email));
+        var candidate = NotificationChannel.SerializeList(new[] { Channel("ops@example.invalid") });
+
+        Assert.Null(TenantConfigValidation.ValidateTelegramChannelGate(candidate, null, isGlobalAdmin: true));
+        var refused = TenantConfigValidation.ValidateTelegramChannelGate(candidate, null, isGlobalAdmin: false);
+        Assert.Equal("E-mail channels can only be configured by a Global Administrator.", refused);
+
+        // A GA-created channel survives a tenant admin's unrelated save; retargeting it does not.
+        Assert.Null(TenantConfigValidation.ValidateTelegramChannelGate(candidate, candidate, isGlobalAdmin: false));
+        var retargeted = NotificationChannel.SerializeList(new[] { Channel("other@example.invalid") });
+        Assert.NotNull(TenantConfigValidation.ValidateTelegramChannelGate(retargeted, candidate, isGlobalAdmin: false));
+    }
+
+    // ── Rendering ─────────────────────────────────────────────────────────
+
+    [Fact]
+    public void Renderer_reads_like_a_message_not_a_log_line()
+    {
+        var alert = Alert();
+        alert.DataJson = "{\"service\":\"apple\",\"statusCode\":401,\"note\":\"<script>\",\"nested\":{\"a\":1}}";
+
+        // No brackets, no severity shouting, the event name as words, the category in parentheses.
+        Assert.Equal("Autopilot Monitor: Push delivery failed (Platform)", EmailAlertRenderer.Subject(alert));
+
+        var html = EmailAlertRenderer.Html(alert);
+        Assert.Contains("Autopilot Monitor raised an error in the Platform category.", html);   // one sentence first
+        Assert.Contains("<h1 style=\"font-size:18px;margin:0 0 8px 0;\">Push delivery failed</h1>", html);
+        Assert.DoesNotContain("Ops Alert: Platform/PushDeliveryFailed", html);                    // the machine title stays out
+        Assert.Contains("A push service refused the platform key", html);
+        Assert.Contains("<td style=\"padding:3px 0;\">Platform</td>", html);                     // facts as a table
+        Assert.Contains("status 401 &lt;kid=abc&gt;", html);                                        // section text escaped
+        Assert.DoesNotContain("<kid=abc>", html);
+        Assert.Contains("<td style=\"padding:3px 0;\">&lt;script&gt;</td>", html);               // payload as rows, escaped
+        Assert.Contains("<td style=\"padding:3px 0;\">{&quot;a&quot;:1}</td>", html);             // nested values stay compact JSON
+        Assert.DoesNotContain("<pre", html);                                                        // no raw JSON block for an object
+        Assert.Contains("Open alerts: <a href=\"https://portal.example.invalid/admin/settings/alerts\"", html);   // visible link
+        Assert.Contains("sent automatically by Autopilot Monitor", html);
+
+        var text = EmailAlertRenderer.Text(alert);
+        Assert.StartsWith("Autopilot Monitor raised an error in the Platform category.", text);
+        Assert.Contains("Push delivery failed\n", text);
+        Assert.Contains("Category: Platform\n", text);
+        Assert.Contains("note: <script>\n", text);                                                 // text part is not HTML-escaped
+        Assert.Contains("Open alerts: https://portal.example.invalid/admin/settings/alerts", text);
+    }
+
+    [Fact]
+    public void Renderer_drops_non_http_links_caps_a_non_object_payload_and_survives_an_empty_alert()
+    {
+        var alert = new NotificationAlert { Title = "", Summary = "", DataJson = new string('x', EmailAlertRenderer.MaxPayloadChars + 100) };
+        alert.Actions.Add(new NotificationAction { Type = "openUrl", Title = "bad", Url = "javascript:alert(1)" });
+
+        Assert.Equal("Autopilot Monitor: Notification", EmailAlertRenderer.Subject(alert));
+        var html = EmailAlertRenderer.Html(alert);
+        Assert.DoesNotContain("javascript:", html);
+        Assert.Contains("(truncated)", html);
+        Assert.True(html.Length < EmailAlertRenderer.MaxPayloadChars + 3000);
+        Assert.Equal("Autopilot Monitor: Hello world", EmailAlertRenderer.Subject(new NotificationAlert { Title = "Hello world", Summary = "" }));
+    }
+
+    [Theory]
+    [InlineData("PushDeliveryFailed", "Push delivery failed")]
+    [InlineData("SlaBreachNotification", "Sla breach notification")]
+    [InlineData("SLAEvaluation", "SLA evaluation")]
+    [InlineData("enrollment_failed", "Enrollment failed")]
+    [InlineData("TenantSignup", "Tenant signup")]
+    public void Humanize_splits_event_names_into_words(string eventName, string expected)
+        => Assert.Equal(expected, EmailAlertRenderer.Humanize(eventName));
+
+    // ── Sending through the provider path ─────────────────────────────────
+
+    [Fact]
+    public async Task Sender_posts_one_message_per_recipient_and_reports_what_the_provider_accepted()
+    {
+        var handler = new StubHandler();
+        var (service, _) = Sender(handler, apiKey: "key");
+
+        var result = await service.SendAlertWithResultAsync("ops@example.invalid; second@example.invalid", Alert());
+
+        Assert.True(result.Success);
+        Assert.Equal("Sent to 2 recipient(s). Provider status: sent, id abc,abc.", result.Message);
+        Assert.Equal(2, handler.Bodies.Count);
+        Assert.Contains("\"to\":[{\"email\":\"ops@example.invalid\"", handler.Bodies[0]);
+        Assert.Contains("\"subject\":\"Autopilot Monitor: Push delivery failed (Platform)\"", handler.Bodies[0]);
+        Assert.Contains("\"tags\":[\"alert\"]", handler.Bodies[0]);
+        Assert.Contains("\"track_opens\":false", handler.Bodies[0]);
+        Assert.Contains("\"text\":\"Autopilot Monitor raised an error", handler.Bodies[0]);      // own text part
+        Assert.Contains("\"auto_text\":false", handler.Bodies[0]);
+        Assert.Contains("\"headers\":{\"Auto-Submitted\":\"auto-generated\",\"X-Auto-Response-Suppress\":\"All\"}", handler.Bodies[0]);
+    }
+
+    [Fact]
+    public async Task Sender_reports_a_rejection_and_an_unconfigured_provider_without_throwing()
+    {
+        var handler = new StubHandler { Responder = _ => StubHandler.Json(HttpStatusCode.OK, "[{\"email\":\"ops@example.invalid\",\"status\":\"rejected\",\"reject_reason\":\"hard-bounce\"}]") };
+        var (service, _) = Sender(handler, apiKey: "key");
+        var rejected = await service.SendAlertWithResultAsync("ops@example.invalid", Alert());
+        Assert.False(rejected.Success);
+        Assert.Contains("accepted 0 of 1", rejected.Message);
+        Assert.Contains("Provider status: rejected", rejected.Message);
+
+        var (unconfigured, _) = Sender(new StubHandler(), apiKey: "");
+        var skipped = await unconfigured.SendAlertWithResultAsync("ops@example.invalid", Alert());
+        Assert.False(skipped.Success);
+        Assert.Contains("not configured", skipped.Message);
+
+        await unconfigured.SendOpsAlertAsync("ops@example.invalid", Alert());   // never throws
+    }
+
+    [Fact]
+    public void ParseRecipients_trims_dedupes_and_keeps_order()
+    {
+        var list = EmailNotificationService.ParseRecipients(" a@x.invalid ; B@x.invalid, a@x.invalid ,, c@x.invalid ");
+        Assert.Equal(new[] { "a@x.invalid", "B@x.invalid", "c@x.invalid" }, list);
+        Assert.Empty(EmailNotificationService.ParseRecipients(null));
+    }
+
+    private static (EmailNotificationService Service, EmailService Email) Sender(StubHandler handler, string apiKey)
+    {
+        var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            [EmailService.ApiKeyConfigKey] = apiKey,
+            ["Email:Endpoint"] = "https://mail.example.invalid/send",
+        }).Build();
+        var templates = new EmailTemplateService(
+            Mock.Of<IConfigRepository>(),
+            new Microsoft.Extensions.Caching.Memory.MemoryCache(new Microsoft.Extensions.Caching.Memory.MemoryCacheOptions()),
+            NullLogger<EmailTemplateService>.Instance);
+        var email = new EmailService(new HttpClient(handler, disposeHandler: false), config, templates, NullLogger<EmailService>.Instance);
+        return (new EmailNotificationService(email, NullLogger<EmailNotificationService>.Instance), email);
+    }
+
+    private sealed class StubHandler : HttpMessageHandler
+    {
+        public List<string> Bodies { get; } = new();
+        public Func<HttpRequestMessage, HttpResponseMessage> Responder { get; set; } = _ =>
+            Json(HttpStatusCode.OK, "[{\"email\":\"x@y.invalid\",\"status\":\"sent\",\"_id\":\"abc\"}]");
+
+        public static HttpResponseMessage Json(HttpStatusCode status, string body)
+            => new(status) { Content = new StringContent(body, System.Text.Encoding.UTF8, "application/json") };
+
+        protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            Bodies.Add(request.Content is null ? string.Empty : await request.Content.ReadAsStringAsync(cancellationToken));
+            return Responder(request);
+        }
+    }
+}
@@ -111,9 +111,14 @@ public sealed class EmailServiceTests
        Assert.Equal(EmailService.DefaultFromName, message.GetProperty("from_name").GetString());
        Assert.Equal("it@contoso.invalid", message.GetProperty("to")[0].GetProperty("email").GetString());
        Assert.Equal("to", message.GetProperty("to")[0].GetProperty("type").GetString());
-        Assert.Equal(EmailTemplates.PreviewApprovedSubject, message.GetProperty("subject").GetString());
+        Assert.Equal("Your Autopilot Monitor access for contoso.invalid is ready", message.GetProperty("subject").GetString());
        Assert.Contains("contoso.invalid", message.GetProperty("html").GetString());
-        Assert.True(message.GetProperty("auto_text").GetBoolean());
+        // A text part of our own (HtmlToText) instead of the provider's derived one, and the
+        // RFC 3834 header on every automated mail.
+        Assert.False(message.GetProperty("auto_text").GetBoolean());
+        Assert.Contains("contoso.invalid", message.GetProperty("text").GetString());
+        Assert.DoesNotContain("<", message.GetProperty("text").GetString());
+        Assert.Equal("auto-generated", message.GetProperty("headers").GetProperty("Auto-Submitted").GetString());
        Assert.False(message.GetProperty("track_opens").GetBoolean());
        Assert.False(message.GetProperty("track_clicks").GetBoolean());
        Assert.Equal("welcome", message.GetProperty("tags")[0].GetString());
@@ -253,7 +258,8 @@ public sealed class EmailServiceTests
        // The mail is sent from a noreply address after portal access is gone, so the
        // feedback pointers must be external channels the recipient can actually reach.
        Assert.Contains("https://github.com/okieselbach/AutopilotMonitor/issues", html);
-        Assert.Contains("linkedin.com", html);
+        Assert.Contains("github.com/okieselbach/AutopilotMonitor/issues", html);
+        Assert.DoesNotContain("linkedin.com", html);   // one feedback link only (user go 2026-10-08)
    }

    [Fact]
@@ -137,7 +137,6 @@ public class EndpointPolicyCatalogCompletenessTests
    [InlineData("PUT", "/api/rules/gather/rule-1", "rules/gather/{ruleId}")]
    [InlineData("DELETE", "/api/tenants/tid-1/admins/user@contoso.com", "tenants/{tenantId}/admins/{adminUpn}")]
    [InlineData("PATCH", "/api/tenants/tid-1/admins/user@contoso.com/permissions", "tenants/{tenantId}/admins/{adminUpn}/permissions")]
-    [InlineData("DELETE", "/api/devices/block/SN123456", "devices/block/{encodedSerialNumber}")]
    [InlineData("DELETE", "/api/versions/block/v1.0.*", "versions/block/{encodedPattern}")]
    [InlineData("PATCH", "/api/global/session-reports/report-1/note", "global/session-reports/{reportId}/note")]
    [InlineData("POST", "/api/rules/analyze/ANALYZE-ID-001/create-from-template", "rules/analyze/{ruleId}/create-from-template")]
@@ -284,8 +283,8 @@ public class EndpointPolicyCatalogCompletenessTests
    /// </summary>
    [Theory]
    [InlineData("GET", "/api/global/apps/list",                       "global/apps/list")]
-    [InlineData("GET", "/api/global/apps/Company%20Portal/analytics", "global/apps/{appName}/analytics")]
-    [InlineData("GET", "/api/global/apps/Company%20Portal/sessions",  "global/apps/{appName}/sessions")]
+    [InlineData("GET", "/api/global/apps/analytics",                  "global/apps/analytics")]
+    [InlineData("GET", "/api/global/apps/sessions",                   "global/apps/sessions")]
    public void GlobalAppsRoutes_AreGlobalReadOrAdmin(string method, string path, string expectedTemplate)
    {
        var entry = EndpointAccessPolicyCatalog.FindPolicy(method, path);
@@ -355,7 +355,7 @@ public class EnrollmentTimeoutClassifierTests
    [Fact]
    public void Classify_device_provisioned_user_phase_pending_within_grace_is_AwaitingUser()
    {
-        // The dominant crcins.com case: DeviceSetup 4/4, AccountSetup 0/5, silent, 6h in.
+        // The dominant field case: DeviceSetup 4/4, AccountSetup 0/5, silent, 6h in.
        var (status, reason) = Classify(new[] { Esp(DeviceSetup44), Esp(AccountSetup05) }, hoursSinceStart: 6);
        Assert.Equal(SessionStatus.AwaitingUser, status);
        Assert.Contains("Device Setup completed", reason);
@@ -382,7 +382,7 @@ public class EnrollmentTimeoutClassifierTests
    public void ExtractRollup_agent_timeout_enrollment_failed_is_not_explicit_failure()
    {
        // The max-lifetime watchdog's enrollment_failed(failureType=agent_timeout) is "the agent
-        // gave up waiting", not a failure verdict — it must not poison rule 1 (tenant a53e67ec).
+        // gave up waiting", not a failure verdict — it must not poison rule 1 (misclassification audit 2026-07-16).
        var timeout = Evt("enrollment_failed",
            data: new Dictionary<string, object> { ["failureType"] = "agent_timeout" });
        Assert.False(EnrollmentTimeoutClassifier.ExtractRollup(new[] { timeout }).HasExplicitFailure);
@@ -589,7 +589,7 @@ public class EnrollmentTimeoutClassifierTests
        }
    }

-    // -------- WhiteGlove Part-2 awaiting-user gate (fairstone.ca analysis 2026-08-21) --------
+    // -------- WhiteGlove Part-2 awaiting-user gate (field analysis 2026-08-21) --------

    private static readonly DateTime Resumed = Start.AddMinutes(20);

@@ -603,7 +603,7 @@ public class EnrollmentTimeoutClassifierTests
        return (status, reason);
    }

-    /// <summary>The fairstone event shape: Part 1 sealed, Part 2 resumed, nobody signed in.</summary>
+    /// <summary>The field event shape: Part 1 sealed, Part 2 resumed, nobody signed in.</summary>
    private static EnrollmentEvent[] WgParkedEvents() => new[]
    {
        Esp(DeviceSetup44), Evt("whiteglove_complete"), Esp(AccountSetup05),
@@ -660,7 +660,7 @@ public class EnrollmentTimeoutClassifierTests
    [Fact]
    public void Classify_whiteglove_part2_parked_within_grace_is_AwaitingUser()
    {
-        // The fairstone shape: technician powers the device off at the logon screen minutes
+        // The field shape: technician powers the device off at the logon screen minutes
        // after the reseal-reboot. Part-1 whiteglove_complete must NOT reconcile to Succeeded.
        var (status, reason) = ClassifyWhiteGlove(WgParkedEvents(), hoursSinceStart: 6);
        Assert.Equal(SessionStatus.AwaitingUser, status);
@@ -734,7 +734,7 @@ public class EnrollmentTimeoutClassifierTests
        Assert.Equal(SessionStatus.Succeeded, status);
    }

-    // -------- Self-deploying profile gate (kiosk tenant aebdce78, audit 2026-08-23) --------
+    // -------- Self-deploying profile gate (kiosk tenant, audit 2026-08-23) --------

    private static (SessionStatus, string) ClassifySelfDeploying(
        IReadOnlyList<EnrollmentEvent> events, double hoursSinceStart = 3, int grace = 51)
@@ -0,0 +1,117 @@
+using System;
+using AutopilotMonitor.Functions.Functions.Feedback;
+using AutopilotMonitor.Shared.DataAccess;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The rating bubble asks a person at most twice: an X click counts, the second ask waits for the pause,
+/// a rating ends it for good and is never replaced. Only clicks count.
+/// </summary>
+public sealed class FeedbackPromptRulesTests
+{
+    private const int Pause = 60;
+    private static readonly DateTime Now = new(2026, 10, 5, 12, 0, 0, DateTimeKind.Utc);
+
+    private static FeedbackEntry Row(bool submitted, int dismissals, int daysAgo) => new()
+    {
+        Upn = "alice@contoso.invalid",
+        TenantId = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+        DisplayName = "Alice",
+        Submitted = submitted,
+        Dismissed = !submitted,
+        Rating = submitted ? 5 : null,
+        Comment = submitted ? "Great" : null,
+        DismissCount = dismissals,
+        InteractedAt = Now.AddDays(-daysAgo),
+    };
+
+    private static FeedbackAnswer Dismiss() =>
+        new("alice@contoso.invalid", "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "Alice", true, null, null);
+
+    private static FeedbackAnswer Rate(int stars, string? comment) =>
+        new("alice@contoso.invalid", "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "Alice", false, stars, comment);
+
+    // ── When the bubble may ask ──────────────────────────────────────────────
+
+    [Fact]
+    public void NeverAnswered_IsAsked()
+        => Assert.True(FeedbackPromptRules.IsEligible(null, Pause, Now));
+
+    [Theory]
+    [InlineData(0, 1)]
+    [InlineData(0, 400)]
+    [InlineData(1, 400)]
+    public void AfterARating_NeverAgain(int dismissals, int daysAgo)
+        => Assert.False(FeedbackPromptRules.IsEligible(Row(submitted: true, dismissals, daysAgo), Pause, Now));
+
+    [Theory]
+    [InlineData(1, false)]
+    [InlineData(59, false)]
+    [InlineData(60, true)]
+    [InlineData(400, true)]
+    public void AfterTheFirstDismissal_OnceMore_AfterThePause(int daysAgo, bool expected)
+        => Assert.Equal(expected, FeedbackPromptRules.IsEligible(Row(submitted: false, 1, daysAgo), Pause, Now));
+
+    [Theory]
+    [InlineData(1)]
+    [InlineData(400)]
+    public void AfterTheSecondDismissal_NeverAgain(int daysAgo)
+        => Assert.False(FeedbackPromptRules.IsEligible(Row(submitted: false, 2, daysAgo), Pause, Now));
+
+    [Fact]
+    public void PauseZero_MeansOneAskOnly()
+        => Assert.False(FeedbackPromptRules.IsEligible(Row(submitted: false, 1, 400), 0, Now));
+
+    // ── What one answer does ─────────────────────────────────────────────────
+
+    [Fact]
+    public void FirstDismissal_CountsOne()
+    {
+        var row = FeedbackPromptRules.Apply(null, Dismiss(), Now)!;
+
+        Assert.True(row.Dismissed);
+        Assert.False(row.Submitted);
+        Assert.Equal(1, row.DismissCount);
+        Assert.Equal(Now, row.InteractedAt);
+        Assert.Null(row.Rating);
+    }
+
+    [Fact]
+    public void SecondDismissal_CountsTwo_AndEndsTheAsking()
+    {
+        var row = FeedbackPromptRules.Apply(Row(submitted: false, 1, 61), Dismiss(), Now)!;
+
+        Assert.Equal(2, row.DismissCount);
+        Assert.False(FeedbackPromptRules.IsEligible(row, Pause, Now.AddDays(400)));
+    }
+
+    [Fact]
+    public void DismissalBeyondTheSecond_ChangesNothing()
+        => Assert.Null(FeedbackPromptRules.Apply(Row(submitted: false, 2, 1), Dismiss(), Now));
+
+    [Fact]
+    public void RatingAfterADismissal_IsStored_AndKeepsTheCount()
+    {
+        var row = FeedbackPromptRules.Apply(Row(submitted: false, 1, 61), Rate(4, "Mostly good"), Now)!;
+
+        Assert.True(row.Submitted);
+        Assert.False(row.Dismissed);
+        Assert.Equal(4, row.Rating);
+        Assert.Equal("Mostly good", row.Comment);
+        Assert.Equal(1, row.DismissCount);
+        Assert.Equal("alice@contoso.invalid", row.Upn);
+        Assert.Equal("Alice", row.DisplayName);
+    }
+
+    [Fact]
+    public void ARatedRow_IsFinal()
+    {
+        // A second tab's dismissal or second rating must neither replace the rating nor ping again.
+        var rated = Row(submitted: true, 0, 1);
+
+        Assert.Null(FeedbackPromptRules.Apply(rated, Dismiss(), Now));
+        Assert.Null(FeedbackPromptRules.Apply(rated, Rate(1, "changed my mind"), Now));
+    }
+}
--- a/Show More
+++ b/Show More