chore(deps): bump the mcp group (#183)

Bumps the mcp group in /src/McpServer/autopilot-monitor-mcp with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/node](https://github.com/modelcontextprotocol/typescript-sdk) | `2.1.0` | `2.1.1` |
| [@modelcontextprotocol/server](https://github.com/modelcontextprotocol/typescript-sdk) | `2.2.0` | `2.3.0` |
| [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) | `2.2.0` | `2.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.4` | `22.20.5` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.37.0` | `6.39.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.71.0` |


Updates `@modelcontextprotocol/node` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/node@2.1.0...@modelcontextprotocol/node@2.1.1)

Updates `@modelcontextprotocol/server` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/server@2.2.0...@modelcontextprotocol/server@2.3.0)

Updates `@modelcontextprotocol/client` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.2.0...@modelcontextprotocol/client@2.3.0)

Updates `@types/node` from 22.20.4 to 22.20.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `knip` from 6.37.0 to 6.39.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.39.0/packages/knip)

Updates `typescript-eslint` from 8.65.0 to 8.71.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/node"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: mcp
- dependency-name: "@modelcontextprotocol/server"
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: mcp
- dependency-name: "@modelcontextprotocol/client"
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mcp
- dependency-name: "@types/node"
  dependency-version: 22.20.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: mcp
- dependency-name: knip
  dependency-version: 6.39.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mcp
- dependency-name: typescript-eslint
  dependency-version: 8.71.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: mcp
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.claude/CLAUDE.md

@@ -38,6 +38,8 @@
 - Simplicity first: minimal, targeted changes. No temporary fixes — find the root cause.
 - Where architecture is flawed, state is duplicated, or patterns are inconsistent, propose and implement the structural fix. Ask what a perfectionist reviewer would reject, and fix that too.
 - On non-trivial changes, ask whether there is a more elegant way before presenting. Skip it for simple fixes — don't over-engineer.
+- Reuse before you write: search for an existing helper by what it does (its key call, literal or regex), not by a guessed name. Web helpers live in `lib/` (route-only ones in a `lib/` beside the route), backend helpers in `Functions/Helpers/`.
+- Dead and copied code is gated: the .NET build fails on unused private members and parameters (`.editorconfig`), `npm run knip` covers web and MCP, and `npm run dup` in `tools/quality` fails on new clones. CI only reports, so run them before calling a change done.
 - English for code comments and everything that carries knowledge.
 
 Private half of these instructions (process, working files, technical docs, operations): @../internal/CLAUDE.md

.editorconfig

@@ -0,0 +1,11 @@
+# Analyzer severities for the .NET build. Directory.Build.props runs the IDE rules in
+# `dotnet build` (EnforceCodeStyleInBuild), and the warning freeze makes every warning an error.
+root = true
+
+[*.cs]
+# Unused private members, private members that are written but never read, and unused parameters
+# of non-public methods. An injected dependency nobody reads is a feature that silently never runs.
+dotnet_diagnostic.IDE0051.severity = warning
+dotnet_diagnostic.IDE0052.severity = warning
+dotnet_diagnostic.IDE0060.severity = warning
+dotnet_code_quality_unused_parameters = non_public

.github/dependabot.yml

@@ -65,7 +65,7 @@ updates:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
 
-  # Validator tooling for rules/ (ajv-cli); combine-rules.yml installs it from this
+  # Validator tooling for rules/ (ajv for validate.js); combine-rules.yml installs it from this
   # lockfile with contents:write in hand, so the pins must not go stale.
   - package-ecosystem: npm
     directory: /rules/scripts
@@ -81,6 +81,23 @@ updates:
         applies-to: security-updates
         patterns: ['*']
 
+  # Duplicate-check tooling (jscpd for tools/quality/check-duplicates.mjs), installed by the
+  # CI duplicates job from this lockfile. A jscpd update can change the clone fingerprints:
+  # if its PR fails the job, regenerate the baseline (npm run dup:baseline) in that PR.
+  - package-ecosystem: npm
+    directory: /tools/quality
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      quality-tooling:
+        patterns: ['*']
+      quality-tooling-security:
+        applies-to: security-updates
+        patterns: ['*']
+
   # Every action is referenced by commit SHA with the version in a trailing comment;
   # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
   # is what keeps those pins current: it rewrites the SHA and the comment together, so the

.github/workflows/action-pins.yml

@@ -26,7 +26,10 @@ name: Workflow gates
 #
 # The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
 # PR that rewrites both the SHA and the trailing version comment. The comment is
-# therefore required too: it is what makes a pinned line reviewable.
+# therefore required too: it is what makes a pinned line reviewable. It names the exact
+# release tag (# v7.0.1), never the floating major (# v7): a major tag moves with every
+# upstream release, after which the comment no longer names the pinned commit and
+# zizmor's ref-version-mismatch flags every line that carries it.
 
 on:
   push:
@@ -45,7 +48,7 @@ jobs:
     name: Verify action pins
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -59,13 +62,15 @@ jobs:
             # nothing to pin.
             case "$ref" in ./*|\$/*) continue ;; esac
 
-            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*v?[0-9]+\.[0-9]+\.[0-9]+([[:space:]]|$) ]]; then
               printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
               continue
             fi
 
             if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
-              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vX.Y.Z' so the line stays reviewable."
+            elif [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+# ]]; then
+              echo "::error file=$file,line=$line::The version comment must name the exact release tag the SHA resolves to ('# vX.Y.Z'), not a floating major: '$ref'. Find it with: gh api repos/<owner>/<action>/git/matching-refs/tags/vN"
             else
               echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
             fi
@@ -89,7 +94,7 @@ jobs:
       security-events: write   # SARIF upload: findings land in the Code scanning tab next to CodeQL
       actions: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/bootstrap-script-gates.yml

@@ -18,7 +18,7 @@ jobs:
     name: Bootstrap guard tests (PS 5.1)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/build-agent.yml

@@ -72,7 +72,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -124,7 +124,7 @@ jobs:
 
       # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
       - name: Setup .NET
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
 
@@ -464,7 +464,7 @@ jobs:
       # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
       - name: Attest build provenance
         if: inputs.upload_blob || inputs.create_release
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             ${{ steps.artifact.outputs.versioned_zip_release }}
@@ -472,13 +472,13 @@ jobs:
             staging/agent/AutopilotMonitor.SummaryDialog.exe
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
           path: ${{ steps.artifact.outputs.versioned_zip_release }}
 
       - name: Upload version metadata
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: version-metadata
           path: ${{ env.MANIFEST_NAME }}

.github/workflows/build-msi.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -240,12 +240,12 @@ jobs:
       # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (MSI)
         if: inputs.upload_blob
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: ${{ env.STABLE_MSI }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
           path: ${{ env.STABLE_MSI }}

.github/workflows/ci.yml

@@ -1,8 +1,8 @@
 name: CI
 
 # Tests, typechecks and drift-checks every push to main and every pull request:
-# the .NET suites, the web and MCP suites, and a guard that the generated rule
-# files still match rules/guardrails.json.
+# the .NET suites, the web and MCP suites, a guard that the generated rule
+# files still match rules/guardrails.json, and the duplicate-code check.
 #
 # The deploy workflows build but never test, so this is the only place the suites
 # actually run. It does not gate anything — main is deliberately unprotected, so a
@@ -98,11 +98,11 @@ jobs:
     # windows-latest is required: the agent test projects target net48.
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
 
@@ -124,6 +124,9 @@ jobs:
       - name: Summary Dialog tests
         run: dotnet test src/Agent/AutopilotMonitor.SummaryDialog.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
 
+      - name: Push tests
+        run: dotnet test src/Push/AutopilotMonitor.Push.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
+
   web:
     name: Web (typecheck + tests)
     runs-on: ubuntu-latest
@@ -131,11 +134,11 @@ jobs:
       run:
         working-directory: src/Web/autopilot-monitor-web
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -157,6 +160,12 @@ jobs:
       - name: Lint
         run: npm run lint -- --max-warnings 0
 
+      # Unused files, exports and dependencies (knip.json). Its own script on
+      # purpose: chained into `lint`, the `-- --max-warnings 0` above would be
+      # handed to knip and ESLint would lose its cap.
+      - name: Unused code
+        run: npm run knip
+
       - name: Tests
         run: npm test
 
@@ -167,11 +176,11 @@ jobs:
       run:
         working-directory: src/McpServer/autopilot-monitor-mcp
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -179,9 +188,19 @@ jobs:
 
       - run: npm ci
 
+      # tsconfig.json covers sources, tests and scripts; the build emits via
+      # tsconfig.build.json.
       - name: Typecheck
         run: npx tsc --noEmit
 
+      # Same rule as the web job: any warning fails — fix new findings, never
+      # raise the cap.
+      - name: Lint
+        run: npm run lint -- --max-warnings 0
+
+      - name: Unused code
+        run: npm run knip
+
       # The vector-search tests tokenize with the real all-MiniLM-L6-v2 model
       # (~23 MB tokenizer + ONNX weights). transformers.js caches under
       # node_modules by default, which npm ci recreates — so every CI run
@@ -189,7 +208,7 @@ jobs:
       # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
       # is honored by vector-search-provider.ts.
       - name: Cache embedding model
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ github.workspace }}/.hf-cache
           key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -203,11 +222,11 @@ jobs:
     name: Generated guardrails match rules/guardrails.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
@@ -226,11 +245,11 @@ jobs:
     name: Generated wire types match shared-manifests.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
@@ -244,8 +263,33 @@ jobs:
 
       - name: Fail if the generated files drifted
         run: |
-          if ! git diff --quiet -- src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts src/Web/autopilot-monitor-web/utils/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-vocabularies.generated.ts; then
+          if ! git diff --quiet -- src/Web/autopilot-monitor-web/lib/generated/shared-manifests.generated.ts src/Web/autopilot-monitor-web/lib/generated/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-vocabularies.generated.ts; then
             echo "::error::Generated wire types are out of date. Run 'npm run generate:manifests' in src/Web/autopilot-monitor-web and commit the result."
             git diff --stat
             exit 1
           fi
+
+  duplicates:
+    name: Duplicate code
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: tools/quality
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: tools/quality/package-lock.json
+
+      - run: npm ci --ignore-scripts
+
+      # jscpd over the C# and TypeScript sources (.jscpd.json). A clone missing from
+      # jscpd-baseline.json fails, and so does a baseline entry whose clone is gone,
+      # so the baseline only shrinks. Locally: npm run dup in tools/quality.
+      - name: Duplicate check
+        run: npm run dup

.github/workflows/codeql.yml

@@ -104,11 +104,11 @@ jobs:
             build-mode: none
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         if: matrix.language == 'csharp'
         with:
           dotnet-version: '10.0.x'

.github/workflows/combine-rules.yml

@@ -24,49 +24,26 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
       # Lockfile and no lifecycle scripts: this job holds contents:write and pushes to
       # main, so an install-time script from a hijacked package would run with a token that
-      # can rewrite the repository. rules/scripts/package-lock.json pins ajv-cli, ajv-formats
+      # can rewrite the repository. rules/scripts/package-lock.json pins ajv, ajv-formats
       # and every transitive package (Dependabot keeps it current); ajv is pure JS and
       # needs no install hooks.
-      - name: Install ajv-cli from the lockfile
+      - name: Install the rules validator from the lockfile
         working-directory: rules/scripts
-        run: |
-          npm ci --ignore-scripts
-          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
+        run: npm ci --ignore-scripts
 
-      - name: Validate Gather Rules
-        run: |
-          for f in rules/gather/*.json; do
-            echo "Validating $f..."
-            ajv validate -s rules/schema/gather-rule.schema.json -d "$f" --spec=draft2020 -c ajv-formats
-          done
-
-      - name: Validate Analyze Rules
-        run: |
-          for f in rules/analyze/*.json; do
-            echo "Validating $f..."
-            ajv validate -s rules/schema/analyze-rule.schema.json -d "$f" --spec=draft2020 -c ajv-formats
-          done
-
-      - name: Validate IME Log Patterns
-        run: |
-          for f in rules/ime-log-patterns/*.json; do
-            echo "Validating $f..."
-            ajv validate -s rules/schema/ime-log-pattern.schema.json -d "$f" --spec=draft2020 -c ajv-formats
-          done
-
-      # guardrails.json values are baked verbatim into generated TypeScript that is
-      # auto-committed to main and shipped to the portal - the schema forbids control
-      # and line-terminator characters so a "data" PR can never become code.
-      - name: Validate Guardrails
-        run: ajv validate -s rules/schema/guardrails.schema.json -d rules/guardrails.json --spec=draft2020 -c ajv-formats
+      # Gather, analyze and IME log pattern files plus guardrails.json, each against its
+      # schema; the guardrails schema is what keeps a "data" PR from becoming code in the
+      # generated TypeScript (see validate.js).
+      - name: Validate rules and guardrails against their schemas
+        run: node rules/scripts/validate.js
 
       - name: Combine rules into dist/
         run: node rules/scripts/combine.js
@@ -83,7 +60,7 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add -- rules/dist/ \
-            src/Web/autopilot-monitor-web/utils/guardrails.generated.ts \
+            src/Web/autopilot-monitor-web/lib/generated/guardrails.generated.ts \
             src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts
           if git diff --cached --quiet; then
             echo "Generated outputs unchanged - nothing to commit"

.github/workflows/deploy-backend.yml

@@ -19,7 +19,7 @@ jobs:
     name: Build and Deploy Backend
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -31,7 +31,7 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
 
@@ -67,7 +67,7 @@ jobs:
         run: dotnet publish ${{ env.CSPROJ_PATH }} --configuration Release --output ./publish --no-build -p:SourceRevisionId=${{ github.sha }} -p:BuildNumber=${{ steps.version.outputs.build_number }} -p:BuildTimestampUtc=${{ steps.version.outputs.build_utc }}
 
       - name: Deploy to Azure Functions
-        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1
+        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7
         with:
           app-name: ${{ env.FUNCTION_APP }}
           package: ./publish

.github/workflows/deploy-mcp.yml

@@ -26,7 +26,7 @@ jobs:
     name: Build and Deploy MCP Server
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -38,7 +38,7 @@ jobs:
       # re-run actually rolls a new revision). /health reports the SHA captured
       # below so that staleness is checkable.
       - name: Check out documentation bundle
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: autopilotmonitor/autopilotmonitor-docs

.github/workflows/deploy-web.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and Deploy Job
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           lfs: false
@@ -57,7 +57,7 @@ jobs:
       # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
       # records which docs commit is live.
       - name: Check out documentation bundle
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           repository: autopilotmonitor/autopilotmonitor-docs
@@ -68,7 +68,7 @@ jobs:
         id: docs
         run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -140,12 +140,12 @@ jobs:
       # commit, workflow file) in a public transparency log.
       # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: ${{ steps.package.outputs.archive }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: portal-${{ github.sha }}
           path: ${{ steps.package.outputs.archive }}

.github/workflows/publish-scripts.yml

@@ -60,7 +60,7 @@ jobs:
       contents: read
       id-token: write   # OIDC federated login for the storage writes (secret-less)
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -135,7 +135,7 @@ jobs:
       # when someone wants to look at the file.
       - name: Upload signed scripts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: signed-scripts
           path: ${{ runner.temp }}/signed-scripts

AutopilotMonitor.sln

@@ -31,6 +31,12 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.Agent.V2.C
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.SummaryDialog.Tests", "src\Agent\AutopilotMonitor.SummaryDialog.Tests\AutopilotMonitor.SummaryDialog.Tests.csproj", "{4F1234C1-9387-4D2C-93E0-713698A2DFCB}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Push", "Push", "{09266D87-DDB8-2F61-A22F-10D1DD295F4F}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.Push", "src\Push\AutopilotMonitor.Push\AutopilotMonitor.Push.csproj", "{2C3E71E4-0049-45A5-839D-F4171B47D5F3}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "AutopilotMonitor.Push.Tests", "src\Push\AutopilotMonitor.Push.Tests\AutopilotMonitor.Push.Tests.csproj", "{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -161,6 +167,30 @@ Global
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB}.Release|x64.Build.0 = Release|Any CPU
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB}.Release|x86.ActiveCfg = Release|Any CPU
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB}.Release|x86.Build.0 = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x64.Build.0 = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Debug|x86.Build.0 = Debug|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|Any CPU.Build.0 = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x64.ActiveCfg = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x64.Build.0 = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x86.ActiveCfg = Release|Any CPU
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3}.Release|x86.Build.0 = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x64.Build.0 = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Debug|x86.Build.0 = Debug|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x64.ActiveCfg = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x64.Build.0 = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x86.ActiveCfg = Release|Any CPU
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -179,5 +209,8 @@ Global
 		{11B36E5C-B512-4D1E-A76B-E5AD866B033C} = {096B6098-F141-7114-B090-72D1899D8853}
 		{95A09BF0-4E22-41D9-9B43-8D6ECC2C8AD0} = {096B6098-F141-7114-B090-72D1899D8853}
 		{4F1234C1-9387-4D2C-93E0-713698A2DFCB} = {096B6098-F141-7114-B090-72D1899D8853}
+		{09266D87-DDB8-2F61-A22F-10D1DD295F4F} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
+		{2C3E71E4-0049-45A5-839D-F4171B47D5F3} = {09266D87-DDB8-2F61-A22F-10D1DD295F4F}
+		{6BB95C52-F9D5-4C48-A107-B2B1FD5EE302} = {09266D87-DDB8-2F61-A22F-10D1DD295F4F}
 	EndGlobalSection
 EndGlobal

Directory.Build.props

@@ -8,5 +8,8 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <MSBuildTreatWarningsAsErrors>true</MSBuildTreatWarningsAsErrors>
     <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
+    <!-- Run the IDE code-style analyzers in the build too, so the rules .editorconfig raises
+         to warning fail it like any compiler warning. -->
+    <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
   </PropertyGroup>
 </Project>

rules/analyze/ANALYZE-DEV-007.json

@@ -5,7 +5,7 @@
   "description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts.",
   "severity": "warning",
   "category": "device",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "author": "Autopilot Monitor",
   "enabled": true,
   "evaluateOn": [
@@ -17,7 +17,7 @@
   "confidenceThreshold": 50,
   "conditions": [
     {
-      "signal": "clock_ahead",
+      "signal": "clock_behind",
       "source": "event_data",
       "eventType": "ntp_time_check",
       "dataField": "offsetSeconds",
@@ -26,7 +26,7 @@
       "required": false
     },
     {
-      "signal": "clock_behind",
+      "signal": "clock_ahead",
       "source": "event_data",
       "eventType": "ntp_time_check",
       "dataField": "offsetSeconds",

rules/analyze/ANALYZE-DEV-013.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-013",
+  "title": "OOBE Quality Update Failed",
+  "description": "Detects that the Windows quality update page at the end of OOBE (Enrollment Status Page setting \"Install Windows quality updates\") reported a failed download or install and recorded no successful install afterwards — the page's own failure names on the oobe_update_page events. Setup usually continues, so the failure is otherwise invisible: the device finishes OOBE without the monthly security update. An OS build change across a restart (os_build_changed) vetoes the finding, and so does the agent's names_capped marker — once the page's event names were capped, a missing success name proves nothing. A downloadInstallFailureHelper entry alone is no failure: updates that installed fine log it too.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "update_failure",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "in",
+      "value": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+      "required": true
+    },
+    {
+      "signal": "no_install_success",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+      "required": true
+    },
+    {
+      "signal": "os_build_unchanged",
+      "source": "event_type",
+      "eventType": "os_build_changed",
+      "operator": "not_exists",
+      "value": "",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    },
+    {
+      "signal": "update_page_failed",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "result",
+      "operator": "equals",
+      "value": "fail",
+      "filterField": "page",
+      "filterOperator": "equals",
+      "filterValue": "OobeNDUP",
+      "required": false
+    },
+    {
+      "signal": "update_skipped",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "regex",
+      "value": "SkipDownloadInstallButtonClicked$",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "update_page_failed",
+      "condition": "exists",
+      "weight": 10
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE reported `{{update_failure}}`, and no successful install was recorded afterwards. When the download or install of the update fails, the page gives up and setup continues, so the enrollment itself can still succeed — but the device most likely finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. Selecting Skip on the page after the failure leads to the same result.",
+  "remediation": [
+    {
+      "title": "Find out why the update failed",
+      "steps": [
+        "Open the oobe_update_page events around the failure in the session timeline: the download progress before it shows how far the download got, and a Skip after it shows that someone chose to continue.",
+        "Check the network path the device uses during OOBE for Windows Update and Delivery Optimization: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+        "Compare with other devices: the same failure on many devices of one site points at the network path, on one model at the device, and across the fleet at the update itself."
+      ]
+    },
+    {
+      "title": "Make sure the device gets the update",
+      "steps": [
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule.",
+        "Where the OOBE quality update keeps failing for one network or device group, decide per Enrollment Status Page profile whether \"Install Windows quality updates\" should stay on."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}

rules/analyze/ANALYZE-DEV-014.json

@@ -0,0 +1,119 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-014",
+  "title": "OOBE Quality Update Not Offered After an Earlier Failure",
+  "description": "Detects that the Windows quality update page at the end of OOBE found no update to install although the device is out of date, on a device whose update page counts an earlier failed download or install (oobe_update_page: NDUPDownloadInstallPreviousFailureCount above 0, osUpdatesWithNDUPPI false, getDaysOutOfDateSucceeded above 0). No failure and no install success are recorded in this session — a failure in this session is ANALYZE-DEV-013 — and the agent's names_capped marker vetoes the finding, because a missing name proves nothing once the page's names were capped. The device finishes OOBE without the monthly security update.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "previous_failures",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "SdxWebAppCloudNDUP_initialize_NDUPDownloadInstallPreviousFailureCount",
+      "required": true
+    },
+    {
+      "signal": "nothing_offered",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "equals",
+      "value": "false",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "SdxWebAppCloudNDUP_updateManager_processUpdatesMetadata_osUpdatesWithNDUPPI",
+      "required": true
+    },
+    {
+      "signal": "days_out_of_date",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+      "required": true
+    },
+    {
+      "signal": "no_update_failure",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "in",
+      "filterValue": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+      "required": true
+    },
+    {
+      "signal": "no_install_success",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE checked for updates and found none to install, although Windows reports the device as {{days_out_of_date}} days out of date. The page's failure counter for this device stands at {{previous_failures}}: an earlier download or install of an OOBE quality update on this device failed. The device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment.",
+  "remediation": [
+    {
+      "title": "Check the earlier attempt",
+      "steps": [
+        "Look at the device's earlier enrollment sessions — the failed attempt and its ANALYZE-DEV-013 finding are usually there.",
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+      ]
+    },
+    {
+      "title": "Reduce how far behind devices start",
+      "steps": [
+        "Devices that start OOBE many months behind need a long update during setup; a current OS image or factory build shortens it and gives a failed attempt less to repeat."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}

rules/analyze/ANALYZE-DEV-015.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-015",
+  "title": "OOBE Update Check Ended Without a Result",
+  "description": "Detects that the Windows quality update page at the end of OOBE started its Windows Update scan but ended without a scan result (oobe_update_page: startWUScanStartedSuccedded, an OobeNDUP stop and no ExpeditedUpdate_getUpdateResults name), on a device that is out of date and allowed to update. In the observed sessions the page ended two minutes after the scan started, on devices more than a year behind. The device finishes OOBE without the monthly security update. The agent's names_capped marker vetoes the finding: once the page's event names were capped, a missing scan result proves nothing.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "update_allowed",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "equals",
+      "value": "true",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded",
+      "required": true
+    },
+    {
+      "signal": "scan_started",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "equals",
+      "value": "ExpeditedUpdate_startWUScanStartedSuccedded",
+      "required": true
+    },
+    {
+      "signal": "no_scan_result",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "name",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "name",
+      "filterOperator": "regex",
+      "filterValue": "^ExpeditedUpdate_getUpdateResults",
+      "required": true
+    },
+    {
+      "signal": "update_page_ended",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "equals",
+      "value": "page_stopped",
+      "filterField": "page",
+      "filterOperator": "equals",
+      "filterValue": "OobeNDUP",
+      "required": true
+    },
+    {
+      "signal": "days_out_of_date",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "value",
+      "operator": "gt",
+      "value": "0",
+      "filterField": "name",
+      "filterOperator": "equals",
+      "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+      "required": true
+    },
+    {
+      "signal": "page_names_complete",
+      "source": "event_data",
+      "eventType": "oobe_update_page",
+      "dataField": "cxhEvent",
+      "operator": "not_exists",
+      "value": "",
+      "filterField": "cxhEvent",
+      "filterOperator": "equals",
+      "filterValue": "names_capped",
+      "required": true
+    }
+  ],
+  "explanation": "The Windows quality update page at the end of OOBE started a Windows Update scan, but no scan result arrived before the page ended. The device is {{days_out_of_date}} days out of date, so an update was due — the device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. The page waits only a short time for the scan (two minutes in the observed sessions): a scan that takes longer, or cannot reach Windows Update, ends the page without an update.",
+  "remediation": [
+    {
+      "title": "Check the path to Windows Update during OOBE",
+      "steps": [
+        "Verify that devices in OOBE reach the Windows Update service: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+        "Check whether an update policy applied during the Enrollment Status Page points the scan at another source, such as WSUS."
+      ]
+    },
+    {
+      "title": "Shorten the scan",
+      "steps": [
+        "Devices far behind scan longer; a current OS image or factory build keeps the OOBE scan short.",
+        "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+      "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "quality-update"
+  ]
+}

rules/dist/analyze-rules.json

@@ -1654,7 +1654,7 @@
       "description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts.",
       "severity": "warning",
       "category": "device",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "author": "Autopilot Monitor",
       "enabled": true,
       "evaluateOn": [
@@ -1666,7 +1666,7 @@
       "confidenceThreshold": 50,
       "conditions": [
         {
-          "signal": "clock_ahead",
+          "signal": "clock_behind",
           "source": "event_data",
           "eventType": "ntp_time_check",
           "dataField": "offsetSeconds",
@@ -1675,7 +1675,7 @@
           "required": false
         },
         {
-          "signal": "clock_behind",
+          "signal": "clock_ahead",
           "source": "event_data",
           "eventType": "ntp_time_check",
           "dataField": "offsetSeconds",
@@ -1930,6 +1930,357 @@
         "environment"
       ]
     },
+    {
+      "ruleId": "ANALYZE-DEV-013",
+      "title": "OOBE Quality Update Failed",
+      "description": "Detects that the Windows quality update page at the end of OOBE (Enrollment Status Page setting \"Install Windows quality updates\") reported a failed download or install and recorded no successful install afterwards — the page's own failure names on the oobe_update_page events. Setup usually continues, so the failure is otherwise invisible: the device finishes OOBE without the monthly security update. An OS build change across a restart (os_build_changed) vetoes the finding, and so does the agent's names_capped marker — once the page's event names were capped, a missing success name proves nothing. A downloadInstallFailureHelper entry alone is no failure: updates that installed fine log it too.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "update_failure",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "in",
+          "value": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+          "required": true
+        },
+        {
+          "signal": "no_install_success",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+          "required": true
+        },
+        {
+          "signal": "os_build_unchanged",
+          "source": "event_type",
+          "eventType": "os_build_changed",
+          "operator": "not_exists",
+          "value": "",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        },
+        {
+          "signal": "update_page_failed",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "result",
+          "operator": "equals",
+          "value": "fail",
+          "filterField": "page",
+          "filterOperator": "equals",
+          "filterValue": "OobeNDUP",
+          "required": false
+        },
+        {
+          "signal": "update_skipped",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "regex",
+          "value": "SkipDownloadInstallButtonClicked$",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "update_page_failed",
+          "condition": "exists",
+          "weight": 10
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE reported `{{update_failure}}`, and no successful install was recorded afterwards. When the download or install of the update fails, the page gives up and setup continues, so the enrollment itself can still succeed — but the device most likely finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. Selecting Skip on the page after the failure leads to the same result.",
+      "remediation": [
+        {
+          "title": "Find out why the update failed",
+          "steps": [
+            "Open the oobe_update_page events around the failure in the session timeline: the download progress before it shows how far the download got, and a Skip after it shows that someone chose to continue.",
+            "Check the network path the device uses during OOBE for Windows Update and Delivery Optimization: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+            "Compare with other devices: the same failure on many devices of one site points at the network path, on one model at the device, and across the fleet at the update itself."
+          ]
+        },
+        {
+          "title": "Make sure the device gets the update",
+          "steps": [
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule.",
+            "Where the OOBE quality update keeps failing for one network or device group, decide per Enrollment Status Page profile whether \"Install Windows quality updates\" should stay on."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-014",
+      "title": "OOBE Quality Update Not Offered After an Earlier Failure",
+      "description": "Detects that the Windows quality update page at the end of OOBE found no update to install although the device is out of date, on a device whose update page counts an earlier failed download or install (oobe_update_page: NDUPDownloadInstallPreviousFailureCount above 0, osUpdatesWithNDUPPI false, getDaysOutOfDateSucceeded above 0). No failure and no install success are recorded in this session — a failure in this session is ANALYZE-DEV-013 — and the agent's names_capped marker vetoes the finding, because a missing name proves nothing once the page's names were capped. The device finishes OOBE without the monthly security update.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "previous_failures",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "SdxWebAppCloudNDUP_initialize_NDUPDownloadInstallPreviousFailureCount",
+          "required": true
+        },
+        {
+          "signal": "nothing_offered",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "equals",
+          "value": "false",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "SdxWebAppCloudNDUP_updateManager_processUpdatesMetadata_osUpdatesWithNDUPPI",
+          "required": true
+        },
+        {
+          "signal": "days_out_of_date",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+          "required": true
+        },
+        {
+          "signal": "no_update_failure",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "in",
+          "filterValue": "SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadFailedError,SdxWebAppCloudNDUP_processStatusChangeFromHandler_installFailedError,ExpeditedUpdate_commitExpeditionDownloadInstallAsyncFailure",
+          "required": true
+        },
+        {
+          "signal": "no_install_success",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "installSucceededRebootRequired|commitExpeditionDownloadInstallAsyncSucceeded",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE checked for updates and found none to install, although Windows reports the device as {{days_out_of_date}} days out of date. The page's failure counter for this device stands at {{previous_failures}}: an earlier download or install of an OOBE quality update on this device failed. The device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment.",
+      "remediation": [
+        {
+          "title": "Check the earlier attempt",
+          "steps": [
+            "Look at the device's earlier enrollment sessions — the failed attempt and its ANALYZE-DEV-013 finding are usually there.",
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+          ]
+        },
+        {
+          "title": "Reduce how far behind devices start",
+          "steps": [
+            "Devices that start OOBE many months behind need a long update during setup; a current OS image or factory build shortens it and gives a failed attempt less to repeat."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
+    {
+      "ruleId": "ANALYZE-DEV-015",
+      "title": "OOBE Update Check Ended Without a Result",
+      "description": "Detects that the Windows quality update page at the end of OOBE started its Windows Update scan but ended without a scan result (oobe_update_page: startWUScanStartedSuccedded, an OobeNDUP stop and no ExpeditedUpdate_getUpdateResults name), on a device that is out of date and allowed to update. In the observed sessions the page ended two minutes after the scan started, on devices more than a year behind. The device finishes OOBE without the monthly security update. The agent's names_capped marker vetoes the finding: once the page's event names were capped, a missing scan result proves nothing.",
+      "severity": "warning",
+      "category": "device",
+      "version": "1.0.0",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end"
+      ],
+      "trigger": "single",
+      "baseConfidence": 75,
+      "confidenceThreshold": 60,
+      "conditions": [
+        {
+          "signal": "update_allowed",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "equals",
+          "value": "true",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded",
+          "required": true
+        },
+        {
+          "signal": "scan_started",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "equals",
+          "value": "ExpeditedUpdate_startWUScanStartedSuccedded",
+          "required": true
+        },
+        {
+          "signal": "no_scan_result",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "name",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "name",
+          "filterOperator": "regex",
+          "filterValue": "^ExpeditedUpdate_getUpdateResults",
+          "required": true
+        },
+        {
+          "signal": "update_page_ended",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "equals",
+          "value": "page_stopped",
+          "filterField": "page",
+          "filterOperator": "equals",
+          "filterValue": "OobeNDUP",
+          "required": true
+        },
+        {
+          "signal": "days_out_of_date",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "value",
+          "operator": "gt",
+          "value": "0",
+          "filterField": "name",
+          "filterOperator": "equals",
+          "filterValue": "ExpeditedUpdate_getDaysOutOfDateSucceeded",
+          "required": true
+        },
+        {
+          "signal": "page_names_complete",
+          "source": "event_data",
+          "eventType": "oobe_update_page",
+          "dataField": "cxhEvent",
+          "operator": "not_exists",
+          "value": "",
+          "filterField": "cxhEvent",
+          "filterOperator": "equals",
+          "filterValue": "names_capped",
+          "required": true
+        }
+      ],
+      "explanation": "The Windows quality update page at the end of OOBE started a Windows Update scan, but no scan result arrived before the page ended. The device is {{days_out_of_date}} days out of date, so an update was due — the device finished OOBE without the monthly security update and installs it only later, through the Windows Update policy that applies after enrollment. The page waits only a short time for the scan (two minutes in the observed sessions): a scan that takes longer, or cannot reach Windows Update, ends the page without an update.",
+      "remediation": [
+        {
+          "title": "Check the path to Windows Update during OOBE",
+          "steps": [
+            "Verify that devices in OOBE reach the Windows Update service: proxy, TLS inspection and firewall rules for the Windows Update endpoints.",
+            "Check whether an update policy applied during the Enrollment Status Page points the scan at another source, such as WSUS."
+          ]
+        },
+        {
+          "title": "Shorten the scan",
+          "steps": [
+            "Devices far behind scan longer; a current OS image or factory build keeps the OOBE scan short.",
+            "Verify the device's patch level after enrollment; the update ring assigned to the device installs the missing monthly security update on its normal schedule."
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Install Windows quality updates during OOBE (Enrollment Status Page)",
+          "url": "https://learn.microsoft.com/en-us/intune/device-enrollment/windows/setup-status-page#windows-monthly-security-update-release-details"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "device",
+        "windows-update",
+        "oobe",
+        "quality-update"
+      ]
+    },
     {
       "ruleId": "ANALYZE-ENRL-001",
       "title": "Enrollment Failed",

rules/scripts/.npmrc

@@ -1,3 +0,0 @@
-# ajv-cli declares ts-node as a peer dependency it never needs for JSON schemas; do not
-# pull ts-node + typescript into a job that pushes to main.
-legacy-peer-deps=true

rules/scripts/combine.js

@@ -86,12 +86,12 @@ for (const config of configs) {
 // ── Guardrails generation ───────────────────────────────────────────────────
 
 const guardrailsPath = path.join(rulesRoot, 'guardrails.json');
-// NOTE: consumers import from "@/utils/guardrails.generated" (see guardValidation.ts
+// NOTE: consumers import from "@/lib/generated/guardrails.generated" (see guardValidation.ts
 // and SectionGatherRules.tsx). The web re-org (commit a3e8e044) moved this file to
 // utils/ but left this output path pointing at the now-orphaned lib/ copy, which
 // silently froze the live allowlist. Keep this in sync with the import path.
 const guardrailsOutput = path.resolve(
-  rulesRoot, '..', 'src', 'Web', 'autopilot-monitor-web', 'utils', 'guardrails.generated.ts'
+  rulesRoot, '..', 'src', 'Web', 'autopilot-monitor-web', 'lib', 'generated', 'guardrails.generated.ts'
 );
 
 if (fs.existsSync(guardrailsPath)) {

rules/scripts/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "autopilot-monitor-rules-tooling",
       "devDependencies": {
-        "ajv-cli": "5.0.0",
+        "ajv": "8.20.0",
         "ajv-formats": "3.0.1"
       }
     },
@@ -27,33 +27,6 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ajv-cli": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ajv-cli/-/ajv-cli-5.0.0.tgz",
-      "integrity": "sha512-LY4m6dUv44HTyhV+u2z5uX4EhPYTM38Iv1jdgDJJJCyOOuqB8KtZEGjPZ2T+sh5ZIJrXUfgErYx/j3gLd3+PlQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0",
-        "fast-json-patch": "^2.0.0",
-        "glob": "^7.1.0",
-        "js-yaml": "^3.14.0",
-        "json-schema-migrate": "^2.0.0",
-        "json5": "^2.1.3",
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "ajv": "dist/index.js"
-      },
-      "peerDependencies": {
-        "ts-node": ">=9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ts-node": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/ajv-formats": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
@@ -72,55 +45,6 @@
         }
       }
     },
-    "node_modules/argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
-      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -128,13 +52,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-json-patch": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz",
-      "integrity": "sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/fast-uri": {
       "version": "3.1.8",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
@@ -152,78 +69,6 @@
       ],
       "license": "BSD-3-Clause"
     },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/js-yaml": {
-      "version": "3.15.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
-      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/json-schema-migrate": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-migrate/-/json-schema-migrate-2.0.0.tgz",
-      "integrity": "sha512-r38SVTtojDRp4eD6WsCqiE0eNDt4v1WalBXb9cyZYw9ai5cGtBwzRNWjHzJl38w6TxFkXAIA7h+fyX3tnrAFhQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0"
-      }
-    },
     "node_modules/json-schema-traverse": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
@@ -231,62 +76,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/json5": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "json5": "lib/cli.js"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/require-from-string": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@ -296,20 +85,6 @@
       "engines": {
         "node": ">=0.10.0"
       }
-    },
-    "node_modules/sprintf-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
-      "license": "ISC"
     }
   }
 }

rules/scripts/package.json

@@ -3,10 +3,7 @@
   "private": true,
   "description": "Validator tooling for rules/ - combine-rules.yml installs from the lockfile so nothing unpinned reaches a job that pushes to main.",
   "devDependencies": {
-    "ajv-cli": "5.0.0",
+    "ajv": "8.20.0",
     "ajv-formats": "3.0.1"
-  },
-  "overrides": {
-    "fast-json-patch": "3.1.1"
   }
 }

rules/scripts/validate.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * Validates every rule file and rules/guardrails.json against its JSON Schema
+ * (draft 2020-12). combine-rules.yml runs this before combine.js; any invalid
+ * file fails the run with exit code 1.
+ *
+ * Run: node rules/scripts/validate.js   (after `npm ci --ignore-scripts` in rules/scripts)
+ */
+
+const fs = require('fs');
+const path = require('path');
+const Ajv2020 = require('ajv/dist/2020');
+const addFormats = require('ajv-formats');
+
+const rulesRoot = path.resolve(__dirname, '..');
+
+const jsonFilesIn = (dir) =>
+  fs.readdirSync(path.join(rulesRoot, dir)).filter(f => f.endsWith('.json')).sort().map(f => `${dir}/${f}`);
+
+const sets = [
+  { schema: 'gather-rule.schema.json', files: jsonFilesIn('gather') },
+  { schema: 'analyze-rule.schema.json', files: jsonFilesIn('analyze') },
+  { schema: 'ime-log-pattern.schema.json', files: jsonFilesIn('ime-log-patterns') },
+  // guardrails.json values are baked verbatim into generated TypeScript that is
+  // auto-committed to main and shipped to the portal - the schema forbids control
+  // and line-terminator characters so a "data" PR can never become code.
+  { schema: 'guardrails.schema.json', files: ['guardrails.json'] }
+];
+
+const ajv = new Ajv2020({ allErrors: true });
+addFormats(ajv);
+
+let invalid = 0;
+
+for (const set of sets) {
+  const validate = ajv.compile(JSON.parse(fs.readFileSync(path.join(rulesRoot, 'schema', set.schema), 'utf8')));
+
+  for (const file of set.files) {
+    let data;
+    try {
+      data = JSON.parse(fs.readFileSync(path.join(rulesRoot, file), 'utf8'));
+    } catch (err) {
+      invalid++;
+      console.error(`INVALID rules/${file}: ${err.message}`);
+      continue;
+    }
+
+    if (!validate(data)) {
+      invalid++;
+      console.error(`INVALID rules/${file}`);
+      for (const e of validate.errors) {
+        console.error(`  ${e.instancePath || '(root)'} ${e.message} ${JSON.stringify(e.params)}`);
+      }
+    }
+  }
+
+  console.log(`${set.schema}: ${set.files.length} files checked`);
+}
+
+if (invalid > 0) {
+  console.error(`ERROR: ${invalid} file(s) failed schema validation`);
+  process.exit(1);
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/RemoteConfigServiceRetryTests.cs

@@ -144,7 +144,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(4, svc.LastFetchAttempts);
         }
 
-        // ── Network-link gate (tenant aebdce78 audit 2026-08-24) ────────────
+        // ── Network-link gate (kiosk-tenant audit 2026-08-24) ────────────
 
         [Fact]
         public async Task FetchConfig_InitialFetch_WaitsForNetworkLink()

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Analyzers/SoftwareInventoryRegistryTextTests.cs

@@ -0,0 +1,31 @@
+#nullable enable
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Analyzers
+{
+    /// <summary>
+    /// Uninstall-key strings are read the way Windows shows them: up to the first NUL. Installers
+    /// that pad REG_SZ data with NULs otherwise leak them into the normalized vendor/name, which
+    /// the backend turns into a table key.
+    /// </summary>
+    public sealed class SoftwareInventoryRegistryTextTests
+    {
+        [Theory]
+        [InlineData("Contoso Widget", "Contoso Widget")]
+        [InlineData("Contoso Widget\0\0\0\0\0", "Contoso Widget")]
+        [InlineData("Contoso\0stale buffer", "Contoso")]
+        [InlineData("\0\0\0", "")]
+        [InlineData("", "")]
+        public void CutAtNul_KeepsTheTextBeforeTheFirstNul(string raw, string expected)
+        {
+            Assert.Equal(expected, SoftwareInventoryAnalyzer.CutAtNul(raw));
+        }
+
+        [Fact]
+        public void CutAtNul_Null_StaysNull()
+        {
+            Assert.Null(SoftwareInventoryAnalyzer.CutAtNul(null!));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/EspAndHelloTrackerStarvedAppsTests.cs

@@ -174,7 +174,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
         [Fact]
         public void Reevaluate_does_not_re_emit_starved_warnings()
         {
-            // sits-d Cloud-PC fix (2026-08-19): the synthesis re-check now runs on EVERY IME
+            // Cloud-PC fix (2026-08-19): the synthesis re-check now runs on EVERY IME
             // app-state transition. It must not turn the one-shot starvation warning into a
             // per-transition stream — the re-check path suppresses the emission entirely
             // (the per-appId dedupe would swallow the duplicates, but walking the probe
@@ -198,7 +198,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
         [Fact]
         public void Starved_apps_that_settle_later_still_complete_the_enrollment()
         {
-            // The real sits-d shape: the ESP exits with apps still starved (warning emitted),
+            // The real field shape: the ESP exits with apps still starved (warning emitted),
             // the apps then all settle, and the re-check must open the gate — the warning
             // already on the timeline is history, not a permanent veto.
             using var f = new Fixture();

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/EspAndHelloTrackerUserAppsSettledSynthesisTests.cs

@@ -172,8 +172,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
         }
 
         // ------------------------------------------------------------------------------
-        // sits-d Cloud-PC fix (2026-08-19) — the synthesis is no longer edge-only.
-        // Sessions 8110e262 / a89aac2d: the ESP page exited while 138 required user-ESP apps
+        // Cloud-PC fix (2026-08-19) — the synthesis is no longer edge-only.
+        // Two field sessions: the ESP page exited while 138 required user-ESP apps
         // were still in flight, they all reached a terminal state (0 failed) minutes later,
         // and because nothing re-checked, the enrollment never completed.
         // ------------------------------------------------------------------------------

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.RetryPairing.cs

@@ -0,0 +1,336 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// B-96m: IME re-runs a failed platform script on later check-ins, so AgentExecutor.log can hold several runs of one
+    /// policy before the tracker has read IME's result of the first — always on the agent's first pass (the agent starts
+    /// mid-enrollment and reads all of AgentExecutor.log before IntuneManagementExtension.log), after a restart, and
+    /// whenever a result line surfaces late. With one slot per policy the second executor start reused the first run's
+    /// slot and its end block overwrote the first one: the first IME result went out with the LAST run's exit code and
+    /// output (session eff1b413: the bootstrap script "Failed (exit 0)" with the stdout of its successful retry), every
+    /// later result without an end block. These tests pin one run per executor start, each IME result paired with the
+    /// run of its policy that started last before it, each run carrying its own end block.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private const string RetryPolicyId = "4c2d8e1a-7b3f-4a9e-8d21-6f0b5c3e9a74";
+        private const string RetryUser = "00000000-0000-0000-0000-000000000000";
+
+        private static string ImeEntryAt(string time, string message)
+            => $"<![LOG[{message}]LOG]!><time=\"{time}\" date=\"9-10-2026\" component=\"IntuneManagementExtension\" context=\"\" type=\"1\" thread=\"12\" file=\"\">\r\n";
+
+        /// <summary>One executor run's start block: banner, the platform argument line, paths, launch.</summary>
+        private static string RunStart(string time, string pid, string policyId = RetryPolicyId, string userId = RetryUser)
+        {
+            var path = $@"{ImeDir}\Policies\Scripts\{userId}_{policyId}.ps1";
+            var results = $@"{ImeDir}\Policies\Results\{userId}_{policyId}";
+            return ExecutorBanner(time)
+                + EntryAt(time, $"Adding argument powershell with value {path} to the named argument list.")
+                + EntryAt(time, "Powershell option gets invoked")
+                + EntryAt(time, path)
+                + EntryAt(time, results + ".output")
+                + EntryAt(time, results + ".error")
+                + EntryAt(time, results + ".timeout")
+                + ExecutorLaunch(time, path, pid);
+        }
+
+        /// <summary>
+        /// One executor run's end block in AgentExecutor's order. "error from script =" logs the stderr buffer before the
+        /// output readers finished (<paramref name="stderrSnapshot"/>); "write output done" logs the final texts, the
+        /// error part being exactly the error file IME judges.
+        /// </summary>
+        private static string RunEnd(string time, int exitCode, string stdout, string stderr, string? stderrSnapshot = null)
+            => EntryAt(time, $"Powershell exit code is {exitCode}")
+            + EntryAt(time, $"length of out={stdout.Length}")
+            + EntryAt(time, $"length of error={stderr.Length}")
+            + EntryAt(time, "error from script =" + (stderrSnapshot ?? stderr))
+            + EntryAt(time, exitCode == 0 ? "Powershell script is successfully executed." : "Powershell script is failed to execute")
+            + EntryAt(time, $"write output done. output = {stdout}, error = {stderr}")
+            + EntryAt(time, "Revert Wow64FsRedirection")
+            + EntryAt(time, "Agent executor completed.");
+
+        private static string ImeRunStart(string time, string policyId = RetryPolicyId, string userId = RetryUser)
+            => ImeEntryAt(time, $@"Script file {ImeDir}\Policies\Scripts\{userId}_{policyId}.ps1 is generated.");
+
+        private static string ImeRunResult(string time, string result, string policyId = RetryPolicyId, string userId = RetryUser)
+            => ImeEntryAt(time, $"[PowerShell] User Id = {userId}, Policy id = {policyId}, policy result = {result}");
+
+        private static void AppendImeLog(Harness h, string text)
+            => File.AppendAllText(Path.Combine(Path.GetDirectoryName(h.LogPath)!, "IntuneManagementExtension.log"), text, new UTF8Encoding(false));
+
+        /// <summary>Result | exit | stdout | stderr — readable in an assertion failure; "-" no exit code, "~" never read.</summary>
+        private static string Shape(ScriptExecutionState s)
+            => $"{s.Result}|{(s.ExitCode.HasValue ? s.ExitCode.Value.ToString() : "-")}|{s.Stdout ?? "~"}|{s.Stderr ?? "~"}";
+
+        /// <summary>
+        /// Two poll passes as the agent runs them (read the files, then the flushes), the second past the result hold:
+        /// a result missing its end block goes out by then.
+        /// </summary>
+        private static async Task PassAndSettle(Harness h)
+        {
+            await h.Tracker.RunPollPassAsync(default);
+            h.Now = h.Now.AddSeconds(6);
+            await h.Tracker.RunPollPassAsync(default);
+        }
+
+        [Fact]
+        public async Task First_pass_pairs_each_ime_result_with_the_end_block_of_its_own_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // IME's first run and two retries on later check-ins, all written before the agent started.
+            h.Append(RunStart("12:00:10.0000000", "1001") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "1002") + RunEnd("12:10:12.0000000", 1, "Run B output", "")
+                + RunStart("12:20:10.0000000", "1003") + RunEnd("12:20:12.0000000", 0, "Run C output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success")
+                + ImeRunStart("12:20:08.0000000") + ImeRunResult("12:20:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|1||Run A failed", "Success|1|Run B output|", "Success|0|Run C output|" },
+                h.Completed.Select(Shape).ToArray());
+            Assert.All(h.Completed, s => Assert.Equal("ime_policy_result", s.ResultSource));
+            Assert.True(h.Completed[0].StartedAtUtc < h.Completed[1].StartedAtUtc && h.Completed[1].StartedAtUtc < h.Completed[2].StartedAtUtc);
+            Assert.Equal(3, h.Completed.Select(s => s.RunId).Distinct().Count());
+        }
+
+        [Fact]
+        public async Task Retry_of_the_bootstrap_script_never_lends_its_success_output_to_the_failed_first_attempt()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "2001") + RunEnd("12:00:20.0000000", 1, "attempt 1: download failed", "Invoke-WebRequest : The remote name could not be resolved")
+                + RunStart("12:10:10.0000000", "2002") + RunEnd("12:10:20.0000000", 0, "===== Bootstrap Completed Successfully =====", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:20.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:20.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[]
+            {
+                "Failed|1|attempt 1: download failed|Invoke-WebRequest : The remote name could not be resolved",
+                "Success|0|===== Bootstrap Completed Successfully =====|",
+            }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_killed_at_the_timeout_reports_failed_without_the_next_runs_end_block()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // IME killed the first executor after 1800 s: its start block is all AgentExecutor.log holds of it.
+            h.Append(RunStart("12:00:10.0000000", "3001")
+                + RunStart("12:40:10.0000000", "3002") + RunEnd("12:40:12.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:30:10.5000000", "Failed")
+                + ImeRunStart("12:40:08.0000000") + ImeRunResult("12:40:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|-|~|~", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_whose_result_never_surfaced_falls_back_on_imes_rule_before_the_next_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "4001") + RunEnd("12:00:12.0000000", 0, "Run A output", "Run A wrote an error")
+                + RunStart("12:10:10.0000000", "4002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // Run A's result line was lost; run B's is there.
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|0|Run A output|Run A wrote an error", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.Equal(new[] { "agentexecutor_fallback", "ime_policy_result" }, h.Completed.Select(s => s.ResultSource).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_in_flight_survives_the_emit_of_the_run_before_it()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "5001") + RunEnd("12:00:12.0000000", 0, "Run A output", "")
+                + RunStart("12:10:10.0000000", "5002"));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Success") + ImeRunStart("12:10:08.0000000"));
+            await PassAndSettle(h);
+            h.Now = h.Now.AddSeconds(30);
+            await h.Pass();
+
+            // Run B ends minutes later.
+            h.Append(RunEnd("12:10:40.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunResult("12:10:40.1000000", "Success"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Success|0|Run A output|", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Shutdown_between_the_two_logs_flushes_each_run_with_its_own_end_block()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "6001") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "6002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // The pass is cancelled after AgentExecutor.log; the shutdown flush follows.
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now, force: true);
+
+            h.Restart();
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+            await PassAndSettle(h);
+
+            // Each run went out with its own block and IME's verdict on it; the results read after the restart are
+            // the same runs and change nothing.
+            Assert.Equal(new[] { "Failed|1||Run A failed", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.All(h.Completed, s => Assert.Equal("agentexecutor_fallback", s.ResultSource));
+        }
+
+        [Fact]
+        public async Task End_block_line_recovered_after_the_next_run_started_stays_with_its_own_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "7001"));
+            var exitLineAt = h.Length;
+            h.Append(RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "7002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            await h.Pass();
+
+            // A stale writer rewrites run A's exit line in place: the ledger check re-reads it behind run B's start.
+            h.Overwrite(exitLineAt, EntryAt("12:00:12.0000000", "Powershell exit code is 7"));
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|7||Run A failed", "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Run_without_result_or_end_block_is_dropped_once_a_later_run_has_its_result()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9001")
+                + RunStart("12:10:10.0000000", "9002") + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunStart("12:10:08.0000000") + ImeRunResult("12:10:12.1000000", "Success"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Success|0|Run B output|" }, h.Completed.Select(Shape).ToArray());
+            Assert.Equal(0, h.Tracker.ParkedPlatformScriptCountForTest);
+        }
+
+        [Fact]
+        public void Reading_the_same_executor_start_line_again_never_parks_its_run()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            var line = $@"Adding argument powershell with value {ImeDir}\Policies\Scripts\{RetryUser}_{RetryPolicyId}.ps1 to the named argument list.";
+            var at = T0.AddMinutes(-30);
+
+            h.Tracker.ProcessLogMessageForTest(line, at, "AgentExecutor.log");
+            h.Tracker.ProcessLogMessageForTest(line, at, "AgentExecutor.log");
+            Assert.Equal(0, h.Tracker.ParkedPlatformScriptCountForTest);
+
+            h.Tracker.ProcessLogMessageForTest(line, at.AddMinutes(10), "AgentExecutor.log");
+            Assert.Equal(1, h.Tracker.ParkedPlatformScriptCountForTest);
+        }
+
+        [Fact]
+        public async Task Run_without_end_block_keeps_waiting_for_its_result_across_a_shutdown()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9101") + RunStart("12:40:10.0000000", "9102"));
+            await h.Pass();
+            h.Tracker.FlushPendingPlatformScriptResults(h.Now, force: true);
+            Assert.Empty(h.Completed);
+
+            h.Restart();
+            Assert.Equal(1, h.Tracker.ParkedPlatformScriptCountForTest);
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:30:10.5000000", "Failed"));
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|-|~|~" }, h.Completed.Select(Shape).ToArray());
+        }
+
+        [Fact]
+        public async Task Earlier_run_emitted_while_a_later_one_runs_never_takes_the_later_runs_register_entry()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9201") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "9202"));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed") + ImeRunStart("12:10:08.0000000"));
+            await PassAndSettle(h);
+            Assert.Single(h.Completed);
+
+            // A save of this key is the latest run's, and that one is still running.
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+            Assert.Equal(PlatformRunClaim.Wait, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out _));
+
+            h.Append(RunEnd("12:10:40.0000000", 0, "Run B output", ""));
+            AppendImeLog(h, ImeRunResult("12:10:40.1000000", "Success"));
+            await PassAndSettle(h);
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out var run));
+            Assert.Equal(h.Completed[1].RunId, run!.RunId);
+            Assert.Equal("Run B output", run.Stdout);
+        }
+
+        [Fact]
+        public async Task Run_of_another_user_keeps_its_own_register_entry_when_it_waited_for_its_result()
+        {
+            const string otherUser = "2b7e5c91-3d4a-4f80-b6e2-9a1c7d3f5e08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9301") + RunEnd("12:00:12.0000000", 1, "", "Run A failed")
+                + RunStart("12:10:10.0000000", "9302", userId: otherUser));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed")
+                + ImeRunStart("12:10:08.0000000", userId: otherUser));
+            await PassAndSettle(h);
+            h.Tracker.ScriptRuns.NotePassCompleted(h.Now);
+
+            Assert.Equal(PlatformRunClaim.Claimed, h.Tracker.ScriptRuns.TryClaim(RetryUser, RetryPolicyId, h.Now.AddSeconds(-10), out var run));
+            Assert.Equal(h.Completed[0].RunId, run!.RunId);
+            Assert.Equal(PlatformRunClaim.Wait, h.Tracker.ScriptRuns.TryClaim(otherUser, RetryPolicyId, h.Now.AddSeconds(-10), out _));
+        }
+
+        [Fact]
+        public async Task Start_line_read_again_stays_a_late_line_after_an_earlier_run_of_another_user_went_out()
+        {
+            const string otherUser = "2b7e5c91-3d4a-4f80-b6e2-9a1c7d3f5e08";
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(RunStart("12:00:10.0000000", "9401") + RunEnd("12:00:12.0000000", 0, "Run A output", "")
+                + RunStart("12:10:10.0000000", "9402", userId: otherUser) + RunEnd("12:10:12.0000000", 0, "Run B output", ""));
+            // Run A's result surfaces after run B's (its line was hidden by a concurrent writer).
+            AppendImeLog(h, ImeRunResult("12:10:12.1000000", "Success", userId: otherUser) + ImeRunResult("12:00:12.1000000", "Success"));
+            await PassAndSettle(h);
+            Assert.Equal(new[] { "Success|0|Run B output|", "Success|0|Run A output|" }, h.Completed.Select(Shape).ToArray());
+
+            // Run B's executor start line read again (a rewind): a late line of the emitted run B, never a new run.
+            var started = 0;
+            h.Tracker.OnScriptStarted = _ => started++;
+            h.Tracker.ProcessLogMessageForTest(
+                $@"Adding argument powershell with value {ImeDir}\Policies\Scripts\{otherUser}_{RetryPolicyId}.ps1 to the named argument list.",
+                h.Completed[0].StartedAtUtc, "AgentExecutor.log");
+            Assert.Equal(0, started);
+        }
+
+        [Fact]
+        public async Task Final_stderr_of_the_end_block_replaces_the_early_snapshot_even_without_stdout()
+        {
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            // The snapshot was taken before the error reader finished; IME judged the full error file.
+            h.Append(RunStart("12:00:10.0000000", "8001") + RunEnd("12:00:12.0000000", 0, "", "Remove-AppxPackage : Cannot process argument", stderrSnapshot: ""));
+            AppendImeLog(h, ImeRunStart("12:00:08.0000000") + ImeRunResult("12:00:12.1000000", "Failed"));
+
+            await PassAndSettle(h);
+
+            Assert.Equal(new[] { "Failed|0||Remove-AppxPackage : Cannot process argument" }, h.Completed.Select(Shape).ToArray());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.RewindFreshness.cs

@@ -0,0 +1,139 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Sessions d29e27e3 and 4377911b: a concurrent IME writer overwrote the result line of a platform script, and the
+    /// overwrite check recovered it one pass later. Recovered lines were never fresh, so they resolved in the agent's own
+    /// cached zone (+60) instead of anchoring themselves (+120): the end stamp landed an hour ahead of the clock and the
+    /// run duration was omitted. Bytes that read differently at a position than at the last look were written after that
+    /// look, so when the replaced bytes were confirmed seconds ago the new line's age is bounded like an appended line's —
+    /// these tests pin that it anchors itself then, and only then.
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private static void AppendExecutorLog(Harness h, string text)
+            => File.AppendAllText(Path.Combine(Path.GetDirectoryName(h.LogPath)!, "AgentExecutor.log"), text, new UTF8Encoding(false));
+
+        /// <summary>An IME log entry with the byte length of <paramref name="sameLengthAs"/>: what a stale writer's line replaces exactly.</summary>
+        private static string FillerLike(string time, string sameLengthAs)
+        {
+            var bare = ImeEntryAt(time, "[Win32App] checking ");
+            Assert.True(sameLengthAs.Length > bare.Length);
+            return ImeEntryAt(time, "[Win32App] checking " + new string('x', sameLengthAs.Length - bare.Length));
+        }
+
+        /// <summary>
+        /// A platform run whose IME writer lives in +120 (local = UTC + 2 h; the harness clock is 19:30Z): both logs are
+        /// observed empty first, so what follows is read fresh. Returns the IME log position where the filler line sits.
+        /// </summary>
+        private static async Task<long> StartRunAndReadFiller(Harness h, string fillerTime, string resultEntry)
+        {
+            h.Append(string.Empty);
+            AppendExecutorLog(h, string.Empty);
+            await h.Tracker.RunPollPassAsync(default);
+
+            AppendExecutorLog(h, RunStart("21:29:50.0000000", "1001"));
+            h.Append(ImeRunStart("21:29:48.0000000"));
+            await h.Tracker.RunPollPassAsync(default);
+
+            // Another IME writer appends a line; the tracker reads it.
+            var at = h.Length;
+            h.Append(FillerLike(fillerTime, resultEntry));
+            h.Now = h.Now.AddSeconds(1);
+            await h.Tracker.RunPollPassAsync(default);
+            return at;
+        }
+
+        [Fact]
+        public async Task Result_line_recovered_seconds_after_its_bytes_were_read_anchors_itself_like_a_fresh_line()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:01.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+
+            // The script ends: its end block, then the stale IME service writes the result over the filler.
+            AppendExecutorLog(h, RunEnd("21:30:01.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            Assert.Equal(1, h.Health.OverwriteRewinds);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.ResultProvenance!.Origin);
+            Assert.Equal(120, script.ResultProvenance.OffsetMinutes);
+            Assert.Equal(ImeLogTrackerAdapter.DurationPairVerdict.Verified, ImeLogTrackerAdapter.JudgeDurationPair(
+                script.StartedAtProvenance, script.ResultProvenance, false, script.ResultObservedAtUtc!.Value - script.StartedAtUtc!.Value, out _));
+        }
+
+        [Fact]
+        public async Task Verification_passes_keep_the_replaced_bytes_current_for_a_script_that_runs_longer()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:41.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+
+            // The script runs 40 s; the cadence check verifies the ledger every 10 s while the run is in flight.
+            for (var i = 0; i < 4; i++)
+            {
+                h.Now = h.Now.AddSeconds(10);
+                await h.Tracker.RunPollPassAsync(default);
+            }
+
+            AppendExecutorLog(h, RunEnd("21:30:41.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(CmTraceOffsetOrigin.LineAnchored, script.ResultProvenance!.Origin);
+            Assert.Equal(120, script.ResultProvenance.OffsetMinutes);
+        }
+
+        [Fact]
+        public async Task Overwrite_does_not_move_the_files_measured_writer_offset()
+        {
+            using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            var result = ImeRunResult("21:30:01.1000000", "Success");
+            var at = await StartRunAndReadFiller(h, "21:30:00.5000000", result);
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out var before));
+
+            AppendExecutorLog(h, RunEnd("21:30:01.0000000", 0, "done", ""));
+            h.Overwrite(at, result);
+            h.Now = h.Now.AddSeconds(1);
+            await PassAndSettle(h);
+
+            Assert.True(h.Tracker.OffsetCalibrator.TryGetOffset("IntuneManagementExtension.log", out var after));
+            Assert.Equal(before, after);
+        }
+
+        [Theory]
+        // Replaced bytes confirmed 1 s / 30 s ago: written since, age bounded like an appended line's.
+        [InlineData(true, true, 1, true)]
+        [InlineData(true, true, 30, true)]
+        // Confirmed longer ago: the new bytes could be minutes old — their age may round onto the 15-minute grid.
+        [InlineData(true, true, 31, false)]
+        // The clock stepped back since the confirmation: the age is unknown.
+        [InlineData(true, true, -1, false)]
+        // The divergence lies in bytes the ledger never held (dropped by a cap): nothing dates them.
+        [InlineData(true, false, 1, false)]
+        // The pass itself is not fresh — the first pass after a restart never anchors.
+        [InlineData(false, true, 1, false)]
+        // Nothing was replaced.
+        [InlineData(true, true, null, false)]
+        public void Rewound_entry_is_fresh_only_when_the_bytes_it_replaced_were_confirmed_within_the_fresh_window(
+            bool passLinesAreFresh, bool entryAtRewindPointReplaced, int? secondsSinceConfirmed, bool expected)
+        {
+            var now = new DateTime(2026, 10, 4, 19, 2, 0, DateTimeKind.Utc);
+            DateTime? confirmed = secondsSinceConfirmed.HasValue ? now.AddSeconds(-secondsSinceConfirmed.Value) : (DateTime?)null;
+            Assert.Equal(expected, ImeLogTracker.RewoundEntryIsFresh(passLinesAreFresh, entryAtRewindPointReplaced, confirmed, now));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.cs

@@ -502,6 +502,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
         public async Task Ime_result_line_hidden_by_an_executor_start_line_is_recovered_from_the_ime_log()
         {
             using var h = new Harness("IntuneManagementExtension.log", ScriptPatterns());
+            // Seen empty first: the start lines are fresh and anchor themselves like the recovered result line will,
+            // so start and result sit on one timeline whatever the host's own zone is.
+            h.Append(string.Empty);
+            await h.Pass();
             h.Append(Entry(GeneratedLine, "17") + Entry("Launch powershell executor in user session", "17") + Entry("process id = 10608", "17"));
             await h.Pass();
             var servicePosition = h.Length;

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerPlatformScriptFallbackTests.cs

@@ -83,8 +83,33 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Single(emitted);
         }
 
+        [Theory]
+        // IME's verdict is Success exactly when the error file is empty, whatever the exit code. Judged by the exit
+        // code, session 67ae751c showed exit 0 with the script's own stderr as Success, and 46a41a0a an exit 1 without
+        // stderr as Failed, a run IME reported as Success one cycle earlier.
+        [InlineData(0, "Invoke-WebRequest : The remote name could not be resolved", "Failed")]
+        [InlineData(1, "", "Success")]
+        [InlineData(1, "  \n", "Success")]
+        [InlineData(0, "", "Success")]
+        [InlineData(1, null, "Failed")]
+        [InlineData(0, null, "Success")]
+        public void Fallback_judges_like_ime_by_the_stderr_it_read(int exitCode, string? stderr, string expected)
+        {
+            using var tmp = new TempDirectory();
+            var tracker = BuildTracker(tmp, out var emitted);
+            var observedAt = new DateTime(2026, 6, 19, 12, 59, 4, DateTimeKind.Utc);
+
+            tracker.SeedPendingPlatformScriptForTesting("0d2294bf", exitCode: exitCode, exitObservedAtUtc: observedAt, stderr: stderr);
+            tracker.FlushPendingPlatformScriptResults(observedAt.AddSeconds(20));
+
+            var script = Assert.Single(emitted);
+            Assert.Equal(expected, script.Result);
+            Assert.Equal(exitCode, script.ExitCode);
+            Assert.Equal("agentexecutor_fallback", script.ResultSource);
+        }
+
         [Fact]
-        public void Nonzero_exit_code_emits_failed_result()
+        public void Nonzero_exit_code_without_a_stderr_line_emits_failed_result()
         {
             using var tmp = new TempDirectory();
             var tracker = BuildTracker(tmp, out var emitted);

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerScriptStatePersistenceTests.cs

@@ -108,6 +108,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
 
             var tracker = BuildTracker(tmp, out var emitted);
             tracker.LoadStateForTest(); // must not throw
+            Assert.Equal(0, tracker.ParkedPlatformScriptCountForTest);
 
             // Degrades to pre-fix behavior: no markers restored, normal emission works (the
             // result waits for its end block until the shutdown flush).
@@ -116,6 +117,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             Assert.Single(emitted);
         }
 
+        [Fact]
+        public void Pending_slot_from_a_state_file_without_executor_start_loads_and_completes()
+        {
+            using var tmp = new TempDirectory();
+            var started = new DateTime(2026, 10, 4, 9, 0, 0, DateTimeKind.Utc);
+
+            // A pending slot written by an agent before runs carried their executor start and run id.
+            var persistence = new ImeTrackerStatePersistence(tmp.Path, new AgentLogger(tmp.Path, AgentLogLevel.Info));
+            persistence.Save(new ImeTrackerStateData
+            {
+                PendingPlatformScripts = new List<ScriptExecutionState>
+                {
+                    new ScriptExecutionState { PolicyId = "policyF", ScriptType = "platform", StartedAtUtc = started, ExitCode = 0, ExitObservedAtUtc = started.AddSeconds(5), Stdout = "done", Stderr = "" },
+                },
+            });
+
+            var tracker = BuildTracker(tmp, out var emitted);
+            tracker.LoadStateForTest();
+            tracker.CompletePlatformScriptFromImeResultForTesting("policyF", "Success", started.AddSeconds(6));
+
+            var script = Assert.Single(emitted);
+            Assert.Equal("Success", script.Result);
+            Assert.Equal(0, script.ExitCode);
+            Assert.False(string.IsNullOrEmpty(script.RunId));
+        }
+
         [Fact]
         public void Stale_result_older_than_current_run_start_is_dropped()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/ShellCoreTrackerBreadcrumbTests.cs

@@ -11,6 +11,7 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
 using Newtonsoft.Json;
 using Xunit;
 
@@ -173,16 +174,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
         public void UpdatePageRecords_ArePageStartsStopsAndNames_OfTheUpdatePageOnly()
         {
             var start = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, lastPage: null);
-            Assert.Equal(OobeUpdatePageRecord.PageStarted, start!.CxhEvent);
+            Assert.Equal(OobeUpdateVocabulary.PageStarted, start!.CxhEvent);
             Assert.Equal("OobeNDUP", start.Page);
 
             var stop = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, lastPage: "RebootNDUP");
-            Assert.Equal(OobeUpdatePageRecord.PageStopped, stop!.CxhEvent);
+            Assert.Equal(OobeUpdateVocabulary.PageStopped, stop!.CxhEvent);
             Assert.Equal("RebootNDUP", stop.Page);
             Assert.Equal("success", stop.Result);
 
             var name = ShellCoreTracker.ParseUpdatePageRecord(ShellCoreTracker.EventId_ShellCore_WebAppEventName, ScanStartedName, lastPage: null);
-            Assert.Equal(OobeUpdatePageRecord.EventName, name!.CxhEvent);
+            Assert.Equal(OobeUpdateVocabulary.EventName, name!.CxhEvent);
             Assert.Equal("ExpeditedUpdate_startWUScanStarted", name.Name);
             Assert.Null(name.Value);
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/ShellCoreTrackerUpdatePageBackfillTests.cs

@@ -0,0 +1,225 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// The first run's update page backfill (<see cref="ShellCoreTracker.BackfillUpdatePageTelemetry"/>)
+    /// and the page a stop belongs to across backfill and live records. The first run has no
+    /// replay — its backfill is telemetry and nothing else, so a Hello-wizard start, an ESP exit
+    /// or an ESP failure in the window must not leave the tracker on any rail.
+    /// </summary>
+    public sealed class ShellCoreTrackerUpdatePageBackfillTests : IDisposable
+    {
+        private static readonly DateTime At = new DateTime(2026, 10, 5, 13, 10, 0, DateTimeKind.Utc);
+
+        private const string NdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'OobeNDUP'.";
+        private const string RebootNdupStarted = "CloudExperienceHost Web App Activity started. CXID: 'RebootNDUP'.";
+        private const string AadHelloStarted = "CloudExperienceHost Web App Activity started. CXID: 'AADHello'.";
+        private const string PageStopped = "CloudExperienceHost Web App Activity stopped. Result: 'success'.";
+        private const string DownloadSucceeded =
+            "CloudExperienceHost Web App Event 1. Name: 'SdxWebAppCloudNDUP_processStatusChangeFromHandler_downloadSucceeded'.";
+        private const string EspExit = "CommercialOOBE_ESPProgress_Page_Exiting";
+        private const string EspFailure = "CommercialOOBE_ESPProgress_Failure";
+        private const string WhiteGloveSuccess = "CommercialOOBE_ESPProgress_WhiteGlove_Success";
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _sink = new FakeSignalIngressSink();
+        private int _registryReads;
+
+        public void Dispose() => _tmp.Dispose();
+
+        private ShellCoreTracker Build() =>
+            new ShellCoreTracker("S1", "T1",
+                new InformationalEventPost(_sink, new VirtualClock(At)),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                helloTracker: null,
+                oobeUpdateRegistryReader: () => { _registryReads++; return Array.Empty<OobeUpdateRegistrySnapshot.KeyState>(); },
+                stateDirectory: Path.Combine(_tmp.Path, "state"));
+
+        private static void Live(ShellCoreTracker tracker, int eventId, string description, DateTime at, long recordId) =>
+            tracker.ProcessEvent(eventId, description, at, "Microsoft-Windows-Shell-Core", isBackfill: false, recordId: recordId);
+
+        private static ShellCoreRecord Record(int eventId, string description, DateTime at, long recordId) =>
+            new ShellCoreRecord(eventId, description, at, recordId);
+
+        private IReadOnlyList<IReadOnlyDictionary<string, object>> Pages() =>
+            _sink.Posted
+                .Where(p => p.Kind == DecisionSignalKind.InformationalEvent
+                    && p.Payload != null
+                    && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var et)
+                    && et == Constants.EventTypes.OobeUpdatePage)
+                .Select(p => (IReadOnlyDictionary<string, object>)p.TypedPayload!)
+                .ToList();
+
+        // ------------------------------------------------------------ first run ----
+
+        [Fact]
+        public void FirstRunBackfill_ReportsTheUpdatePage_AndNothingElse()
+        {
+            using var tracker = Build();
+            var raised = new List<string>();
+            tracker.HelloWizardStarted += (_, _) => raised.Add("hello");
+            tracker.FinalizingSetupPhaseTriggered += (_, reason) => raised.Add($"finalizing:{reason}");
+            tracker.EspExited += (_, _) => raised.Add("exit");
+            tracker.EspFailureDetected += (_, _) => raised.Add("failure");
+            tracker.WhiteGloveCompleted += (_, _) => raised.Add("whiteglove");
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, EspExit, At.AddMinutes(-41), 95),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, EspFailure, At.AddSeconds(-2430), 96),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEvent, WhiteGloveSuccess, At.AddSeconds(-2420), 97),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEventName, DownloadSucceeded, At.AddMinutes(-30), 101),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, AadHelloStarted, At.AddMinutes(-2), 110),
+            });
+
+            Assert.Empty(raised);
+            Assert.False(tracker.IsEspExitedForTest);
+            Assert.False(tracker.IsWhiteGloveDetectedForTest);
+            var pages = Pages();
+            Assert.Equal(new object[] { "page_started", "event_name" }, pages.Select(d => d["cxhEvent"]).ToArray());
+            Assert.All(pages, d => Assert.Equal(true, d["backfill"]));
+            // No agent_trace, no ESP or Hello event — only the two page rows.
+            Assert.Equal(2, _sink.Posted.Count);
+            // The registry shows the state now, not at the records' time.
+            Assert.Equal(0, _registryReads);
+        }
+
+        [Fact]
+        public void FirstRunBackfill_KeepsTheEventTimes()
+        {
+            using var tracker = Build();
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+            });
+
+            var posted = Assert.Single(_sink.Posted);
+            Assert.Equal(At.AddMinutes(-40), posted.OccurredAtUtc);
+        }
+
+        [Fact]
+        public void LiveStop_FindsThePageThatStartedBeforeTheAgent()
+        {
+            using var tracker = Build();
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-40), 100),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(5), 120);
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("OobeNDUP", stop["page"]);
+            Assert.Equal(false, stop["backfill"]);
+        }
+
+        [Fact]
+        public void SameRecord_FromTheLiveWatcherAndTheFirstRunBackfill_IsReportedOnce()
+        {
+            // The live watcher is armed before the backfill reads, so both can deliver a record.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 700);
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 700),
+            });
+
+            Assert.Single(Pages(), d => (string)d["cxhEvent"] == "page_started");
+        }
+
+        // ---------------------------------------------------- the page of a stop ----
+
+        [Fact]
+        public void ReplayedOlderStart_DoesNotTakeOverTheNextLiveStop()
+        {
+            // A restart replay reads records older than the live watcher's; before, its page start
+            // overwrote the live page and the next live stop was attributed to the old page.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At, 900);
+            tracker.ReplayBackfillRecords(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-20), 850),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppEventName, DownloadSucceeded, At.AddMinutes(-19), 851),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), 901);
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("RebootNDUP", stop["page"]);
+        }
+
+        [Fact]
+        public void BackfilledStop_BelongsToTheStartOfItsOwnBatch()
+        {
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At, 900);
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At.AddMinutes(-20), 850),
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-18), 852),
+            });
+
+            var stop = Pages().Last();
+            Assert.Equal("page_stopped", stop["cxhEvent"]);
+            Assert.Equal("OobeNDUP", stop["page"]);
+            Assert.Equal(true, stop["backfill"]);
+        }
+
+        [Fact]
+        public void BackfilledStopWithoutItsStart_IsNotGivenTheLivePage()
+        {
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 900);
+
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(-18), 852),
+            });
+
+            Assert.DoesNotContain(Pages(), d => (string)d["cxhEvent"] == "page_stopped");
+        }
+
+        [Fact]
+        public void NewerBackfilledStart_MovesTheLivePageForward()
+        {
+            // Records written between arming the watcher and the backfill's read are newer than
+            // the last live start the watcher delivered before them.
+            using var tracker = Build();
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStarted, NdupStarted, At, 900);
+            tracker.ReplayUpdatePageTelemetry(new[]
+            {
+                Record(ShellCoreTracker.EventId_ShellCore_WebAppStarted, RebootNdupStarted, At.AddSeconds(30), 905),
+            });
+
+            Live(tracker, ShellCoreTracker.EventId_ShellCore_WebAppStopped, PageStopped, At.AddMinutes(1), 906);
+
+            Assert.Equal("RebootNDUP", Pages().Last()["page"]);
+        }
+
+        [Fact]
+        public void UpdatePageLookback_IsInsideTheReplayClamp()
+        {
+            Assert.Equal(ShellCoreTracker.UpdatePageBackfillLookbackMinutes,
+                ShellCoreTracker.ClampLookbackMinutes(ShellCoreTracker.UpdatePageBackfillLookbackMinutes));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/MdmRebootPolicyTrackerTests.cs

@@ -64,7 +64,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         private void Buffer(string? rebootUri, long? recordId = null, bool isBackfill = false, DateTime? timeCreatedUtc = null, string? description = null)
         {
             _tracker.ProcessEvent(
-                eventId: MdmRebootPolicyTracker.EventId_PolicyRebootRequired,
                 recordId: recordId ?? _nextRecordId++,
                 timeCreatedUtc: timeCreatedUtc ?? At,
                 rebootUri: rebootUri,
@@ -226,13 +225,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             // The coalesced reboot restarts the agent; the post-reboot backfill re-reads the same
             // records — a FLUSHED record must be skipped by the next instance.
             var first = MakeTracker(stateDirectory: _tmp.Path);
-            first.ProcessEvent(MdmRebootPolicyTracker.EventId_PolicyRebootRequired, recordId: 500,
+            first.ProcessEvent(recordId: 500,
                 timeCreatedUtc: At, rebootUri: UriSvchost, formattedDescription: null, isBackfill: false);
             first.FlushPending();
 
             var second = MakeTracker(stateDirectory: _tmp.Path);
             second.LoadWatermark();
-            second.ProcessEvent(MdmRebootPolicyTracker.EventId_PolicyRebootRequired, recordId: 500,
+            second.ProcessEvent(recordId: 500,
                 timeCreatedUtc: At, rebootUri: UriSvchost, formattedDescription: null, isBackfill: true);
             second.FlushPending();
 
@@ -245,13 +244,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             // Process killed by the very reboot the records announce: nothing was flushed, so the
             // next instance must re-read and emit the records.
             var first = MakeTracker(stateDirectory: _tmp.Path);
-            first.ProcessEvent(MdmRebootPolicyTracker.EventId_PolicyRebootRequired, recordId: 500,
+            first.ProcessEvent(recordId: 500,
                 timeCreatedUtc: At, rebootUri: UriSvchost, formattedDescription: null, isBackfill: false);
             // no FlushPending — simulated reboot kill
 
             var second = MakeTracker(stateDirectory: _tmp.Path);
             second.LoadWatermark();
-            second.ProcessEvent(MdmRebootPolicyTracker.EventId_PolicyRebootRequired, recordId: 500,
+            second.ProcessEvent(recordId: 500,
                 timeCreatedUtc: At, rebootUri: UriSvchost, formattedDescription: null, isBackfill: true);
             second.FlushPending();
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/OobeUpdateTelemetryTests.cs

@@ -10,6 +10,7 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
 using Xunit;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
@@ -56,7 +57,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         public void Page_IsReported_WithItsEventTime_AndFields()
         {
             Build().ReportPage(
-                new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "OobeNDUP", result: "success"),
+                new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, 62405, page: "OobeNDUP", result: "success"),
                 At.AddMinutes(-3), isBackfill: true);
 
             var page = Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage));
@@ -75,7 +76,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         public void EventName_CarriesItsSafeValue()
         {
             Build().ReportPage(
-                new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62407, name: "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", value: "true"),
+                new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62407, name: "ExpeditedUpdate_isNDUPAllowedByCSPSucceeded", value: "true"),
                 At, isBackfill: false);
 
             var data = Data(Assert.Single(ByType(Constants.EventTypes.OobeUpdatePage)));
@@ -89,9 +90,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             var telemetry = Build();
             for (var i = 0; i < 10; i++)
             {
-                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_progress"), At.AddSeconds(i), isBackfill: false);
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_progress"), At.AddSeconds(i), isBackfill: false);
             }
-            telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "OobeNDUP", result: "success"), At.AddMinutes(1), isBackfill: false);
+            telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, 62405, page: "OobeNDUP", result: "success"), At.AddMinutes(1), isBackfill: false);
 
             var pages = ByType(Constants.EventTypes.OobeUpdatePage);
             Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey + 1, pages.Count);
@@ -101,15 +102,41 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         }
 
         [Fact]
-        public void PageEvents_AreCappedPerRun()
+        public void PageEvents_AreCappedPerRun_AndTheCapIsMarkedOnce()
         {
             var telemetry = Build();
             for (var i = 0; i < OobeUpdateTelemetry.MaxPageEventsPerRun + 20; i++)
             {
-                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false);
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At.AddSeconds(i), isBackfill: false);
             }
 
-            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun, ByType(Constants.EventTypes.OobeUpdatePage).Count);
+            var pages = ByType(Constants.EventTypes.OobeUpdatePage);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 1, pages.Count);
+            // A name missing after the marker proves nothing — the rules check for it.
+            var marker = Data(pages.Last());
+            Assert.Equal(OobeUpdateVocabulary.NamesCapped, marker["cxhEvent"]);
+            Assert.Equal(false, marker["backfill"]);
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun, marker["limit"]);
+            Assert.Equal(At.AddSeconds(OobeUpdateTelemetry.MaxPageEventsPerRun), pages.Last().OccurredAtUtc); // the first name over the budget
+        }
+
+        [Fact]
+        public void BackfilledNames_HaveTheirOwnBudget()
+        {
+            // The records from before the agent started cannot spend the live page's budget.
+            var telemetry = Build();
+            for (var i = 0; i < OobeUpdateTelemetry.MaxBackfillPageEventsPerRun + 5; i++)
+            {
+                telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: $"ExpeditedUpdate_old{i}"), At.AddMinutes(-30), isBackfill: true);
+            }
+
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_live"), At, isBackfill: false));
+
+            var markers = ByType(Constants.EventTypes.OobeUpdatePage)
+                .Where(p => (string)Data(p)["cxhEvent"] == OobeUpdateVocabulary.NamesCapped).ToList();
+            var marker = Assert.Single(markers);
+            Assert.Equal(true, Data(marker)["backfill"]);
+            Assert.Equal(OobeUpdateTelemetry.MaxBackfillPageEventsPerRun, Data(marker)["limit"]);
         }
 
         [Fact]
@@ -119,16 +146,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             var telemetry = Build();
             for (var i = 0; i < OobeUpdateTelemetry.MaxPageEventsPerRun; i++)
             {
-                Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false));
+                Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: $"ExpeditedUpdate_step{i}"), At, isBackfill: false));
             }
 
-            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, 62406, name: "ExpeditedUpdate_late"), At, isBackfill: false));
-            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, 62404, page: "RebootNDUP"), At.AddMinutes(1), isBackfill: false));
-            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, 62405, page: "RebootNDUP", result: "success"), At.AddMinutes(2), isBackfill: false));
+            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_late"), At, isBackfill: false));
+            Assert.False(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, 62406, name: "ExpeditedUpdate_later"), At, isBackfill: false));
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStarted, 62404, page: "RebootNDUP"), At.AddMinutes(1), isBackfill: false));
+            Assert.True(telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, 62405, page: "RebootNDUP", result: "success"), At.AddMinutes(2), isBackfill: false));
 
             var pages = ByType(Constants.EventTypes.OobeUpdatePage);
-            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 2, pages.Count);
-            Assert.Equal(new object[] { "page_started", "page_stopped" },
+            Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerRun + 3, pages.Count);
+            Assert.Equal(new object[] { OobeUpdateVocabulary.NamesCapped, "page_started", "page_stopped" },
                 pages.Skip(OobeUpdateTelemetry.MaxPageEventsPerRun).Select(p => Data(p)["cxhEvent"]).ToArray());
         }
 
@@ -138,7 +166,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
             // Outside the run budget, but a page that restarts in a loop still cannot flood.
             var telemetry = Build();
             var reported = Enumerable.Range(0, 10)
-                .Count(i => telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, 62404, page: "OobeNDUP"), At.AddMinutes(i), isBackfill: false));
+                .Count(i => telemetry.ReportPage(new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStarted, 62404, page: "OobeNDUP"), At.AddMinutes(i), isBackfill: false));
 
             Assert.Equal(OobeUpdateTelemetry.MaxPageEventsPerKey, reported);
         }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Transport/EmergencyReporterTests.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.Net.Http;
 using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Shared.Models;
 using Xunit;
 
@@ -49,6 +50,74 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
         private static EmergencyReporter Reporter(FakeApiClient client)
             => new EmergencyReporter(client, "session", "tenant", "0.0.0", logger: null);
 
+        private static EmergencyReporter Reporter(FakeApiClient client, VirtualClock clock)
+            => new EmergencyReporter(client, "session", "tenant", "0.0.0", logger: null, clock: clock);
+
+        private static VirtualClock Clock() => new VirtualClock(new DateTime(2026, 10, 9, 10, 0, 0, DateTimeKind.Utc));
+
+        [Fact]
+        public async Task Session_unknown_report_is_not_suppressed_by_the_cooldown_of_an_earlier_report()
+        {
+            // Terminal report, sent at most once per process right before the termination — a
+            // routine report one minute earlier must not cost it. Every other type keeps the cooldown.
+            var clock = Clock();
+            var client = new FakeApiClient();
+            client.Results.Enqueue(true);
+            client.Results.Enqueue(true);
+            client.Results.Enqueue(true);
+            var reporter = Reporter(client, clock);
+
+            await reporter.TrySendAsync(AgentErrorType.IngestFailed, "m", httpStatusCode: 503);
+            clock.Advance(TimeSpan.FromMinutes(1));
+            await reporter.TrySendAsync(AgentErrorType.TelemetryRejectedSessionUnknown, "m", httpStatusCode: 410);
+
+            Assert.Equal(2, client.Calls);
+            Assert.Equal(AgentErrorType.TelemetryRejectedSessionUnknown, client.Reports[1].ErrorType);
+
+            // Control: a third report of another type inside the window is still held back.
+            clock.Advance(TimeSpan.FromMinutes(1));
+            await reporter.TrySendAsync(AgentErrorType.ConfigFetchFailed, "m");
+            Assert.Equal(2, client.Calls);
+        }
+
+        [Fact]
+        public async Task Second_session_unknown_report_within_the_window_is_still_suppressed()
+        {
+            var clock = Clock();
+            var client = new FakeApiClient();
+            client.Results.Enqueue(true);
+            client.Results.Enqueue(true);
+            var reporter = Reporter(client, clock);
+
+            await reporter.TrySendAsync(AgentErrorType.TelemetryRejectedSessionUnknown, "m", httpStatusCode: 410);
+            clock.Advance(TimeSpan.FromMinutes(1));
+            await reporter.TrySendAsync(AgentErrorType.TelemetryRejectedSessionUnknown, "m", httpStatusCode: 410);
+
+            Assert.Equal(1, client.Calls);
+        }
+
+        [Fact]
+        public async Task Session_unknown_report_still_counts_against_the_per_session_maximum()
+        {
+            // Five delivered reports (ten minutes apart, distinct keys) exhaust the budget; the
+            // exemption waives only the cooldown, not the maximum.
+            var clock = Clock();
+            var client = new FakeApiClient();
+            for (var i = 0; i < 6; i++) client.Results.Enqueue(true);
+            var reporter = Reporter(client, clock);
+
+            foreach (var status in new[] { 500, 502, 503, 504, 429 })
+            {
+                await reporter.TrySendAsync(AgentErrorType.IngestFailed, "m", httpStatusCode: status);
+                clock.Advance(TimeSpan.FromMinutes(10));
+            }
+            Assert.Equal(5, client.Calls);
+
+            await reporter.TrySendAsync(AgentErrorType.TelemetryRejectedSessionUnknown, "m", httpStatusCode: 410);
+
+            Assert.Equal(5, client.Calls);
+        }
+
         [Fact]
         public async Task Failed_send_rolls_back_reservation_so_a_later_call_retries()
         {
@@ -142,6 +211,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Transport
             Assert.Equal(2, client.Calls);
         }
 
+        [Fact]
+        public async Task Session_unknown_report_carries_error_type_and_http_410()
+        {
+            var client = new FakeApiClient();
+            client.Results.Enqueue(true);
+            var reporter = Reporter(client);
+
+            await reporter.TrySendAsync(AgentErrorType.TelemetryRejectedSessionUnknown, "m", httpStatusCode: 410);
+
+            var report = Assert.Single(client.Reports);
+            Assert.Equal(AgentErrorType.TelemetryRejectedSessionUnknown, report.ErrorType);
+            Assert.Equal(410, report.HttpStatusCode);
+        }
+
         [Fact]
         public async Task Session_age_is_carried_in_the_report_and_absent_by_default()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/DefaultComponentFactoryOrderingTests.cs

@@ -145,7 +145,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
         [Fact]
         public void Ime_app_state_callback_is_chained_into_the_user_apps_settled_recheck()
         {
-            // sits-d Cloud-PC fix (2026-08-19): the AccountSetup synthesis is re-evaluated on every
+            // Cloud-PC fix (2026-08-19): the AccountSetup synthesis is re-evaluated on every
             // terminal IME app transition, which only works while the factory keeps this chain
             // wired. It is five lines that a refactor can drop silently and whose absence costs a
             // whole class of sessions their completion — so pin it here.

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/UserEspKeepAwakeHostTests.cs

@@ -77,7 +77,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
 
             ing.Start();
             host.Start();
@@ -98,7 +98,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
 
             ing.Start();
             host.Start();
@@ -127,7 +127,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
             var progress = false;
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller,
                 espTimeoutProvider: () => null, accountSetupProgressProbe: () => Volatile.Read(ref progress));
 
             ing.Start();
@@ -156,7 +156,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
             var progress = false;
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller,
                 espTimeoutProvider: () => null, accountSetupProgressProbe: () => Volatile.Read(ref progress));
 
             ing.Start();
@@ -186,7 +186,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller,
                 espTimeoutProvider: () => null, accountSetupProgressProbe: () => true);
 
             ing.Start();
@@ -212,7 +212,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller,
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller,
                 espTimeoutProvider: () => null, accountSetupProgressProbe: () => true);
 
             ing.Start();
@@ -236,7 +236,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
 
             ing.Start();
             host.Start();
@@ -259,7 +259,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             using var ing = BuildIngress(clock);
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
-            var host = new UserEspKeepAwakeHost("S1", "T1", ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
+            var host = new UserEspKeepAwakeHost(ing, clock, NewLogger(), controller: controller, espTimeoutProvider: () => null);
 
             ing.Start();
             host.Start();
@@ -282,7 +282,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             var api = new FakeKeepAwakeApi();
             var controller = new KeepAwakeController(NewLogger(), api);
             var host = new UserEspKeepAwakeHost(
-                "S1", "T1", ing, clock, NewLogger(),
+                ing, clock, NewLogger(),
                 controller: controller,
                 safetyCapOverride: TimeSpan.FromMilliseconds(75),
                 espTimeoutProvider: () => null);

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/AgentBootstrapSelfUpdateRetryTests.cs

@@ -11,7 +11,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
 {
     /// <summary>
     /// Contract tests for <see cref="AgentBootstrap.RetrySelfUpdateAfterEnrollment"/> —
-    /// the post-cert one-shot self-update retry (field case sits-d.cloud, 2026-08-09):
+    /// the post-cert one-shot self-update retry (field case 2026-08-09):
     /// guard on <see cref="SelfUpdater.LastVersionCheckSucceeded"/>, the relaxed
     /// timeouts/trigger it passes to the updater, and the swallow-everything exception
     /// contract (bootstrap must continue on any updater failure). Uses the

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/AgentRuntimeConfigTests.cs

@@ -44,7 +44,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             // from a real backend). We exercise the bundle-shape contract here.
             var rcs = new AutopilotMonitor.Agent.V2.Core.Configuration.RemoteConfigService(
                 auth.BackendApiClient, "tenant-x", logger,
-                auth.EmergencyReporter, auth.DistressReporter, auth.AuthFailureTracker);
+                auth.EmergencyReporter, auth.AuthFailureTracker);
             var rc = new AgentConfigResponse();
             var merge = new RemoteConfigMergeResult();
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/LifecycleEmittersRemoteConfigTests.cs

@@ -182,7 +182,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.Equal("FromCache", data["outcome"]);
         }
 
-        // ── Post-registration recovery (Phase 6.5, tenant aebdce78 audit 2026-08-24) ─
+        // ── Post-registration recovery (Phase 6.5, kiosk-tenant audit 2026-08-24) ─
 
         [Fact]
         public void EmitFetchFailedIfAny_AfterRecovery_MarksRecoveredAndDemotesToInfo()

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/ServerControlPlaneSessionGoneTests.cs

@@ -0,0 +1,170 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Configuration;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
+{
+    /// <summary>
+    /// Host wiring for <c>TelemetryUploadOrchestrator.SessionGone</c>
+    /// (HTTP 410 on the current session's telemetry): exactly one
+    /// <see cref="AgentErrorType.TelemetryRejectedSessionUnknown"/> emergency report carrying the
+    /// status, then a synthetic forced <c>terminate_session</c> tagged <c>origin=session_gone</c>
+    /// — and nothing at all once a shutdown is already in progress.
+    /// </summary>
+    public sealed class ServerControlPlaneSessionGoneTests
+    {
+        private sealed class RecordingEmergencyReporter : EmergencyReporter
+        {
+            private readonly List<string> _sequence;
+            public List<(AgentErrorType ErrorType, string Message, int? HttpStatusCode)> Reports { get; } =
+                new List<(AgentErrorType, string, int?)>();
+
+            public RecordingEmergencyReporter(List<string> sequence)
+                : base(apiClient: null!, sessionId: "S1", tenantId: "T1", agentVersion: "0.0.0", logger: null!)
+            {
+                _sequence = sequence;
+            }
+
+            public override Task TrySendAsync(
+                AgentErrorType errorType,
+                string message,
+                int? httpStatusCode = null,
+                long? sequenceNumber = null,
+                int attempts = 1,
+                TimeSpan? perAttemptTimeout = null,
+                TimeSpan? retryDelay = null,
+                double? sessionAgeHours = null,
+                RegistrationFailureSummary? priorRegistrationFailure = null)
+            {
+                Reports.Add((errorType, message, httpStatusCode));
+                _sequence.Add("report");
+                return Task.CompletedTask;
+            }
+        }
+
+        private sealed class RecordingDispatcher : ServerActionDispatcher
+        {
+            private readonly List<string> _sequence;
+            public List<ServerAction> Dispatched { get; } = new List<ServerAction>();
+
+            public RecordingDispatcher(AgentConfiguration config, AgentLogger logger, InformationalEventPost post, List<string> sequence)
+                : base(
+                    configuration: config,
+                    logger: logger,
+                    rotateConfigAsync: () => Task.FromResult(true),
+                    uploadDiagnosticsAsync: _ => Task.FromResult<DiagnosticsUploadResult>(null!),
+                    onTerminateRequested: _ => Task.CompletedTask,
+                    post: post)
+            {
+                _sequence = sequence;
+            }
+
+            public override Task DispatchAsync(List<ServerAction> actions)
+            {
+                Dispatched.AddRange(actions);
+                _sequence.Add("dispatch");
+                return Task.CompletedTask;
+            }
+        }
+
+        private sealed class Rig : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public List<string> Sequence { get; } = new List<string>();
+            public RecordingEmergencyReporter Reporter { get; }
+            public RecordingDispatcher Dispatcher { get; }
+            public ManualResetEventSlim Shutdown { get; } = new ManualResetEventSlim(false);
+            public ManualResetEventSlim ShutdownComplete { get; } = new ManualResetEventSlim(false);
+
+            public Rig()
+            {
+                Logger = new AgentLogger(Path.Combine(Tmp.Path, "logs"), AgentLogLevel.Info);
+                var config = new AgentConfiguration { SessionId = "S1", TenantId = "T1", ApiBaseUrl = "http://localhost" };
+                var post = new InformationalEventPost(
+                    new FakeSignalIngressSink(),
+                    new VirtualClock(new DateTime(2026, 10, 9, 10, 0, 0, DateTimeKind.Utc)));
+                Reporter = new RecordingEmergencyReporter(Sequence);
+                Dispatcher = new RecordingDispatcher(config, Logger, post, Sequence);
+            }
+
+            public void Handle(string reason = "session gone: http 410") =>
+                global::AutopilotMonitor.Agent.V2.Runtime.ServerControlPlane.HandleSessionGone(
+                    reason, Reporter, Dispatcher, Shutdown, ShutdownComplete, Logger);
+
+            public void Dispose()
+            {
+                Shutdown.Dispose();
+                ShutdownComplete.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Reports_once_with_410_then_dispatches_forced_terminate_tagged_session_gone()
+        {
+            using var rig = new Rig();
+
+            rig.Handle();
+
+            Assert.Equal(new[] { "report", "dispatch" }, rig.Sequence);
+
+            var report = Assert.Single(rig.Reporter.Reports);
+            Assert.Equal(AgentErrorType.TelemetryRejectedSessionUnknown, report.ErrorType);
+            Assert.Equal(410, report.HttpStatusCode);
+            Assert.Contains("410", report.Message);
+
+            var action = Assert.Single(rig.Dispatcher.Dispatched);
+            Assert.Equal(ServerActionTypes.TerminateSession, action.Type);
+            Assert.Contains("410", action.Reason);
+            Assert.NotNull(action.Params);
+            var parameters = action.Params!;
+            Assert.Equal("true", parameters["forceSelfDestruct"]);
+            Assert.Equal("0", parameters["gracePeriodSeconds"]);
+            Assert.Equal(TerminationOrigins.SessionGone, parameters["origin"]);
+        }
+
+        [Theory]
+        [InlineData(true, false)]
+        [InlineData(false, true)]
+        public void Does_nothing_when_a_shutdown_is_already_in_progress(bool shutdownSet, bool shutdownCompleteSet)
+        {
+            using var rig = new Rig();
+            if (shutdownSet) rig.Shutdown.Set();
+            if (shutdownCompleteSet) rig.ShutdownComplete.Set();
+
+            rig.Handle();
+
+            Assert.Empty(rig.Reporter.Reports);
+            Assert.Empty(rig.Dispatcher.Dispatched);
+        }
+
+        [Fact]
+        public void ReadOrigin_returns_the_origin_param_or_null()
+        {
+            Assert.Equal(TerminationOrigins.SessionGone,
+                global::AutopilotMonitor.Agent.V2.Runtime.ServerControlPlane.ReadOrigin(
+                    new Dictionary<string, string> { ["origin"] = TerminationOrigins.SessionGone }));
+            Assert.Equal(TerminationOrigins.KillSignal,
+                global::AutopilotMonitor.Agent.V2.Runtime.ServerControlPlane.ReadOrigin(
+                    new Dictionary<string, string> { ["origin"] = TerminationOrigins.KillSignal, ["forceSelfDestruct"] = "true" }));
+            Assert.Null(global::AutopilotMonitor.Agent.V2.Runtime.ServerControlPlane.ReadOrigin(
+                new Dictionary<string, string> { ["adminOutcome"] = "Failed" }));
+            Assert.Null(global::AutopilotMonitor.Agent.V2.Runtime.ServerControlPlane.ReadOrigin(
+                new Dictionary<string, string> { ["origin"] = string.Empty }));
+            Assert.Null(global::AutopilotMonitor.Agent.V2.Runtime.ServerControlPlane.ReadOrigin(null!));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/RealmJoinWatcherAdapterTests.cs

@@ -479,14 +479,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             public HashSet<string> ExistingKeys { get; } =
                 new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
-            public IReadOnlyList<string> Enumerate(RegistryHive hive, string packagesPath)
+            public IReadOnlyList<string> Enumerate(RegistryHive _, string packagesPath)
             {
                 return PackagesByPath.TryGetValue(packagesPath, out var ids)
                     ? (IReadOnlyList<string>)ids
                     : Array.Empty<string>();
             }
 
-            public bool TryRead(RegistryHive hive, string packagesPath, string packageId, out RealmJoinPackageSnapshot snapshot)
+            public bool TryRead(RegistryHive _, string _1, string packageId, out RealmJoinPackageSnapshot snapshot)
             {
                 snapshot = new RealmJoinPackageSnapshot(
                     packageId: packageId,
@@ -497,7 +497,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
                 return true;
             }
 
-            public bool KeyExists(RegistryHive hive, string subPath)
+            public bool KeyExists(RegistryHive _, string subPath)
                 => ExistingKeys.Contains(subPath);
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Termination/EnrollmentTerminationHandlerTests.cs

@@ -310,6 +310,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
             new EnrollmentTerminatedEventArgs(
                 reason, outcome, stage.ToString(), at ?? EndUtc);
 
+        /// <summary>
+        /// The args <c>ServerControlPlane.OnTerminateRequested</c> synthesises for a
+        /// <c>terminate_session</c> action tagged with <paramref name="origin"/>.
+        /// </summary>
+        private static EnrollmentTerminatedEventArgs ServerArgs(string origin) =>
+            new EnrollmentTerminatedEventArgs(
+                EnrollmentTerminationReason.DecisionTerminalStage,
+                EnrollmentTerminationOutcome.Failed,
+                SessionStage.Failed.ToString(),
+                EndUtc,
+                details: "Server-requested termination",
+                origin: origin);
+
         [Fact]
         public void Handle_writes_final_status_json_in_state_directory()
         {
@@ -458,6 +471,52 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
             Assert.Equal(0, rig.CleanupService.Invocations);
         }
 
+        // ============================================================= origin=session_gone (HTTP 410)
+
+        [Fact]
+        public void Handle_session_gone_skips_spool_drain_and_diagnostics_but_still_cleans_up()
+        {
+            // The backend no longer knows the session: every drain would only burn its budget on
+            // 410s and a diagnostics package would describe a deleted session. Marker, cleanup
+            // and the (forced) self-destruct still run.
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Failed }.Build();
+            rig.SpoolDrainPeriodOverride = TimeSpan.FromSeconds(5);
+            var spoolPolls = 0;
+            rig.PendingItemCountAccessor = () => { spoolPolls++; return 5; }; // never drains — a poll would burn the budget
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: true);
+
+            rig.Build(cfg).Handle(sender: null!, ServerArgs(TerminationOrigins.SessionGone));
+
+            Assert.Equal(0, spoolPolls);
+            Assert.Equal(0, rig.DiagnosticsUploads);
+            Assert.DoesNotContain(Constants.EventTypes.DiagnosticsCollecting, rig.EmittedEventTypes);
+            Assert.Contains(Constants.EventTypes.AgentShuttingDown, rig.EmittedEventTypes);
+            Assert.True(File.Exists(Path.Combine(rig.StateDir, "enrollment-complete.marker")));
+            Assert.Equal(1, rig.CleanupService.Invocations);
+            Assert.Equal(1, rig.ShutdownSignalled);
+        }
+
+        [Fact]
+        public void Handle_kill_signal_origin_still_drains_spool_and_uploads_diagnostics()
+        {
+            // The administrator kill signal keeps its full sequence — only session_gone skips.
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Failed }.Build();
+            rig.SpoolDrainPeriodOverride = TimeSpan.FromSeconds(5);
+            var spoolPolls = 0;
+            rig.PendingItemCountAccessor = () => { spoolPolls++; return 0; };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: true);
+
+            rig.Build(cfg).Handle(sender: null!, ServerArgs(TerminationOrigins.KillSignal));
+
+            Assert.True(spoolPolls > 0);
+            Assert.Equal(1, rig.DiagnosticsUploads);
+            Assert.Contains(Constants.EventTypes.DiagnosticsCollecting, rig.EmittedEventTypes);
+            Assert.Equal(1, rig.CleanupService.Invocations);
+            Assert.Equal(1, rig.ShutdownSignalled);
+        }
+
         [Fact]
         public void Handle_signals_shutdown_exactly_once_even_on_error()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Termination/ObservationCoverageTests.cs

@@ -107,7 +107,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
         [Fact]
         public void Succeeded_outcome_is_an_info_about_tail_only_coverage_without_alarm_framing()
         {
-            // The 659c3a90 shape: healthy enrollment, bootstrap merely ran late in the ESP queue.
+            // The field shape: healthy enrollment, bootstrap merely ran late in the ESP queue.
             Describe(EnrollmentTerminationOutcome.Succeeded, "in_progress",
                 out var severity, out _, out var note);
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendApiClientAuthClassificationTests.cs

@@ -14,7 +14,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
     /// 401/403 classification in <see cref="BackendApiClient"/>: a backend JSON 403 is a real
     /// device-authorization verdict, while an HTML body means the response came from the Azure
     /// platform / an edge proxy (stopped or retired app) and must NOT be reported as
-    /// "device is not authorized". Field case sits-d.cloud 2026-08-09: a pre-cutover agent hit
+    /// "device is not authorized". Field case 2026-08-09: a pre-cutover agent hit
     /// the stopped legacy Function App and support chased a non-existent authorization problem.
     /// </summary>
     public sealed class BackendApiClientAuthClassificationTests

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderTests.cs

@@ -275,9 +275,44 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 
             Assert.False(result.Success);
             Assert.False(result.IsTransient);
+            Assert.False(result.IsSessionGone);
             Assert.Contains(((int)status).ToString(), result.ErrorReason);
         }
 
+        [Fact]
+        public async Task Gone_410_maps_to_SessionGone()
+        {
+            // 410 = the backend no longer knows this session. Not transient (no retry), not auth,
+            // not poison, not a size problem — a distinct terminal kind the drain reacts to.
+            using var rig = new Rig();
+            rig.Handler.QueueStatus(HttpStatusCode.Gone, body: "session unknown");
+
+            var result = await rig.Sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            Assert.False(result.Success);
+            Assert.True(result.IsSessionGone);
+            Assert.False(result.IsTransient);
+            Assert.False(result.IsAuthFailure);
+            Assert.False(result.IsPoison);
+            Assert.False(result.RequiresSplit);
+            Assert.Contains("410", result.ErrorReason);
+        }
+
+        [Fact]
+        public async Task Gone_410_with_poison_body_is_still_SessionGone_never_poison()
+        {
+            // A poison body on 410 must not be honoured: dropping items + emitting
+            // telemetry_upload_poisoned would only produce the next 410 (emit/reject loop).
+            using var rig = new Rig();
+            rig.Handler.QueueStatus(HttpStatusCode.Gone, body: "{\"poison\":true,\"rejectedRowKeys\":[\"rk1\"],\"reason\":\"x\"}");
+
+            var result = await rig.Sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            Assert.True(result.IsSessionGone);
+            Assert.False(result.IsPoison);
+            Assert.Null(result.PoisonRowKeys);
+        }
+
         [Theory]
         [InlineData(HttpStatusCode.RequestTimeout)]    // 408
         [InlineData((HttpStatusCode)429)]              // TooManyRequests

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/FakeBackendTelemetryUploader.cs

@@ -68,6 +68,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             return this;
         }
 
+        public FakeBackendTelemetryUploader QueueSessionGone(string reason = "session gone: http 410")
+        {
+            _script.Enqueue(_ => UploadResult.SessionGone(reason));
+            return this;
+        }
+
         public FakeBackendTelemetryUploader QueueThrow(Exception ex)
         {
             _script.Enqueue(_ => throw ex);

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetrySpoolTests.cs

@@ -10,10 +10,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {
     public sealed class TelemetrySpoolTests
     {
-        private static TelemetryItemDraft EventDraft(string rowKey = "row-1") =>
+        private const string OwnKey = "tenant_session";
+        private const string ForeignKey = "tenant_old-session";
+
+        private static TelemetryItemDraft EventDraft(string rowKey = "row-1") => EventDraft(rowKey, OwnKey);
+
+        private static TelemetryItemDraft EventDraft(string rowKey, string partitionKey) =>
             new TelemetryItemDraft(
                 kind: TelemetryItemKind.Event,
-                partitionKey: "tenant_session",
+                partitionKey: partitionKey,
                 rowKey: rowKey,
                 payloadJson: "{\"EventType\":\"agent_started\"}",
                 isSessionScoped: true);
@@ -195,6 +200,86 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.Equal(1, next.TelemetryItemId);
         }
 
+        // ============================================================ Startup partition-key filter
+
+        [Fact]
+        public void Ctor_drops_leading_pending_items_of_another_session_and_persists_cursor()
+        {
+            // Same spool directory, new session id: the previous session's unsent items would only
+            // draw a 410 that must not end the new session. They are dropped on startup; the own
+            // item behind them stays pending.
+            using var tmp = new TempDirectory();
+            var s1 = new TelemetrySpool(tmp.Path, Clock());
+            s1.Enqueue(EventDraft("old-a", ForeignKey));
+            s1.Enqueue(EventDraft("old-b", ForeignKey));
+            s1.Enqueue(EventDraft("own", OwnKey));
+
+            var s2 = new TelemetrySpool(tmp.Path, Clock(), expectedPartitionKey: OwnKey);
+
+            Assert.Equal(1, s2.LastUploadedItemId);
+            Assert.Equal(2, s2.LastAssignedItemId);
+            Assert.Equal(1, s2.PendingItemCount);
+            Assert.Equal("own", Assert.Single(s2.Peek(10)).RowKey);
+
+            // Cursor persisted: a later start without the filter sees the same tail with the same bytes.
+            var s3 = new TelemetrySpool(tmp.Path, Clock());
+            Assert.Equal(1, s3.LastUploadedItemId);
+            Assert.Equal(1, s3.PendingItemCount);
+            Assert.Equal(s3.PendingBytes, s2.PendingBytes);
+
+            var next = s2.Enqueue(EventDraft("next", OwnKey));
+            Assert.Equal(3, next.TelemetryItemId);
+        }
+
+        [Fact]
+        public void Ctor_drops_nothing_when_a_foreign_item_follows_an_own_item()
+        {
+            // Impossible by construction (one process = one session); if it happens the order is
+            // not trustworthy, so the filter keeps everything instead of guessing.
+            using var tmp = new TempDirectory();
+            var s1 = new TelemetrySpool(tmp.Path, Clock());
+            s1.Enqueue(EventDraft("old-a", ForeignKey));
+            s1.Enqueue(EventDraft("own", OwnKey));
+            s1.Enqueue(EventDraft("old-b", ForeignKey));
+
+            var s2 = new TelemetrySpool(tmp.Path, Clock(), expectedPartitionKey: OwnKey);
+
+            Assert.Equal(-1, s2.LastUploadedItemId);
+            Assert.Equal(3, s2.PendingItemCount);
+            Assert.Equal(s1.PendingBytes, s2.PendingBytes);
+        }
+
+        [Fact]
+        public void Ctor_keeps_pending_items_that_carry_the_expected_key()
+        {
+            // WhiteGlove Part 2 reuses the Part-1 session id: its leftovers carry the expected key.
+            using var tmp = new TempDirectory();
+            var s1 = new TelemetrySpool(tmp.Path, Clock());
+            s1.Enqueue(EventDraft("a", OwnKey));
+            s1.Enqueue(EventDraft("b", OwnKey));
+            s1.Enqueue(EventDraft("c", OwnKey));
+
+            var s2 = new TelemetrySpool(tmp.Path, Clock(), expectedPartitionKey: OwnKey);
+
+            Assert.Equal(-1, s2.LastUploadedItemId);
+            Assert.Equal(3, s2.PendingItemCount);
+            Assert.Equal(s1.PendingBytes, s2.PendingBytes);
+        }
+
+        [Fact]
+        public void Ctor_without_expected_key_keeps_foreign_items()
+        {
+            using var tmp = new TempDirectory();
+            var s1 = new TelemetrySpool(tmp.Path, Clock());
+            s1.Enqueue(EventDraft("old-a", ForeignKey));
+            s1.Enqueue(EventDraft("old-b", ForeignKey));
+
+            var s2 = new TelemetrySpool(tmp.Path, Clock());
+
+            Assert.Equal(-1, s2.LastUploadedItemId);
+            Assert.Equal(2, s2.PendingItemCount);
+        }
+
         [Fact]
         public void Enqueue_with_RequiresImmediateFlush_raises_ImmediateFlushRequested()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetryUploadOrchestratorTests.cs

@@ -10,10 +10,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {
     public sealed class TelemetryUploadOrchestratorTests
     {
-        private static TelemetryItemDraft Draft(string rowKey) =>
+        private const string OwnKey = "tenant_session";
+
+        private static TelemetryItemDraft Draft(string rowKey) => Draft(rowKey, OwnKey);
+
+        private static TelemetryItemDraft Draft(string rowKey, string partitionKey) =>
             new TelemetryItemDraft(
                 kind: TelemetryItemKind.Event,
-                partitionKey: "tenant_session",
+                partitionKey: partitionKey,
                 rowKey: rowKey,
                 payloadJson: $"{{\"rk\":\"{rowKey}\"}}",
                 isSessionScoped: true);
@@ -157,6 +161,118 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.Equal(1, blockedCount);
         }
 
+        // ============================================================ HTTP 410 — session gone
+
+        [Fact]
+        public async Task SessionGone_for_current_session_stops_drain_retains_cursor_and_raises_once()
+        {
+            using var tmp = new TempDirectory();
+            var spool = new TelemetrySpool(tmp.Path, Clock());
+            spool.Enqueue(Draft("a"));
+            spool.Enqueue(Draft("b"));
+
+            var uploader = new FakeBackendTelemetryUploader().QueueSessionGone().QueueSessionGone();
+            using var sut = new TelemetryUploadOrchestrator(spool, uploader, Clock(), currentPartitionKey: OwnKey);
+            var gone = new System.Collections.Generic.List<string>();
+            int blockedCount = 0;
+            PoisonReport? poison = null;
+            sut.SessionGone += (_, reason) => gone.Add(reason);
+            sut.UploadBlocked += (_, __) => blockedCount++;
+            sut.BatchPoisoned += (_, p) => poison = p;
+
+            var first = await sut.DrainAllAsync();
+
+            Assert.False(first.Success);
+            Assert.Equal(1, first.FailedBatches);
+            Assert.Equal(0, first.UploadedItems);
+            Assert.Equal(1, uploader.CallCount);       // no retries — nothing can make a 410 succeed
+            Assert.Equal(-1, sut.LastUploadedItemId);  // retained — items stay on disk for the diag ZIP
+            Assert.Single(gone);
+            Assert.Contains("410", gone[0]);
+            Assert.Equal(0, blockedCount);             // not a "blocked" pipeline
+            Assert.Null(poison);
+
+            // One-shot: the next drain hits the 410 again but does not raise again.
+            var second = await sut.DrainAllAsync();
+            Assert.False(second.Success);
+            Assert.Equal(2, uploader.CallCount);
+            Assert.Equal(-1, sut.LastUploadedItemId);
+            Assert.Single(gone);
+            Assert.Equal(0, blockedCount);
+        }
+
+        [Fact]
+        public async Task SessionGone_for_leading_foreign_items_drops_only_them_and_continues()
+        {
+            // Leftovers of a previous session id at the head of the spool (defence in depth — the
+            // spool filters these at startup). A 410 for them must not end the current session:
+            // drop exactly the leading foreign run, then carry on with the current session's items.
+            using var tmp = new TempDirectory();
+            var spool = new TelemetrySpool(tmp.Path, Clock());
+            spool.Enqueue(Draft("old-a", "tenant_old-session"));
+            spool.Enqueue(Draft("old-b", "tenant_old-session"));
+            spool.Enqueue(Draft("new", OwnKey));
+
+            var uploader = new FakeBackendTelemetryUploader().QueueSessionGone().QueueOk();
+            using var sut = new TelemetryUploadOrchestrator(spool, uploader, Clock(), currentPartitionKey: OwnKey);
+            int goneCount = 0, blockedCount = 0;
+            sut.SessionGone += (_, __) => goneCount++;
+            sut.UploadBlocked += (_, __) => blockedCount++;
+
+            var result = await sut.DrainAllAsync();
+
+            Assert.True(result.Success);
+            Assert.Equal(0, result.FailedBatches);
+            Assert.Equal(1, result.UploadedItems);
+            Assert.Equal(2, uploader.CallCount);
+            Assert.Equal(3, uploader.Received[0].Count);              // first batch carried all three
+            Assert.Equal("new", Assert.Single(uploader.Received[1]).RowKey); // retry carried only the own item
+            Assert.Equal(2, sut.LastUploadedItemId);
+            Assert.Equal(0, goneCount);
+            Assert.Equal(0, blockedCount);
+        }
+
+        [Fact]
+        public async Task SessionGone_is_not_latched_before_a_handler_is_subscribed()
+        {
+            // The host subscribes after EnrollmentOrchestrator.Start; a 410 on the very first drain
+            // must still reach it on the next drain instead of being swallowed by the one-shot guard.
+            using var tmp = new TempDirectory();
+            var spool = new TelemetrySpool(tmp.Path, Clock());
+            spool.Enqueue(Draft("only"));
+
+            var uploader = new FakeBackendTelemetryUploader().QueueSessionGone().QueueSessionGone();
+            using var sut = new TelemetryUploadOrchestrator(spool, uploader, Clock(), currentPartitionKey: OwnKey);
+
+            await sut.DrainAllAsync();                 // nobody listening yet
+
+            int goneCount = 0;
+            sut.SessionGone += (_, __) => goneCount++;
+            await sut.DrainAllAsync();
+
+            Assert.Equal(1, goneCount);
+            Assert.Equal(-1, sut.LastUploadedItemId);
+        }
+
+        [Fact]
+        public async Task SessionGone_without_a_current_key_treats_every_batch_as_own()
+        {
+            using var tmp = new TempDirectory();
+            var spool = new TelemetrySpool(tmp.Path, Clock());
+            spool.Enqueue(Draft("x", "tenant_whatever"));
+
+            var uploader = new FakeBackendTelemetryUploader().QueueSessionGone();
+            using var sut = new TelemetryUploadOrchestrator(spool, uploader, Clock());
+            int goneCount = 0;
+            sut.SessionGone += (_, __) => goneCount++;
+
+            var result = await sut.DrainAllAsync();
+
+            Assert.False(result.Success);
+            Assert.Equal(1, goneCount);
+            Assert.Equal(-1, sut.LastUploadedItemId);
+        }
+
         [Fact]
         public async Task TooLarge_splits_batch_and_uploads_everything()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/RemoteConfigService.cs

@@ -21,7 +21,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         private readonly AgentLogger _logger;
         private readonly string _cacheFilePath;
         private readonly EmergencyReporter _emergencyReporter;
-        private readonly DistressReporter _distressReporter;
         private readonly AuthFailureTracker _authFailureTracker;
 
         private AgentConfigResponse _currentConfig;
@@ -46,7 +45,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         /// Upper bound for the pre-fetch network-link wait on the initial startup fetch.
         /// Deliberately longer than the registration gate's 15s: the fetch runs FIRST after a
         /// boot-time relaunch, when Wi-Fi may still be associating (802.1X, OOBE), and a fetch
-        /// burned into a dead link strands the whole session on built-in defaults — tenant aebdce78
+        /// burned into a dead link strands the whole session on built-in defaults — kiosk-tenant
         /// audit 2026-08-24: ~50% of sessions lost their tenant config exactly this way.
         /// </summary>
         internal static readonly TimeSpan InitialFetchNetworkLinkWaitMax = TimeSpan.FromSeconds(60);
@@ -92,13 +91,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         /// </summary>
         public bool RecoveredAfterFetchFailure { get; private set; }
 
-        public RemoteConfigService(BackendApiClient apiClient, string tenantId, AgentLogger logger, EmergencyReporter emergencyReporter = null, DistressReporter distressReporter = null, AuthFailureTracker authFailureTracker = null)
+        public RemoteConfigService(BackendApiClient apiClient, string tenantId, AgentLogger logger, EmergencyReporter emergencyReporter = null, AuthFailureTracker authFailureTracker = null)
         {
             _apiClient = apiClient ?? throw new ArgumentNullException(nameof(apiClient));
             _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
             _emergencyReporter = emergencyReporter;
-            _distressReporter = distressReporter;
             _authFailureTracker = authFailureTracker;
 
             var cacheDir = Environment.ExpandEnvironmentVariables(@"%ProgramData%\AutopilotMonitor\Config");

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Handlers.cs

@@ -306,6 +306,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         {
             var currentStartTs = LastMatchedLogTimestamp ?? UtcNowProvider();
             var currentStartProvenance = CaptureLastMatchedProvenance();
+            var fromExecutor = string.Equals(source, "agentexecutor", StringComparison.OrdinalIgnoreCase);
 
             // A start line older than the result this policy already emitted is the late start
             // line of THAT run: its AgentExecutor block surfaced after the IME result — the two
@@ -318,7 +319,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             // never tie; a low-resolution clock in a test may).
             if (_platformScriptResultEmitted.TryGetValue(id, out var emittedResultTs) && currentStartTs < emittedResultTs)
             {
-                RecordInvocationMarker(id, isClose: false);
+                RecordInvocationMarker(id, isClose: false, EmittedRunId);
                 NoteInvocationActivity();
                 _logger.Debug($"ImeLogTracker: platform script start line for {id} (source: {source ?? "ime"}) predates its emitted result — late line of that run, not a new one");
                 return;
@@ -326,7 +327,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
             if (_pendingPlatformScripts.TryGetValue(id, out var pendingSlot))
             {
-                if (pendingSlot.StartedAtUtc.HasValue && currentStartTs - pendingSlot.StartedAtUtc.Value > TimeSpan.FromHours(24))
+                if (pendingSlot.StartedAtUtc.HasValue && currentStartTs - pendingSlot.StartedAtUtc.Value > StalePlatformRunAge)
                 {
                     // Stale-slot hardening (session eaf3d8c4): a replayed start line from a previous
                     // enrollment whose matching result never appeared (script was mid-run when that
@@ -343,6 +344,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     // Emit what the held run has; its end block did not surface in time.
                     EmitPlatformScriptResult(pendingSlot, "the next run of this policy started");
                 }
+                else if (fromExecutor && LastMatchedLogTimestamp.HasValue && pendingSlot.Result == null
+                    && pendingSlot.ExecutorStartedAtUtc.HasValue && pendingSlot.ExecutorStartedAtUtc.Value < currentStartTs)
+                {
+                    // Every executor process writes its start line once: a later one is the next run
+                    // (IME re-runs a failed script on a later check-in), whose end block must not
+                    // overwrite this one's. This run waits for its IME result — on the first pass
+                    // AgentExecutor.log is read in full before the IME log (session eff1b413).
+                    ParkPlatformRun(pendingSlot);
+                }
                 else if (!pendingSlot.StartedAtUtc.HasValue)
                 {
                     // The slot was opened by its result while the start block was still hidden;
@@ -351,9 +361,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     pendingSlot.StartedAtProvenance = currentStartProvenance;
                     _stateDirty = true;
                 }
-                if (pendingSlot.UserId == null && userId != null) pendingSlot.UserId = userId;
             }
-            if (!_pendingPlatformScripts.ContainsKey(id))
+            if (_pendingPlatformScripts.TryGetValue(id, out var slot))
+            {
+                if (slot.UserId == null && userId != null) slot.UserId = userId;
+                if (fromExecutor && !slot.ExecutorStartedAtUtc.HasValue)
+                {
+                    slot.ExecutorStartedAtUtc = currentStartTs;
+                    _stateDirty = true;
+                }
+            }
+            else
             {
                 // A fresh start for this policy (no pending entry) begins a NEW execution.
                 // Clear any emitted-marker from a prior run so IME re-evaluations / retries of
@@ -361,18 +379,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 // deduped away. A start line of the emitted run itself never reaches this point
                 // (the guard above), so this never clears the current run's own marker.
                 _platformScriptResultEmitted.Remove(id);
-                _pendingPlatformScripts[id] = new ScriptExecutionState
+                slot = new ScriptExecutionState
                 {
                     PolicyId = id,
                     ScriptType = "platform",
                     UserId = userId,
+                    RunId = NewRunId(),
                     // Prefer the source CMTrace timestamp so a script that started before the
                     // agent launched (replayed log content) is dated to its real start, not now.
                     // Set only at slot creation: the start line fires twice (agentexecutor + ime
                     // source) but the earliest wins.
                     StartedAtUtc = currentStartTs,
                     StartedAtProvenance = currentStartProvenance,
+                    ExecutorStartedAtUtc = fromExecutor ? currentStartTs : (DateTime?)null,
                 };
+                _pendingPlatformScripts[id] = slot;
                 ScriptRuns.NoteStarted(userId, id, UtcNowProvider());
                 // Live "running" indicator — same signal health scripts emit. Gated on slot
                 // creation so the duplicate start line (agentexecutor + ime source) doesn't
@@ -380,7 +401,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 try { OnScriptStarted?.Invoke(new ScriptStartedInfo { PolicyId = id, ScriptType = "platform" }); }
                 catch (Exception ex) { _logger.Warning($"ImeLogTracker: OnScriptStarted handler threw: {ex.Message}"); }
             }
-            RecordInvocationMarker(id, isClose: false);
+            RecordInvocationMarker(id, isClose: false, LastMatchedLogTimestamp.HasValue ? RunIdOfStartLine(slot, fromExecutor, currentStartTs) : slot.RunId);
             NoteInvocationActivity();
             // Started lines fire twice per script (agentexecutor + ime source) and carry no
             // outcome — the matching `platform script completed` line below carries result+exit
@@ -388,6 +409,34 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             _logger.Debug($"ImeLogTracker: platform script started: {id} (source: {source ?? "ime"})");
         }
 
+        /// <summary>How long after IME's "Script file … is generated" line its executor writes its start line (about 2 s).</summary>
+        private static readonly TimeSpan ImeLaunchWindow = TimeSpan.FromMinutes(1);
+
+        /// <summary>
+        /// The run a timestamped start line belongs to, for its invocation marker. An executor start line belongs to the
+        /// slot unless it is older than the slot's executor start — re-read behind a later run — then to the parked run
+        /// it started. IME's "Script file … is generated" precedes its executor: it belongs to the live run whose
+        /// executor started within <see cref="ImeLaunchWindow"/> after it, else to a slot whose executor has not
+        /// started yet; otherwise its run is not known (yet) and the lines behind it go nowhere.
+        /// </summary>
+        private string RunIdOfStartLine(ScriptExecutionState slot, bool fromExecutor, DateTime lineTs)
+        {
+            if (fromExecutor)
+            {
+                if (!slot.ExecutorStartedAtUtc.HasValue || slot.ExecutorStartedAtUtc.Value <= lineTs) return slot.RunId;
+                var parked = _parkedPlatformScripts.FirstOrDefault(r =>
+                    string.Equals(r.PolicyId, slot.PolicyId, StringComparison.OrdinalIgnoreCase) && r.ExecutorStartedAtUtc == lineTs);
+                return parked?.RunId ?? EmittedRunId;
+            }
+
+            var launched = LivePlatformRuns(slot.PolicyId)
+                .Where(r => r.ExecutorStartedAtUtc.HasValue && r.ExecutorStartedAtUtc.Value >= lineTs && r.ExecutorStartedAtUtc.Value - lineTs <= ImeLaunchWindow)
+                .OrderBy(r => r.ExecutorStartedAtUtc.Value)
+                .FirstOrDefault();
+            if (launched != null) return launched.RunId;
+            return slot.ExecutorStartedAtUtc.HasValue ? EmittedRunId : slot.RunId;
+        }
+
         // Routes line-by-line script-data handlers (context / exitCode / output) to the right
         // accumulator based on the pattern's scriptType parameter. Health-script lines feed the
         // single-slot _pendingHealthScript (the HS-NEW-RESULT JSON delivers the full cycle in one
@@ -502,13 +551,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
             // PS-AGENT-OUTPUT captures both stdout and stderr in one pattern
             var output = match.Groups["output"]?.Value;
-            var error = match.Groups["error"]?.Value;
+            var error = match.Groups["error"];
 
-            if (!string.IsNullOrEmpty(output) && !string.IsNullOrEmpty(error))
+            if (error != null && error.Success)
             {
-                // Combined pattern (write output done. output = ..., error = ...)
-                script.Stdout = TruncateOutput(output.Trim());
-                script.Stderr = TruncateOutput(error.Trim());
+                // Combined pattern (write output done. output = ..., error = ...): both texts as
+                // AgentExecutor wrote them to the result files — the error part is the error file
+                // IME judges. The "error from script" line before it is a snapshot taken before the
+                // output readers finished, so this one replaces it, an empty stdout included.
+                script.Stdout = TruncateOutput(output?.Trim());
+                script.Stderr = TruncateOutput(error.Value.Trim());
             }
             else if (string.Equals(outputType, "stderr", StringComparison.OrdinalIgnoreCase))
             {
@@ -556,49 +608,44 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// </summary>
         internal void CompletePlatformScriptFromImeResult(string policyId, string result, DateTime? resultLineTimestampUtc, string patternId, CmTraceLineProvenance resultProvenance, string userId = null)
         {
-            // Dedup: the deadline-based fallback (FlushPendingPlatformScriptResults) may already have
-            // emitted this script from its AgentExecutor exit code because IME's authoritative
-            // PS-SCRIPT-RESULT line arrived late. The fallback carries the same exit code + stdout,
-            // so re-emitting here would duplicate the timeline entry and inflate counts. Drop the
-            // now-redundant pending entry and skip.
-            if (_platformScriptResultEmitted.ContainsKey(policyId))
+            // The result belongs to the run of this policy that started last before its line —
+            // the run in flight, or an earlier one that waits for its result while a later run
+            // already started (ParkPlatformRun).
+            var script = FindRunForResult(policyId, userId, resultLineTimestampUtc);
+            if (script == null)
             {
-                _logger.Debug($"ImeLogTracker: platform script {policyId} PS-SCRIPT-RESULT arrived after fallback emit — skipping duplicate");
-                _pendingPlatformScripts.Remove(policyId);
-                return;
-            }
+                // Dedup: the deadline-based fallback (FlushPendingPlatformScriptResults) may already
+                // have emitted this run from its AgentExecutor end block because IME's authoritative
+                // PS-SCRIPT-RESULT line arrived late, or the same result line is read again.
+                // Re-emitting would duplicate the timeline entry and inflate counts.
+                if (_platformScriptResultEmitted.ContainsKey(policyId))
+                {
+                    _logger.Debug($"ImeLogTracker: platform script {policyId} PS-SCRIPT-RESULT arrived after its run was emitted — skipping duplicate");
+                    return;
+                }
 
-            // Merge with pending AgentExecutor data if available
-            if (_pendingPlatformScripts.TryGetValue(policyId, out var script))
-            {
-                // Stale-result guard: on an intra-lifetime re-run of the same policy, run 1's
-                // late PS-SCRIPT-RESULT can arrive after run 2's start line already created a
-                // fresh slot (the start clears the emitted-marker). Merging would pair run 2's
-                // StartedAtUtc/state with run 1's result and then drop run 2's genuine result at
-                // the marker check above. A result line always postdates its own run's start
-                // line in the source log, so a result older than the pending slot's start
-                // belongs to a previous run — drop it and keep the live slot intact.
-                if (script.StartedAtUtc.HasValue
-                    && resultLineTimestampUtc.HasValue
-                    && resultLineTimestampUtc.Value < script.StartedAtUtc.Value)
+                // Stale-result guard: every run of this policy in flight started after the result
+                // line — a result line always postdates its own run's start line in the source log,
+                // so it belongs to a previous run. Keep the live runs intact.
+                if (HasLivePlatformRun(policyId))
                 {
                     _logger.Debug($"ImeLogTracker: platform script {policyId} result predates the current run's start — stale result from a previous run, skipping");
                     return;
                 }
-            }
-            else
-            {
+
                 script = new ScriptExecutionState
                 {
                     PolicyId = policyId,
                     ScriptType = "platform",
                     UserId = userId,
+                    RunId = NewRunId(),
                 };
                 _pendingPlatformScripts[policyId] = script;
                 ScriptRuns.NoteStarted(userId, policyId, UtcNowProvider());
             }
 
             if (script.UserId == null && userId != null) script.UserId = userId;
+            ResolveParkedRunsBefore(script);
             script.Result = result;
             script.ResultSource = "ime_policy_result";
             script.ResultObservedAtUtc = resultLineTimestampUtc ?? UtcNowProvider();
@@ -627,21 +674,150 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         private void EmitPlatformScriptResult(ScriptExecutionState script, string note = null)
         {
             _logger.Info($"ImeLogTracker: platform script completed: {script.PolicyId}, result={script.Result}, exit={script.ExitCode}{(note != null ? $" ({note})" : string.Empty)}");
-            if (string.IsNullOrEmpty(script.RunId)) script.RunId = Guid.NewGuid().ToString("D");
+            if (string.IsNullOrEmpty(script.RunId)) script.RunId = NewRunId();
             EmitScriptEvent(script);
-            ScriptRuns.NoteEmitted(script, UtcNowProvider());
+            // The register keeps the latest run per (user, policy) for the registry reconciliation:
+            // a run that waited for its result while a later one started must not take that later
+            // run's entry.
+            if (!HasLaterLivePlatformRun(script)) ScriptRuns.NoteEmitted(script, UtcNowProvider());
             // The run's source stamp, capped at the clock: a result line cannot be read before it
             // was written, so a stamp ahead of the clock is a wrong zone assumption on that line
             // (a rewound result resolved in the reader's zone, session 4377911b: +1 h). Left
             // uncapped, the marker made the genuine NEXT run's start line read as a late line of
-            // this run and its result a duplicate.
+            // this run and its result a duplicate. Only ever raised: a run emitted after a later
+            // one must not move the reference back.
             var runStamp = script.ResultObservedAtUtc ?? script.ExitObservedAtUtc ?? UtcNowProvider();
             var nowUtc = UtcNowProvider();
-            _platformScriptResultEmitted[script.PolicyId] = runStamp > nowUtc ? nowUtc : runStamp;
-            _pendingPlatformScripts.Remove(script.PolicyId);
+            var stamp = runStamp > nowUtc ? nowUtc : runStamp;
+            if (!_platformScriptResultEmitted.TryGetValue(script.PolicyId, out var previousStamp) || stamp > previousStamp)
+                _platformScriptResultEmitted[script.PolicyId] = stamp;
+            if (_pendingPlatformScripts.TryGetValue(script.PolicyId, out var current) && ReferenceEquals(current, script))
+                _pendingPlatformScripts.Remove(script.PolicyId);
+            else
+                _parkedPlatformScripts.Remove(script);
             _stateDirty = true;
         }
 
+        private static string NewRunId() => Guid.NewGuid().ToString("D");
+
+        /// <summary>A run older than this by source time is from a previous enrollment, not a run in flight.</summary>
+        private static readonly TimeSpan StalePlatformRunAge = TimeSpan.FromHours(24);
+
+        private static bool SameUserOrUnknown(string a, string b)
+            => a == null || b == null || string.Equals(a, b, StringComparison.OrdinalIgnoreCase);
+
+        private static DateTime StartOf(ScriptExecutionState run) => run.StartedAtUtc ?? DateTime.MinValue;
+
+        /// <summary>The runs of a policy that are not emitted yet: the earlier ones waiting for their IME result, then the one in flight.</summary>
+        private IEnumerable<ScriptExecutionState> LivePlatformRuns(string policyId)
+        {
+            foreach (var run in _parkedPlatformScripts)
+            {
+                if (string.Equals(run.PolicyId, policyId, StringComparison.OrdinalIgnoreCase)) yield return run;
+            }
+            if (_pendingPlatformScripts.TryGetValue(policyId, out var current)) yield return current;
+        }
+
+        private bool HasLivePlatformRun(string policyId) => LivePlatformRuns(policyId).Any();
+
+        /// <summary>The live run a start marker names, or null once that run was emitted.</summary>
+        private ScriptExecutionState FindLivePlatformRun(string policyId, string runId)
+            => LivePlatformRuns(policyId).FirstOrDefault(r => string.Equals(r.RunId, runId, StringComparison.Ordinal));
+
+        private bool HasLaterLivePlatformRun(ScriptExecutionState script)
+            => LivePlatformRuns(script.PolicyId).Any(r => !ReferenceEquals(r, script)
+                && SameUserOrUnknown(r.UserId, script.UserId) && StartOf(r) > StartOf(script));
+
+        /// <summary>
+        /// The live run an IME result line belongs to: of the runs of its policy that started at or before the line,
+        /// the latest — one of the same IME user when there is one.
+        /// </summary>
+        private ScriptExecutionState FindRunForResult(string policyId, string userId, DateTime? resultLineTimestampUtc)
+        {
+            ScriptExecutionState sameUser = null, anyUser = null;
+            foreach (var run in LivePlatformRuns(policyId))
+            {
+                if (resultLineTimestampUtc.HasValue && run.StartedAtUtc.HasValue && run.StartedAtUtc.Value > resultLineTimestampUtc.Value) continue;
+                if (anyUser == null || StartOf(run) > StartOf(anyUser)) anyUser = run;
+                if (SameUserOrUnknown(run.UserId, userId) && (sameUser == null || StartOf(run) > StartOf(sameUser))) sameUser = run;
+            }
+            return sameUser ?? anyUser;
+        }
+
+        /// <summary>
+        /// Moves the run in flight aside when the next executor run of its policy starts: it keeps its own end block and
+        /// waits for its IME result (<see cref="FindRunForResult"/>), the exit-code fallback, or a later run's result.
+        /// </summary>
+        private void ParkPlatformRun(ScriptExecutionState run)
+        {
+            _pendingPlatformScripts.Remove(run.PolicyId);
+            _parkedPlatformScripts.Add(run);
+            _stateDirty = true;
+            if (_parkedPlatformScripts.Count > MaxParkedPlatformScripts)
+            {
+                var oldest = _parkedPlatformScripts.OrderBy(StartOf).First();
+                _logger.Warning($"ImeLogTracker: more than {MaxParkedPlatformScripts} platform runs wait for their IME result — resolving the oldest ({oldest.PolicyId}, started {oldest.StartedAtUtc:o}) now");
+                ResolveParkedRun(oldest, "too many runs waiting for their IME result");
+            }
+            _logger.Debug($"ImeLogTracker: platform script {run.PolicyId}: the next executor run started before IME's result of run {run.RunId} was read — that run keeps its end block and waits for its result");
+        }
+
+        /// <summary>
+        /// Results arrive in run order: a parked run of the same IME user that started before the run a result belongs to
+        /// gets none any more (its result line was lost) — it goes out now, ahead of the later run.
+        /// </summary>
+        private void ResolveParkedRunsBefore(ScriptExecutionState owner)
+        {
+            if (_parkedPlatformScripts.Count == 0 || !owner.StartedAtUtc.HasValue) return;
+            var earlier = _parkedPlatformScripts
+                .Where(r => !ReferenceEquals(r, owner)
+                    && string.Equals(r.PolicyId, owner.PolicyId, StringComparison.OrdinalIgnoreCase)
+                    && SameUserOrUnknown(r.UserId, owner.UserId)
+                    && r.StartedAtUtc.HasValue && r.StartedAtUtc.Value < owner.StartedAtUtc.Value)
+                .OrderBy(StartOf)
+                .ToList();
+            foreach (var run in earlier) ResolveParkedRun(run, "a later run of this policy got its IME result first");
+        }
+
+        /// <summary>A parked run that will not get its IME result: out with what it has, or dropped when it has nothing.</summary>
+        private void ResolveParkedRun(ScriptExecutionState run, string why)
+        {
+            if (run.Result != null)
+            {
+                EmitPlatformScriptResult(run, why);
+            }
+            else if (run.ExitCode.HasValue)
+            {
+                EmitFromExecutorEndBlock(run, why);
+            }
+            else
+            {
+                _parkedPlatformScripts.Remove(run);
+                _stateDirty = true;
+                _logger.Debug($"ImeLogTracker: platform script {run.PolicyId} run {run.RunId} has neither IME result nor executor end block — dropped ({why})");
+            }
+        }
+
+        /// <summary>
+        /// IME's own verdict from a run's end block: Success exactly when the error file was empty
+        /// (<c>IsNullOrEmpty(errorFile.Trim())</c> in IME), whatever the exit code — PowerShell returns 0 after a
+        /// non-terminating error and any code a script exits with. Only when the stderr line was never read does the
+        /// exit code stand in.
+        /// </summary>
+        internal static string ImeResultFromEndBlock(ScriptExecutionState script)
+        {
+            if (script.Stderr != null) return string.IsNullOrWhiteSpace(script.Stderr) ? "Success" : "Failed";
+            return script.ExitCode == 0 ? "Success" : "Failed";
+        }
+
+        private void EmitFromExecutorEndBlock(ScriptExecutionState script, string why)
+        {
+            script.Result = ImeResultFromEndBlock(script);
+            script.ResultSource = "agentexecutor_fallback";
+            var basis = script.Stderr == null ? $"exit code {script.ExitCode}, stderr not read" : script.Stderr.Trim().Length == 0 ? "empty stderr" : "stderr present";
+            EmitPlatformScriptResult(script, $"{why} — {script.Result} from the executor end block ({basis}) (fallback)");
+        }
+
         /// <summary>
         /// Grace period after a platform script's AgentExecutor exit code is observed before
         /// <see cref="FlushPendingPlatformScriptResults"/> emits a completion from that exit code.
@@ -679,29 +855,48 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// out once its executor end block has been read — the block arrives within one pass, so
         /// stdout/stderr are in by now — or after <see cref="PlatformScriptEndBlockGrace"/>.</item>
         /// <item>A script with a known AgentExecutor exit code but no IME <c>PS-SCRIPT-RESULT</c>
-        /// line within <see cref="PlatformScriptResultGrace"/> is emitted from the exit code
-        /// (0 → Success, else Failed), tagged <c>resultSource=agentexecutor_fallback</c> so the
-        /// data is honest about its provenance. Without this, scripts that completed shortly
-        /// before the agent terminates were silently dropped.</item>
+        /// line within <see cref="PlatformScriptResultGrace"/> is emitted from its end block by
+        /// IME's own rule (<see cref="ImeResultFromEndBlock"/>), tagged
+        /// <c>resultSource=agentexecutor_fallback</c> so the data is honest about its provenance.
+        /// Without this, scripts that completed shortly before the agent terminates were silently
+        /// dropped.</item>
         /// </list>
+        /// Parked runs go first, oldest first, so a policy's runs leave in run order; one without
+        /// result and end block keeps waiting — across a shutdown too — until a later run's result
+        /// resolves it or it is a day old.
         /// Runs on the single-threaded polling loop (no locking needed, same as the handlers).
         /// <paramref name="force"/> bypasses both grace checks for the final pass on shutdown.
         /// </summary>
         internal void FlushPendingPlatformScriptResults(DateTime nowUtc, bool force = false)
         {
-            if (_pendingPlatformScripts.Count == 0) return;
+            if (_pendingPlatformScripts.Count == 0 && _parkedPlatformScripts.Count == 0) return;
 
             var fallbackEmitted = false;
-            foreach (var script in _pendingPlatformScripts.Values.ToList())
+            foreach (var run in _parkedPlatformScripts.OrderBy(StartOf).ToList())
             {
-                // Already emitted by the authoritative path — just drop the stale buffer entry.
-                if (_platformScriptResultEmitted.ContainsKey(script.PolicyId))
+                if (run.Result != null)
                 {
-                    _pendingPlatformScripts.Remove(script.PolicyId);
-                    _stateDirty = true;
+                    if (run.ExitCode.HasValue || force || !run.ResultHeldSinceUtc.HasValue || nowUtc - run.ResultHeldSinceUtc.Value >= PlatformScriptEndBlockGrace)
+                        EmitPlatformScriptResult(run, run.ExitCode.HasValue ? "executor end block read after the result" : $"no executor end block within {PlatformScriptEndBlockGrace.TotalSeconds:F0}s");
                     continue;
                 }
+                if (run.ExitCode.HasValue)
+                {
+                    if (!force && (!run.ExitObservedAtUtc.HasValue || nowUtc - run.ExitObservedAtUtc.Value < PlatformScriptResultGrace)) continue;
+                    EmitFromExecutorEndBlock(run, $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)}");
+                    fallbackEmitted = true;
+                    continue;
+                }
+                if (run.StartedAtUtc.HasValue && nowUtc - run.StartedAtUtc.Value > StalePlatformRunAge)
+                {
+                    _parkedPlatformScripts.Remove(run);
+                    _stateDirty = true;
+                    _logger.Debug($"ImeLogTracker: platform script {run.PolicyId} run {run.RunId} waited a day without IME result or executor end block — dropped");
+                }
+            }
 
+            foreach (var script in _pendingPlatformScripts.Values.ToList())
+            {
                 if (script.Result != null)
                 {
                     if (script.ExitCode.HasValue)
@@ -720,10 +915,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     if (nowUtc - script.ExitObservedAtUtc.Value < PlatformScriptResultGrace) continue;
                 }
 
-                script.Result = script.ExitCode.Value == 0 ? "Success" : "Failed";
-                script.ResultSource = "agentexecutor_fallback";
-                EmitPlatformScriptResult(script,
-                    $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)} — emitted from AgentExecutor exit code {script.ExitCode.Value} (fallback)");
+                EmitFromExecutorEndBlock(script, $"result not seen within {PlatformScriptResultGrace.TotalSeconds:F0}s{(force ? ", shutdown flush" : string.Empty)}");
                 fallbackEmitted = true;
             }
 
@@ -735,7 +927,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <summary>Test seam: inject a pending platform script as if AgentExecutor.log had reported
         /// its start + exit code, without an IME PS-SCRIPT-RESULT line.</summary>
         internal void SeedPendingPlatformScriptForTesting(string policyId, int? exitCode, DateTime? exitObservedAtUtc, string stdout = null, DateTime? startedAtUtc = null,
-            CmTraceLineProvenance startedAtProvenance = null, CmTraceLineProvenance exitProvenance = null)
+            CmTraceLineProvenance startedAtProvenance = null, CmTraceLineProvenance exitProvenance = null, string stderr = null)
         {
             // Mirrors a fresh execution start: a new run clears any prior emitted-marker (see
             // HandleScriptStarted) so re-runs of the same policy within one lifetime emit again.
@@ -744,9 +936,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 PolicyId = policyId,
                 ScriptType = "platform",
+                RunId = NewRunId(),
                 ExitCode = exitCode,
                 ExitObservedAtUtc = exitObservedAtUtc,
                 Stdout = stdout,
+                Stderr = stderr,
                 StartedAtUtc = startedAtUtc,
                 StartedAtProvenance = startedAtProvenance,
                 ExitProvenance = exitProvenance,
@@ -755,6 +949,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             RecordInvocationMarker(policyId, isClose: false);
         }
 
+        /// <summary>Test seam: earlier runs waiting for their IME result while a later run of their policy is in flight.</summary>
+        internal int ParkedPlatformScriptCountForTest => _parkedPlatformScripts.Count;
+
         /// <summary>Test seam: the authoritative IME PS-SCRIPT-RESULT path for a platform script
         /// (the production handler minus regex extraction). <paramref name="resultLineTimestampUtc"/>
         /// stands in for the CMTrace timestamp of the PS-SCRIPT-RESULT line (production reads it
@@ -793,7 +990,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// for each detection. When HS-NEW-RESULT later fires with the full payload, the UI
         /// reducer's dataCompleteness scoring keeps the more complete entry.
         /// </summary>
-        private void HandleHealthScriptDetectionResult(Match match, Dictionary<string, string> parameters)
+        private void HandleHealthScriptDetectionResult(Match match)
         {
             var id = match.Groups["id"]?.Value;
             var compliance = match.Groups["compliance"]?.Value;
@@ -915,7 +1112,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 sample,
                 @"\[HS\] the (?<part>pre|post)-remdiation detection script compliance result for (?<id>[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}) is (?<compliance>True|False)",
                 System.Text.RegularExpressions.RegexOptions.IgnoreCase);
-            HandleHealthScriptDetectionResult(match, new Dictionary<string, string>());
+            HandleHealthScriptDetectionResult(match);
         }
 
         /// <summary>Test seam: seed the per-policy health-script cycle start timestamp as if an
@@ -928,7 +1125,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             _healthScriptStartTimes[policyId] = (startedAtUtc, provenance);
         }
 
-        private void HandleHealthScriptResult(Match match, Dictionary<string, string> parameters)
+        private void HandleHealthScriptResult(Match match)
         {
             var json = match.Groups["json"]?.Value;
             if (string.IsNullOrEmpty(json))
@@ -944,7 +1141,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// <summary>
         /// Test seam that bypasses the regex-match plumbing and feeds a raw <c>[HS] new result</c>
         /// JSON payload directly into the parser. Production code path runs through
-        /// <see cref="HandleHealthScriptResult(Match, Dictionary{string, string})"/>; this method
+        /// <see cref="HandleHealthScriptResult(Match)"/>; this method
         /// exists so unit tests can exercise the JSON parser + 1-3 phase emit logic without
         /// having to write CMTrace log files into a temp directory.
         /// </summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -123,8 +123,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             var ledger = IsMultiWriterLogFile(fileName) ? GetLedger(fileName) : null;
 
             // Set by a rewind: entries that still read unchanged behind the old bookmark are
-            // skipped (their invocation markers are given back), and nothing below the old
-            // bookmark is fresh or a calibration anchor.
+            // skipped (their invocation markers are given back); a changed entry below the old
+            // bookmark is fresh only when the bytes it replaced were seen moments ago, and never a
+            // calibration anchor.
             RewindState rewind = null;
             long oldBookmark = -1;
             var writerBoundaries = IsWriterBoundaryLogFile(fileName);
@@ -171,12 +172,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     var guardFrom = ledger.OffsetOfEntryAtOrAfter(startPos - OverwriteGuardBytes);
                     if (guardFrom >= 0 && guardFrom < startPos)
                     {
-                        var divergence = await FindOverwriteAsync(stream, ledger, guardFrom, startPos, token);
+                        var divergence = await FindOverwriteAsync(stream, ledger, guardFrom, startPos, passNowUtc, token);
                         _verifiedBytes += startPos - guardFrom;
                         if (divergence >= 0)
                         {
                             // The guard saw only the tail of the ledger; the block may start earlier.
-                            var earliest = await FindOverwriteAsync(stream, ledger, ledger.StartOffset, startPos, token);
+                            var earliest = await FindOverwriteAsync(stream, ledger, ledger.StartOffset, startPos, passNowUtc, token);
                             _verifiedBytes += startPos - ledger.StartOffset;
                             _verifyPasses++;
                             if (earliest >= 0) divergence = earliest;
@@ -271,7 +272,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         }
                     }
 
-                    if (ledger != null) ledger.Record(entry);
+                    if (ledger != null) ledger.Record(entry, passNowUtc);
                     var unchanged = rewind != null && rewind.IsUnchanged(entry);
                     if (unchanged) RestoreInvocationMarkers(rewind, entry.Offset);
 
@@ -287,7 +288,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
                     if (unchanged) continue; // unchanged behind the old bookmark — processed before the rewind
 
-                    _currentPassLinesAreFresh = passLinesAreFresh && entry.Offset >= oldBookmark;
+                    // Behind the old bookmark only changed entries arrive here: fresh when the bytes they replaced
+                    // were seen moments ago (RewoundEntryIsFresh), never a calibration anchor.
+                    _currentPassLinesAreFresh = entry.Offset >= oldBookmark
+                        ? passLinesAreFresh
+                        : rewind != null && RewoundEntryIsFresh(passLinesAreFresh, rewind.EntryAtRewindPointReplaced, rewind.OldestReplacedSeenUtc, passNowUtc);
 
                     // --- Normal processing (single-line or completed multiline) ---
                     CmTraceLogEntry parsed;
@@ -877,11 +882,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                         break;
 
                     case "healthscriptresult":
-                        HandleHealthScriptResult(match, pattern.Parameters);
+                        HandleHealthScriptResult(match);
                         break;
 
                     case "healthscriptdetectionresult":
-                        HandleHealthScriptDetectionResult(match, pattern.Parameters);
+                        HandleHealthScriptDetectionResult(match);
                         break;
 
                     default:

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Overwrite.cs

@@ -62,6 +62,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             public long Offset;
             public int Length;
             public ulong Hash;
+            /// <summary>
+            /// When these bytes were last seen as they are (read, seeded or verified unchanged): bytes found different
+            /// at this position later were written after it. Not part of the identity.
+            /// </summary>
+            public DateTime SeenUtc;
 
             // Identity is (offset, hash): a tail first read unterminated and later completed
             // keeps its hash but grows by its terminator.
@@ -100,11 +105,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 return idx < Entries.Count ? Entries[idx].Offset : -1;
             }
 
-            public void Record(AssembledEntry e)
+            public void Record(AssembledEntry e, DateTime seenUtc)
             {
                 var idx = IndexOfFirstAtOrAfter(e.Offset);
                 if (idx < Entries.Count) Entries.RemoveRange(idx, Entries.Count - idx);
-                Entries.Add(new LedgerEntry { Offset = e.Offset, Length = e.Length, Hash = e.Hash });
+                Entries.Add(new LedgerEntry { Offset = e.Offset, Length = e.Length, Hash = e.Hash, SeenUtc = seenUtc });
             }
 
             /// <summary>Drops everything from <paramref name="offset"/> on and returns it — the entries a rewind must not process twice.</summary>
@@ -197,7 +202,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 ledger.Seeded = true;
                 if (ledger.Entries.Count == 0 && bookmark > 0)
-                    await SeedLedgerAsync(filePath, ledger, bookmark, token).ConfigureAwait(false);
+                    await SeedLedgerAsync(filePath, ledger, bookmark, nowUtc, token).ConfigureAwait(false);
             }
 
             var due = ledger.VerifyRequested || (InContention(nowUtc) && nowUtc >= ledger.NextCadenceVerifyUtc);
@@ -213,7 +218,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
             long divergence;
             using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
-                divergence = await FindOverwriteAsync(stream, ledger, from, bookmark, token).ConfigureAwait(false);
+                divergence = await FindOverwriteAsync(stream, ledger, from, bookmark, nowUtc, token).ConfigureAwait(false);
             if (token.IsCancellationRequested) return -1;
 
             ledger.VerifyRequested = false;
@@ -228,8 +233,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// Re-reads [fromOffset, toOffset) with the read loop's assembler and compares against the
         /// ledger. Returns the offset of the first entry whose bytes changed — a ledger entry not
         /// reproduced, or an entry the ledger never had — or -1 when everything reads as before.
+        /// Every entry found unchanged is stamped seen at <paramref name="nowUtc"/>.
         /// </summary>
-        private async Task<long> FindOverwriteAsync(FileStream stream, FileLedger ledger, long fromOffset, long toOffset, CancellationToken token)
+        private async Task<long> FindOverwriteAsync(FileStream stream, FileLedger ledger, long fromOffset, long toOffset, DateTime nowUtc, CancellationToken token)
         {
             var entries = ledger.Entries;
             var idx = ledger.IndexOfFirstAtOrAfter(fromOffset);
@@ -255,6 +261,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 if (idx < entries.Count && entries[idx].Offset == e.Offset)
                 {
                     if (entries[idx].Hash != e.Hash) return e.Offset;
+                    var confirmed = entries[idx];
+                    confirmed.SeenUtc = nowUtc;
+                    entries[idx] = confirmed;
                     idx++;
                     continue;
                 }
@@ -265,7 +274,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         }
 
         /// <summary>After a restart the ledger is empty: fingerprint the entries just behind the persisted bookmark without processing them.</summary>
-        private async Task SeedLedgerAsync(string filePath, FileLedger ledger, long bookmark, CancellationToken token)
+        private async Task SeedLedgerAsync(string filePath, FileLedger ledger, long bookmark, DateTime nowUtc, CancellationToken token)
         {
             var from = Math.Max(0, bookmark - RestartSeedBytes);
             using (var stream = new FileStream(filePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
@@ -288,7 +297,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                     if (assembler.Feed(line, reader.LastLineStart, reader.Position, reader.LastLineTruncated, reader.LastLineHash, out e)
                             == CmTraceEntryAssembler.Outcome.Entry
                         && e.Offset + e.Length <= bookmark)
-                        ledger.Record(e);
+                        ledger.Record(e, nowUtc);
                 }
             }
         }
@@ -300,12 +309,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// </summary>
         private sealed class RewindState
         {
-            public RewindState(string fileName, HashSet<LedgerEntry> unchanged, List<InvocationMarker> markers, InvocationMarker lastPlatformMarker)
+            public RewindState(string fileName, HashSet<LedgerEntry> unchanged, List<InvocationMarker> markers, InvocationMarker lastPlatformMarker, long rewindTo)
             {
                 FileName = fileName;
                 Unchanged = unchanged;
                 Markers = markers;
                 LastPlatformMarker = lastPlatformMarker;
+                foreach (var replaced in unchanged)
+                {
+                    if (replaced.Offset == rewindTo) EntryAtRewindPointReplaced = true;
+                    if (!OldestReplacedSeenUtc.HasValue || replaced.SeenUtc < OldestReplacedSeenUtc.Value) OldestReplacedSeenUtc = replaced.SeenUtc;
+                }
             }
 
             public string FileName { get; }
@@ -315,10 +329,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             /// <summary>The tracker-wide last platform marker, when it was among the set-aside ones.</summary>
             public InvocationMarker LastPlatformMarker { get; }
             public int Next { get; set; }
+            /// <summary>The ledger held the entry at the rewind point: the changed bytes lie where something was seen before.</summary>
+            public bool EntryAtRewindPointReplaced { get; }
+            /// <summary>The earliest time any of the replaced bytes was last seen as it was: every changed byte was written after it.</summary>
+            public DateTime? OldestReplacedSeenUtc { get; }
 
             public bool IsUnchanged(AssembledEntry entry) => Unchanged.Contains(new LedgerEntry { Offset = entry.Offset, Hash = entry.Hash });
         }
 
+        /// <summary>
+        /// Whether an entry a rewind re-processes (it reads differently than before) is fresh. Its bytes were written after
+        /// the bytes it replaced were last seen as they were — IME stamps a line when it writes it — so when that was at
+        /// most <see cref="FreshLineMaxAge"/> ago the entry's age is bounded like an appended line's and it may anchor
+        /// itself (session d29e27e3: recovered result lines fell back to the agent's stale zone and lost their duration).
+        /// Not fresh when the pass is not (the first pass after a restart never anchors), when the divergence lies in bytes
+        /// the ledger never held (nothing dates them), or when the clock stepped back since.
+        /// </summary>
+        internal static bool RewoundEntryIsFresh(bool passLinesAreFresh, bool entryAtRewindPointReplaced, DateTime? oldestReplacedSeenUtc, DateTime passNowUtc)
+        {
+            if (!passLinesAreFresh || !entryAtRewindPointReplaced || !oldestReplacedSeenUtc.HasValue) return false;
+            var sinceSeen = passNowUtc - oldestReplacedSeenUtc.Value;
+            return sinceSeen >= TimeSpan.Zero && sinceSeen <= FreshLineMaxAge;
+        }
+
         /// <summary>Moves the bookmark back to the first changed entry; returns what the re-read needs to skip and to give back.</summary>
         private RewindState ApplyRewind(string filePath, string fileName, FileLedger ledger, long rewindTo, long bookmark)
         {
@@ -341,7 +374,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 _logger.Debug(message);
             }
-            return new RewindState(fileName, removed, markers, tookLastPlatformMarker ? lastPlatformMarker : null);
+            return new RewindState(fileName, removed, markers, tookLastPlatformMarker ? lastPlatformMarker : null, rewindTo);
         }
 
         private long RetentionFloor(string fileName, long bookmark)
@@ -380,11 +413,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         {
             public long Offset;
             public string PolicyId;
+            /// <summary>
+            /// The platform run the start line belongs to: the lines behind it go to that run while it is pending or
+            /// waits for its IME result, and nowhere once it was emitted — never to a later run of the same policy.
+            /// Null only on seeded test markers, which resolve by policy.
+            /// </summary>
+            public string RunId;
             public bool IsClose;
             /// <summary>Set on a writer boundary: the platform invocation it closed.</summary>
             public string ClosedPolicyId;
         }
 
+        /// <summary>Run id of a start line whose run was emitted already (a late line): owns its lines, matches no live run.</summary>
+        private const string EmittedRunId = "emitted";
+
         private const string ExecutorLogFileName = "AgentExecutor.log";
 
         private readonly Dictionary<string, List<InvocationMarker>> _invocationMarkers =
@@ -437,7 +479,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             list.Add(marker);
         }
 
-        private void RecordInvocationMarker(string policyId, bool isClose)
+        private void RecordInvocationMarker(string policyId, bool isClose, string runId = null)
         {
             if (_currentEntryOffset < 0) return;
             var file = _currentSourceFileName ?? TestSourceFileName;
@@ -451,6 +493,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 if (!isClose && policyId != null && last.ClosedPolicyId == null)
                 {
                     last.PolicyId = policyId;
+                    last.RunId = runId;
                     last.IsClose = false;
                     _lastPlatformMarker = last;
                     _platformMarkerFiles.Add(file);
@@ -458,7 +501,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 return;
             }
 
-            var marker = new InvocationMarker { Offset = _currentEntryOffset, PolicyId = policyId, IsClose = isClose };
+            var marker = new InvocationMarker { Offset = _currentEntryOffset, PolicyId = policyId, RunId = runId, IsClose = isClose };
             AppendInvocationMarker(list, marker);
             if (!isClose && policyId != null)
             {
@@ -526,6 +569,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             if (marker == null || marker.IsClose || marker.PolicyId == null) return null;
 
             ownerPolicyId = marker.PolicyId;
+            if (marker.RunId != null) return FindLivePlatformRun(marker.PolicyId, marker.RunId);
             ScriptExecutionState state;
             return _pendingPlatformScripts.TryGetValue(marker.PolicyId, out state) ? state : null;
         }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -182,6 +182,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         private readonly Dictionary<string, ScriptExecutionState> _pendingPlatformScripts =
             new Dictionary<string, ScriptExecutionState>(StringComparer.OrdinalIgnoreCase);
 
+        // Earlier runs of a policy whose next executor run started before IME's result of them was
+        // read (IME re-runs a failed script on later check-ins; the first pass reads all of
+        // AgentExecutor.log before the IME log). Each keeps its own end block until its result
+        // arrives — session eff1b413 lost that and paired the first result with the last run's block.
+        private readonly List<ScriptExecutionState> _parkedPlatformScripts = new List<ScriptExecutionState>();
+        private const int MaxParkedPlatformScripts = 64;
+
         /// <summary>
         /// The platform runs this tracker started and emitted, for the registry reconciliation that
         /// checks them against IME's saved results (D-316). Shared with the registry host's thread.
@@ -1191,6 +1198,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 }
             }
 
+            _parkedPlatformScripts.Clear();
+            if (state.ParkedPlatformScripts != null)
+            {
+                foreach (var parked in state.ParkedPlatformScripts)
+                {
+                    if (!string.IsNullOrEmpty(parked?.PolicyId) && _parkedPlatformScripts.Count < MaxParkedPlatformScripts)
+                        _parkedPlatformScripts.Add(parked);
+                }
+            }
+
             _scriptTimeoutSuspectedPosted.Clear();
             if (state.ScriptTimeoutSuspectedPosted != null)
             {
@@ -1276,6 +1293,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 // must survive restarts — see the LoadState comment for the duplicate scenario.
                 PlatformScriptResultEmittedAt = new Dictionary<string, DateTime>(_platformScriptResultEmitted, StringComparer.OrdinalIgnoreCase),
                 PendingPlatformScripts = _pendingPlatformScripts.Values.ToList(),
+                ParkedPlatformScripts = _parkedPlatformScripts.ToList(),
                 ScriptTimeoutSuspectedPosted = _scriptTimeoutSuspectedPosted.ToList(),
                 RecurringScripts = _recurringScripts.ToPersisted(),
             };

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerStatePersistence.cs

@@ -151,6 +151,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // that run from the start of the next one.
         public Dictionary<string, DateTime> PlatformScriptResultEmittedAt { get; set; }
         public List<ScriptExecutionState> PendingPlatformScripts { get; set; }
+        // Earlier runs that wait for their IME result while a later run of the same policy is in
+        // flight; a restart between reading AgentExecutor.log and the IME log must keep them. Null on
+        // older state files → none.
+        public List<ScriptExecutionState> ParkedPlatformScripts { get; set; }
         public List<string> ScriptTimeoutSuspectedPosted { get; set; }
 
         // Recurring health-script runs collapsed per policy. Saved in the same write as

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/PlatformScriptRunRegister.cs

@@ -41,9 +41,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
     /// Written on the tracker's poll thread, claimed on the registry host's timer thread: every member
     /// locks, and nothing calls out while holding the lock.
     /// <para>
-    /// A save belongs to the latest run of its key: IME runs a policy once per batch and saves the
-    /// batch after its last script, so the next run of the same key starts minutes later at the
-    /// earliest. A save is paired only after the tracker completed a pass that started
+    /// A save belongs to the latest run of its key: IME runs a policy at most once per check-in and
+    /// saves after reporting that check-in's batch, so the next run of the key comes with a later
+    /// check-in. (Overlapping check-ins can run a key twice at once; then IME itself shares the key's
+    /// result files and the judge's foreign verdict is the safety net.) A run that waited for its IME
+    /// result while a later run of its key already started is emitted without touching that later
+    /// run's entry. A save is paired only after the tracker completed a pass that started
     /// <see cref="TrackerCatchUp"/> after the save was seen — every line written before the save, the
     /// run's start among them, has been read by then, a stalled poll loop included.
     /// </para>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ScriptExecutionState.cs

@@ -23,11 +23,20 @@ public class ScriptExecutionState
     public string UserId { get; set; }
 
     /// <summary>
-    /// Identity of one emitted platform-script run, surfaced as <c>runId</c> on the event: what a
-    /// later <c>script_output_reconciliation</c> names when it corrects that run.
+    /// Identity of one platform-script run, given when its slot opens and surfaced as <c>runId</c> on
+    /// the event: the invocation markers bind the run's executor lines to it, and a later
+    /// <c>script_output_reconciliation</c> names it when it corrects that run.
     /// </summary>
     public string RunId { get; set; }
 
+    /// <summary>
+    /// Source timestamp of the run's AgentExecutor start line (<c>Adding argument powershell with
+    /// value …</c>). Every executor process writes that line once, so a later one for the same
+    /// policy starts the next run, never this one. Null until the line is read, and on state files
+    /// from before the field.
+    /// </summary>
+    public System.DateTime? ExecutorStartedAtUtc { get; set; }
+
     /// <summary>
     /// UTC timestamp of the script's first observed start line, taken from the source CMTrace log
     /// timestamp (so it dates correctly even when the agent replays historic IME log content that

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/EspAndHelloTracker.cs

@@ -50,12 +50,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
 
         // Session caa6cf50 gate-starvation fix (2026-06-11) — fire-once guard for the
         // user-ESP-apps-settled AccountSetup synthesis (see MaybeSynthesizeAccountSetupComplete).
-        // Interlocked rather than a plain bool: since the sits-d Cloud-PC fix the synthesis is
+        // Interlocked rather than a plain bool: since the Cloud-PC fix the synthesis is
         // ALSO re-evaluated from the IME app-state-change thread, so two threads can reach the
         // guard concurrently (Shell-Core watcher thread + IME log thread).
         private int _userAppsSettledSynthesisFired;
 
-        // sits-d Cloud-PC fix (2026-08-19) — set once a CONFIRMED post-AccountSetup Shell-Core
+        // Cloud-PC fix (2026-08-19) — set once a CONFIRMED post-AccountSetup Shell-Core
         // exit has been observed (live OR backfill). The synthesis needs two facts: the ESP exit
         // is an EDGE that happens once, the settled user-ESP apps are a LEVEL that may only be
         // reached minutes later. Recording the edge lets ReevaluateUserAppsSettledSynthesis
@@ -367,7 +367,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             => _shellCoreTracker?.BackfillRecentHelloWizardStart(lookbackMinutes);
 
         /// <summary>
-        /// sits-d Cloud-PC fix (2026-08-19) — re-check the user-apps-settled AccountSetup
+        /// First run only: the update page's records from before the agent started, as telemetry
+        /// and nothing else — see <see cref="ShellCoreTracker.BackfillUpdatePageTelemetry"/>.
+        /// </summary>
+        public void BackfillUpdatePageTelemetry(int lookbackMinutes)
+            => _shellCoreTracker?.BackfillUpdatePageTelemetry(lookbackMinutes);
+
+        /// <summary>
+        /// Cloud-PC fix (2026-08-19) — re-check the user-apps-settled AccountSetup
         /// synthesis after the ESP exit has already been observed. Wired to the IME tracker's
         /// app-state-change callback in <c>DefaultComponentFactory</c>.
         /// <para>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/MdmRebootPolicyTracker.cs

@@ -237,7 +237,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             var rebootUri = ExtractRebootUri(ParseEventData(xml), description);
 
             ProcessEvent(
-                eventId: record.Id,
                 recordId: recordId,
                 timeCreatedUtc: record.TimeCreated?.ToUniversalTime(),
                 rebootUri: rebootUri,
@@ -251,7 +250,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// — after the debounce quiet-period, at backfill completion, or at <see cref="Stop"/>.
         /// </summary>
         internal void ProcessEvent(
-            int eventId,
             long recordId,
             DateTime? timeCreatedUtc,
             string rebootUri,

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/OobeUpdateTelemetry.cs

@@ -14,10 +14,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
     /// </summary>
     internal sealed class OobeUpdatePageRecord
     {
-        public const string PageStarted = "page_started";
-        public const string PageStopped = "page_stopped";
-        public const string EventName = "event_name";
-
         public OobeUpdatePageRecord(string cxhEvent, int windowsEventId, string page = null, string result = null, string name = null, string value = null)
         {
             CxhEvent = cxhEvent;
@@ -28,7 +24,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             Value = value;
         }
 
-        /// <summary><see cref="PageStarted"/>, <see cref="PageStopped"/> or <see cref="EventName"/>.</summary>
+        /// <summary>
+        /// <see cref="OobeUpdateVocabulary.PageStarted"/>, <see cref="OobeUpdateVocabulary.PageStopped"/> or
+        /// <see cref="OobeUpdateVocabulary.EventName"/> (the shared vocabulary the backend and the portal read).
+        /// </summary>
         public string CxhEvent { get; }
         public int WindowsEventId { get; }
 
@@ -54,6 +53,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
     internal sealed class OobeUpdateTelemetry
     {
         internal const int MaxPageEventsPerRun = 150;
+
+        /// <summary>
+        /// Event names the backfills (first run, restart) report per run — their own budget, so
+        /// the records from before the agent started cannot spend the live page's.
+        /// </summary>
+        internal const int MaxBackfillPageEventsPerRun = 150;
+
         internal const int MaxPageEventsPerKey = 3;
         internal const int MaxStateEventsPerRun = 6;
         internal const int MaxStateLineLength = 1000;
@@ -67,7 +73,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             public const string AgentStop = "agent_stop";
         }
 
-        private const string Source = "ShellCoreTracker";
+        private const string Source = Constants.EventSources.ShellCoreTracker;
 
         private readonly string _sessionId;
         private readonly string _tenantId;
@@ -77,8 +83,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
 
         private readonly object _lock = new object();
         private readonly Dictionary<string, int> _pageEventsPerKey = new Dictionary<string, int>(StringComparer.Ordinal);
-        private int _pageEvents;
-        private bool _pageCapLogged;
+        private int _livePageEvents;
+        private int _backfillPageEvents;
+        private bool _liveCapReported;
+        private bool _backfillCapReported;
         private int _stateEvents;
         private string _lastStateContent;
 
@@ -99,33 +107,49 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// <summary>
         /// One <c>oobe_update_page</c> per update-page record, at most
         /// <see cref="MaxPageEventsPerKey"/> per page/name — a page that logs the same name in a
-        /// loop cannot flood the session. Event names also share <see cref="MaxPageEventsPerRun"/>
-        /// per run; a page start or stop is outside that budget, because the time attribution
-        /// reads the update's span from them. True when the record was reported.
+        /// loop cannot flood the session. Event names also share a budget per run: live ones
+        /// <see cref="MaxPageEventsPerRun"/>, backfilled ones <see cref="MaxBackfillPageEventsPerRun"/>;
+        /// the first name over a budget sends the <see cref="OobeUpdateVocabulary.NamesCapped"/>
+        /// marker. A page start or stop is outside the budgets, because the time attribution reads
+        /// the update's span from them. True when the record was reported.
         /// </summary>
         public bool ReportPage(OobeUpdatePageRecord record, DateTime occurredAtUtc, bool isBackfill)
         {
             if (record == null) return false;
 
-            var isEventName = record.CxhEvent == OobeUpdatePageRecord.EventName;
+            var isEventName = record.CxhEvent == OobeUpdateVocabulary.EventName;
             var key = $"{record.CxhEvent}:{record.Page ?? record.Name}";
-            int occurrence;
+            var budget = isBackfill ? MaxBackfillPageEventsPerRun : MaxPageEventsPerRun;
+            var occurrence = 0;
+            bool overBudget;
+            var firstOverBudget = false;
             lock (_lock)
             {
-                if (isEventName && _pageEvents >= MaxPageEventsPerRun)
+                overBudget = isEventName && (isBackfill ? _backfillPageEvents : _livePageEvents) >= budget;
+                if (overBudget)
                 {
-                    if (!_pageCapLogged)
-                    {
-                        _pageCapLogged = true;
-                        _logger.Info($"OOBE update page telemetry: {MaxPageEventsPerRun} event names reached, the rest of this run stays in agent.log");
-                    }
-                    return false;
+                    firstOverBudget = isBackfill ? !_backfillCapReported : !_liveCapReported;
+                    if (isBackfill) _backfillCapReported = true;
+                    else _liveCapReported = true;
                 }
-                _pageEventsPerKey.TryGetValue(key, out occurrence);
-                if (occurrence >= MaxPageEventsPerKey) return false;
-                occurrence++;
-                _pageEventsPerKey[key] = occurrence;
-                if (isEventName) _pageEvents++;
+                else
+                {
+                    _pageEventsPerKey.TryGetValue(key, out occurrence);
+                    if (occurrence >= MaxPageEventsPerKey) return false;
+                    occurrence++;
+                    _pageEventsPerKey[key] = occurrence;
+                    if (isEventName)
+                    {
+                        if (isBackfill) _backfillPageEvents++;
+                        else _livePageEvents++;
+                    }
+                }
+            }
+
+            if (overBudget)
+            {
+                if (firstOverBudget) ReportNamesCapped(budget, occurredAtUtc, isBackfill);
+                return false;
             }
 
             var data = new Dictionary<string, object>
@@ -141,6 +165,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             if (record.Name != null) data["name"] = record.Name;
             if (record.Value != null) data["value"] = record.Value;
 
+            return EmitPage(occurredAtUtc, DescribePage(record), data);
+        }
+
+        /// <summary>
+        /// The marker that a budget is spent: from here on this run's live or backfilled event
+        /// names stay in agent.log, so a name missing from the session proves nothing — the
+        /// analyze rules that read an absent name check for this marker first.
+        /// </summary>
+        private void ReportNamesCapped(int budget, DateTime occurredAtUtc, bool isBackfill)
+        {
+            var kind = isBackfill ? "backfilled " : string.Empty;
+            _logger.Info($"OOBE update page telemetry: {budget} {kind}event names reached, the rest of this run stays in agent.log");
+
+            EmitPage(occurredAtUtc,
+                $"OOBE update page: {budget} {kind}event names reached, later ones of this agent run are not sent",
+                new Dictionary<string, object>
+                {
+                    { "cxhEvent", OobeUpdateVocabulary.NamesCapped },
+                    { "eventTime", occurredAtUtc.ToString("o") },
+                    { "backfill", isBackfill },
+                    { "limit", budget },
+                });
+        }
+
+        private bool EmitPage(DateTime occurredAtUtc, string message, Dictionary<string, object> data)
+        {
             try
             {
                 _post.Emit(new EnrollmentEvent
@@ -152,7 +202,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                     Severity = EventSeverity.Debug,
                     Source = Source,
                     Phase = EnrollmentPhase.Unknown,
-                    Message = DescribePage(record),
+                    Message = message,
                     Data = data,
                     ImmediateUpload = false,
                 });
@@ -236,9 +286,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         {
             switch (record.CxhEvent)
             {
-                case OobeUpdatePageRecord.PageStarted:
+                case OobeUpdateVocabulary.PageStarted:
                     return $"OOBE update page started: {record.Page}";
-                case OobeUpdatePageRecord.PageStopped:
+                case OobeUpdateVocabulary.PageStopped:
                     return $"OOBE update page stopped: {record.Page} (result: {record.Result})";
                 default:
                     return record.Value == null

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ProvisioningStatusTracker.cs

@@ -1382,7 +1382,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                     // window (user clicks "Try again" / IME re-sync flips the subcategory back
                     // to inProgress) — firing the stale args would terminate the agent on a
                     // failure Windows no longer reports, and the retry outcome is lost.
-                    recovered = IsSettledFailureRecovered(categoryName, args);
+                    recovered = IsSettledFailureRecovered(categoryName);
                     if (recovered)
                     {
                         if (args.FailedSubcategory != null
@@ -1447,7 +1447,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// and must fire (with the latched args — statusText/HRESULT of the new subcategory
         /// were never captured). Caller holds <see cref="_stateLock"/>.
         /// </summary>
-        private bool IsSettledFailureRecovered(string categoryName, EspFailureDetectedEventArgs args)
+        private bool IsSettledFailureRecovered(string categoryName)
         {
             if (_lastCategorySucceeded != null
                 && _lastCategorySucceeded.TryGetValue(categoryName, out var succeeded)

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ServicingTracker.cs

@@ -224,27 +224,27 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             switch (eventId)
             {
                 case EventId_InitiatingChanges:
-                    step = "initiating";
-                    osStep = IsState(targetState, "Installed") ? OsUpdateSteps.InstallStarted
+                    step = OobeUpdateVocabulary.StepInitiating;
+                    osStep = IsState(targetState, OobeUpdateVocabulary.InstalledState) ? OsUpdateSteps.InstallStarted
                         : IsState(targetState, "Staged") ? OsUpdateSteps.StagingStarted
                         : null;
                     message = $"Servicing started for {pkg}: {(string.IsNullOrEmpty(initialState) ? "?" : initialState)} → {target}";
                     break;
                 case EventId_StateReached:
-                    step = "state_reached";
-                    osStep = IsState(targetState, "Installed") ? OsUpdateSteps.Installed
+                    step = OobeUpdateVocabulary.StepStateReached;
+                    osStep = IsState(targetState, OobeUpdateVocabulary.InstalledState) ? OsUpdateSteps.Installed
                         : IsState(targetState, "Staged") ? OsUpdateSteps.Staged
                         : null;
                     message = $"Servicing finished for {pkg}: now {target}";
                     break;
                 case EventId_RebootRequired:
-                    step = "reboot_required";
+                    step = OobeUpdateVocabulary.StepRebootRequired;
                     osStep = OsUpdateSteps.RebootRequired;
                     message = $"Servicing needs a restart to finish {pkg} → {target}";
                     break;
                 case EventId_ChangeFailed:
                 case EventId_PartiallyInstalled:
-                    step = "failed";
+                    step = OobeUpdateVocabulary.StepFailed;
                     osStep = OsUpdateSteps.Failed;
                     severity = EventSeverity.Warning;
                     message = $"Servicing FAILED for {pkg} → {target}" +

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ShellCoreTracker.cs

@@ -51,6 +51,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// </summary>
         internal const int BackfillLookbackMaxMinutes = 360;
 
+        /// <summary>
+        /// Lookback of the first run's update page backfill (<see cref="BackfillUpdatePageTelemetry"/>)
+        /// — the hour the servicing watcher reads back, so the page's records and the update's
+        /// servicing steps cover the same time.
+        /// </summary>
+        internal const int UpdatePageBackfillLookbackMinutes = 60;
+
         private static readonly HashSet<int> TrackedShellCoreEventIds = new HashSet<int>
         {
             EventId_ShellCore_WebAppStarted,
@@ -100,7 +107,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         private bool _espExitDetected;
         private bool _whiteGloveDetected;
         private bool _helloWizardStartDetected;
-        private string _lastCxhPage; // 62405 names no page, it ends the last one started
+        // 62405 names no page, it ends the last one started. The live watcher's page; a backfill
+        // moves it only with a newer record (see ObserveCxhRecord).
+        private string _lastCxhPage;
+        private long _lastCxhPageRecordId = -1;
         private readonly object _stateLock = new object();
 
         /// <summary>
@@ -194,7 +204,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                 // WhiteGlove success — indistinguishable on the backend from a real no-signal
                 // enrollment. Surface it as one-shot telemetry.
                 CollectorDegradationReporter.Report(_post, _sessionId, _tenantId,
-                    collectorName: "ShellCoreTracker", reason: "watcher_arm_failed", ex: ex);
+                    collectorName: Constants.EventSources.ShellCoreTracker, reason: "watcher_arm_failed", ex: ex);
             }
         }
 
@@ -258,7 +268,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             IReadOnlyList<string> properties = null)
         {
             var fields = ReadCxhFields(eventId, description, properties);
-            ObserveCxhRecord(eventId, fields, timestamp, isBackfill, recordId);
+            ObserveCxhRecord(eventId, fields, timestamp, isBackfill, recordId, backfillPage: null);
             if (eventId == EventId_ShellCore_WebAppStopped || eventId == EventId_ShellCore_WebAppEventName) return;
 
             string eventType;
@@ -459,31 +469,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         {
             try
             {
-                var lookbackMs = ClampLookbackMinutes(lookbackMinutes) * 60 * 1000;
-                var query = new EventLogQuery(
-                    ShellCoreEventLogChannel,
-                    PathType.LogName,
-                    $"*[System[{WatchedEventIdsXPath} and TimeCreated[timediff(@SystemTime) <= {lookbackMs}]]]");
-
-                var records = new List<ShellCoreRecord>();
-                using (var reader = new EventLogReader(query))
-                {
-                    for (EventRecord record = reader.ReadEvent(); record != null; record = reader.ReadEvent())
-                    {
-                        using (record)
-                        {
-                            var description = record.FormatDescription() ?? "";
-                            // Preserve the historical event time across backfill so subscribers
-                            // (EspAndHelloTrackerAdapter) can stamp signals with the source time
-                            // rather than collapsing to wall-clock-now.
-                            var timestamp = (record.TimeCreated ?? DateTime.UtcNow).ToUniversalTime();
-                            records.Add(new ShellCoreRecord(record.Id, description, timestamp,
-                                record.RecordId ?? -1, ReadProperties(record)));
-                        }
-                    }
-                }
-
-                ReplayBackfillRecords(records);
+                ReplayBackfillRecords(ReadRecentRecords(lookbackMinutes));
             }
             catch (Exception ex)
             {
@@ -491,6 +477,76 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             }
         }
 
+        /// <summary>
+        /// The FIRST run's counterpart of the restart replay, for telemetry only: the update
+        /// page's records of the last <paramref name="lookbackMinutes"/> minutes (clamped like
+        /// the replay) become <c>oobe_update_page</c> rows. The agent is installed during the ESP
+        /// and can start after the update page began; without this its time attribution has no
+        /// page start to begin the update with (field: a first run 7 min after the update's
+        /// restart saw neither the page start nor the update's first half).
+        /// <para>
+        /// Nothing else is looked at: no Hello-wizard replay, no ESP exit or failure count, no
+        /// <c>agent_trace</c>. The first run keeps its decision behaviour exactly — see
+        /// <see cref="ReplayBackfillRecords"/> for why no replayed record may reach the engine and
+        /// <c>DefaultComponentFactory.ResolveEspExitBackfillLookbackMinutes</c> for why the first
+        /// run has no replay. No boot bound: an agent that first starts after the update's restart
+        /// is exactly the case to cover; the RecordId watermark keeps it from re-sending.
+        /// </para>
+        /// </summary>
+        public void BackfillUpdatePageTelemetry(int lookbackMinutes)
+        {
+            try
+            {
+                ReplayUpdatePageTelemetry(ReadRecentRecords(lookbackMinutes));
+            }
+            catch (Exception ex)
+            {
+                _logger.Warning($"Shell-Core update page backfill failed: {ex.Message}");
+            }
+        }
+
+        /// <summary>The update page telemetry of a chronological batch of Shell-Core records — nothing else.</summary>
+        internal void ReplayUpdatePageTelemetry(IReadOnlyList<ShellCoreRecord> records)
+        {
+            if (records == null || records.Count == 0) return;
+
+            var page = new BackfillPageCursor();
+            foreach (var record in records)
+            {
+                var fields = ReadCxhFields(record.Id, record.Description ?? string.Empty, record.Properties);
+                ObserveCxhRecord(record.Id, fields, record.OccurredAtUtc, isBackfill: true, recordId: record.RecordId, backfillPage: page);
+            }
+        }
+
+        /// <summary>The watched Shell-Core records of the last minutes, oldest first, with their original event time.</summary>
+        private List<ShellCoreRecord> ReadRecentRecords(int lookbackMinutes)
+        {
+            var lookbackMs = ClampLookbackMinutes(lookbackMinutes) * 60 * 1000;
+            var query = new EventLogQuery(
+                ShellCoreEventLogChannel,
+                PathType.LogName,
+                $"*[System[{WatchedEventIdsXPath} and TimeCreated[timediff(@SystemTime) <= {lookbackMs}]]]");
+
+            var records = new List<ShellCoreRecord>();
+            using (var reader = new EventLogReader(query))
+            {
+                for (EventRecord record = reader.ReadEvent(); record != null; record = reader.ReadEvent())
+                {
+                    using (record)
+                    {
+                        var description = record.FormatDescription() ?? "";
+                        // Preserve the historical event time across backfill so subscribers
+                        // (EspAndHelloTrackerAdapter) can stamp signals with the source time
+                        // rather than collapsing to wall-clock-now.
+                        var timestamp = (record.TimeCreated ?? DateTime.UtcNow).ToUniversalTime();
+                        records.Add(new ShellCoreRecord(record.Id, description, timestamp,
+                            record.RecordId ?? -1, ReadProperties(record)));
+                    }
+                }
+            }
+            return records;
+        }
+
         /// <summary>
         /// Replays a chronological batch of Shell-Core records. <b>Only the Hello-wizard start
         /// (62404) is replayed.</b> ESP exits and ESP failures (62407) are counted and reported,
@@ -546,12 +602,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             var skippedFailures = 0;
             DateTime? oldestSkipped = null;
             DateTime? newestSkipped = null;
+            var page = new BackfillPageCursor();
 
             foreach (var record in records)
             {
                 var description = record.Description ?? string.Empty;
                 var fields = ReadCxhFields(record.Id, description, record.Properties);
-                ObserveCxhRecord(record.Id, fields, record.OccurredAtUtc, isBackfill: true, recordId: record.RecordId);
+                ObserveCxhRecord(record.Id, fields, record.OccurredAtUtc, isBackfill: true, recordId: record.RecordId, backfillPage: page);
 
                 if (record.Id == EventId_ShellCore_WebAppStarted)
                 {
@@ -594,7 +651,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                     TenantId = _tenantId,
                     EventType = Constants.EventTypes.AgentTrace,
                     Severity = EventSeverity.Info,
-                    Source = "ShellCoreTracker",
+                    Source = Constants.EventSources.ShellCoreTracker,
                     Phase = EnrollmentPhase.Unknown,
                     Message =
                         $"Shell-Core replay skipped {skippedExits} ESP exit(s) and {skippedFailures} ESP failure(s) " +
@@ -662,6 +719,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         // CloudExperienceHost navigation: breadcrumbs and OOBE update page telemetry (D-310)
         // =====================================================================
 
+        /// <summary>The last page started within one backfill batch.</summary>
+        private sealed class BackfillPageCursor
+        {
+            public string Page;
+        }
+
         /// <summary>
         /// Writes one agent.log line per CloudExperienceHost page start/stop and per update-page
         /// event name, so a diagnostics package shows the OOBE navigation. Records of the update
@@ -669,8 +732,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// are also reported as <c>oobe_update_page</c> — once across agent runs, by RecordId — and
         /// at the page's live start and stop the registry state behind it as
         /// <c>oobe_update_state</c>. No decision.
+        /// <para>
+        /// A stop (62405) belongs to the page started last. A backfill batch
+        /// (<paramref name="backfillPage"/>) reads records older than the live watcher's, which is
+        /// armed first, so it keeps its own last page; it moves the live watcher's only with a
+        /// record of a higher RecordId — a replayed older start must not take over the next live
+        /// stop, and a first run's live stop still finds the page that started before the agent.
+        /// </para>
         /// </summary>
-        private void ObserveCxhRecord(int eventId, CxhFields fields, DateTime occurredAtUtc, bool isBackfill, long recordId)
+        private void ObserveCxhRecord(int eventId, CxhFields fields, DateTime occurredAtUtc, bool isBackfill, long recordId,
+            BackfillPageCursor backfillPage)
         {
             try
             {
@@ -678,8 +749,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                 lock (_stateLock)
                 {
                     if (eventId == EventId_ShellCore_WebAppStarted && fields.Primary != null)
-                        _lastCxhPage = fields.Primary;
-                    page = _lastCxhPage;
+                    {
+                        if (backfillPage != null) backfillPage.Page = fields.Primary;
+                        if (backfillPage == null || (recordId >= 0 && recordId > _lastCxhPageRecordId))
+                        {
+                            _lastCxhPage = fields.Primary;
+                            if (recordId >= 0) _lastCxhPageRecordId = recordId;
+                        }
+                    }
+                    page = backfillPage != null ? backfillPage.Page : _lastCxhPage;
                 }
 
                 var crumb = FormatCxhBreadcrumb(eventId, fields, page);
@@ -698,10 +776,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                     _pageWatermark.MarkEmitted(recordId);
 
                 // The registry is read now — only a live page boundary is the page's moment.
-                if (!isBackfill && record.CxhEvent != OobeUpdatePageRecord.EventName)
+                if (!isBackfill && record.CxhEvent != OobeUpdateVocabulary.EventName)
                 {
                     _oobeUpdate.ReportState(
-                        record.CxhEvent == OobeUpdatePageRecord.PageStarted
+                        record.CxhEvent == OobeUpdateVocabulary.PageStarted
                             ? OobeUpdateTelemetry.Moments.UpdatePageStarted
                             : OobeUpdateTelemetry.Moments.UpdatePageStopped,
                         record.Page);
@@ -801,11 +879,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             {
                 case EventId_ShellCore_WebAppStarted:
                     return IsUpdatePageToken(fields.Primary)
-                        ? new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStarted, eventId, page: fields.Primary)
+                        ? new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStarted, eventId, page: fields.Primary)
                         : null;
                 case EventId_ShellCore_WebAppStopped:
                     return IsUpdatePageToken(lastPage)
-                        ? new OobeUpdatePageRecord(OobeUpdatePageRecord.PageStopped, eventId,
+                        ? new OobeUpdatePageRecord(OobeUpdateVocabulary.PageStopped, eventId,
                             page: lastPage, result: fields.Primary ?? "?")
                         : null;
                 case EventId_ShellCore_WebAppEventName:
@@ -813,7 +891,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                 {
                     if (!IsUpdatePageToken(fields.Primary)) return null;
                     var value = eventId == EventId_ShellCore_WebAppEvent ? SafeValue(fields.Value) : null;
-                    return new OobeUpdatePageRecord(OobeUpdatePageRecord.EventName, eventId, name: fields.Primary, value: value);
+                    return new OobeUpdatePageRecord(OobeUpdateVocabulary.EventName, eventId, name: fields.Primary, value: value);
                 }
                 default:
                     return null;

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/StallProbeCollector.cs

@@ -138,7 +138,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         //   - Explicit "Required app failed" lines from the ESP required-app enforcer
         //
         // TODO(stall-probe-imelog-scan): Also scan IntuneManagementExtension.log (not just
-        // AppWorkload.log). Learning from the Oriflame session b4b5d37e-a993-453e-b16b-9b75098022e4
+        // AppWorkload.log). Learning from a field session
         // (MS Intune AAD token service outage 2026-04-08): the ESP blocker was
         //   "Failed to get AAD token. errorCode = 3399548929"  (= 0xCAA90001 AADSTS_SERVER_ERROR)
         // and this string lives in IntuneManagementExtension.log, NOT AppWorkload.log. Add a third
@@ -241,7 +241,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                 if (alreadyFired)
                     continue;
 
-                RunProbe(probeIndex, thresholdMinutes, idleMinutes, genAtStart);
+                RunProbe(probeIndex, idleMinutes, genAtStart);
 
                 lock (_stateLock)
                 {
@@ -253,7 +253,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             }
         }
 
-        private void RunProbe(int probeIndex, int thresholdMinutes, double idleMinutes, int generation)
+        private void RunProbe(int probeIndex, double idleMinutes, int generation)
         {
             var started = DateTime.UtcNow;
             var result = new ProbeResult { ProbeIndex = probeIndex, IdleMinutes = Math.Round(idleMinutes, 1) };

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/DiagnosticsPackageService.cs

@@ -1052,7 +1052,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             if (!IsAllowedBlobUploadUrl(blobUploadUrl))
             {
                 _logger.Warning(
-                    $"Blob upload rejected: URL is not an allowed Azure Blob Storage endpoint " +
+                    $"Blob upload of {blobName} rejected: URL is not an allowed Azure Blob Storage endpoint " +
                     $"(expected https://*.blob.core.windows.net or sovereign-cloud equivalent). " +
                     $"URL prefix: {BuildSasUrlPrefix(blobUploadUrl)}");
                 return (false, "url_host_rejected");
@@ -1086,7 +1086,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                     // Auth errors (401/403) are permanent — SAS token invalid or expired, retrying won't help
                     if (statusCode == 401 || statusCode == 403)
                     {
-                        _logger.Warning($"Blob upload auth error (not retryable): {lastErrorCode} - {responseBody}");
+                        _logger.Warning($"Blob upload of {blobName}: auth error (not retryable): {lastErrorCode} - {responseBody}");
                         return (false, lastErrorCode);
                     }
 
@@ -1106,7 +1106,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 }
             }
 
-            _logger.Warning($"Diagnostics package upload failed after {maxRetries} attempts");
+            _logger.Warning($"Diagnostics package upload failed after {maxRetries} attempts: {blobName}");
             return (false, lastErrorCode);
         }
     }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/SelfUpdater.cs

@@ -145,7 +145,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
         /// On any failure, returns normally so the current version continues.
         /// </summary>
         /// <param name="forceUpdate">
-        /// When true, bypasses the IsNewerVersion check — used by the runtime-hash-mismatch trigger
+        /// When true, bypasses the version comparison — used by the runtime-hash-mismatch trigger
         /// to cover hotfixes that reuse the same version number.
         /// </param>
         /// <param name="triggerReason">
@@ -517,16 +517,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             }
         }
 
-        /// <summary>
-        /// Compares two version strings. Returns true if latest is newer than current.
-        /// Strips SemVer suffixes (+metadata, -prerelease) before parsing because
-        /// System.Version cannot handle them (e.g. "1.0.386+b7f8d3c..." would fail).
-        /// </summary>
-        private static bool IsNewerVersion(string current, string latest)
-        {
-            return CompareVersions(current, latest) > 0;
-        }
-
         /// <summary>
         /// Compares two version strings. Returns negative when latest is older than current,
         /// zero when equal, positive when latest is newer than current. Returns

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs

@@ -254,9 +254,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
                                 if (subKey == null)
                                     continue;
 
-                                var displayName = subKey.GetValue("DisplayName")?.ToString();
+                                var displayName = ReadRegistryText(subKey, "DisplayName");
                                 var systemComponent = subKey.GetValue("SystemComponent");
-                                var parentKeyName = subKey.GetValue("ParentKeyName")?.ToString();
+                                var parentKeyName = ReadRegistryText(subKey, "ParentKeyName");
 
                                 if (ShouldExclude(displayName, systemComponent, parentKeyName))
                                     continue;
@@ -264,11 +264,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
                                 results.Add(new SoftwareEntry
                                 {
                                     DisplayName = displayName,
-                                    DisplayVersion = subKey.GetValue("DisplayVersion")?.ToString(),
-                                    Publisher = subKey.GetValue("Publisher")?.ToString(),
-                                    InstallDate = subKey.GetValue("InstallDate")?.ToString(),
-                                    InstallLocation = subKey.GetValue("InstallLocation")?.ToString(),
-                                    UninstallString = subKey.GetValue("UninstallString")?.ToString(),
+                                    DisplayVersion = ReadRegistryText(subKey, "DisplayVersion"),
+                                    Publisher = ReadRegistryText(subKey, "Publisher"),
+                                    InstallDate = ReadRegistryText(subKey, "InstallDate"),
+                                    InstallLocation = ReadRegistryText(subKey, "InstallLocation"),
+                                    UninstallString = ReadRegistryText(subKey, "UninstallString"),
                                     IsWindowsInstaller = Convert.ToInt32(subKey.GetValue("WindowsInstaller") ?? 0) == 1,
                                     RegistrySource = source
                                 });
@@ -287,6 +287,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
             }
         }
 
+        private static string ReadRegistryText(RegistryKey key, string name)
+            => CutAtNul(key.GetValue(name)?.ToString());
+
+        /// <summary>
+        /// A registry string the way Windows shows it: up to the first NUL. Some installers write
+        /// REG_SZ data padded with NULs, and .NET Framework drops only one terminator — the rest
+        /// would ride into the normalized identity and, server-side, into a table key.
+        /// </summary>
+        internal static string CutAtNul(string value)
+        {
+            if (value == null)
+                return null;
+            var nul = value.IndexOf('\0');
+            return nul < 0 ? value : value.Substring(0, nul);
+        }
+
         // -----------------------------------------------------------------------
         // HKU per-user profile enumeration
         // -----------------------------------------------------------------------

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs

@@ -827,11 +827,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             sb.Append(value);
         }
 
-        private EventSeverity ParseSeverity(string severity)
-        {
-            return GatherRuleContext.ParseSeverity(severity);
-        }
-
         private void StopAllTimers()
         {
             foreach (var timer in _intervalTimers.Values)

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Office/OfficeInstallDetector.cs

@@ -104,7 +104,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Office
         private bool _preinstalledReported; // office_preinstalled_detected already emitted (emit-once guard)
         private DateTime? _startedAtUtc;
         private string? _startedTrigger;
-        private OfficeDoSample? _lastDo;
         private OfficeDoSample? _peakDo; // highest-bytes sample seen — basis for the completed doSummary
 
         public OfficeInstallDetector(
@@ -252,7 +251,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Office
                     // _peakDo). The seed is persisted directly (it is the lifecycle's first DO sample).
                     if (_state == DetectorState.Active)
                     {
-                        _lastDo = sample;
                         _peakDo = sample;
                         PersistState(OfficeInstallStateData.StateActive);
                     }
@@ -261,7 +259,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Office
 
                 // Active: no progress event — the sample only updates the DO summary data. A grown
                 // peak is re-persisted (throttled) so a mid-install agent restart keeps the doSummary.
-                _lastDo = sample;
                 var peakGrew = _peakDo == null || sample.TotalBytesDownloaded > _peakDo.TotalBytesDownloaded;
                 if (peakGrew) _peakDo = sample;
                 if (peakGrew && _statePersistence != null
@@ -380,7 +377,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Office
             // wrapper that re-runs C2R) the watcher's initial scan completes the lifecycle synchronously.
             // Emitting started first guarantees the correct order (started → completed); otherwise a
             // pre-installed Office produced completed-before-started (field session a7525e97).
-            EmitLifecycle(Constants.EventTypes.OfficeInstallStarted, snap, EventSeverity.Info, PhaseOf(snap), isTerminal: false);
+            EmitLifecycle(Constants.EventTypes.OfficeInstallStarted, snap, EventSeverity.Info, InFlightPhase, isTerminal: false);
             // Persist Active BEFORE ObserveInstallationPath: when Office is already on disk the
             // host's binary watcher completes the lifecycle synchronously from inside that callback
             // (and persists Completed) — persisting Active afterwards would overwrite the terminal.
@@ -508,7 +505,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Office
 
         // StreamingFinished does not exist in the C2R registry, so the in-flight phase is reported as a
         // single "Installing"; the terminal completion uses "Completed".
-        private static string PhaseOf(OfficeC2RSnapshot snap) => "Installing";
+        private const string InFlightPhase = "Installing";
 
         // -----------------------------------------------------------------------
         // Payload

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/NetworkChangeDetector.cs

@@ -26,7 +26,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
         private readonly string _tenantId;
         private readonly InformationalEventPost _post;
         private readonly AgentLogger _logger;
-        private readonly string _apiBaseUrl;
 
         private NetworkStateSnapshot _lastKnownState;
         private Timer _debounceTimer;
@@ -54,14 +53,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
             string sessionId,
             string tenantId,
             InformationalEventPost post,
-            AgentLogger logger,
-            string apiBaseUrl = null)
+            AgentLogger logger)
         {
             _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
             _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
             _post = post ?? throw new ArgumentNullException(nameof(post));
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-            _apiBaseUrl = apiBaseUrl;
         }
 
         public void Start()
@@ -225,15 +222,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
         {
             if (_disposed || _connectivityCheckClient == null) return;
 
-            // Build endpoint list: static MDM endpoints + dynamic backend URL
+            // Static MDM endpoints only. The backend API stays out on purpose: enrollment does not
+            // need it, so its outage must not raise a connectivity alarm.
             var endpoints = new List<(string Name, string Url)>(MdmEndpoints);
-            // Optionally add the Autopilot Monitor API endpoint, but we don't want to cause false alarms if it's down or unreachable, 
-            // since it's not critical for enrollment success and may be available only after certain network changes (e.g. if it's behind a captive portal). 
-            // For now, we can omit it from the critical checks.
-            // if (!string.IsNullOrEmpty(_apiBaseUrl))
-            // {
-            //     endpoints.Add(("Autopilot Monitor API", _apiBaseUrl));
-            // }
 
             // Run all checks in parallel
             var tasks = endpoints.Select(ep => CheckEndpointAsync(ep.Name, ep.Url)).ToArray();

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Provisioning/ProvisioningPackageCollector.cs

@@ -69,20 +69,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Provisioning
         private readonly string _tenantId;
         private readonly InformationalEventPost _post;
         private readonly AgentLogger _logger;
-        private readonly IClock? _clock;
 
         public ProvisioningPackageCollector(
             string sessionId,
             string tenantId,
             InformationalEventPost post,
-            AgentLogger logger,
-            IClock? clock = null)
+            AgentLogger logger)
         {
             _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
             _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
             _post = post ?? throw new ArgumentNullException(nameof(post));
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
-            _clock = clock;
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/BackendApiClient.cs

@@ -284,7 +284,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
         /// Throws <see cref="BackendAuthException"/> for 401/403 responses so callers can
         /// distinguish authentication failures from transient server errors.
         /// <para>
-        /// Field case (sits-d.cloud, 2026-08-09): a pre-cutover agent build pointed at a
+        /// Field case (2026-08-09): a pre-cutover agent build pointed at a
         /// retired Function App; Azure answers for a stopped app with a platform-level 403
         /// carrying an HTML error page ("Web App - Unavailable"). Our backend never returns
         /// HTML on 401/403 — an HTML body therefore means the response did not come from the

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/EmergencyReporter.cs

@@ -2,6 +2,7 @@ using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
@@ -14,6 +15,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
     ///   - Same error key (ErrorType + HTTP status code) is only ever sent once per session
     ///   - At most <see cref="MaxReportsPerSession"/> emergency reports total per session
     ///   - At most one report every <see cref="MinIntervalMinutes"/> minutes regardless of error type
+    ///     (the terminal <see cref="AgentErrorType.TelemetryRejectedSessionUnknown"/> report is exempt)
     ///
     /// A failure in this reporter is silently swallowed — it must never cascade into the main loop.
     /// </summary>
@@ -32,6 +34,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
         private readonly string _tenantId;
         private readonly string _agentVersion;
         private readonly AgentLogger _logger;
+        private readonly IClock _clock;
 
         private readonly HashSet<string> _reportedKeys = new HashSet<string>();
         private readonly object _antiFloodLock = new object();
@@ -43,13 +46,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
             string sessionId,
             string tenantId,
             string agentVersion,
-            AgentLogger logger)
+            AgentLogger logger,
+            IClock clock = null)
         {
             _apiClient = apiClient;
             _sessionId = sessionId;
             _tenantId = tenantId;
             _agentVersion = agentVersion;
             _logger = logger;
+            _clock = clock ?? SystemClock.Instance;
         }
 
         /// <summary>
@@ -100,6 +105,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
             // All anti-flood checks are protected by a lock to prevent race conditions when
             // TrySendAsync is called concurrently (fire-and-forget from multiple threads).
             var key = $"{errorType}:{httpStatusCode}";
+            var now = _clock.UtcNow;
             int currentReportCount;
             DateTime? previousLastReportTime;
 
@@ -117,8 +123,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
                     return;
                 }
 
-                if (_lastReportTime != null &&
-                    (DateTime.UtcNow - _lastReportTime.Value).TotalMinutes < MinIntervalMinutes)
+                // The session-unknown report is terminal and sent at most once per process (the
+                // termination follows immediately): a routine report minutes earlier must not cost
+                // the last word about the session. Only the cooldown is waived; key dedup and the
+                // per-session maximum still apply.
+                var exemptFromCooldown = errorType == AgentErrorType.TelemetryRejectedSessionUnknown;
+                if (!exemptFromCooldown && _lastReportTime != null &&
+                    (now - _lastReportTime.Value).TotalMinutes < MinIntervalMinutes)
                 {
                     _logger?.Debug($"[EmergencyChannel] Suppressed (cooldown active, last report at {_lastReportTime.Value:HH:mm:ss}): {key}");
                     return;
@@ -127,7 +138,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
                 previousLastReportTime = _lastReportTime;
                 _reportedKeys.Add(key);
                 _reportCount++;
-                _lastReportTime = DateTime.UtcNow;
+                _lastReportTime = now;
                 currentReportCount = _reportCount;
             }
 
@@ -145,7 +156,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
                 SessionAgeHours = sessionAgeHours,
                 PriorRegistrationFailure = priorRegistrationFailure,
                 AgentVersion = _agentVersion,
-                Timestamp = DateTime.UtcNow
+                Timestamp = now
             };
 
             var delivered = false;

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/NetworkLinkWait.cs

@@ -11,7 +11,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
     /// signal once per second for at most <paramref name="maxWait"/>. It cannot prove backend
     /// reachability — the callers' retry loops handle that — it only keeps retry budgets from
     /// being burned into a link that is provably still down (BootTrigger relaunch after a
-    /// mid-enrollment reboot, Wi-Fi still associating; tenant aebdce78 audits 2026-08-23/24).
+    /// mid-enrollment reboot, Wi-Fi still associating; kiosk-tenant audits 2026-08-23/24).
     /// Free on the normal path — a live link returns immediately. Probe errors end the wait,
     /// never the caller's operation.
     /// </summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/DefaultComponentFactory.cs

@@ -258,7 +258,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             // on esp_exiting events long after Start.
             ImeLogHost? imeLogHostRef = null;
 
-            // sits-d Cloud-PC fix (2026-08-19), narrowed after review: the Shell-Core ESP-exit
+            // Cloud-PC fix (2026-08-19), narrowed after review: the Shell-Core ESP-exit
             // replay is restart recovery, so it stays OFF on a first run and the happy path keeps
             // its pre-fix behaviour exactly. See ResolveEspExitBackfillLookbackMinutes.
             var espExitBackfillLookbackMinutes = ResolveEspExitBackfillLookbackMinutes(
@@ -377,8 +377,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             if (analyzers.KeepAwakeDuringUserEsp)
             {
                 hosts.Add(new UserEspKeepAwakeHost(
-                    sessionId: sessionId,
-                    tenantId: tenantId,
                     ingress: ingress,
                     clock: clock,
                     logger: logger,
@@ -453,7 +451,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             imeLogHost.Tracker.OnUserTokenAcquired = lineUtc => aadJoinHost.NotifyUserTokenAcquired(lineUtc);
             imeLogHost.Tracker.OnTokenFailureLine = (code, lineUtc) => aadJoinHost.NotifyTokenFailureLine(code, lineUtc);
 
-            // sits-d Cloud-PC fix (2026-08-19): the user-apps-settled AccountSetup synthesis used
+            // Cloud-PC fix (2026-08-19): the user-apps-settled AccountSetup synthesis used
             // to run ONLY on the EspExited edge. On a tenant with a large required-app set the ESP
             // page exits while apps are still in flight, the single attempt misses, and nothing
             // ever re-checks — sessions 8110e262 / a89aac2d reached 138/138 apps with 0 failed and
@@ -648,8 +646,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 tenantId: tenantId,
                 ingress: ingress,
                 clock: clock,
-                logger: logger,
-                apiBaseUrl: _agentConfig.ApiBaseUrl));
+                logger: logger));
 
             // Live AC/battery watcher — WMI Win32_PowerManagementEvent push (no polling), emits
             // power_state_change on AC↔battery transitions and 50/30/15 % downward threshold

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs

@@ -371,8 +371,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             // 3) Telemetry-Transport. Batch size flows from AgentConfiguration.MaxBatchSize
             //    via Program.cs (P1 fix: previously the remote-config knob was merged but
             //    never applied, so tenants saw drainInterval/MaxBatchSize have no effect).
-            _spool = new TelemetrySpool(_transportDirectory, _clock, _logger);
-            _transport = new TelemetryUploadOrchestrator(_spool, _uploader, _clock, batchSize: _uploadBatchSize);
+            //    The partition key names the registered session: the spool drops leftovers of a
+            //    previous session id on startup, and the orchestrator tells a 410 for this session
+            //    (SessionGone → host terminates) from a 410 for such leftovers (dropped).
+            var partitionKey = TelemetryPartitionKey.ForSession(_tenantId, _sessionId);
+            _spool = new TelemetrySpool(_transportDirectory, _clock, _logger, expectedPartitionKey: partitionKey);
+            _transport = new TelemetryUploadOrchestrator(
+                _spool, _uploader, _clock, batchSize: _uploadBatchSize, currentPartitionKey: partitionKey, logger: _logger);
 
             // TRACE-H1 — surface skipped oversized items + blocked-pipeline conditions as timeline
             // events. Raised after the drain guard releases, so posting back through the ingress

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentTerminatedEventArgs.cs

@@ -73,13 +73,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// </summary>
         public string? StopReason { get; }
 
+        /// <summary>
+        /// The <c>origin</c> param of a server-requested <c>terminate_session</c> action
+        /// (<see cref="TerminationOrigins"/>); null for every termination the agent decided
+        /// itself. <see cref="TerminationOrigins.SessionGone"/> makes the termination handler
+        /// skip the spool drain and the diagnostics upload — the backend no longer knows the
+        /// session, so both could only fail.
+        /// </summary>
+        public string? Origin { get; }
+
         public EnrollmentTerminatedEventArgs(
             EnrollmentTerminationReason reason,
             EnrollmentTerminationOutcome outcome,
             string? stageName,
             DateTime terminatedAtUtc,
             string? details = null,
-            string? stopReason = null)
+            string? stopReason = null,
+            string? origin = null)
         {
             Reason = reason;
             Outcome = outcome;
@@ -87,6 +97,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             TerminatedAtUtc = terminatedAtUtc;
             Details = details;
             StopReason = stopReason;
+            Origin = origin;
         }
     }
+
+    /// <summary>
+    /// Values of the <c>origin</c> param on a synthesised <c>terminate_session</c>
+    /// <c>ServerAction</c>, carried into <see cref="EnrollmentTerminatedEventArgs.Origin"/>.
+    /// </summary>
+    public static class TerminationOrigins
+    {
+        /// <summary>Administrator kill signal (<c>DeviceKillSignal</c> on a 2xx telemetry response).</summary>
+        public const string KillSignal = "kill_signal";
+
+        /// <summary>The backend answered HTTP 410 for the current session's telemetry.</summary>
+        public const string SessionGone = "session_gone";
+    }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/DesktopArrivalHost.cs

@@ -18,7 +18,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
 
         private readonly DesktopArrivalDetector _detector;
         private readonly DesktopArrivalDetectorAdapter _adapter;
-        private readonly AgentLogger _logger;
         private int _disposed;
 
         public DesktopArrivalHost(
@@ -30,7 +29,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             string? tenantId = null,
             Action<string>? onRealUserOwnerObserved = null)
         {
-            _logger = logger;
             _detector = new DesktopArrivalDetector(logger, noCandidateTimeoutMinutes);
             _adapter = new DesktopArrivalDetectorAdapter(_detector, ingress, clock);
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/EspAndHelloHost.cs

@@ -118,7 +118,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// the Shell-Core watcher only ever saw events written AFTER <see cref="Start"/>. Any
         /// agent restart therefore lost an ESP exit (62407) or Hello-wizard start (62404) that
         /// happened while the agent was down — and after a mid-ESP reboot that is exactly the
-        /// window the completion signal lands in (sits-d Cloud PCs, 2026-08-19: five sessions
+        /// window the completion signal lands in (Cloud PCs, 2026-08-19: five sessions
         /// hung in AccountSetup until the server-side timeout while the devices were fine).
         /// </para>
         /// <para>
@@ -142,6 +142,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// replayed 62407 cannot be placed in time; see
         /// <c>ShellCoreTracker.ReplayBackfillRecords</c>.
         /// </para>
+        /// <para>
+        /// The first run reads the last hour for the OOBE update page telemetry instead — no
+        /// replay, nothing that reaches the decision engine; see
+        /// <c>ShellCoreTracker.BackfillUpdatePageTelemetry</c>.
+        /// </para>
         /// </summary>
         public void Start()
         {
@@ -149,6 +154,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
 
             if (_espExitBackfillLookbackMinutes > 0)
                 _tracker.BackfillRecentHelloWizardStart(_espExitBackfillLookbackMinutes);
+            else
+                _tracker.BackfillUpdatePageTelemetry(ShellCoreTracker.UpdatePageBackfillLookbackMinutes);
         }
 
         public void Stop() => _tracker.Stop();

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/NetworkChangeHost.cs

@@ -26,14 +26,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             string tenantId,
             ISignalIngressSink ingress,
             IClock clock,
-            AgentLogger logger,
-            string? apiBaseUrl)
+            AgentLogger logger)
         {
             if (ingress == null) throw new ArgumentNullException(nameof(ingress));
             if (clock == null) throw new ArgumentNullException(nameof(clock));
             _logger = logger;
             var post = new InformationalEventPost(ingress, clock);
-            _detector = new NetworkChangeDetector(sessionId, tenantId, post, logger, apiBaseUrl);
+            _detector = new NetworkChangeDetector(sessionId, tenantId, post, logger);
         }
 
         public void Start()

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/ProvisioningPackageHost.cs

@@ -60,7 +60,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
 
             var post = new InformationalEventPost(ingress, clock, logger);
-            _collector = new ProvisioningPackageCollector(sessionId, tenantId, post, logger, clock);
+            _collector = new ProvisioningPackageCollector(sessionId, tenantId, post, logger);
             _observableIngress = ingress as SignalIngress;
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/UserEspKeepAwakeHost.cs

@@ -91,8 +91,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
 
         private static readonly string AccountSetupPhaseName = EnrollmentPhase.AccountSetup.ToString();
 
-        private readonly string _sessionId;
-        private readonly string _tenantId;
         private readonly AgentLogger _logger;
         private readonly InformationalEventPost _post;
         private readonly KeepAwakeController _controller;
@@ -112,8 +110,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         private int _disposed;
 
         public UserEspKeepAwakeHost(
-            string sessionId,
-            string tenantId,
             ISignalIngressSink ingress,
             IClock clock,
             AgentLogger logger,
@@ -125,8 +121,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         {
             if (ingress == null) throw new ArgumentNullException(nameof(ingress));
             if (clock == null) throw new ArgumentNullException(nameof(clock));
-            _sessionId = sessionId ?? string.Empty;
-            _tenantId = tenantId ?? string.Empty;
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
             _post = new InformationalEventPost(ingress, clock, logger);
             _controller = controller ?? new KeepAwakeController(logger);

src/Agent/AutopilotMonitor.Agent.V2.Core/Security/SessionRegistrationHelper.cs

@@ -27,7 +27,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
     ///   <item>6 attempts total; between attempts <c>2^attempt</c> seconds (2s, 4s, 8s, 16s, 32s —
     ///     ~62 s of backoff). The original V1 budget of 5 attempts / ~30 s was too short for the
     ///     reboot-relaunch on Wi-Fi kiosks: the relaunched agent gave up and exited 7 before
-    ///     the network came back, leaving the session silent forever (tenant aebdce78,
+    ///     the network came back, leaving the session silent forever (kiosk-tenant
     ///     2026-08-23 audit). A relaunch that misses here is lost — nothing retries later.</item>
     ///   <item>On <c>response.Success == true</c> → stop immediately.</item>
     ///   <item>On <see cref="BackendAuthException"/> (401/403) → report to the

src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Events/TelemetryEventEmitter.cs

@@ -45,7 +45,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events
             _sequenceCounter = sequenceCounter ?? throw new ArgumentNullException(nameof(sequenceCounter));
             _sessionId = sessionId;
             _tenantId = tenantId;
-            _partitionKey = $"{tenantId}_{sessionId}";
+            _partitionKey = TelemetryPartitionKey.ForSession(tenantId, sessionId);
             _traceEventsEnabled = traceEventsEnabled;
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Signals/TelemetrySignalEmitter.cs

@@ -42,7 +42,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Signals
             if (string.IsNullOrEmpty(sessionId)) throw new ArgumentException("SessionId is mandatory.", nameof(sessionId));
             if (string.IsNullOrEmpty(tenantId)) throw new ArgumentException("TenantId is mandatory.", nameof(tenantId));
             _transport = transport ?? throw new ArgumentNullException(nameof(transport));
-            _partitionKey = $"{tenantId}_{sessionId}";
+            _partitionKey = TelemetryPartitionKey.ForSession(tenantId, sessionId);
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Transitions/TelemetryTransitionEmitter.cs

@@ -43,7 +43,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Transitions
             if (string.IsNullOrEmpty(sessionId)) throw new ArgumentException("SessionId is mandatory.", nameof(sessionId));
             if (string.IsNullOrEmpty(tenantId)) throw new ArgumentException("TenantId is mandatory.", nameof(tenantId));
             _transport = transport ?? throw new ArgumentNullException(nameof(transport));
-            _partitionKey = $"{tenantId}_{sessionId}";
+            _partitionKey = TelemetryPartitionKey.ForSession(tenantId, sessionId);
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Termination/EnrollmentTerminationHandler.cs

@@ -306,7 +306,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                     });
 
                     DelayLateEventGrace();
-                    DrainSpool();
+                    DrainSpool(args);
 
                     // Option 2 (WG Part 1 graceful-exit hardening, 2026-04-30): write the
                     // clean-exit marker BEFORE _signalShutdown returns control to the main
@@ -329,7 +329,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
 
                 RunUploadDiagnosticsWithEvents(args);
                 WriteEnrollmentCompleteMarker(args);
-                RunStandaloneRebootIfRequested();
+                RunStandaloneRebootIfRequested(args);
                 RunSelfDestructIfAppropriate(args);
                 // Option 2 (same hardening) — covers the standard Completed / Failed terminal
                 // path too. Cleanup PowerShell does not touch this marker, so writing it before
@@ -824,7 +824,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
         /// IME-log event) but the agent actually observed only the end-state. Severity and phrasing
         /// are outcome-calibrated via <see cref="ObservationCoverage.DescribeLateStart"/>: a failure
         /// stays a Warning with the post-mortem/hung-script note, a success is an Info about
-        /// tail-only coverage (fleet 2026-07-28: tenant 659c3a90 collected 12 Warnings on healthy
+        /// tail-only coverage (fleet 2026-07-28: one tenant collected 12 Warnings on healthy
         /// enrollments whose bootstrap merely ran late). No state mutation.
         /// </summary>
         private void MaybeEmitAgentLateStart(EnrollmentTerminatedEventArgs args)
@@ -979,6 +979,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
         /// </param>
         private void RunUploadDiagnosticsWithEvents(EnrollmentTerminatedEventArgs args, string suffixOverride = null)
         {
+            if (IsSessionGone(args))
+            {
+                // The backend answered 410 for this session: the package would describe a session
+                // that no longer exists, and its diagnostics_* events could never be accepted.
+                _logger.Info("EnrollmentTerminationHandler: diagnostics upload skipped — backend no longer knows this session.");
+                return;
+            }
+
             var mode = _configuration.DiagnosticsUploadMode ?? "Off";
             if (!_configuration.DiagnosticsUploadEnabled || string.Equals(mode, "Off", StringComparison.OrdinalIgnoreCase))
             {
@@ -1124,7 +1132,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
         /// but enables <c>RebootOnComplete</c>, the agent's final act is <c>shutdown.exe /r</c>
         /// with the configured delay, giving the user a visible countdown.
         /// </summary>
-        private void RunStandaloneRebootIfRequested()
+        private void RunStandaloneRebootIfRequested(EnrollmentTerminatedEventArgs args)
         {
             if (_configuration.SelfDestructOnComplete) return;
             if (!_configuration.RebootOnComplete) return;
@@ -1148,7 +1156,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                 ImmediateUpload = true,
             });
 
-            DrainSpool();
+            DrainSpool(args);
 
             try
             {
@@ -1185,7 +1193,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                 // just above. The WG-Part-1 and standalone-reboot paths already drain first; this
                 // closes the gap on the self-destruct path. Bounded + best-effort (never blocks
                 // termination on a wedged backend).
-                DrainSpool();
+                DrainSpool(args);
 
                 var service = _cleanupServiceFactory();
                 service.ExecuteSelfDestruct();
@@ -1318,8 +1326,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
             }
         }
 
-        private void DrainSpool()
+        /// <summary>
+        /// <see cref="TerminationOrigins.SessionGone"/>: the backend no longer knows the session.
+        /// Every drain would only collect more 410s against a bounded budget, and a diagnostics
+        /// package would describe a deleted session — both are skipped; marker, cleanup and
+        /// self-destruct run as usual.
+        /// </summary>
+        private static bool IsSessionGone(EnrollmentTerminatedEventArgs args) =>
+            string.Equals(args.Origin, TerminationOrigins.SessionGone, StringComparison.Ordinal);
+
+        private void DrainSpool(EnrollmentTerminatedEventArgs args)
         {
+            if (IsSessionGone(args))
+            {
+                _logger.Info("EnrollmentTerminationHandler: spool drain skipped — backend no longer knows this session.");
+                return;
+            }
+
             // Block briefly so pending events can land before the next destructive step
             // (shutdown.exe, self-destruct). Two phases share the same bounded budget:
             //

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/BackendTelemetryUploader.cs

@@ -165,6 +165,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                     {
                         _logger?.Warning($"BackendTelemetryUploader: ingest TRANSIENT (corr={correlationId}, items={items.Count}, durationMs={sw.ElapsedMilliseconds}, status={(int)response.StatusCode}): {result.ErrorReason}");
                     }
+                    else if (result.IsSessionGone)
+                    {
+                        _logger?.Error($"BackendTelemetryUploader: ingest rejected — backend no longer knows this session (corr={correlationId}, items={items.Count}, durationMs={sw.ElapsedMilliseconds}, status={(int)response.StatusCode}): {result.ErrorReason}");
+                    }
                     else
                     {
                         _logger?.Error($"BackendTelemetryUploader: ingest PERMANENT fail (corr={correlationId}, items={items.Count}, durationMs={sw.ElapsedMilliseconds}, status={(int)response.StatusCode}): {result.ErrorReason}");
@@ -208,6 +212,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
 
                 case HttpStatusCode.RequestEntityTooLarge: // 413 — the data is fine, only the batch
                     return UploadResult.TooLarge(shortReason); // size is wrong → split & retry (P1).
+
+                case HttpStatusCode.Gone:                  // 410 — the backend no longer knows this session.
+                    // Decided BEFORE the poison-body check: a poison body on 410 would make the
+                    // drain drop items and emit telemetry_upload_poisoned, which the backend
+                    // rejects with 410 again — an emit/reject loop for a session that is over.
+                    return UploadResult.SessionGone($"session gone: {shortReason}");
             }
 
             if (statusCode >= 500 && statusCode <= 599) return UploadResult.Transient(shortReason);

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetryPartitionKey.cs

@@ -0,0 +1,14 @@
+#nullable enable
+namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
+{
+    /// <summary>
+    /// The one composition of a session's Azure-Table partition key. The three emitters stamp
+    /// it on every <see cref="TelemetryItem"/>; the spool and the upload orchestrator compare
+    /// against it to tell the current session's items from leftovers of a previous session id.
+    /// A drift between producer and comparer would silently drop or retain the wrong items.
+    /// </summary>
+    public static class TelemetryPartitionKey
+    {
+        public static string ForSession(string tenantId, string sessionId) => $"{tenantId}_{sessionId}";
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetrySpool.cs

@@ -74,7 +74,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             public int ByteLength { get; }
         }
 
-        public TelemetrySpool(string directoryPath, IClock clock, Logging.AgentLogger? logger = null)
+        /// <param name="expectedPartitionKey">
+        /// Partition key of the session this process serves (<see cref="TelemetryPartitionKey.ForSession"/>).
+        /// When set, pending items of another session id found at the head of the spool are dropped
+        /// on startup — see <see cref="DropLeadingForeignPending"/>. Null disables the filter.
+        /// </param>
+        public TelemetrySpool(
+            string directoryPath,
+            IClock clock,
+            Logging.AgentLogger? logger = null,
+            string? expectedPartitionKey = null)
         {
             if (string.IsNullOrEmpty(directoryPath))
             {
@@ -96,6 +105,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             // count as "pending" and need to be rehydrated into _pending.
             _lastUploadedItemId = _cursor.Load();
             _lastAssignedItemId = ScanSpoolAndRehydratePending();
+            DropLeadingForeignPending(expectedPartitionKey);
             _peakPendingCount = _pending.Count;
         }
 
@@ -312,5 +322,68 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             }
             return highest;
         }
+
+        /// <summary>
+        /// Startup filter: drops the LEADING run of pending items whose partition key is not
+        /// <paramref name="expectedPartitionKey"/>, advancing and persisting the cursor past them.
+        /// Such items are leftovers of a previous session id in the same spool directory; the
+        /// backend answers 410 for them, and that 410 must never end the session this process
+        /// serves. One process serves one session, so a foreign item AFTER an own item cannot
+        /// occur — if it does, the order is not trustworthy and nothing is dropped. WhiteGlove
+        /// Part 2 reuses the Part-1 session id, so its leftovers carry the expected key and stay.
+        /// Called once from the ctor, after rehydration.
+        /// </summary>
+        private void DropLeadingForeignPending(string? expectedPartitionKey)
+        {
+            if (string.IsNullOrEmpty(expectedPartitionKey) || _pending.Count == 0) return;
+
+            var leadingForeign = 0;
+            long lastForeignId = -1;
+            var seenOwn = false;
+            foreach (var entry in _pending)
+            {
+                var isForeign = !string.Equals(entry.Item.PartitionKey, expectedPartitionKey, StringComparison.Ordinal);
+                if (!isForeign)
+                {
+                    seenOwn = true;
+                    continue;
+                }
+
+                if (!seenOwn)
+                {
+                    leadingForeign++;
+                    lastForeignId = entry.Item.TelemetryItemId;
+                    continue;
+                }
+
+                _logger?.Error(
+                    $"TelemetrySpool: pending itemId={entry.Item.TelemetryItemId} carries a foreign partition key after items of the current session — spool order is inconsistent; keeping all {_pending.Count} pending item(s).");
+                return;
+            }
+
+            if (leadingForeign == 0) return;
+
+            try
+            {
+                _cursor.Save(lastForeignId);
+            }
+            catch (Exception ex)
+            {
+                // Keep the items rather than risk a cursor that disagrees with disk; the drain
+                // loop drops the same leading run on its first 410 (defence in depth).
+                _logger?.Warning($"TelemetrySpool: could not persist the cursor past {leadingForeign} foreign pending item(s): {ex.Message}");
+                return;
+            }
+
+            _lastUploadedItemId = lastForeignId;
+            for (var i = 0; i < leadingForeign; i++)
+            {
+                _pendingBytes -= _pending.First!.Value.ByteLength;
+                _pending.RemoveFirst();
+            }
+
+            _logger?.Warning(
+                $"TelemetrySpool: dropped {leadingForeign} pending item(s) of a previous session id (cursor advanced to {lastForeignId}, {_pending.Count} pending item(s) of the current session kept).");
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetryUploadOrchestrator.cs

@@ -28,7 +28,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         private readonly ITelemetrySpool _spool;
         private readonly IBackendTelemetryUploader _uploader;
         private readonly IClock _clock;
-        private readonly int _batchSize;
         private readonly IReadOnlyList<TimeSpan> _retryBackoffs;
         private readonly SemaphoreSlim _drainGuard = new SemaphoreSlim(1, 1);
         private bool _disposed;
@@ -45,22 +44,39 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         // telemetry_upload_blocked exactly once per process rather than on every 30 s drain.
         private bool _uploadBlockedReported;
 
+        // Partition key of the session this process serves; null = every batch counts as own.
+        private readonly string? _currentPartitionKey;
+        private readonly Logging.AgentLogger? _logger;
+
+        // One-shot guard for SessionGone. Latched only when a handler is subscribed: the host
+        // wires the handler after EnrollmentOrchestrator.Start, and a 410 on the very first
+        // drain must not be swallowed before anyone listens.
+        private bool _sessionGoneReported;
+
+        /// <param name="currentPartitionKey">
+        /// <see cref="TelemetryPartitionKey.ForSession"/> of the registered session. A 410 on a
+        /// batch that starts with this key ends the session (<see cref="SessionGone"/>); a 410 on
+        /// a batch that starts with any other key only drops those leftover items.
+        /// </param>
         public TelemetryUploadOrchestrator(
             ITelemetrySpool spool,
             IBackendTelemetryUploader uploader,
             IClock clock,
             int batchSize = 100,
-            IReadOnlyList<TimeSpan>? retryBackoffs = null)
+            IReadOnlyList<TimeSpan>? retryBackoffs = null,
+            string? currentPartitionKey = null,
+            Logging.AgentLogger? logger = null)
         {
             _spool = spool ?? throw new ArgumentNullException(nameof(spool));
             _uploader = uploader ?? throw new ArgumentNullException(nameof(uploader));
             _clock = clock ?? throw new ArgumentNullException(nameof(clock));
 
             if (batchSize <= 0) throw new ArgumentOutOfRangeException(nameof(batchSize), "BatchSize must be positive.");
-            _batchSize = batchSize;
             _effectiveBatchSize = batchSize;
 
             _retryBackoffs = retryBackoffs ?? DefaultRetryBackoffs;
+            _currentPartitionKey = currentPartitionKey;
+            _logger = logger;
         }
 
         /// <summary>
@@ -97,6 +113,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         /// </summary>
         public event EventHandler<string>? UploadBlocked;
 
+        /// <summary>
+        /// Raised once per process (after the drain guard releases) when the backend answered
+        /// HTTP 410 for a batch of the CURRENT session: the session is over server-side (never
+        /// registered, deleted, or being deleted) and no retry can succeed. The batch is retained
+        /// (cursor stays) and the drain stops; the host reports once over the emergency channel
+        /// and terminates the agent with self-destruct. Carries the backend error reason.
+        /// </summary>
+        public event EventHandler<string>? SessionGone;
+
         /// <summary>
         /// <c>true</c> when the last successful upload returned <see cref="UploadResult.DeviceBlocked"/>
         /// and the paused-until window has not expired. Drain is a no-op in this state.
@@ -124,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             List<UploadResult>? pendingSignals = null;
             List<PoisonReport>? pendingPoison = null;
             string? pendingBlockedReason = null;
+            string? pendingSessionGoneReason = null;
             DrainResult result;
 
             try
@@ -247,6 +273,35 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                             new PoisonReport(1, oversizeId, "oversize: " + outcome.ErrorReason, PoisonKind.Oversize));
                         break;
                     }
+                    else if (outcome.IsSessionGone)
+                    {
+                        // HTTP 410 — the backend no longer knows the session these items belong to.
+                        var foreignRun = CountLeadingForeignItems(batch);
+                        if (foreignRun > 0)
+                        {
+                            // Leftovers of a previous session id (the spool drops these at startup;
+                            // this is defence in depth). Drop only that leading run and carry on: a
+                            // legitimate new session must never be ended because of old items.
+                            var throughId = batch[foreignRun - 1].TelemetryItemId;
+                            _spool.MarkUploaded(throughId);
+                            _logger?.Warning(
+                                $"TelemetryUploadOrchestrator: dropped {foreignRun} item(s) of a previous session id the backend rejected with 410 (cursor advanced to {throughId}).");
+                            continue;
+                        }
+
+                        // The current session is over server-side. RETAIN (cursor stays, the items
+                        // remain on disk for the diagnostics ZIP), stop this drain, and surface it
+                        // once — not as telemetry_upload_blocked, which would only queue another
+                        // item behind a batch that can never be accepted.
+                        failedBatches++;
+                        lastError = outcome.ErrorReason;
+                        if (!_sessionGoneReported && SessionGone != null)
+                        {
+                            _sessionGoneReported = true;
+                            pendingSessionGoneReason = outcome.ErrorReason;
+                        }
+                        break;
+                    }
                     else
                     {
                         // P1 — RETAIN. Transient (retry next drain), auth-permanent (uploader already
@@ -301,9 +356,32 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                 catch { /* handler must not abort the drain result */ }
             }
 
+            if (pendingSessionGoneReason != null)
+            {
+                try { SessionGone?.Invoke(this, pendingSessionGoneReason); }
+                catch { /* handler must not abort the drain result */ }
+            }
+
             return result;
         }
 
+        /// <summary>
+        /// Number of items at the head of <paramref name="batch"/> whose partition key is not the
+        /// current session's. 0 when no current key is configured (every batch counts as own).
+        /// </summary>
+        private int CountLeadingForeignItems(IReadOnlyList<TelemetryItem> batch)
+        {
+            if (_currentPartitionKey == null) return 0;
+
+            var count = 0;
+            while (count < batch.Count
+                && !string.Equals(batch[count].PartitionKey, _currentPartitionKey, StringComparison.Ordinal))
+            {
+                count++;
+            }
+            return count;
+        }
+
         private static bool CarriesSignal(UploadResult outcome) =>
             outcome.DeviceBlocked
             || outcome.DeviceKillSignal

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/UploadResult.cs

@@ -30,7 +30,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             bool isAuthFailure = false,
             bool requiresSplit = false,
             bool isPoison = false,
-            IReadOnlyList<string>? poisonRowKeys = null)
+            IReadOnlyList<string>? poisonRowKeys = null,
+            bool isSessionGone = false)
         {
             Success = success;
             ErrorReason = errorReason;
@@ -44,6 +45,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             RequiresSplit = requiresSplit;
             IsPoison = isPoison;
             PoisonRowKeys = poisonRowKeys;
+            IsSessionGone = isSessionGone;
         }
 
         public bool Success { get; }
@@ -81,6 +83,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         /// <summary>The RowKeys the backend named as poison (item-level). Non-empty when <see cref="IsPoison"/>.</summary>
         public IReadOnlyList<string>? PoisonRowKeys { get; }
 
+        /// <summary>
+        /// HTTP 410: the backend no longer knows the session the batch belongs to (never
+        /// registered, deleted, or being deleted). Not transient, not auth, not poison — retrying
+        /// can never succeed. The orchestrator stops the drain (cursor stays) and raises
+        /// <see cref="TelemetryUploadOrchestrator.SessionGone"/> when the batch belongs to the
+        /// current session, or drops the batch's leading items when they are leftovers of a
+        /// previous session id.
+        /// </summary>
+        public bool IsSessionGone { get; }
+
         /// <summary>
         /// Non-terminal quarantine signalled by the backend. The agent should stop draining
         /// uploads until <see cref="UnblockAt"/> (if set) elapses — the session stays alive so
@@ -165,5 +177,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             new UploadResult(false, reason ?? throw new ArgumentNullException(nameof(reason)), isTransient: false,
                 deviceBlocked: false, unblockAt: null, deviceKillSignal: false, adminAction: null, actions: null,
                 isPoison: true, poisonRowKeys: rejectedRowKeys ?? throw new ArgumentNullException(nameof(rejectedRowKeys)));
+
+        /// <summary>
+        /// HTTP 410 — the backend no longer knows the session. Flagged <see cref="IsSessionGone"/>;
+        /// never retried, never split, never treated as poison.
+        /// </summary>
+        public static UploadResult SessionGone(string reason) =>
+            new UploadResult(false, reason ?? throw new ArgumentNullException(nameof(reason)), isTransient: false,
+                deviceBlocked: false, unblockAt: null, deviceKillSignal: false, adminAction: null, actions: null,
+                isSessionGone: true);
     }
 }