View as: keep the navbar and sidebar clear of the view-as bar

The bar sat in the normal flow above the sticky navbar and scrolled away,
while the desktop sidebar is fixed at the navbar's height. In a view-as tab
the navbar therefore covered the top of the sidebar (its first entry) by up
to the bar's height, depending on the scroll position.

The bar now sticks above the navbar at a fixed height: one line, a long
tenant name truncates. globals.css derives --view-as-offset from its
presence (:root:has([data-view-as-bar])): the bar's height while it is
shown, 0 otherwise. Everything positioned against the top of the viewport
adds it: the navbar's sticky top, the desktop sidebar, the mobile
notification panel, the sticky severity card, the push app's header, and
anchor scrolling (scroll-padding-top on the root). The sidebar's section
jump and scroll-spy margin add the bar's measured height
(viewAsBarHeight in lib/viewAs.ts). Ordinary tabs keep offset 0, so their
layout is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -30,7 +30,7 @@
 - Stage explicit file lists; never `git add -A` or a directory. Pushing is the user's call.
 - New API responses need a typed DTO plus the parity fact. MCP vocabularies are generated from the wire types, never retyped.
 - Every route belongs in the route policy catalog; every new event type goes into the MCP resource catalog.
-- Workflow files under `.github/` go through zizmor before they are committed (`zizmor .` from the repository root, findings from severity low on): fix every finding or ignore it in `zizmor.yml` with a reason. The `zizmor` job in `action-pins.yml` runs the same check on every push.
+- Workflow files under `.github/` go through zizmor before they are committed (`zizmor .` from the repository root, findings from severity low on): fix every finding or ignore it in `.github/zizmor.yml` with a reason. The `zizmor` job in `action-pins.yml` runs the same check on every push.
 - The about, terms and privacy pages under `src/Web/autopilot-monitor-web/app/` state facts customers rely on: verify every claim against the code before writing it and update them in the same change as the fact they describe.
 
 ## Code Quality

.github/dependabot.yml

@@ -24,6 +24,11 @@ updates:
       dotnet-security:
         applies-to: security-updates
         patterns: ['*']
+    # Application Insights 3 is the OpenTelemetry rewrite (no telemetry processors, another sampling
+    # model) and the Functions worker integration still builds on 2.x: a planned migration, not a bump.
+    ignore:
+      - dependency-name: 'Microsoft.ApplicationInsights.WorkerService'
+        update-types: ['version-update:semver-major']
 
   - package-ecosystem: npm
     directory: /src/Web/autopilot-monitor-web
@@ -98,6 +103,24 @@ updates:
         applies-to: security-updates
         patterns: ['*']
 
+  # SWA CLI for the deploy job of deploy-web.yml, which installs it from this lockfile next to
+  # the production deploy token: a version reaches that job only through a reviewed bump here.
+  # deploy-web watches this folder, so a merged bump redeploys and proves the new CLI at once.
+  # Not under .github/: there Dependabot's update PR was refused as an unauthorized change.
+  - package-ecosystem: npm
+    directory: /tools/swa-cli
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      swa-cli:
+        patterns: ['*']
+      swa-cli-security:
+        applies-to: security-updates
+        patterns: ['*']
+
   # Every action is referenced by commit SHA with the version in a trailing comment;
   # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
   # is what keeps those pins current: it rewrites the SHA and the comment together, so the

.github/workflows/action-pins.yml

@@ -1,15 +1,18 @@
 name: Workflow gates
 
-# Three checks over the workflow files and their helper scripts:
+# Four checks over the workflow files and their helper scripts:
 #   * verify-pins -- every third-party action is referenced by a full commit SHA plus a
 #                    version comment (stricter than zizmor's unpinned-uses audit).
 #   * zizmor      -- static analysis of every workflow (permissions, credential
 #                    persistence, template injection, ...). Configuration and the
-#                    reasoned ignores live in zizmor.yml at the repository root; the
-#                    same run is expected locally before a workflow change is committed.
+#                    reasoned ignores live in .github/zizmor.yml, which zizmor finds on
+#                    its own; the same run is expected locally before a workflow change
+#                    is committed.
 #   * hosts       -- no workflow or .github/scripts helper spells out a host; every one
 #                    comes from .github/scripts/Get-Endpoints.ps1, CI's member of the URL
 #                    registry (the C#, web and MCP registries have guard tests of their own).
+#   * packages    -- no workflow or helper fetches a package at a version the repository
+#                    does not fix, in the forms zizmor's adhoc-packages audit does not see.
 #
 # Every third-party action must be referenced by a full commit SHA, never by a tag.
 # Tags are mutable: whoever controls an action repository can repoint v4 at new code,
@@ -37,10 +40,10 @@ name: Workflow gates
 on:
   push:
     branches: [main]
-    paths: ['.github/workflows/**', '.github/scripts/**', '.github/dependabot.yml', 'zizmor.yml']
+    paths: ['.github/workflows/**', '.github/scripts/**', '.github/dependabot.yml', '.github/zizmor.yml']
   pull_request:
     branches: [main]
-    paths: ['.github/workflows/**', '.github/scripts/**', '.github/dependabot.yml', 'zizmor.yml']
+    paths: ['.github/workflows/**', '.github/scripts/**', '.github/dependabot.yml', '.github/zizmor.yml']
   workflow_dispatch:
 
 permissions:
@@ -105,7 +108,7 @@ jobs:
       # the local install so the gate and the pre-commit run agree on the finding set.
       # Informational findings (template expansion of our own step outputs in pwsh) are
       # visible locally but do not fail the gate.
-      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+      - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           version: 1.30.1
           min-severity: low
@@ -123,3 +126,51 @@ jobs:
       - name: No host literal outside .github/scripts/Get-Endpoints.ps1
         shell: pwsh
         run: ./.github/scripts/Assert-HostsFromRegistry.ps1
+
+  packages:
+    name: Packages only at a version the repository fixes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # npm packages come from a committed lockfile via npm ci; zizmor's adhoc-packages flags
+      # `npm install <pkg>` (also yarn, pnpm, gem), but not the forms below, which also fetch at
+      # run time:
+      #   * npx / npm exec without --no: in CI they install a missing package without asking.
+      #     The -- is load-bearing: without it npx hands the tool's own flags to npm.
+      #   * a .NET tool without an exact --version, a PowerShell module without -RequiredVersion.
+      # Other package managers (pip, cargo, dlx runners) are covered by neither check.
+      - name: No package fetched at a version the repository does not fix
+        run: |
+          set -uo pipefail
+          failed=0
+          fail() { echo "::error file=$1,line=$2::$3"; failed=1; }
+          while IFS=: read -r file line text; do
+            # YAML, shell and PowerShell comments alike start the line with #.
+            [[ "$text" =~ ^[[:space:]]*# ]] && continue
+
+            if [[ "$text" =~ (^|[^[:alnum:]_./-])(npx|npm[[:space:]]+(exec|x))([[:space:]]|$) ]] &&
+               ! [[ "$text" =~ (npx|npm[[:space:]]+(exec|x))[[:space:]]+--no[[:space:]]+--([[:space:]]|$) ]]; then
+              fail "$file" "$line" "Write 'npx --no -- <tool>' (or 'npm exec --no -- <tool>'): without --no a missing package is fetched from the registry, without -- the tool's flags go to npm."
+            fi
+
+            if [[ "$text" =~ dotnet[[:space:]]+tool[[:space:]]+(install|update) ]] &&
+               ! [[ "$text" =~ --version[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+([^0-9.*]|$) ]]; then
+              fail "$file" "$line" "Give the .NET tool an exact --version X.Y.Z on the same line; a range or a missing version resolves at run time."
+            fi
+
+            if [[ "$text" =~ Install-(Module|PSResource)[[:space:]] ]] &&
+               ! [[ "$text" =~ -RequiredVersion[[:space:]]+[^[:space:]] || "$text" =~ -Version[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+([^0-9.*]|$) ]]; then
+              fail "$file" "$line" "Give the PowerShell module an exact version on the same line, -RequiredVersion for Install-Module, -Version X.Y.Z for Install-PSResource; -MinimumVersion resolves at run time."
+            fi
+          # -H is load-bearing, as in verify-pins: with a single matching file grep omits the name.
+          done < <(grep -nHE 'npx|npm[[:space:]]+(exec|x)([[:space:]]|$)|dotnet[[:space:]]+tool[[:space:]]+(install|update)|Install-(Module|PSResource)' \
+                   .github/workflows/*.yml .github/scripts/*.ps1)
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::Packages fetched at a version the repository does not fix -- fix them before this reaches main."
+            exit 1
+          fi
+          echo "Every package the workflows and their helpers fetch has a version the repository fixes."

.github/workflows/bootstrap-script-gates.yml

@@ -65,11 +65,11 @@ jobs:
           persist-credentials: false
 
       # For all users: the SYSTEM pass below runs Pester as SYSTEM.
-      - name: Install Pester 5+
+      - name: Install Pester
         shell: powershell
         run: |
           Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope AllUsers | Out-Null
-          Install-Module Pester -Scope AllUsers -Force -SkipPublisherCheck -MinimumVersion 5.5.0
+          Install-Module Pester -Scope AllUsers -Force -SkipPublisherCheck -RequiredVersion 6.2.0
 
       # Windows PowerShell 5.1 on purpose: that is the runtime IME uses to execute
       # platform scripts, so guard/relax logic is verified without resetting a device.

.github/workflows/build-agent.yml

@@ -247,7 +247,7 @@ jobs:
           Get-ChildItem $outDir | ForEach-Object { Write-Host "$($_.Name): $([math]::Round($_.Length / 1MB, 2)) MB" }
 
       - name: Upload unsigned build output
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: agent-unsigned
           path: ${{ runner.temp }}/agent-unsigned
@@ -293,7 +293,7 @@ jobs:
         run: ./.github/scripts/Get-Endpoints.ps1 -ExportToGitHubEnv
 
       - name: Download unsigned build output
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: agent-unsigned
           path: ${{ runner.temp }}/agent-unsigned
@@ -790,13 +790,13 @@ jobs:
             staging/agent/AutopilotMonitor.SummaryDialog.exe
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: AutopilotMonitor-Agent-v${{ needs.reserve.outputs.version }}
           path: ${{ steps.artifact.outputs.versioned_zip_release }}
 
       - name: Upload version metadata
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: version-metadata
           path: ${{ env.MANIFEST_NAME }}

.github/workflows/build-msi.yml

@@ -127,7 +127,7 @@ jobs:
           Write-Host "$env:RUNNER_SCRIPT : Valid, timestamped, signer $($sig.SignerCertificate.Subject.Split(',')[0])"
 
       - name: Upload signed loader
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bootstrap-loader-signed
           path: ${{ env.RUNNER_SCRIPT }}
@@ -148,7 +148,7 @@ jobs:
           persist-credentials: false
 
       - name: Download signed loader
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bootstrap-loader-signed
           path: ${{ runner.temp }}/loader
@@ -187,7 +187,7 @@ jobs:
           Write-Host "Built $env:STABLE_MSI ($([math]::Round((Get-Item $env:STABLE_MSI).Length / 1KB)) KB)"
 
       - name: Upload unsigned MSI
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bootstrap-msi-unsigned
           path: ${{ env.STABLE_MSI }}
@@ -215,7 +215,7 @@ jobs:
           persist-credentials: false
 
       - name: Download unsigned MSI
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bootstrap-msi-unsigned
           path: ${{ runner.temp }}/msi
@@ -310,7 +310,7 @@ jobs:
           "version=$version" >> $env:GITHUB_OUTPUT
 
       - name: Download unsigned MSI
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bootstrap-msi-unsigned
           path: ${{ runner.temp }}/msi
@@ -442,7 +442,7 @@ jobs:
           subject-path: ${{ env.STABLE_MSI }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
           path: ${{ env.STABLE_MSI }}

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
-      - 'zizmor.yml'
+      - '.github/zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -56,7 +56,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
-      - 'zizmor.yml'
+      - '.github/zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -134,7 +134,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: npm
@@ -145,10 +145,10 @@ jobs:
       # next-env.d.ts + .next type stubs are gitignored (Next-managed since
       # v16); typegen generates them so tsc sees the same types as a build.
       - name: Generate Next.js types
-        run: npx next typegen
+        run: npx --no -- next typegen
 
       - name: Typecheck
-        run: npx tsc --noEmit
+        run: npx --no -- tsc --noEmit
 
       # Errors fail outright, and so does ANY warning: the codebase is
       # warning-clean and must stay that way — fix new findings, never
@@ -176,7 +176,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: npm
@@ -187,7 +187,7 @@ jobs:
       # tsconfig.json covers sources, tests and scripts; the build emits via
       # tsconfig.build.json.
       - name: Typecheck
-        run: npx tsc --noEmit
+        run: npx --no -- tsc --noEmit
 
       # Same rule as the web job: any warning fails — fix new findings, never
       # raise the cap.
@@ -222,7 +222,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
 
@@ -245,7 +245,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
 
@@ -276,7 +276,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: npm

.github/workflows/codeql.yml

@@ -17,7 +17,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
-      - 'zizmor.yml'
+      - '.github/zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -48,7 +48,7 @@ on:
       - 'infra/**'
       - '.claude/**'
       - '.gitmodules'
-      - 'zizmor.yml'
+      - '.github/zizmor.yml'
       - '**/*.md'
       - 'LICENSE'
       - '.github/ISSUE_TEMPLATE/**'
@@ -112,7 +112,7 @@ jobs:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -123,6 +123,6 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release
 
       - name: Analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: /language:${{ matrix.language }}

.github/workflows/combine-rules.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
 
@@ -66,7 +66,7 @@ jobs:
       # `git push` needs.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
 

.github/workflows/deploy-backend.yml

@@ -99,7 +99,7 @@ jobs:
         run: tar -czf "$RUNNER_TEMP/backend-publish.tgz" -C publish .
 
       - name: Upload publish output
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: backend-publish
           path: ${{ runner.temp }}/backend-publish.tgz
@@ -128,7 +128,7 @@ jobs:
         run: ./.github/scripts/Get-Endpoints.ps1 -ExportToGitHubEnv
 
       - name: Download publish output
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: backend-publish
           path: ${{ runner.temp }}/backend-artifact

.github/workflows/deploy-web.yml

@@ -1,14 +1,14 @@
 name: Deploy Web (Static Web App)
 
-# Build here, upload with the pinned SWA CLI. No third-party action sees the deploy token
-# (the CLI is Microsoft-published npm code at an exact version), the build runs on the same
-# path ci.yml tests (setup-node 22 + npm ci + next build) instead of Oryx guessing inside the
-# action's container, and the exported site is attested like the agent ZIP and the MSI.
+# Build here, upload with the SWA CLI from its own lockfile (tools/swa-cli). No
+# third-party action sees the deploy token, the build runs on the same path ci.yml tests
+# (setup-node 22 + npm ci + next build) instead of Oryx guessing inside the action's container,
+# and the exported site is attested like the agent ZIP and the MSI.
 #
-# Three jobs, each holding only what it needs: build runs all third-party code without any
-# credential, deploy holds the SWA token alone, record attests, verifies and writes the
-# manifest. A failed record job is re-run on its own; it writes only once the live site
-# serves this commit.
+# Three jobs, each holding only what it needs: build runs the third-party build code without
+# any credential, deploy holds the SWA token alone and runs nothing but the locked CLI, record
+# attests, verifies and writes the manifest. A failed record job is re-run on its own; it
+# writes only once the live site serves this commit.
 #
 # PR preview environments were dropped with the action: their per-PR URLs are never
 # registered as redirect URIs, so nobody could log in on them anyway.
@@ -19,6 +19,7 @@ on:
       - main
     paths:
       - 'src/Web/autopilot-monitor-web/**'
+      - 'tools/swa-cli/**'
       - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
 
@@ -32,9 +33,6 @@ permissions:
 # repository variable.
 env:
   WEB_DIR: src/Web/autopilot-monitor-web
-  # Exact version: `npx --package` resolves from the registry at run time, so the pin is the
-  # only thing that keeps the deploy step's code fixed. Bump deliberately.
-  SWA_CLI_VERSION: 2.0.10
 
 jobs:
   # Build zone: no login, no id-token. The one secret here is the Application Insights
@@ -74,7 +72,7 @@ jobs:
         id: docs
         run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: npm
@@ -149,14 +147,15 @@ jobs:
           sha256sum "$archive"
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: portal-${{ github.sha }}
           path: ${{ steps.package.outputs.archive }}
           if-no-files-found: error
 
-  # Holds the SWA deployment token and nothing else -- deliberately no id-token: the SWA CLI
-  # is third-party npm code whose dependencies resolve at run time.
+  # Holds the SWA deployment token and nothing else -- deliberately no id-token. The token alone
+  # can replace the portal, so the SWA CLI, the one third-party code here, comes from a committed
+  # lockfile: a version published after the last reviewed bump never runs next to it.
   deploy:
     name: Deploy to Static Web App
     needs: build
@@ -164,13 +163,21 @@ jobs:
     environment: production
 
     steps:
-      # For staticwebapp.config.json only.
+      # For staticwebapp.config.json and the CLI's lockfile.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
+      # npm ci, never npx or npm install: the lockfile pins every transitive package by hash.
+      # No lifecycle scripts: keytar, the only package with one, serves the keychain, which
+      # --no-use-keychain keeps unloaded. Before the artifact arrives, so nothing from the
+      # build zone can touch the install.
+      - name: Install the SWA CLI from its lockfile
+        working-directory: tools/swa-cli
+        run: npm ci --ignore-scripts
+
       - name: Download build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: portal-${{ github.sha }}
           path: ${{ runner.temp }}/portal
@@ -186,7 +193,7 @@ jobs:
         env:
           SWA_CLI_DEPLOYMENT_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
         run: |
-          npx --yes --package "@azure/static-web-apps-cli@${SWA_CLI_VERSION}" swa deploy \
+          tools/swa-cli/node_modules/.bin/swa deploy \
             --app-location "$WEB_DIR" \
             --output-location out \
             --swa-config-location "$WEB_DIR" \
@@ -215,7 +222,7 @@ jobs:
         run: ./.github/scripts/Get-Endpoints.ps1 -ExportToGitHubEnv
 
       - name: Download build artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: portal-${{ github.sha }}
           path: ${{ runner.temp }}/portal

.github/workflows/publish-scripts.yml

@@ -150,7 +150,7 @@ jobs:
       # when someone wants to look at the file.
       - name: Upload signed scripts
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: signed-scripts
           path: ${{ runner.temp }}/signed-scripts

.gitmodules

@@ -1,9 +1,15 @@
+# The three submodules are private. "update = none" makes recursive clones skip them (the
+# public, Dependabot's NuGet updater); a clone with access sets
+# submodule.<name>.update = checkout once, or runs git submodule update --init --checkout.
 [submodule ".claude/commands"]
 	path = .claude/commands
 	url = https://github.com/okieselbach/Autopilot-Monitor-dotclaude.git
+	update = none
 [submodule "docs"]
 	path = internal
 	url = https://github.com/okieselbach/Autopilot-Monitor-internal.git
+	update = none
 [submodule "infra"]
 	path = infra
 	url = https://github.com/okieselbach/Autopilot-Monitor-infra.git
+	update = none

rules/schema/analyze-rule.schema.json

@@ -89,12 +89,14 @@
           "type": "array",
           "description": "Conditions evaluated against the event stream. All required conditions must match for the rule to fire.",
           "items": { "$ref": "#/$defs/ruleCondition" },
-          "minItems": 1
+          "minItems": 1,
+          "maxItems": 20
         },
         "preconditions": {
           "type": "array",
           "description": "Optional device-fact gates evaluated BEFORE conditions. ALL preconditions must pass; if any fails the rule is silently skipped — no result, no UI card. Useful for filtering out hardware/OS profiles where the rule does not apply (e.g. virtual machines).",
           "items": { "$ref": "#/$defs/rulePrecondition" },
+          "maxItems": 10,
           "default": []
         },
         "baseConfidence": {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/AutopilotMonitor.Agent.V2.Core.Tests.csproj

@@ -18,9 +18,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerOverwriteRewindTests.Rollover.cs

@@ -0,0 +1,277 @@
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// IME rolls a log with File.Move at 3 MB. The tracker used to take the archive for a new file and
+    /// read it from 0: every app line played again, finished apps fell back to Installing and the
+    /// subgraph line of an older app marked the running app as skipped (session 190fed00).
+    /// </summary>
+    public sealed partial class ImeLogTrackerOverwriteRewindTests
+    {
+        private const string FirstStamp = "20260910-193000";
+        private const string SecondStamp = "20260910-193500";
+
+        private static string Folder(Harness h) => Path.GetDirectoryName(h.LogPath)!;
+
+        private static string ArchivePath(Harness h, string stamp = FirstStamp)
+            => Path.Combine(Folder(h), $"{Path.GetFileNameWithoutExtension(h.LogName)}-{stamp}.log");
+
+        private static string Roll(Harness h, string stamp = FirstStamp)
+        {
+            var archive = ArchivePath(h, stamp);
+            File.Move(h.LogPath, archive);
+            return archive;
+        }
+
+        private static List<ImeLogPattern> AppPatterns() => new List<ImeLogPattern>
+        {
+            new ImeLogPattern
+            {
+                PatternId = "T-POLICIES", Category = "always", Enabled = true,
+                Pattern = @"^policies discovered = (?<policies>\[.*\])", Action = "policiesDiscovered",
+                Parameters = new Dictionary<string, string>(),
+            },
+            new ImeLogPattern
+            {
+                PatternId = "T-SUBGRAPH", Category = "always", Enabled = true,
+                Pattern = @"^subgraph (?<id>[\w-]+)", Action = "cancelStuckAndSetCurrent",
+                Parameters = new Dictionary<string, string>(),
+            },
+            new ImeLogPattern
+            {
+                PatternId = "T-INSTALLING", Category = "always", Enabled = true,
+                Pattern = @"^installing (?<id>[\w-]+)", Action = "updateStateInstalling",
+                Parameters = new Dictionary<string, string>(),
+            },
+            new ImeLogPattern
+            {
+                PatternId = "T-INSTALLED", Category = "always", Enabled = true,
+                Pattern = @"^installed (?<id>[\w-]+)", Action = "updateStateInstalled",
+                Parameters = new Dictionary<string, string>(),
+            },
+        };
+
+        private const string AppPoliciesLine = @"policies discovered = [{""Id"":""app-1"",""Name"":""App One""},{""Id"":""app-2"",""Name"":""App Two""}]";
+
+        private static string OneFinishedOneRunning() =>
+            Entry(AppPoliciesLine) + Entry("subgraph app-1") + Entry("installing app-1") + Entry("installed app-1")
+            + Entry("subgraph app-2") + Entry("installing app-2");
+
+        [Theory]
+        [InlineData("AppWorkload.log")]
+        [InlineData("AppActionProcessor.log")]
+        [InlineData("HealthScripts.log")]
+        [InlineData("AgentExecutor.log")]
+        [InlineData("IntuneManagementExtension.log")]
+        public async Task Rolled_over_log_is_not_read_again(string logName)
+        {
+            using var h = new Harness(logName, MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3"));
+            await h.Pass();
+
+            Roll(h);
+            h.Append(Entry("marker 4"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 4 }, h.Matched());
+
+            h.Tracker.RequestOverwriteCheckForTest();
+            h.Now = h.Now.AddSeconds(2);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 4 }, h.Matched());
+            Assert.Equal(0, h.Health.OverwriteRewinds);
+        }
+
+        [Fact]
+        public async Task Bytes_written_after_the_last_read_come_from_the_archive_once_and_first()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+
+            h.Append(Entry("marker 3"));
+            Roll(h);
+            h.Append(Entry("marker 4"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 4 }, h.Matched());
+        }
+
+        [Fact]
+        public async Task Line_held_back_at_the_end_of_the_file_is_finished_from_the_archive()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            var second = Entry("marker 2");
+            h.Append(Entry("marker 1") + second.Substring(0, 10));
+            await h.Pass();
+            Assert.Equal(new[] { 1 }, h.Matched());
+
+            h.Append(second.Substring(10));
+            Roll(h);
+            h.Append(Entry("marker 3"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3 }, h.Matched());
+        }
+
+        [Fact]
+        public async Task Rollover_leaves_finished_and_running_apps_alone()
+        {
+            using var h = new Harness("AppWorkload.log", AppPatterns());
+            var transitions = new List<string>();
+            h.Tracker.OnAppStateChanged = (pkg, from, to) => transitions.Add($"{pkg.Id}:{from}->{to}");
+            h.Append(OneFinishedOneRunning());
+            await h.Pass();
+            var before = transitions.ToList();
+
+            Roll(h);
+            h.Append(Entry("marker unrelated"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Equal(before, transitions);
+            var states = h.Tracker.GetAllKnownPackageStates().ToDictionary(p => p.Id, p => p.InstallationState);
+            Assert.Equal(AppInstallationState.Installed, states["app-1"]);
+            Assert.Equal(AppInstallationState.Installing, states["app-2"]);
+        }
+
+        [Fact]
+        public async Task Without_a_readable_identity_the_archive_is_read_again_as_before()
+        {
+            // The fallback, and the proof that the tests above catch the replay: this is what they saw before the fix.
+            using var h = new Harness("AppWorkload.log", AppPatterns());
+            h.Tracker.FileIdentityProvider = _ => null!;
+            var transitions = new List<string>();
+            h.Tracker.OnAppStateChanged = (pkg, from, to) => transitions.Add($"{pkg.Id}:{from}->{to}");
+            h.Append(OneFinishedOneRunning());
+            await h.Pass();
+
+            Roll(h);
+            h.Append(Entry("marker unrelated"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            Assert.Contains("app-2:Installing->Skipped", transitions);
+            Assert.Contains("app-1:Installed->Installing", transitions);
+        }
+
+        [Fact]
+        public async Task Live_file_that_sorts_before_its_archive_hands_over_its_bookmark()
+        {
+            // LogMaxHistory <= 1: the archive is _X.log, which sorts behind X.log. The pass reaches the
+            // shrunken live file first, and the next rollover replaces the archive under the same name.
+            using var h = new Harness("IntuneManagementExtension.log", MarkerPatterns());
+            var archive = Path.Combine(Folder(h), "_IntuneManagementExtension.log");
+            h.Append(Entry("marker 1") + Entry("marker 2") + Entry("marker 3") + Entry("marker 4"));
+            await h.Pass();
+
+            File.Move(h.LogPath, archive);
+            h.Append(Entry("marker 5"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 4, 5 }, h.Matched());
+
+            h.Append(Entry("marker 6"));
+            File.Delete(archive);
+            File.Move(h.LogPath, archive);
+            h.Append(Entry("marker 8"));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+            Assert.Equal(new[] { 1, 2, 3, 4, 5, 6, 8 }, h.Matched());
+        }
+
+        [Fact]
+        public async Task Rollover_during_a_restart_with_a_longer_new_file_loses_and_repeats_nothing()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+
+            h.Restart();
+            h.Append(Entry("marker 3"));
+            Roll(h);
+            h.Append(Entry("marker 4") + Entry("marker 5") + Entry("marker 6") + Entry("marker 7"));
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 4, 5, 6, 7 }, h.Matched());
+        }
+
+        [Fact]
+        public async Task Two_rollovers_during_a_restart_with_the_bookmarked_file_deleted_lose_nothing()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1") + Entry("marker 2"));
+            await h.Pass();
+
+            h.Restart();
+            var first = Roll(h, FirstStamp);
+            h.Append(Entry("marker 3"));
+            Roll(h, SecondStamp);
+            h.Append(Entry("marker 4") + Entry("marker 5") + Entry("marker 6"));
+            File.Delete(first);
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 4, 5, 6 }, h.Matched());
+        }
+
+        [Fact]
+        public async Task Archives_found_at_the_first_start_are_read_from_the_beginning_in_order()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            File.WriteAllText(ArchivePath(h, FirstStamp), Entry("marker 1") + Entry("marker 2"));
+            File.WriteAllText(ArchivePath(h, SecondStamp), Entry("marker 3"));
+            h.Append(Entry("marker 4"));
+
+            await h.Pass();
+
+            Assert.Equal(new[] { 1, 2, 3, 4 }, h.Matched());
+        }
+
+        [Fact]
+        public async Task Platform_script_in_flight_keeps_its_end_block_across_a_rollover()
+        {
+            // Reading the archive again used to restore the marker of the run in flight by accident.
+            using var h = new Harness("AgentExecutor.log", ScriptPatterns());
+            h.Append(Entry("ExecutorLog AgentExecutor gets invoked") + Entry(PlatformStartLine) + Entry("[Executor] created powershell with process id 12708"));
+            await h.Pass();
+
+            Roll(h);
+            h.Append(Entry("Powershell exit code is 0") + Entry("write output done. output = Hello from E, error = ") + Entry("Agent executor completed."));
+            h.Now = h.Now.AddMilliseconds(100);
+            await h.Pass();
+
+            h.Tracker.ProcessLogMessageForTest(ResultLine);
+            var script = Assert.Single(h.Completed);
+            Assert.Equal(PlatformId, script.PolicyId);
+            Assert.Equal(0, script.ExitCode);
+            Assert.Equal("Hello from E", script.Stdout);
+        }
+
+        [Fact]
+        public void Identity_of_a_real_file_survives_a_rename_and_differs_from_the_next_file()
+        {
+            using var h = new Harness("AppWorkload.log", MarkerPatterns());
+            h.Append(Entry("marker 1"));
+            var before = ImeLogFileIdentity.TryRead(h.LogPath);
+            Assert.NotNull(before);
+
+            var archive = Roll(h);
+            h.Append(Entry("marker 2"));
+
+            Assert.Equal(before, ImeLogFileIdentity.TryRead(archive));
+            Assert.NotEqual(before, ImeLogFileIdentity.TryRead(h.LogPath));
+            Assert.Null(ImeLogFileIdentity.TryRead(archive + ".missing"));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/LogFilePositionTrackerTests.cs

@@ -0,0 +1,187 @@
+using System;
+using System.Collections.Generic;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// A bookmark belongs to a file, not to a name: IME rolls a log by renaming it, so the identity
+    /// (volume plus file index) tells what happened to the bytes behind the bookmark.
+    /// </summary>
+    public sealed class LogFilePositionTrackerTests
+    {
+        private const string Live = @"C:\Logs\AppWorkload.log";
+        private const string Archive = @"C:\Logs\AppWorkload-20260910-193000.log";
+        private const string Underscore = @"C:\Logs\_AppWorkload.log";
+
+        private static readonly DateTime Checked = new DateTime(2026, 9, 10, 19, 30, 0, DateTimeKind.Utc);
+
+        private static Dictionary<string, string> Ids(params (string Path, string Id)[] entries)
+        {
+            var ids = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            foreach (var entry in entries) ids[entry.Path] = entry.Id;
+            return ids;
+        }
+
+        private static LogFilePositionTracker TrackerWithBookmark(string path, string id, long position)
+        {
+            var tracker = new LogFilePositionTracker();
+            tracker.Reconcile(Ids((path, id)));
+            tracker.MarkChecked(path, Checked);
+            tracker.SetPosition(path, position);
+            return tracker;
+        }
+
+        [Fact]
+        public void Renamed_file_keeps_its_bookmark_and_the_old_path_starts_over()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            var moves = tracker.Reconcile(Ids((Archive, "A"), (Live, "B")));
+
+            var move = Assert.Single(moves);
+            Assert.Equal(Live, move.From);
+            Assert.Equal(Archive, move.To);
+            Assert.Equal(3000, move.Position);
+            Assert.Equal(3000, tracker.GetPosition(Archive));
+            Assert.Equal("A", tracker.GetFileId(Archive));
+            Assert.Equal(0, tracker.GetPosition(Live));
+            Assert.Equal("B", tracker.GetFileId(Live));
+        }
+
+        [Fact]
+        public void Both_paths_keep_the_freshness_reference()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            tracker.Reconcile(Ids((Archive, "A"), (Live, "B")));
+
+            Assert.True(tracker.HasSeen(Archive));
+            Assert.Equal(Checked, tracker.GetLastCheckedUtc(Archive));
+            Assert.True(tracker.HasSeen(Live));
+            Assert.Equal(Checked, tracker.GetLastCheckedUtc(Live));
+        }
+
+        [Fact]
+        public void Renamed_file_whose_old_path_is_not_recreated_yet_keeps_its_bookmark()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            var moves = tracker.Reconcile(Ids((Archive, "A")));
+
+            Assert.Single(moves);
+            Assert.Equal(3000, tracker.GetPosition(Archive));
+            Assert.Equal(0, tracker.GetPosition(Live));
+            Assert.False(tracker.HasIdentity(Live));
+        }
+
+        [Fact]
+        public void Second_name_for_the_same_file_moves_nothing()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            var moves = tracker.Reconcile(Ids((Live, "A"), (Archive, "A")));
+
+            Assert.Empty(moves);
+            Assert.Equal(3000, tracker.GetPosition(Live));
+            Assert.False(tracker.HasSeen(Archive));
+        }
+
+        [Fact]
+        public void Unknown_file_stays_unseen_so_its_first_pass_is_not_taken_for_fresh_lines()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            var moves = tracker.Reconcile(Ids((Live, "A"), (Archive, "X")));
+
+            Assert.Empty(moves);
+            Assert.True(tracker.HasIdentity(Archive));
+            Assert.False(tracker.HasSeen(Archive));
+            Assert.Equal(0, tracker.GetPosition(Archive));
+        }
+
+        [Fact]
+        public void Path_holding_another_file_with_no_one_to_take_over_starts_at_zero()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            var moves = tracker.Reconcile(Ids((Live, "B")));
+
+            Assert.Empty(moves);
+            // GetSafePosition alone would keep 3000 here when the new file is longer: lost lines.
+            Assert.Equal(0, tracker.GetSafePosition(Live, 5000));
+            Assert.Equal("B", tracker.GetFileId(Live));
+        }
+
+        [Fact]
+        public void Unreadable_identity_changes_nothing()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            var moves = tracker.Reconcile(Ids((Live, null!), (Archive, null!)));
+
+            Assert.Empty(moves);
+            Assert.Equal(3000, tracker.GetPosition(Live));
+            Assert.Equal("A", tracker.GetFileId(Live));
+            Assert.True(tracker.HasIdentity(Archive));
+            Assert.Null(tracker.GetFileId(Archive));
+        }
+
+        [Fact]
+        public void Single_slot_archive_is_replaced_by_the_next_rollover()
+        {
+            // LogMaxHistory <= 1: IME deletes _X.log and renames X.log to it.
+            var tracker = TrackerWithBookmark(Underscore, "A", 9000);
+            tracker.Reconcile(Ids((Underscore, "A"), (Live, "B")));
+            tracker.SetPosition(Live, 3000);
+
+            var moves = tracker.Reconcile(Ids((Underscore, "B"), (Live, "C")));
+
+            var move = Assert.Single(moves);
+            Assert.Equal(Live, move.From);
+            Assert.Equal(Underscore, move.To);
+            Assert.Equal(3000, tracker.GetPosition(Underscore));
+            Assert.Equal(0, tracker.GetPosition(Live));
+        }
+
+        [Fact]
+        public void A_renamed_file_can_leave_the_path_it_moved_into()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+            tracker.Reconcile(Ids((Live, "A"), (Underscore, "B")));
+            tracker.SetPosition(Underscore, 700);
+
+            var moves = tracker.Reconcile(Ids((Underscore, "A"), (Archive, "B"), (Live, "C")));
+
+            Assert.Equal(2, moves.Count);
+            Assert.Equal(3000, tracker.GetPosition(Underscore));
+            Assert.Equal(700, tracker.GetPosition(Archive));
+            Assert.Equal(0, tracker.GetPosition(Live));
+        }
+
+        [Fact]
+        public void Behind_bookmark_only_when_smaller_than_the_position()
+        {
+            var tracker = TrackerWithBookmark(Live, "A", 3000);
+
+            Assert.True(tracker.IsBehindBookmark(Live, 2999));
+            Assert.False(tracker.IsBehindBookmark(Live, 3000));
+            Assert.False(tracker.IsBehindBookmark(Archive, 0));
+        }
+
+        [Fact]
+        public void Restored_identity_is_used_to_find_a_rollover_during_the_downtime()
+        {
+            var tracker = new LogFilePositionTracker();
+            tracker.RestorePosition(Live, 3000, 3000);
+            tracker.RestoreFileId(Live, "A");
+
+            var moves = tracker.Reconcile(Ids((Archive, "A"), (Live, "B")));
+
+            Assert.Single(moves);
+            Assert.Equal(3000, tracker.GetPosition(Archive));
+            Assert.Equal(0, tracker.GetPosition(Live));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/DefaultComponentFactoryOrderingTests.cs

@@ -27,6 +27,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
     ///     already in flight misses its wake.</item>
     ///   <item>DesktopArrivalHost before AadJoinHost — the AadJoinHost ctor takes the desktop
     ///     host's RequestResetForRealUserSwitch callback, so the target must exist first.</item>
+    ///   <item>UserEspKeepAwakeHost before RealmJoinHost — after an agent restart the RealmJoin
+    ///     watcher posts realmjoin_detected from its own Start; the keep-awake host hands its
+    ///     hold over to RealmJoin (D-413) and must already observe the rail.</item>
     /// </list>
     /// </summary>
     public sealed class DefaultComponentFactoryOrderingTests : IDisposable
@@ -143,6 +146,30 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             }
         }
 
+        [Fact]
+        public void Keep_awake_host_subscribes_before_the_RealmJoin_watcher_starts()
+        {
+            var hosts = CreateSurfaces(new AnalyzerConfiguration
+            {
+                EnableRealmJoinWatcher = true,
+                KeepAwakeDuringUserEsp = true,
+            }).Hosts;
+            try
+            {
+                AssertBefore<UserEspKeepAwakeHost, RealmJoinHost>(
+                    hosts,
+                    "D-413 — a realmjoin_detected posted from the watcher's Start (agent restart with " +
+                    "RealmJoin installed) must reach the keep-awake host, or it waits for a start it missed.");
+            }
+            finally
+            {
+                foreach (var host in hosts)
+                {
+                    try { host.Dispose(); } catch { /* construction-only test — best-effort cleanup */ }
+                }
+            }
+        }
+
         [Theory]
         [InlineData(false, 0)]
         [InlineData(true, 1)]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/ProxySettingsHostTests.cs

@@ -0,0 +1,162 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Transport;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
+{
+    /// <summary>The watchers only listen on the real keys; settings are played in, none is changed.</summary>
+    public sealed class ProxySettingsHostTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly FakeSignalIngressSink _ingress = new FakeSignalIngressSink();
+        private readonly VirtualClock _clock = new VirtualClock(new DateTime(2026, 11, 2, 6, 53, 43, DateTimeKind.Utc));
+        private readonly AgentLogger _logger;
+        private readonly ProxyObserver _observer;
+        private ProxySettings _settings = new ProxySettings(true, null, null, null, null);
+        private string _route = "proxy.example.test:8080";
+
+        public ProxySettingsHostTests()
+        {
+            _logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _observer = new ProxyObserver(() => _settings, () => _route, _logger, _clock, TimeSpan.FromSeconds(30));
+            _observer.CaptureBaseline();
+        }
+
+        private ProxySettingsHost NewHost() => new ProxySettingsHost(_observer, _ingress, _clock, _logger);
+
+        private void SwitchToNoProxy()
+        {
+            _settings = new ProxySettings(false, null, null, null, null);
+            _route = "direct";
+        }
+
+        private List<FakeSignalIngressSink.PostedSignal> ProxyEvents() =>
+            _ingress.Posted
+                .Where(p => p.Kind == DecisionSignalKind.InformationalEvent
+                            && p.Payload != null
+                            && p.Payload.TryGetValue(SignalPayloadKeys.EventType, out var eventType)
+                            && eventType == Constants.EventTypes.ProxyConfiguration)
+                .ToList();
+
+        private string Log()
+        {
+            var text = string.Empty;
+            foreach (var file in Directory.EnumerateFiles(_tmp.Path, "*.log", SearchOption.AllDirectories))
+            {
+                using var stream = new FileStream(file, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
+                using var reader = new StreamReader(stream);
+                text += reader.ReadToEnd();
+            }
+            return text;
+        }
+
+        public void Dispose() => _tmp.Dispose();
+
+        [Fact]
+        public void A_change_goes_on_the_timeline_as_a_warning_with_what_moved()
+        {
+            using var host = NewHost();
+            host.Start();
+            SwitchToNoProxy();
+
+            _observer.CheckForChange();
+
+            var signal = Assert.Single(ProxyEvents());
+            Assert.Equal(nameof(EventSeverity.Warning), signal.Payload![SignalPayloadKeys.Severity]);
+            Assert.Equal("Proxy settings changed: IE settings of this account: auto-detect -> no proxy", signal.Payload[SignalPayloadKeys.Message]);
+
+            var data = Assert.IsAssignableFrom<IReadOnlyDictionary<string, object>>(signal.TypedPayload);
+            Assert.Equal("changed", data["trigger"]);
+            Assert.Equal("IE settings of this account: auto-detect -> no proxy", data["change"]);
+            Assert.Equal("direct", data["route"]);
+            Assert.Equal("Direct", data["proxyType"]);
+        }
+
+        [Fact]
+        public void A_change_between_the_baseline_and_the_start_is_noticed_at_the_start()
+        {
+            SwitchToNoProxy();
+
+            using var host = NewHost();
+            host.Start();
+
+            Assert.Single(ProxyEvents());
+        }
+
+        [Fact]
+        public void No_change_means_no_event()
+        {
+            using var host = NewHost();
+            host.Start();
+
+            _observer.CheckForChange();
+
+            Assert.Empty(ProxyEvents());
+        }
+
+        [Fact]
+        public void A_stopped_ingress_does_not_reach_the_upload_path()
+        {
+            using var host = NewHost();
+            host.Start();
+            _ingress.ThrowOnPost = new InvalidOperationException("SignalIngress has been stopped.");
+            SwitchToNoProxy();
+
+            _observer.OnSendFailed(TimeSpan.Zero);
+
+            Assert.Contains("uploads are failing", Log());
+        }
+
+        [Fact]
+        public void Stopping_while_uploads_fail_says_so_once()
+        {
+            var host = NewHost();
+            host.Start();
+            _observer.OnSendFailed(TimeSpan.Zero);
+
+            host.Stop();
+            host.Stop();
+            host.Dispose();
+
+            var log = Log();
+            var first = log.IndexOf("stopping with uploads still failing", StringComparison.Ordinal);
+            Assert.True(first >= 0);
+            Assert.Equal(-1, log.IndexOf("stopping with uploads still failing", first + 1, StringComparison.Ordinal));
+        }
+
+        [Fact]
+        public void A_change_after_the_stop_no_longer_posts()
+        {
+            var host = NewHost();
+            host.Start();
+            host.Stop();
+            SwitchToNoProxy();
+
+            _observer.CheckForChange();
+
+            Assert.Empty(ProxyEvents());
+            host.Dispose();
+        }
+
+        [Fact]
+        public void A_host_that_never_started_stays_silent_on_stop()
+        {
+            var host = NewHost();
+            _observer.OnSendFailed(TimeSpan.Zero);
+
+            host.Dispose();
+
+            Assert.DoesNotContain("stopping with uploads still failing", Log());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/UserEspKeepAwakeHostTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.Agent.V2.Core.Persistence;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
+using SharedEventTypes = AutopilotMonitor.Shared.Constants.EventTypes;
 using Xunit;
 
 // ManualResetEventSlim.Wait inside the controller is driven deterministically here; SpinUntil is
@@ -52,10 +53,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
 
         private AgentLogger NewLogger() => new AgentLogger(_tmp.Path);
 
-        private SignalIngress BuildIngress(VirtualClock clock) =>
+        private SignalIngress BuildIngress(VirtualClock clock, string signalLogName = "signal-log.jsonl") =>
             new SignalIngress(
                 engine: new DecisionEngine(),
-                signalLog: new SignalLogWriter(_tmp.File("signal-log.jsonl")),
+                signalLog: new SignalLogWriter(_tmp.File(signalLogName)),
                 traceCounter: new SessionTraceOrdinalProvider(),
                 processor: new FakeDecisionStepProcessor(),
                 clock: clock);
@@ -300,6 +301,365 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             ing.Stop();
         }
 
+        // -------- RealmJoin hand-over (D-413) --------
+
+        /// <summary>Records keep_awake_released payloads from the rail (posted on ThreadPool threads).</summary>
+        private sealed class ReleaseRecorder
+        {
+            private readonly object _lock = new object();
+            private readonly List<Dictionary<string, string>> _released = new List<Dictionary<string, string>>();
+
+            public ReleaseRecorder(SignalIngress ing) => ing.SignalPosted += OnPosted;
+
+            private void OnPosted(DecisionSignalKind kind, IReadOnlyDictionary<string, string>? payload)
+            {
+                if (kind != DecisionSignalKind.InformationalEvent || payload == null) return;
+                if (!payload.TryGetValue(SignalPayloadKeys.EventType, out var eventType)
+                    || eventType != SharedEventTypes.KeepAwakeReleased) return;
+                var copy = new Dictionary<string, string>(StringComparer.Ordinal);
+                foreach (var kv in payload) copy[kv.Key] = kv.Value;
+                lock (_lock) { _released.Add(copy); }
+            }
+
+            public List<Dictionary<string, string>> Snapshot()
+            {
+                lock (_lock) { return new List<Dictionary<string, string>>(_released); }
+            }
+        }
+
+        private static void PostRealmJoin(SignalIngress ing, DecisionSignalKind kind, int? phase)
+        {
+            var payload = new Dictionary<string, string>();
+            if (phase.HasValue) payload[DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = phase.Value.ToString();
+            ing.Post(kind, At, "RealmJoinWatcher", Raw("rj"), payload: payload);
+        }
+
+        private UserEspKeepAwakeHost NewHost(
+            SignalIngress ing,
+            VirtualClock clock,
+            KeepAwakeController controller,
+            Func<bool>? progress = null,
+            TimeSpan? safetyCap = null,
+            TimeSpan? realmJoinWait = null,
+            StartupEventGate? gate = null) =>
+            new UserEspKeepAwakeHost(ing, clock, NewLogger(),
+                controller: controller,
+                safetyCapOverride: safetyCap,
+                espTimeoutProvider: () => null,
+                accountSetupProgressProbe: progress ?? (() => true),
+                realmJoinStartWaitOverride: realmJoinWait,
+                startupGate: gate);
+
+        [Fact]
+        public void Page_exit_with_RealmJoin_still_Blank_holds_until_RealmJoin_starts()
+        {
+            // The common RealmJoin shape: detected during the ESP, deployment starts after the
+            // user-ESP page closed. The gap in between is what the hold now covers.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var recorder = new ReleaseRecorder(ing);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = NewHost(ing, clock, controller, realmJoinWait: TimeSpan.FromMinutes(5));
+
+            ing.Start();
+            host.Start();
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinDetected, 0);
+
+            PostEspExiting(ing);
+            Assert.True(WaitFor(() => host.AwaitingRealmJoinForTest), "the page exit must start the RealmJoin wait");
+            PostEspExiting(ing); // a repeated exit changes nothing
+            Assert.False(WaitFor(() => api.AllowCount > 0, 500), "the hold must outlive the page exit while RealmJoin is Blank");
+            Assert.True(controller.IsEngaged);
+
+            clock.Advance(TimeSpan.FromSeconds(90));
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinPhaseChanged, 101);
+
+            Assert.True(WaitFor(() => api.AllowCount == 1), "RealmJoin leaving Blank must release the hold");
+            Assert.True(WaitFor(() => recorder.Snapshot().Count == 1));
+            var released = recorder.Snapshot()[0];
+            Assert.Equal(UserEspKeepAwakeHost.ReasonRealmJoinStarted, released["reason"]);
+            Assert.Equal("90", released["waitedSeconds"]);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void RealmJoin_wait_bound_releases_when_RealmJoin_never_starts()
+        {
+            // RealmJoin may never leave Blank in the session — the wait is bounded.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var recorder = new ReleaseRecorder(ing);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = NewHost(ing, clock, controller, realmJoinWait: TimeSpan.FromMilliseconds(150));
+
+            ing.Start();
+            host.Start();
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinDetected, 0);
+            PostEspExiting(ing);
+
+            Assert.True(WaitFor(() => api.AllowCount == 1), "the RealmJoin wait must end the hold");
+            Assert.True(WaitFor(() => recorder.Snapshot().Count == 1));
+            var released = recorder.Snapshot()[0];
+            Assert.Equal(UserEspKeepAwakeHost.ReasonRealmJoinNotStarted, released["reason"]);
+            Assert.True(released.ContainsKey("waitMinutes"));
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void Page_exit_replaces_the_ESP_safety_cap_with_the_RealmJoin_wait()
+        {
+            // One timer, one bound per phase of the hold: once the page closed, the ESP-sized cap
+            // must not end the RealmJoin wait.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var recorder = new ReleaseRecorder(ing);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = NewHost(ing, clock, controller,
+                safetyCap: TimeSpan.FromSeconds(1), realmJoinWait: TimeSpan.FromMinutes(5));
+
+            ing.Start();
+            host.Start();
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinDetected, 0);
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+            PostEspExiting(ing);
+            Assert.True(WaitFor(() => host.AwaitingRealmJoinForTest));
+
+            Assert.False(WaitFor(() => api.AllowCount > 0, 1500), "the superseded ESP cap must not fire");
+
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinPhaseChanged, 101);
+            Assert.True(WaitFor(() => api.AllowCount == 1));
+            Assert.True(WaitFor(() => recorder.Snapshot().Count == 1));
+            Assert.Equal(UserEspKeepAwakeHost.ReasonRealmJoinStarted, recorder.Snapshot()[0]["reason"]);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void Page_exit_without_RealmJoin_releases_as_before()
+        {
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var recorder = new ReleaseRecorder(ing);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = NewHost(ing, clock, controller, realmJoinWait: TimeSpan.FromMinutes(5));
+
+            ing.Start();
+            host.Start();
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+            PostEspExiting(ing);
+
+            Assert.True(WaitFor(() => api.AllowCount == 1));
+            Assert.True(WaitFor(() => recorder.Snapshot().Count == 1));
+            Assert.Equal(UserEspKeepAwakeHost.ReasonUserEspExited, recorder.Snapshot()[0]["reason"]);
+            Assert.False(host.AwaitingRealmJoinForTest);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Theory]
+        [InlineData(DecisionSignalKind.RealmJoinPhaseChanged, 100)]
+        [InlineData(DecisionSignalKind.RealmJoinPhaseChanged, 210)]
+        [InlineData(DecisionSignalKind.RealmJoinResolved, null)]
+        public void RealmJoin_leaving_Blank_before_the_page_exit_releases_the_hold(DecisionSignalKind kind, int? phase)
+        {
+            // RealmJoin can start shortly before the page closes; it keeps the device awake from
+            // there. Resolved carries no phase and still means "left Blank".
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var recorder = new ReleaseRecorder(ing);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = NewHost(ing, clock, controller, realmJoinWait: TimeSpan.FromMinutes(5));
+
+            ing.Start();
+            host.Start();
+            PostAccountSetupPhase(ing);
+            Assert.True(WaitFor(() => api.PreventCount == 1));
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinDetected, 0);
+            Assert.False(WaitFor(() => api.AllowCount > 0, 300), "detection alone must not release");
+
+            PostRealmJoin(ing, kind, phase);
+
+            Assert.True(WaitFor(() => api.AllowCount == 1));
+            Assert.True(WaitFor(() => recorder.Snapshot().Count == 1));
+            var released = recorder.Snapshot()[0];
+            Assert.Equal(UserEspKeepAwakeHost.ReasonRealmJoinStarted, released["reason"]);
+            Assert.False(released.ContainsKey("waitedSeconds"));
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        [Fact]
+        public void RealmJoin_already_deploying_before_AccountSetup_prevents_the_engage()
+        {
+            // Agent restart: the watcher reports the running phase from its start, and the
+            // AccountSetup phase is posted again afterwards — there is nothing to hand over.
+            var clock = new VirtualClock(At);
+            using var ing = BuildIngress(clock);
+            var api = new FakeKeepAwakeApi();
+            var controller = new KeepAwakeController(NewLogger(), api);
+            var host = NewHost(ing, clock, controller, realmJoinWait: TimeSpan.FromMinutes(5));
+
+            ing.Start();
+            host.Start();
+            PostRealmJoin(ing, DecisionSignalKind.RealmJoinDetected, 101);
+            PostAccountSetupPhase(ing);
+
+            Assert.False(WaitFor(() => api.PreventCount > 0, 500), "no hold once RealmJoin deploys");
+            Assert.False(controller.IsEngaged);
+
+            host.Dispose();
+            ing.Stop();
+        }
+
+        // -------- Page-closed latch across agent restarts (D-414) --------
+
+        /// <summary>
+        /// One agent run: its own ingress and host on the shared state folder. A later run is a new
+        /// <see cref="StartupEventGate"/> loading the same folder, exactly what a restart does.
+        /// </summary>
+        private sealed class AgentRun : IDisposable
+        {
+            public SignalIngress Ingress { get; }
+            public FakeKeepAwakeApi Api { get; } = new FakeKeepAwakeApi();
+            public KeepAwakeController Controller { get; }
+            public StartupEventGate Gate { get; }
+            public UserEspKeepAwakeHost Host { get; }
+
+            public AgentRun(UserEspKeepAwakeHostTests t, string stateDir, string runName, Func<bool> progress)
+            {
+                var clock = new VirtualClock(At);
+                Ingress = t.BuildIngress(clock, $"signal-log-{runName}.jsonl");
+                Controller = new KeepAwakeController(t.NewLogger(), Api);
+                Gate = new StartupEventGate(stateDir, t.NewLogger());
+                Host = t.NewHost(Ingress, clock, Controller, progress: progress,
+                    realmJoinWait: TimeSpan.FromMinutes(5), gate: Gate);
+                Ingress.Start();
+                Host.Start();
+            }
+
+            public void Dispose()
+            {
+                Host.Dispose();
+                Ingress.Stop();
+                Ingress.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Closed_page_keeps_a_later_agent_run_from_engaging()
+        {
+            // After an agent restart the AccountSetup phase reaches the rail again (IME logs it at
+            // the next sign-in, the adapter's dedup lives per process). The page is gone, so no hold.
+            using var stateDir = new TempDirectory();
+            using (var first = new AgentRun(this, stateDir.Path, "1", () => true))
+            {
+                PostAccountSetupPhase(first.Ingress);
+                Assert.True(WaitFor(() => first.Api.PreventCount == 1));
+                PostEspExiting(first.Ingress);
+                Assert.True(WaitFor(() => first.Api.AllowCount == 1));
+                Assert.True(WaitFor(() => first.Gate.AlreadySucceeded(UserEspKeepAwakeHost.UserEspPageClosedKey)));
+            }
+
+            using var second = new AgentRun(this, stateDir.Path, "2", () => true);
+            PostAccountSetupPhase(second.Ingress);
+
+            Assert.False(WaitFor(() => second.Api.PreventCount > 0, 500), "the page already closed in this enrollment");
+            Assert.False(second.Controller.IsEngaged);
+        }
+
+        [Fact]
+        public void Restart_before_the_page_closed_engages_again()
+        {
+            // A reboot in the middle of the user ESP: the page is still to come, so the next run holds.
+            using var stateDir = new TempDirectory();
+            using (var first = new AgentRun(this, stateDir.Path, "1", () => true))
+            {
+                PostAccountSetupPhase(first.Ingress);
+                Assert.True(WaitFor(() => first.Api.PreventCount == 1));
+            }
+
+            using var second = new AgentRun(this, stateDir.Path, "2", () => true);
+            PostAccountSetupPhase(second.Ingress);
+
+            Assert.True(WaitFor(() => second.Api.PreventCount == 1), "the user ESP is still running");
+            Assert.True(second.Controller.IsEngaged);
+        }
+
+        [Fact]
+        public void Handoff_exit_without_AccountSetup_progress_sets_no_latch()
+        {
+            using var stateDir = new TempDirectory();
+            using (var first = new AgentRun(this, stateDir.Path, "1", () => false))
+            {
+                PostAccountSetupPhase(first.Ingress);
+                Assert.True(WaitFor(() => first.Api.PreventCount == 1));
+                PostEspExiting(first.Ingress); // the Device→Account handoff
+                Assert.False(WaitFor(() => first.Api.AllowCount > 0, 300));
+                Assert.False(first.Gate.AlreadySucceeded(UserEspKeepAwakeHost.UserEspPageClosedKey));
+            }
+
+            using var second = new AgentRun(this, stateDir.Path, "2", () => true);
+            PostAccountSetupPhase(second.Ingress);
+
+            Assert.True(WaitFor(() => second.Api.PreventCount == 1));
+        }
+
+        [Fact]
+        public void Page_exit_while_waiting_for_RealmJoin_is_latched()
+        {
+            // The hold outlived the page while RealmJoin was Blank, then the agent restarted: after
+            // the reboot RealmJoin needs the next sign-in anyway, so the next run does not hold.
+            using var stateDir = new TempDirectory();
+            using (var first = new AgentRun(this, stateDir.Path, "1", () => true))
+            {
+                PostRealmJoin(first.Ingress, DecisionSignalKind.RealmJoinDetected, 0);
+                PostAccountSetupPhase(first.Ingress);
+                Assert.True(WaitFor(() => first.Api.PreventCount == 1));
+                PostEspExiting(first.Ingress);
+                Assert.True(WaitFor(() => first.Host.AwaitingRealmJoinForTest));
+                Assert.True(WaitFor(() => first.Gate.AlreadySucceeded(UserEspKeepAwakeHost.UserEspPageClosedKey)));
+            }
+
+            using var second = new AgentRun(this, stateDir.Path, "2", () => true);
+            PostRealmJoin(second.Ingress, DecisionSignalKind.RealmJoinDetected, 0);
+            PostAccountSetupPhase(second.Ingress);
+
+            Assert.False(WaitFor(() => second.Api.PreventCount > 0, 500));
+        }
+
+        [Fact]
+        public void Page_exit_seen_while_idle_is_latched_and_blocks_a_later_engage()
+        {
+            // The exit counts in every hold state — here the host never engaged before it.
+            using var stateDir = new TempDirectory();
+            using var run = new AgentRun(this, stateDir.Path, "1", () => true);
+
+            PostEspExiting(run.Ingress);
+            Assert.True(WaitFor(() => run.Gate.AlreadySucceeded(UserEspKeepAwakeHost.UserEspPageClosedKey)),
+                "an exit seen while idle must still be latched");
+
+            PostAccountSetupPhase(run.Ingress);
+            Assert.False(WaitFor(() => run.Api.PreventCount > 0, 500));
+        }
+
         // -------- KeepAwakeController: late-confirm (ready-timeout) edge --------
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Security/EnrollmentRegistryDetectorTests.cs

@@ -7,7 +7,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
 {
     /// <summary>
     /// Regression coverage for the IsHybridJoin detection that runs at session-registration
-    /// time. Field evidence (session c4c8d206-…, Lenovo ThinkPad T14 Gen 5, Win11 23H2
+    /// time. Field evidence (Lenovo ThinkPad T14 Gen 5, Win11 23H2
     /// 22631.4317): the AutopilotPolicyCache key on this device exposes
     /// <c>CloudAssignedDomainJoinMethod</c> only inside the embedded <c>PolicyJsonCache</c>
     /// blob, not as a top-level registry value. Without the JSON fallback the agent registered
@@ -47,11 +47,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Security
         [Fact]
         public void Missing_TopLevel_falls_back_to_PolicyJsonCache_one_returns_true()
         {
-            // Real-world payload from the Bayer Lenovo T14 Gen 5 / Win11 23H2 22631.4317
-            // device that triggered this fix. Truncated for readability — the only relevant
+            // Shape of a real PolicyJsonCache payload (Win11 23H2 22631.4317) with a
+            // placeholder tenant domain. Truncated for readability — the only relevant
             // key is CloudAssignedDomainJoinMethod=1.
             const string policyJson =
-                "{\r\n  \"CloudAssignedTenantDomain\": \"bayergroup.onmicrosoft.com\",\r\n" +
+                "{\r\n  \"CloudAssignedTenantDomain\": \"contoso.onmicrosoft.com\",\r\n" +
                 "  \"CloudAssignedDomainJoinMethod\": 1,\r\n" +
                 "  \"AutopilotMode\": 2\r\n}";
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/RealmJoinWatcherAdapterTests.cs

@@ -600,6 +600,111 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             Assert.DoesNotContain(ingress.Posted, p => p.Kind == DecisionSignalKind.RealmJoinPackageCompleted);
         }
 
+        // ---- Detected carries the current phase (service-key attach) -------------------------
+
+        private sealed class PhaseHarness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public int? Phase;
+            public RealmJoinWatcher Watcher { get; }
+            public RealmJoinWatcherAdapter Adapter { get; }
+
+            public PhaseHarness()
+            {
+                var registry = new FakeRealmJoinRegistry();
+                Watcher = new RealmJoinWatcher(
+                    new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                    enumeratePackageIds: registry.Enumerate,
+                    tryReadPackage: registry.TryRead,
+                    keyExists: registry.KeyExists,
+                    readVersionInfo: () => RealmJoinVersionInfo.Empty,
+                    readUninstallDisplayVersion: () => null,
+                    readDeploymentPhase: () => Phase);
+                Adapter = new RealmJoinWatcherAdapter(Watcher, Ingress, new VirtualClock(Fixed));
+            }
+
+            public string DetectedPhase() =>
+                Ingress.Posted.Single(p => p.Kind == DecisionSignalKind.RealmJoinDetected)
+                    .Payload![DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase];
+
+            public void Dispose()
+            {
+                Adapter.Dispose();
+                Watcher.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        [Theory]
+        [InlineData(101)]
+        [InlineData(200)]
+        public void Detected_carries_the_phase_RealmJoin_is_in_when_the_service_key_attaches(int phase)
+        {
+            // Agent restarted while RJ deploys. Detected used to say Blank, which reset the
+            // engine's persisted LastDeploymentPhase and hid from the keep-awake host that RJ had
+            // started — no PhaseChanged follows while the phase stays put.
+            using var h = new PhaseHarness { Phase = phase };
+
+            h.Watcher.TriggerServiceStageAttachedFromTest();
+
+            Assert.Equal(phase.ToString(), h.DetectedPhase());
+            Assert.True(h.Watcher.PackageWatchersArmedForTest);
+            Assert.DoesNotContain(h.Ingress.Posted, p => p.Kind == DecisionSignalKind.RealmJoinPhaseChanged);
+        }
+
+        [Fact]
+        public void Detected_with_a_completed_phase_resolves_in_the_same_pass()
+        {
+            using var h = new PhaseHarness { Phase = RealmJoinInfo.PhaseCompletedFirstDeployment };
+
+            h.Watcher.TriggerServiceStageAttachedFromTest();
+
+            Assert.Equal("110", h.DetectedPhase());
+            var kinds = h.Ingress.Posted
+                .Where(p => p.Kind == DecisionSignalKind.RealmJoinDetected || p.Kind == DecisionSignalKind.RealmJoinResolved)
+                .Select(p => p.Kind)
+                .ToList();
+            Assert.Equal(new[] { DecisionSignalKind.RealmJoinDetected, DecisionSignalKind.RealmJoinResolved }, kinds);
+        }
+
+        [Fact]
+        public void Phase_not_written_at_attach_reports_Blank_and_the_first_value_surfaces_as_PhaseChanged()
+        {
+            // Detected says Blank while Parameters\DeploymentPhase is missing; that report is the
+            // baseline, so a first value of 101 must not be swallowed silently.
+            using var h = new PhaseHarness { Phase = null };
+
+            h.Watcher.TriggerServiceStageAttachedFromTest();
+            Assert.Equal("0", h.DetectedPhase());
+            Assert.False(h.Watcher.PackageWatchersArmedForTest);
+
+            h.Phase = 101;
+            h.Watcher.TriggerCheckParametersFromTest();
+
+            var changed = Assert.Single(h.Ingress.Posted, p => p.Kind == DecisionSignalKind.RealmJoinPhaseChanged);
+            Assert.Equal("101", changed.Payload![DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase]);
+            Assert.Equal("0", changed.Payload[DecisionEngine.RealmJoinPayloadKeys.PreviousPhase]);
+            Assert.True(h.Watcher.PackageWatchersArmedForTest);
+        }
+
+        [Fact]
+        public void Blank_at_attach_then_running_fires_one_PhaseChanged()
+        {
+            // The common first-run shape (RJ installed during the ESP, deployment starts after
+            // the user-ESP page closed): Blank on attach, 0 -> 101 later.
+            using var h = new PhaseHarness { Phase = 0 };
+
+            h.Watcher.TriggerServiceStageAttachedFromTest();
+            h.Watcher.TriggerCheckParametersFromTest();   // same value again — no change
+            h.Phase = 101;
+            h.Watcher.TriggerCheckParametersFromTest();
+
+            Assert.Equal("0", h.DetectedPhase());
+            var changed = Assert.Single(h.Ingress.Posted, p => p.Kind == DecisionSignalKind.RealmJoinPhaseChanged);
+            Assert.Equal("0", changed.Payload![DecisionEngine.RealmJoinPayloadKeys.PreviousPhase]);
+        }
+
 
         // ---- auto-update (Uninstall\RealmJoin) -----------------------------------------------
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/CollectorBaseReentrancyTests.cs

@@ -12,8 +12,8 @@ using Xunit;
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry
 {
     /// <summary>
-    /// Regression coverage for the duplicate <c>performance_snapshot</c> events observed on
-    /// session c4c8d206-… (Bayer / Lenovo T14 Gen 5): two snapshots fired with timestamps
+    /// Regression coverage for duplicate <c>performance_snapshot</c> events observed in the
+    /// field (Lenovo T14 Gen 5): two snapshots fired with timestamps
     /// 0–1ms apart, the second one carrying a fresh-baseline net delta of 0. Root cause:
     /// <see cref="System.Threading.Timer"/> is documented to dispatch callbacks on different
     /// ThreadPool threads when a callback exceeds the period, and the

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderLoggingTests.cs

@@ -6,6 +6,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Transport;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
 using AutopilotMonitor.Shared.Models;
@@ -35,6 +36,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
                 requiresImmediateFlush: false,
                 enqueuedAtUtc: At);
 
+        private static ProxyObserver NewProxyObserver(AgentLogger logger) =>
+            new ProxyObserver(
+                () => new ProxySettings(false, null, null, null, null),
+                () => "direct",
+                logger,
+                new VirtualClock(At),
+                TimeSpan.FromSeconds(30));
+
         private static string ReadLogs(string path)
         {
             // AgentLogger writes to a dated file; scan the whole dir to stay robust to format.
@@ -235,5 +244,126 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.DoesNotContain("flushing", logContent);
             Assert.DoesNotContain("ingest", logContent);
         }
+
+        [Fact]
+        public async Task Network_failure_names_the_route_and_opens_a_series()
+        {
+            using var tmp = new TempDirectory();
+            var logger = new AgentLogger(tmp.Path, AgentLogLevel.Info);
+
+            var handler = new RecordingHttpMessageHandler();
+            handler.QueueThrow(new HttpRequestException("An error occurred while sending the request."));
+            using var http = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+
+            var sut = new BackendTelemetryUploader(
+                httpClient: http, baseUrl: "https://backend.test", tenantId: "T1", logger: logger, proxy: NewProxyObserver(logger));
+
+            await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            var logContent = ReadLogs(tmp.Path);
+            Assert.Contains("ingest NETWORK fail after", logContent);
+            Assert.Contains("items=1, route=direct): ", logContent);
+            Assert.Contains("ProxyObserver: uploads are failing since", logContent);
+        }
+
+        [Fact]
+        public async Task Timeout_names_the_route_and_opens_a_series()
+        {
+            using var tmp = new TempDirectory();
+            var logger = new AgentLogger(tmp.Path, AgentLogLevel.Info);
+
+            var handler = new RecordingHttpMessageHandler();
+            handler.QueueThrow(new TaskCanceledException("A task was canceled."));
+            using var http = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+
+            var sut = new BackendTelemetryUploader(
+                httpClient: http, baseUrl: "https://backend.test", tenantId: "T1", logger: logger, proxy: NewProxyObserver(logger));
+
+            await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            var logContent = ReadLogs(tmp.Path);
+            Assert.Contains("ingest TIMEOUT after", logContent);
+            Assert.Contains("items=1, route=direct): ", logContent);
+            Assert.Contains("ProxyObserver: uploads are failing since", logContent);
+        }
+
+        [Fact]
+        public async Task Interception_names_the_route_and_opens_a_series()
+        {
+            using var tmp = new TempDirectory();
+            var logger = new AgentLogger(tmp.Path, AgentLogLevel.Info);
+
+            var handler = new RecordingHttpMessageHandler();
+            handler.QueueForeign(HttpStatusCode.Forbidden, InterceptionFixtures.CertificateRequiredPage);
+            using var http = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+
+            var sut = new BackendTelemetryUploader(
+                httpClient: http, baseUrl: "https://backend.test", tenantId: "T1", logger: logger, proxy: NewProxyObserver(logger));
+
+            var result = await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+            Assert.True(result.IsIntercepted);
+
+            var logContent = ReadLogs(tmp.Path);
+            Assert.Contains(", route=direct).", logContent);
+            Assert.Contains("ProxyObserver: uploads are failing since", logContent);
+        }
+
+        [Fact]
+        public async Task A_successful_upload_ends_the_series()
+        {
+            using var tmp = new TempDirectory();
+            var logger = new AgentLogger(tmp.Path, AgentLogLevel.Info);
+
+            var handler = new RecordingHttpMessageHandler();
+            handler.QueueThrow(new HttpRequestException("An error occurred while sending the request."));
+            handler.QueueStatus(HttpStatusCode.OK);
+            using var http = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+
+            var sut = new BackendTelemetryUploader(
+                httpClient: http, baseUrl: "https://backend.test", tenantId: "T1", logger: logger, proxy: NewProxyObserver(logger));
+
+            await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+            await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            Assert.Contains("ProxyObserver: uploads work again after 1 failed attempt(s)", ReadLogs(tmp.Path));
+        }
+
+        [Fact]
+        public async Task An_answer_from_the_backend_that_is_not_a_success_leaves_the_series_alone()
+        {
+            using var tmp = new TempDirectory();
+            var logger = new AgentLogger(tmp.Path, AgentLogLevel.Info);
+
+            var handler = new RecordingHttpMessageHandler();
+            handler.QueueStatus(HttpStatusCode.InternalServerError);
+            using var http = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+
+            var sut = new BackendTelemetryUploader(
+                httpClient: http, baseUrl: "https://backend.test", tenantId: "T1", logger: logger, proxy: NewProxyObserver(logger));
+
+            await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            Assert.DoesNotContain("ProxyObserver: uploads", ReadLogs(tmp.Path));
+        }
+
+        [Fact]
+        public async Task Without_an_observer_the_failure_line_stays_as_it_was()
+        {
+            using var tmp = new TempDirectory();
+            var logger = new AgentLogger(tmp.Path, AgentLogLevel.Info);
+
+            var handler = new RecordingHttpMessageHandler();
+            handler.QueueThrow(new HttpRequestException("An error occurred while sending the request."));
+            using var http = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
+
+            var sut = new BackendTelemetryUploader(
+                httpClient: http, baseUrl: "https://backend.test", tenantId: "T1", logger: logger);
+
+            await sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            var logContent = ReadLogs(tmp.Path);
+            Assert.Contains("items=1): ", logContent);
+            Assert.DoesNotContain("route=", logContent);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderTests.cs

@@ -550,6 +550,24 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.Contains("network", result.ErrorReason);
         }
 
+        [Fact]
+        public async Task Network_error_reason_names_the_cause_instead_of_the_generic_text()
+        {
+            using var rig = new Rig();
+            rig.Handler.QueueThrow(new HttpRequestException(
+                "An error occurred while sending the request.",
+                new WebException(
+                    "Unable to connect to the remote server",
+                    new System.Net.Sockets.SocketException((int)System.Net.Sockets.SocketError.TimedOut),
+                    WebExceptionStatus.ConnectFailure,
+                    null)));
+
+            var result = await rig.Sut.UploadBatchAsync(new[] { NewEventItem(1) }, CancellationToken.None);
+
+            Assert.True(result.IsTransient);
+            Assert.StartsWith("network: status=ConnectFailure, socket=TimedOut: ", result.ErrorReason);
+        }
+
         [Fact]
         public async Task HttpClient_timeout_maps_to_Transient()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/ProxyObserverTests.cs

@@ -0,0 +1,366 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Transport;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
+{
+    /// <summary>Settings and route are played in: no test changes a real proxy setting.</summary>
+    public sealed class ProxyObserverTests : IDisposable
+    {
+        private static readonly ProxySettings AutoDetect = new ProxySettings(true, null, null, null, null);
+        private static readonly ProxySettings NoProxy = new ProxySettings(false, null, null, null, null);
+
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly VirtualClock _clock = new VirtualClock(new DateTime(2026, 11, 2, 6, 29, 13, DateTimeKind.Utc));
+        private ProxySettings _settings = AutoDetect;
+        private string _route = "proxy.example.test:8080";
+
+        private ProxyObserver NewObserver(Func<string>? readRoute = null, TimeSpan? routeBound = null, Func<ProxySettings>? readSettings = null) =>
+            new ProxyObserver(
+                readSettings ?? (() => _settings),
+                readRoute ?? (() => _route),
+                new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                _clock,
+                routeBound ?? TimeSpan.FromSeconds(30));
+
+        private ProxyObserver StartedObserver()
+        {
+            var observer = NewObserver();
+            observer.CaptureBaseline();
+            return observer;
+        }
+
+        private void SwitchToNoProxy()
+        {
+            _settings = NoProxy;
+            _route = "direct";
+        }
+
+        private List<string> LogLines()
+        {
+            var lines = new List<string>();
+            foreach (var file in Directory.EnumerateFiles(_tmp.Path, "*.log", SearchOption.AllDirectories))
+            {
+                using var stream = new FileStream(file, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
+                using var reader = new StreamReader(stream);
+                lines.AddRange(reader.ReadToEnd().Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries));
+            }
+            return lines.Where(l => l.Contains("ProxyObserver:")).ToList();
+        }
+
+        public void Dispose() => _tmp.Dispose();
+
+        [Fact]
+        public void The_baseline_names_settings_and_route_at_info()
+        {
+            StartedObserver();
+
+            var line = Assert.Single(LogLines());
+            Assert.Contains("[INFO]", line);
+            Assert.Contains("start - IE settings of this account: auto-detect; WinHTTP: direct; route to backend: proxy.example.test:8080", line);
+        }
+
+        [Fact]
+        public void A_rebuild_of_the_clients_does_not_repeat_the_baseline()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            foreach (var _ in new[] { 1, 2 })
+            {
+                new ProxyObserver(() => _settings, () => _route, logger, _clock, TimeSpan.FromSeconds(30)).CaptureBaseline();
+            }
+
+            Assert.Single(LogLines());
+        }
+
+        [Fact]
+        public void A_change_warns_once_with_both_sides()
+        {
+            var observer = StartedObserver();
+            SwitchToNoProxy();
+
+            observer.CheckForChange();
+            observer.CheckForChange();
+
+            var line = Assert.Single(LogLines().Skip(1));
+            Assert.Contains("[WARN]", line);
+            Assert.Contains("proxy settings changed - IE settings of this account: auto-detect -> no proxy; route to backend: proxy.example.test:8080 -> direct.", line);
+            Assert.Contains("bitsadmin /util /getieproxy localsystem", line);
+        }
+
+        [Fact]
+        public void Rewriting_the_same_content_says_nothing()
+        {
+            var observer = StartedObserver();
+            _settings = new ProxySettings(true, null, null, null, null);
+
+            observer.CheckForChange();
+
+            Assert.Single(LogLines());
+        }
+
+        [Fact]
+        public void A_winhttp_change_says_uploads_do_not_use_it()
+        {
+            var observer = StartedObserver();
+            _settings = new ProxySettings(true, null, null, null, "p:8080");
+
+            observer.CheckForChange();
+
+            var line = LogLines().Last();
+            Assert.Contains("[WARN]", line);
+            Assert.Contains("WinHTTP: direct -> proxy p:8080", line);
+            Assert.Contains("do not use WinHTTP", line);
+        }
+
+        [Fact]
+        public void A_winhttp_change_is_not_blamed_for_failing_uploads()
+        {
+            var observer = StartedObserver();
+            _settings = new ProxySettings(true, null, null, null, "p:8080");
+            observer.CheckForChange();
+
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            Assert.Contains("Proxy settings of this account unchanged since start: auto-detect.", LogLines().Last());
+        }
+
+        [Fact]
+        public void A_change_reaches_the_subscriber_with_settings_and_route()
+        {
+            var observer = StartedObserver();
+            ProxySettings? seen = null;
+            string? seenWhat = null;
+            string? seenRoute = null;
+            observer.SettingsChanged += (settings, what, route) =>
+            {
+                seen = settings;
+                seenWhat = what;
+                seenRoute = route;
+            };
+            SwitchToNoProxy();
+
+            observer.CheckForChange();
+
+            Assert.Equal(NoProxy, seen);
+            Assert.Equal("IE settings of this account: auto-detect -> no proxy", seenWhat);
+            Assert.Equal("direct", seenRoute);
+        }
+
+        [Fact]
+        public void A_subscriber_that_throws_does_not_reach_the_caller()
+        {
+            var observer = StartedObserver();
+            observer.SettingsChanged += (_, _, _) => throw new InvalidOperationException("SignalIngress has been stopped.");
+            SwitchToNoProxy();
+
+            observer.CheckForChange();
+
+            Assert.Contains(LogLines(), l => l.Contains("proxy settings changed"));
+        }
+
+        [Fact]
+        public void The_first_failure_ties_the_series_to_the_change()
+        {
+            var observer = StartedObserver();
+            _clock.Advance(TimeSpan.FromMinutes(23));
+            observer.OnSendSucceeded();
+            _clock.Advance(TimeSpan.FromSeconds(90));
+            SwitchToNoProxy();
+            observer.CheckForChange();
+            _clock.Advance(TimeSpan.FromSeconds(62));
+
+            observer.OnSendFailed(TimeSpan.FromSeconds(21));
+
+            var line = LogLines().Last();
+            Assert.Contains("[WARN]", line);
+            Assert.Contains("uploads are failing since 06:54:24, 41 s after the proxy settings changed at 06:53:43 (IE settings of this account: auto-detect -> no proxy).", line);
+            Assert.Contains("Route to backend: direct. Last successful upload 06:52:13.", line);
+        }
+
+        [Fact]
+        public void A_failure_notices_a_change_the_watcher_did_not_report()
+        {
+            var observer = StartedObserver();
+            SwitchToNoProxy();
+
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            var lines = LogLines();
+            Assert.Contains(lines, l => l.Contains("proxy settings changed - IE settings of this account: auto-detect -> no proxy"));
+            Assert.Contains("after the proxy settings changed", lines.Last());
+        }
+
+        [Fact]
+        public void A_series_writes_its_finding_once()
+        {
+            var observer = StartedObserver();
+
+            observer.OnSendFailed(TimeSpan.Zero);
+            observer.OnSendFailed(TimeSpan.Zero);
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            Assert.Single(LogLines(), l => l.Contains("uploads are failing"));
+        }
+
+        [Fact]
+        public void A_failure_without_a_change_says_the_settings_are_unchanged()
+        {
+            var observer = StartedObserver();
+
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            var line = LogLines().Last();
+            Assert.Contains("Proxy settings of this account unchanged since start: auto-detect.", line);
+            Assert.Contains("Route to backend: proxy.example.test:8080. No successful upload yet.", line);
+        }
+
+        [Fact]
+        public void A_change_before_the_last_success_is_not_blamed()
+        {
+            var observer = StartedObserver();
+            SwitchToNoProxy();
+            observer.CheckForChange();
+            _clock.Advance(TimeSpan.FromMinutes(1));
+            observer.OnSendSucceeded();
+            _clock.Advance(TimeSpan.FromMinutes(1));
+
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            Assert.Contains("Proxy settings of this account unchanged since the last successful upload: no proxy.", LogLines().Last());
+        }
+
+        [Fact]
+        public void Recovery_is_noted_and_a_new_series_gets_its_own_finding()
+        {
+            var observer = StartedObserver();
+            observer.OnSendFailed(TimeSpan.Zero);
+            observer.OnSendFailed(TimeSpan.Zero);
+            _clock.Advance(TimeSpan.FromMinutes(9));
+
+            observer.OnSendSucceeded();
+
+            var line = LogLines().Last();
+            Assert.Contains("[INFO]", line);
+            Assert.Contains("uploads work again after 2 failed attempt(s) over 9 min; route to backend: proxy.example.test:8080.", line);
+
+            observer.OnSendFailed(TimeSpan.Zero);
+            Assert.Equal(2, LogLines().Count(l => l.Contains("uploads are failing")));
+        }
+
+        [Fact]
+        public void Recovery_reports_settings_that_came_back()
+        {
+            var observer = StartedObserver();
+            SwitchToNoProxy();
+            observer.OnSendFailed(TimeSpan.Zero);
+            _settings = AutoDetect;
+            _route = "proxy.example.test:8080";
+
+            observer.OnSendSucceeded();
+
+            Assert.Contains(LogLines(), l => l.Contains("no proxy -> auto-detect"));
+        }
+
+        [Fact]
+        public void A_success_without_a_series_stays_silent()
+        {
+            var observer = StartedObserver();
+
+            observer.OnSendSucceeded();
+
+            Assert.Single(LogLines());
+        }
+
+        [Fact]
+        public void Stopping_while_failing_sums_it_up()
+        {
+            var observer = StartedObserver();
+            observer.OnSendSucceeded();
+            _clock.Advance(TimeSpan.FromMinutes(1));
+            SwitchToNoProxy();
+            observer.OnSendFailed(TimeSpan.Zero);
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            observer.LogOpenFailures();
+
+            var line = LogLines().Last();
+            Assert.Contains("[WARN]", line);
+            Assert.Contains("stopping with uploads still failing: 2 failed attempt(s) since 06:30:13, last success 06:29:13, route to backend: direct.", line);
+            Assert.Contains("Proxy settings changed at 06:30:13 (IE settings of this account: auto-detect -> no proxy).", line);
+        }
+
+        [Fact]
+        public void Stopping_without_a_series_stays_silent()
+        {
+            var observer = StartedObserver();
+            observer.OnSendFailed(TimeSpan.Zero);
+            observer.OnSendSucceeded();
+            var before = LogLines().Count;
+
+            observer.LogOpenFailures();
+
+            Assert.Equal(before, LogLines().Count);
+        }
+
+        [Fact]
+        public void A_settings_read_that_throws_is_not_a_change_and_never_reaches_the_upload()
+        {
+            var throwing = false;
+            var observer = NewObserver(readSettings: () => throwing ? throw new InvalidOperationException("boom") : _settings);
+            observer.CaptureBaseline();
+            throwing = true;
+
+            observer.CheckForChange();
+            observer.OnSendFailed(TimeSpan.Zero);
+
+            Assert.DoesNotContain(LogLines(), l => l.Contains("proxy settings changed"));
+            Assert.Contains("Proxy settings of this account unchanged since start: auto-detect.", LogLines().Last());
+        }
+
+        [Fact]
+        public void An_unreadable_state_is_not_a_change()
+        {
+            var observer = StartedObserver();
+            _settings = ProxySettings.Unreadable(5);
+
+            observer.CheckForChange();
+
+            Assert.Single(LogLines());
+        }
+
+        [Fact]
+        public void A_route_read_that_throws_reads_as_unknown()
+        {
+            var observer = NewObserver(readRoute: () => throw new InvalidOperationException("boom"));
+
+            Assert.Equal("unknown", observer.RouteText());
+        }
+
+        [Fact]
+        public void A_hanging_route_read_gives_up_and_does_not_pile_up()
+        {
+            using var release = new ManualResetEventSlim(false);
+            var reads = 0;
+            var observer = NewObserver(
+                readRoute: () =>
+                {
+                    Interlocked.Increment(ref reads);
+                    release.Wait();
+                    return "direct";
+                },
+                routeBound: TimeSpan.FromMilliseconds(50));
+
+            Assert.Equal("unknown", observer.RouteText());
+            Assert.Equal("unknown", observer.RouteText());
+            Assert.Equal(1, Volatile.Read(ref reads));
+
+            release.Set();
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/ProxySettingsTests.cs

@@ -0,0 +1,167 @@
+using System;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Transport;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
+{
+    public sealed class ProxySettingsTests
+    {
+        private static ProxySettings Settings(
+            bool autoDetect = false, string? pac = null, string? proxy = null, string? bypass = null, string? winHttp = null) =>
+            new ProxySettings(autoDetect, pac, proxy, bypass, winHttp);
+
+        [Fact]
+        public void Each_kind_of_setting_describes_itself()
+        {
+            Assert.Equal("no proxy", Settings().Describe());
+            Assert.Equal("auto-detect", Settings(autoDetect: true).Describe());
+            Assert.Equal("PAC https://pac.example.test/proxy.pac", Settings(pac: "https://pac.example.test/proxy.pac").Describe());
+            Assert.Equal("proxy proxy.example.test:8080", Settings(proxy: "proxy.example.test:8080").Describe());
+            Assert.Equal("auto-detect, proxy p:8080", Settings(autoDetect: true, proxy: "p:8080").Describe());
+            Assert.Equal("direct", Settings().DescribeWinHttp());
+            Assert.Equal("proxy p:8080", Settings(winHttp: "p:8080").DescribeWinHttp());
+            Assert.Equal("unreadable (Win32 error 5)", ProxySettings.Unreadable(5).Describe());
+        }
+
+        [Theory]
+        [InlineData(false, null, null, "Direct")]
+        [InlineData(true, null, null, "AutoDetect")]
+        [InlineData(true, "https://pac.example.test/p.pac", null, "PAC")]
+        [InlineData(true, "https://pac.example.test/p.pac", "p:8080", "Proxy")]
+        public void Type_keeps_the_values_the_download_rule_matches(bool autoDetect, string? pac, string? proxy, string expected)
+        {
+            Assert.Equal(expected, Settings(autoDetect, pac, proxy).ProxyType);
+        }
+
+        [Fact]
+        public void An_unreadable_state_has_its_own_type()
+        {
+            Assert.Equal("Unknown", ProxySettings.Unreadable(5).ProxyType);
+        }
+
+        [Fact]
+        public void Equal_content_is_equal_and_any_field_makes_it_different()
+        {
+            Assert.Equal(Settings(autoDetect: true), Settings(autoDetect: true));
+            Assert.NotEqual(Settings(autoDetect: true), Settings());
+            Assert.NotEqual(Settings(pac: "https://a.test/p"), Settings(pac: "https://b.test/p"));
+            Assert.NotEqual(Settings(proxy: "a:1"), Settings(proxy: "b:1"));
+            Assert.NotEqual(Settings(proxy: "a:1", bypass: "x"), Settings(proxy: "a:1", bypass: "y"));
+            Assert.NotEqual(Settings(winHttp: "a:1"), Settings());
+        }
+
+        [Fact]
+        public void An_empty_string_counts_as_not_set()
+        {
+            Assert.Equal(Settings(), Settings(pac: "", proxy: "", bypass: "", winHttp: ""));
+        }
+
+        [Theory]
+        [InlineData("user:secret@p:8080")]
+        [InlineData("http://user:secret@p:8080")]
+        [InlineData("http=user:secret@p:8080;https=user:secret@q:8443")]
+        [InlineData("user:se=cret@p:8080")]
+        [InlineData("user:se;cret@p:8080")]
+        [InlineData("http=user:se;cret@p:8080")]
+        [InlineData("user:se://cret@p:8080")]
+        public void Credentials_never_reach_logs_or_events(string configured)
+        {
+            var settings = Settings(proxy: configured, winHttp: configured);
+            var data = settings.ToEventData();
+
+            foreach (var text in new[] { settings.DescribeAll(), (string)data["proxyServer"], (string)data["winHttpProxy"] })
+            {
+                Assert.DoesNotContain("user", text);
+                Assert.DoesNotContain("cret", text);
+            }
+
+            Assert.Equal(ProxySettings.CredentialsHidden, settings.Proxy);
+            Assert.Equal(ProxySettings.CredentialsHidden, settings.WinHttpProxy);
+            Assert.True((bool)data["proxyEnabled"]);
+            Assert.True((bool)data["winHttpProxyConfigured"]);
+        }
+
+        [Theory]
+        [InlineData("p:8080")]
+        [InlineData("http://p:8080")]
+        [InlineData("http=p:8080;https=q:8443")]
+        public void A_value_without_credentials_stays_as_it_is(string configured)
+        {
+            Assert.Equal(configured, Settings(proxy: configured).Proxy);
+            Assert.Equal(configured, Settings(winHttp: configured).WinHttpProxy);
+        }
+
+        [Theory]
+        [InlineData("https://pac.example.test/p.pac?key=secret", "https://pac.example.test/p.pac")]
+        [InlineData("http://user:secret@pac.example.test:8080/p.pac", "http://pac.example.test:8080/p.pac")]
+        [InlineData("http://user:se=cr;et@pac.example.test/p.pac", "http://pac.example.test/p.pac")]
+        [InlineData("not a url with secret", "(unparsable URL)")]
+        public void A_pac_url_keeps_scheme_host_port_and_path(string configured, string expected)
+        {
+            Assert.Equal(expected, Settings(pac: configured).PacUrl);
+        }
+
+        [Fact]
+        public void A_change_names_what_moved()
+        {
+            var before = Settings(autoDetect: true);
+
+            Assert.Equal("IE settings of this account: auto-detect -> no proxy", Settings().DescribeChangeFrom(before));
+            Assert.Equal("WinHTTP: direct -> proxy p:1", Settings(autoDetect: true, winHttp: "p:1").DescribeChangeFrom(before));
+            Assert.Equal(
+                "IE settings of this account: auto-detect -> no proxy; WinHTTP: direct -> proxy p:1",
+                Settings(winHttp: "p:1").DescribeChangeFrom(before));
+            Assert.Equal(
+                "IE settings of this account: proxy bypass list changed",
+                Settings(proxy: "p:1", bypass: "b").DescribeChangeFrom(Settings(proxy: "p:1", bypass: "a")));
+        }
+
+        [Fact]
+        public void Only_the_account_settings_count_as_a_change_for_uploads()
+        {
+            var before = Settings(autoDetect: true);
+
+            Assert.True(Settings().DiffersForUploadsFrom(before));
+            Assert.False(Settings(autoDetect: true, winHttp: "p:1").DiffersForUploadsFrom(before));
+        }
+
+        [Fact]
+        public void The_event_tells_auto_detect_from_direct()
+        {
+            var data = Settings(autoDetect: true).ToEventData();
+
+            Assert.Equal("AutoDetect", data["proxyType"]);
+            Assert.True((bool)data["autoDetect"]);
+            Assert.False((bool)data["proxyEnabled"]);
+            Assert.Null(data["proxyServer"]);
+            Assert.False((bool)data["winHttpProxyConfigured"]);
+            Assert.Null(data["winHttpProxy"]);
+        }
+
+        [Fact]
+        public void The_event_carries_a_real_winhttp_proxy()
+        {
+            var data = Settings(winHttp: "p:8080").ToEventData();
+
+            Assert.True((bool)data["winHttpProxyConfigured"]);
+            Assert.Equal("p:8080", data["winHttpProxy"]);
+        }
+
+        [Fact]
+        public void The_real_settings_of_this_account_can_be_read()
+        {
+            var settings = ProxySettingsReader.Read();
+
+            Assert.False(settings.IsUnreadable, settings.Describe());
+        }
+
+        [Fact]
+        public async Task The_real_route_can_be_read()
+        {
+            var read = Task.Run(() => ProxySettingsReader.ReadRoute(new Uri("https://backend.example.invalid/")));
+
+            Assert.False(string.IsNullOrEmpty(await read));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TransportErrorCodesTests.cs

@@ -2,7 +2,9 @@ using System;
 using System.ComponentModel;
 using System.Net;
 using System.Net.Http;
+using System.Net.Sockets;
 using System.Security.Authentication;
+using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Transport;
 using Xunit;
 
@@ -69,5 +71,56 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
             Assert.Equal("boom", TransportErrorCodes.MessageWithNativeCode(new InvalidOperationException("boom")));
             Assert.Null(TransportErrorCodes.MessageWithNativeCode(null!));
         }
+
+        // The .NET Framework shape of a failed connect or name lookup through HttpClient.
+        private static Exception SendFailureChain(WebExceptionStatus status, SocketError socketError) =>
+            new HttpRequestException(
+                "An error occurred while sending the request.",
+                new WebException("Unable to connect to the remote server", new SocketException((int)socketError), status, null));
+
+        [Theory]
+        [InlineData(WebExceptionStatus.ConnectFailure, SocketError.TimedOut, "status=ConnectFailure, socket=TimedOut: ")]
+        [InlineData(WebExceptionStatus.NameResolutionFailure, SocketError.HostNotFound, "status=NameResolutionFailure, socket=HostNotFound: ")]
+        public void Send_failure_names_status_and_socket_error(WebExceptionStatus status, SocketError socketError, string expectedPrefix)
+        {
+            var described = TransportErrorCodes.DescribeSendFailure(SendFailureChain(status, socketError));
+
+            Assert.StartsWith(expectedPrefix, described);
+            Assert.DoesNotContain("An error occurred while sending the request", described);
+        }
+
+        [Fact]
+        public void Send_failure_of_a_tls_handshake_names_status_and_native_code()
+        {
+            var described = TransportErrorCodes.DescribeSendFailure(TlsFailureChain(new Win32Exception(IllegalMessage)));
+
+            Assert.StartsWith("status=SecureChannelFailure, win32=0x80090326: ", described);
+        }
+
+        [Fact]
+        public void Send_failure_without_details_is_the_innermost_message()
+        {
+            Assert.Equal("inner", TransportErrorCodes.DescribeSendFailure(new HttpRequestException("outer", new InvalidOperationException("inner"))));
+            Assert.Equal("boom", TransportErrorCodes.DescribeSendFailure(new InvalidOperationException("boom")));
+            Assert.Null(TransportErrorCodes.DescribeSendFailure(null!));
+        }
+
+        [Fact]
+        public async Task Real_refused_connect_names_the_endpoint_it_tried()
+        {
+            // The endpoint in the message is what tells the backend from a proxy, and only a real
+            // connect produces it: a hand-built SocketException carries none.
+            var listener = new TcpListener(IPAddress.Loopback, 0);
+            listener.Start();
+            var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+            listener.Stop();
+
+            using var client = new HttpClient(new HttpClientHandler { UseProxy = false });
+            var failure = await Assert.ThrowsAsync<HttpRequestException>(() => client.GetAsync($"http://127.0.0.1:{port}/"));
+
+            var described = TransportErrorCodes.DescribeSendFailure(failure);
+            Assert.StartsWith("status=ConnectFailure, socket=ConnectionRefused: ", described);
+            Assert.Contains($"127.0.0.1:{port}", described);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/AutopilotMonitor.Agent.V2.Core.csproj

@@ -44,7 +44,7 @@
   <Import Project="V2Isolation.targets" />
 
   <ItemGroup>
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
   </ItemGroup>
 
   <ItemGroup>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogFileIdentity.cs

@@ -0,0 +1,33 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
+{
+    /// <summary>
+    /// Which file a path holds right now: volume serial plus file index. IME rolls a log with
+    /// <c>File.Move</c>, so the identity stays with the bytes when the name changes.
+    /// </summary>
+    internal static class ImeLogFileIdentity
+    {
+        /// <summary>
+        /// Null when the file cannot be opened. An attribute-only handle with full sharing, so it
+        /// can never make IME's rename of the log fail.
+        /// </summary>
+        public static string TryRead(string path)
+        {
+            using (var handle = FileNativeMethods.CreateFileW(
+                path,
+                FileNativeMethods.FILE_READ_ATTRIBUTES,
+                FileNativeMethods.FILE_SHARE_READ | FileNativeMethods.FILE_SHARE_WRITE | FileNativeMethods.FILE_SHARE_DELETE,
+                IntPtr.Zero,
+                FileNativeMethods.OPEN_EXISTING,
+                0,
+                IntPtr.Zero))
+            {
+                if (handle.IsInvalid) return null;
+                if (!FileNativeMethods.GetFileInformationByHandle(handle, out var info)) return null;
+                return $"{info.VolumeSerialNumber:X8}-{info.FileIndexHigh:X8}{info.FileIndexLow:X8}";
+            }
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Handlers.cs

@@ -1709,7 +1709,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 {
                     _allAppsCompletedFired = true;
                     _logger.Info($"ImeLogTracker: all {_packageStates.CountAll} apps completed");
-                    OnAllAppsCompleted?.Invoke();
                 }
             }
         }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -51,23 +51,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             if (!Directory.Exists(_logFolder))
                 return;
 
-            // Get all matching log files, sorted by name (archived files come before current).
-            // M2: a SINGLE directory enumeration filtered in-memory against the patterns, instead
-            // of one Directory.GetFiles(pattern) per LogFilePattern every 100 ms poll (~90 folder
-            // enumerations/s → 1). The in-memory regex match is anchored, so it is also immune to
-            // the Win32 "*.ext" 8.3 search-pattern quirk.
-            var files = new List<string>();
-            try
-            {
-                foreach (var filePath in Directory.EnumerateFiles(_logFolder))
-                {
-                    if (MatchesLogFilePattern(Path.GetFileName(filePath)))
-                        files.Add(filePath);
-                }
-            }
-            catch (DirectoryNotFoundException) { }
-
-            files.Sort(StringComparer.OrdinalIgnoreCase);
+            var files = EnumerateLogFiles();
+            if (FileIdentitiesAreDue(files)) ReconcileFileIdentities(files);
 
             // Σ(file length − bookmark) after this pass — the tracker's queue depth.
             long backlogBytes = 0;
@@ -94,6 +79,66 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             }
         }
 
+        /// <summary>
+        /// All matching log files, sorted by name (archived files come before current).
+        /// M2: a SINGLE directory enumeration filtered in-memory against the patterns, instead
+        /// of one Directory.GetFiles(pattern) per LogFilePattern every 100 ms poll (~90 folder
+        /// enumerations/s → 1). The in-memory regex match is anchored, so it is also immune to
+        /// the Win32 "*.ext" 8.3 search-pattern quirk.
+        /// </summary>
+        private List<string> EnumerateLogFiles()
+        {
+            var files = new List<string>();
+            try
+            {
+                foreach (var filePath in Directory.EnumerateFiles(_logFolder))
+                {
+                    if (MatchesLogFilePattern(Path.GetFileName(filePath)))
+                        files.Add(filePath);
+                }
+            }
+            catch (DirectoryNotFoundException) { }
+
+            files.Sort(StringComparer.OrdinalIgnoreCase);
+            return files;
+        }
+
+        /// <summary>
+        /// On the first pass (a restart can have rolled logs over) and when a file has no known
+        /// identity yet, which is how a rolled-over archive first shows up. Nothing is opened in
+        /// the regular poll.
+        /// </summary>
+        private bool FileIdentitiesAreDue(List<string> files)
+        {
+            if (!_fileIdentitiesReconciled) return true;
+            foreach (var filePath in files)
+            {
+                if (!_positionTracker.HasIdentity(filePath)) return true;
+            }
+            return false;
+        }
+
+        /// <summary>
+        /// Lets every bookmark follow its file (see <see cref="LogFilePositionTracker.Reconcile"/>).
+        /// Reading a rolled-over log again would replay every app and script line in it: finished
+        /// apps fall back to Installing, and the subgraph line of an older app marks the app that is
+        /// running right now as skipped.
+        /// </summary>
+        private void ReconcileFileIdentities(List<string> files)
+        {
+            _fileIdentitiesReconciled = true;
+
+            var idByPath = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            foreach (var filePath in files) idByPath[filePath] = FileIdentityProvider(filePath);
+
+            foreach (var move in _positionTracker.Reconcile(idByPath))
+            {
+                MoveFileContext(move.From, move.To);
+                _logger.Info($"ImeLogTracker: {Path.GetFileName(move.From)} rolled over to {Path.GetFileName(move.To)} - continuing at offset {move.Position} instead of reading it again");
+            }
+            _stateDirty = true;
+        }
+
         /// <summary>
         /// One pass over one file: the bytes behind the bookmark, on a multi-writer file preceded
         /// by the overwrite check that may move the bookmark back first (see
@@ -104,6 +149,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             var fileInfo = new FileInfo(filePath);
             if (!fileInfo.Exists) return 0;
 
+            // IME renamed the file after this pass listed the folder, or its archive sorts behind it
+            // (_IntuneManagementExtension.log). Either way the archive needs the bookmark before the
+            // read below resets it.
+            if (_positionTracker.IsBehindBookmark(filePath, fileInfo.Length))
+                ReconcileFileIdentities(EnumerateLogFiles());
+
             // Captured BEFORE MarkChecked below stamps this pass. Growth measured
             // against a previously observed state is what makes this pass's lines valid
             // "written now" anchors — for the per-file measurement AND per-line anchoring.

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.Overwrite.cs

@@ -616,6 +616,35 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
 
         private void InvalidateInvocationMarkersFrom(string fileName, long offset) => TakeInvocationMarkersFrom(fileName, offset, out _);
 
+        /// <summary>
+        /// A log was rolled over: what the tracker knows about its bytes goes with them. The markers keep
+        /// <see cref="_lastPlatformMarker"/> alive, so the run in flight still owns its lines in the fresh file;
+        /// the ledger stays behind and empties, an archive is not checked for overwrites.
+        /// </summary>
+        private void MoveFileContext(string fromPath, string toPath)
+        {
+            var from = Path.GetFileName(fromPath);
+            var to = Path.GetFileName(toPath);
+
+            List<InvocationMarker> markers;
+            if (_invocationMarkers.TryGetValue(from, out markers))
+            {
+                _invocationMarkers.Remove(from);
+                _invocationMarkers[to] = markers;
+            }
+            if (_platformMarkerFiles.Contains(from)) _platformMarkerFiles.Add(to);
+
+            FileLedger ledger;
+            if (_ledgers.TryGetValue(from, out ledger)) ledger.Clear();
+
+            HeldTail held;
+            if (_heldTails.TryGetValue(fromPath, out held))
+            {
+                _heldTails.Remove(fromPath);
+                _heldTails[toPath] = held;
+            }
+        }
+
         /// <summary>
         /// An entry that reads unchanged after a rewind keeps its markers: gives back the set-aside markers at exactly
         /// <paramref name="entryOffset"/>. Set-aside markers in front of it belonged to entries that changed and stay

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -88,6 +88,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // system clock, ImeLogHost rewires it to the agent IClock, tests to their VirtualClock.
         internal Func<DateTime> UtcNowProvider { get; set; } = () => DateTime.UtcNow;
 
+        // Which file a path holds; null when unreadable. Tests swap it to cover that path.
+        internal Func<string, string> FileIdentityProvider { get; set; } = ImeLogFileIdentity.TryRead;
+
+        // False until the bookmarks were checked against the disk once in this process.
+        private bool _fileIdentitiesReconciled;
+
         /// <summary>
         /// CMTrace timestamps from IME are emitted in UTC, but DateTimeKind may arrive as
         /// Unspecified depending on the parser path. Normalize via SpecifyKind=Utc rather than
@@ -494,7 +500,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         public Action OnImeStarted { get; set; }
         public Action<AppPackageState, AppInstallationState, AppInstallationState> OnAppStateChanged { get; set; }
         public Action<string> OnPoliciesDiscovered { get; set; }
-        public Action OnAllAppsCompleted { get; set; }
         public Action OnUserSessionCompleted { get; set; }
         public Action<string> OnImeSessionChange { get; set; }
         // Args: errorCode (may be empty when IME logged none), raw failure line excerpt.
@@ -954,13 +959,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             {
                 if (!Directory.Exists(_logFolder)) return;
                 var inputs = new List<ImeLogEraPreScan.ScanInput>();
-                var files = new List<string>();
-                foreach (var filePath in Directory.EnumerateFiles(_logFolder))
-                {
-                    if (MatchesLogFilePattern(Path.GetFileName(filePath)))
-                        files.Add(filePath);
-                }
-                files.Sort(StringComparer.OrdinalIgnoreCase);
+                var files = EnumerateLogFiles();
+                // First: the read below resets the bookmark of a file that shrank, and the archive
+                // that file moved to during the downtime still needs that bookmark.
+                ReconcileFileIdentities(files);
                 foreach (var filePath in files)
                 {
                     var info = new FileInfo(filePath);
@@ -994,9 +996,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             LoadState();
 
             // Era anchors for the backlog the first pass is about to read (2026-09-04). Runs
-            // before the poll loop so every replayed line already finds its era; read-only on
-            // the position tracker. Replay tooling anchors nothing — its logs did not come from
-            // this device's bootstrap.
+            // before the poll loop so every replayed line already finds its era. Replay tooling
+            // anchors nothing — its logs did not come from this device's bootstrap.
             if (!SimulationMode) PreScanEras();
 
             _cts = new CancellationTokenSource();
@@ -1180,6 +1181,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 {
                     var fullPath = Path.Combine(_logFolder, kvp.Key);
                     _positionTracker.RestorePosition(fullPath, kvp.Value.Position, kvp.Value.LastKnownSize);
+                    _positionTracker.RestoreFileId(fullPath, kvp.Value.FileId);
                 }
             }
 
@@ -1346,7 +1348,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 state.FilePositions[fileName] = new FilePositionData
                 {
                     Position = kvp.Value.Position,
-                    LastKnownSize = kvp.Value.LastKnownSize
+                    LastKnownSize = kvp.Value.LastKnownSize,
+                    FileId = _positionTracker.GetFileId(kvp.Key)
                 };
             }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerStatePersistence.cs

@@ -250,5 +250,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
     {
         public long Position { get; set; }
         public long LastKnownSize { get; set; }
+
+        /// <summary>Which file the position belongs to (see <see cref="LogFilePositionTracker.Reconcile"/>); null on older state files.</summary>
+        public string FileId { get; set; }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/LogFilePositionTracker.cs

@@ -13,12 +13,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         private readonly Dictionary<string, FilePositionState> _positions
             = new Dictionary<string, FilePositionState>(StringComparer.OrdinalIgnoreCase);
 
-        /// <summary>
-        /// Gets the safe read position for a file, detecting rollover/truncation.
-        /// If the current file size is smaller than the stored position, the file
-        /// has been rotated - resets to 0 to read from beginning.
-        /// Returns 0 if no position has been recorded yet.
-        /// </summary>
+        // Which file each path held when last checked (see Reconcile). Apart from _positions: a file
+        // whose identity is known but which no pass looked at yet must still count as unseen for
+        // HasSeen. A null value means the identity could not be read.
+        private readonly Dictionary<string, string> _fileIds
+            = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
         /// <summary>
         /// Whether this file was already observed in an earlier pass.
         /// <para>
@@ -31,6 +31,112 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         /// </summary>
         public bool HasSeen(string filePath) => _positions.ContainsKey(filePath);
 
+        /// <summary>Whether <see cref="Reconcile"/> already looked at this path.</summary>
+        public bool HasIdentity(string filePath) => _fileIds.ContainsKey(filePath);
+
+        /// <summary>The identity recorded for this path, or null.</summary>
+        public string GetFileId(string filePath)
+        {
+            string id;
+            return _fileIds.TryGetValue(filePath, out id) ? id : null;
+        }
+
+        /// <summary>Restores a persisted identity. <see cref="Reconcile"/> checks it against the disk on the next pass.</summary>
+        public void RestoreFileId(string filePath, string fileId)
+        {
+            if (fileId != null) _fileIds[filePath] = fileId;
+        }
+
+        /// <summary>True when the file is smaller than its bookmark: it was rolled over or truncated.</summary>
+        public bool IsBehindBookmark(string filePath, long currentFileSize)
+        {
+            FilePositionState state;
+            return _positions.TryGetValue(filePath, out state) && currentFileSize < state.Position;
+        }
+
+        /// <summary>
+        /// Brings the bookmarks in line with the files on disk. A bookmark belongs to a file, not to
+        /// a name: IME rolls a log by renaming it, so a known file under a new path keeps its
+        /// position and only the bytes behind it are still unread. The old path starts at 0 with
+        /// whatever file it holds next, and keeps its freshness reference because that file was
+        /// written since the last look. Returns the moves.
+        /// <list type="bullet">
+        ///   <item>A file that is still at its old path as well (a hard link) moves nothing.</item>
+        ///   <item>A path that holds another file with no bookmark to take over starts at 0, even
+        ///     when the new file is longer than the old position.</item>
+        ///   <item>An unreadable identity (null) changes nothing, the path keeps its bookmark.</item>
+        /// </list>
+        /// </summary>
+        public List<BookmarkMove> Reconcile(IDictionary<string, string> idByPath)
+        {
+            var moves = new List<BookmarkMove>();
+            var claimed = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            foreach (var entry in idByPath)
+            {
+                if (entry.Value == null || GetFileId(entry.Key) == entry.Value) continue;
+                var holder = FindBookmarkLeftBehind(entry.Value, entry.Key, idByPath);
+                if (holder != null && claimed.Add(holder))
+                    moves.Add(new BookmarkMove(holder, entry.Key, _positions[holder].Position));
+            }
+
+            // In two steps: a path can be source and target at once (X.log becomes _X.log while
+            // _X.log's own file was replaced).
+            var movedStates = new List<FilePositionState>();
+            foreach (var move in moves)
+            {
+                var state = _positions[move.From];
+                movedStates.Add(state);
+                _positions[move.From] = new FilePositionState { LastCheckedUtc = state.LastCheckedUtc };
+                _fileIds.Remove(move.From);
+            }
+            for (var i = 0; i < moves.Count; i++)
+            {
+                _positions[moves[i].To] = movedStates[i];
+                _fileIds[moves[i].To] = idByPath[moves[i].To];
+            }
+
+            foreach (var entry in idByPath)
+            {
+                if (entry.Value == null)
+                {
+                    if (!_fileIds.ContainsKey(entry.Key)) _fileIds[entry.Key] = null;
+                    continue;
+                }
+
+                string known;
+                FilePositionState state;
+                if (_fileIds.TryGetValue(entry.Key, out known) && known != null && known != entry.Value
+                    && _positions.TryGetValue(entry.Key, out state))
+                {
+                    state.Position = 0;
+                    state.LastKnownSize = 0;
+                }
+                _fileIds[entry.Key] = entry.Value;
+            }
+
+            return moves;
+        }
+
+        private string FindBookmarkLeftBehind(string fileId, string newPath, IDictionary<string, string> idByPath)
+        {
+            foreach (var known in _fileIds)
+            {
+                if (known.Value != fileId || string.Equals(known.Key, newPath, StringComparison.OrdinalIgnoreCase)) continue;
+                if (!_positions.ContainsKey(known.Key)) continue;
+
+                string stillThere;
+                if (idByPath.TryGetValue(known.Key, out stillThere) && stillThere == fileId) continue;
+                return known.Key;
+            }
+            return null;
+        }
+
+        /// <summary>
+        /// Gets the safe read position for a file, detecting rollover/truncation.
+        /// If the current file size is smaller than the stored position, the file
+        /// has been rotated - resets to 0 to read from beginning.
+        /// Returns 0 if no position has been recorded yet.
+        /// </summary>
         public long GetSafePosition(string filePath, long currentFileSize)
         {
             FilePositionState state;
@@ -144,6 +250,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         }
     }
 
+    /// <summary>One bookmark that followed its file to a new path.</summary>
+    public sealed class BookmarkMove
+    {
+        public BookmarkMove(string from, string to, long position)
+        {
+            From = from;
+            To = to;
+            Position = position;
+        }
+
+        public string From { get; }
+        public string To { get; }
+        public long Position { get; }
+    }
+
     public class FilePositionState
     {
         public long Position { get; set; }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/RealmJoinWatcher.cs

@@ -114,6 +114,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
     /// fire once; <see cref="RealmJoinPackageStarted"/> / <see cref="RealmJoinPackageCompleted"/>
     /// fire once per <c>(scope, packageId)</c>.
     /// </para>
+    /// <para>
+    /// <see cref="RealmJoinDetected"/> carries the phase RJ is in when the service key is first
+    /// seen in this process — Blank (0) only while the value is not written yet. After an agent
+    /// restart RJ may already be deploying: the engine's restart path and the keep-awake
+    /// hand-over to RJ both read the phase from Detected, because no PhaseChanged follows when
+    /// the phase does not change again.
+    /// </para>
     /// </remarks>
     internal sealed class RealmJoinWatcher : IDisposable
     {
@@ -127,6 +134,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         internal delegate bool KeyExistsDelegate(RegistryHive hive, string subPath);
         internal delegate RealmJoinVersionInfo ReadVersionInfoDelegate();
         internal delegate string? ReadUninstallDisplayVersionDelegate();
+        internal delegate int? ReadDeploymentPhaseDelegate();
 
         /// <summary>
         /// Debounce for the Uninstall-key watcher. Longer than <see cref="DebounceMilliseconds"/>:
@@ -141,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         private readonly KeyExistsDelegate _keyExists;
         private readonly ReadVersionInfoDelegate _readVersionInfo;
         private readonly ReadUninstallDisplayVersionDelegate _readUninstallDisplayVersion;
+        private readonly ReadDeploymentPhaseDelegate _readDeploymentPhase;
         private readonly object _stateLock = new object();
 
         // Auto-update stage (armed once Detected fired, held until Stop).
@@ -204,7 +213,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             TryReadPackageDelegate tryReadPackage,
             KeyExistsDelegate keyExists,
             ReadVersionInfoDelegate? readVersionInfo = null,
-            ReadUninstallDisplayVersionDelegate? readUninstallDisplayVersion = null)
+            ReadUninstallDisplayVersionDelegate? readUninstallDisplayVersion = null,
+            ReadDeploymentPhaseDelegate? readDeploymentPhase = null)
         {
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
             _enumeratePackageIds = enumeratePackageIds ?? throw new ArgumentNullException(nameof(enumeratePackageIds));
@@ -212,6 +222,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             _keyExists = keyExists ?? throw new ArgumentNullException(nameof(keyExists));
             _readVersionInfo = readVersionInfo ?? RealmJoinInfo.TryReadRealmJoinVersionInfo;
             _readUninstallDisplayVersion = readUninstallDisplayVersion ?? RealmJoinInfo.TryReadUninstallDisplayVersion;
+            _readDeploymentPhase = readDeploymentPhase ?? (() => RealmJoinInfo.TryReadDeploymentPhase(RegistryHive.LocalMachine));
         }
 
         public void Start()
@@ -452,14 +463,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                 }
             }
 
-            // The appearance of Services\realmjoin is itself the RJ-detected signal —
-            // surface it even if Parameters\DeploymentPhase isn't populated yet. The package
-            // watchers (HKLM + HKU SOFTWARE\RealmJoin) intentionally stay disarmed here:
-            // NotifyRealmJoinPresence arms them once DeploymentPhase >= PhaseRunningThresholdMin
-            // is observed. Before that the same subtree may still receive in-flight IME
-            // package writes that are not part of RJ's lifecycle.
-            NotifyRealmJoinPresence(phase: null);
-            CheckParameters();
+            NotifyServiceStageAttached();
+        }
+
+        /// <summary>
+        /// The appearance of Services\realmjoin is itself the RJ-detected signal — surfaced even
+        /// if Parameters\DeploymentPhase isn't populated yet. One read feeds Detected, so it
+        /// carries the phase RJ is in right now (see the class remarks). The package watchers
+        /// (HKLM + HKU SOFTWARE\RealmJoin) stay disarmed below PhaseRunningThresholdMin: before
+        /// that the same subtree may still receive in-flight IME package writes that are not
+        /// part of RJ's lifecycle.
+        /// </summary>
+        private void NotifyServiceStageAttached()
+        {
+            int? phase = null;
+            try { phase = _readDeploymentPhase(); }
+            catch (Exception ex) { _logger.Warning($"RealmJoinWatcher: DeploymentPhase read at attach threw: {ex.Message}"); }
+            NotifyRealmJoinPresence(phase);
         }
 
         private void AttachMachineRealmJoinSubtreeWatcher()
@@ -550,7 +570,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         {
             try
             {
-                var phase = RealmJoinInfo.TryReadDeploymentPhase(RegistryHive.LocalMachine);
+                var phase = _readDeploymentPhase();
                 if (phase == null) return;
                 NotifyRealmJoinPresence(phase);
             }
@@ -580,6 +600,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                 fireDetected = !_detectedFired;
                 if (fireDetected) _detectedFired = true;
 
+                // Detected reports Blank (0) while the value is not written yet. That report is
+                // the baseline, so a first real value of 100+ surfaces as PhaseChanged instead of
+                // silently setting _lastPhase.
+                if (fireDetected && !phase.HasValue && !_lastPhase.HasValue) _lastPhase = 0;
+
                 if (phase.HasValue)
                 {
                     if (_lastPhase.HasValue && _lastPhase.Value != phase.Value)
@@ -926,6 +951,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
 
         // Test seams — drive the read paths deterministically without touching the real registry.
         internal void TriggerCheckParametersFromTest() => CheckParameters();
+        internal void TriggerServiceStageAttachedFromTest() => NotifyServiceStageAttached();
         internal void TriggerCheckMachinePackagesFromTest() => CheckMachinePackages();
         internal void TriggerCheckUserPackagesFromTest() => CheckUserPackages();
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/FileNativeMethods.cs

@@ -9,6 +9,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
     /// Win32 file-handle declarations for <c>PinnedSourceFolder</c>: open a file or directory
     /// without following a reparse point at its final component, and ask the handle where it
     /// really points (<c>GetFinalPathNameByHandle</c>) instead of trusting the path string.
+    /// <c>ImeLogFileIdentity</c> reads a file's identity through the same declarations.
     /// </summary>
     internal static class FileNativeMethods
     {
@@ -18,6 +19,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
 
         public const uint FILE_SHARE_READ = 0x1;
         public const uint FILE_SHARE_WRITE = 0x2;
+        public const uint FILE_SHARE_DELETE = 0x4;
 
         public const uint OPEN_EXISTING = 3;
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/WinHttpNativeMethods.cs

@@ -0,0 +1,41 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
+{
+    internal static class WinHttpNativeMethods
+    {
+        public const int ERROR_FILE_NOT_FOUND = 2;
+        public const uint WINHTTP_ACCESS_TYPE_NAMED_PROXY = 3;
+
+        [StructLayout(LayoutKind.Sequential)]
+        public struct WINHTTP_CURRENT_USER_IE_PROXY_CONFIG
+        {
+            [MarshalAs(UnmanagedType.Bool)]
+            public bool fAutoDetect;
+            public IntPtr lpszAutoConfigUrl;
+            public IntPtr lpszProxy;
+            public IntPtr lpszProxyBypass;
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        public struct WINHTTP_PROXY_INFO
+        {
+            public uint dwAccessType;
+            public IntPtr lpszProxy;
+            public IntPtr lpszProxyBypass;
+        }
+
+        [DllImport("winhttp.dll", SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        public static extern bool WinHttpGetIEProxyConfigForCurrentUser(ref WINHTTP_CURRENT_USER_IE_PROXY_CONFIG config);
+
+        [DllImport("winhttp.dll", SetLastError = true)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        public static extern bool WinHttpGetDefaultProxyConfiguration(ref WINHTTP_PROXY_INFO info);
+
+        // WinHTTP allocates the strings of both structs with GlobalAlloc; the caller frees them.
+        [DllImport("kernel32.dll", SetLastError = true)]
+        public static extern IntPtr GlobalFree(IntPtr hMem);
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/DeviceInfo/DeviceInfoCollector.NetworkAndSecurity.cs

@@ -11,6 +11,7 @@ using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
 using AutopilotMonitor.Agent.V2.Core.Orchestration;
 using AutopilotMonitor.Agent.V2.Core.Security;
+using AutopilotMonitor.Agent.V2.Core.Transport;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared;
@@ -113,34 +114,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
         {
             try
             {
-                var data = new Dictionary<string, object>();
-
-                using (var key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Internet Settings"))
-                {
-                    if (key != null)
-                    {
-                        data["proxyEnabled"] = key.GetValue("ProxyEnable")?.ToString() == "1";
-                        data["proxyServer"] = key.GetValue("ProxyServer")?.ToString();
-                        data["proxyOverride"] = key.GetValue("ProxyOverride")?.ToString();
-                        data["autoConfigUrl"] = key.GetValue("AutoConfigURL")?.ToString();
-                    }
-                }
-
-                // Also check WinHTTP proxy
-                using (var key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections"))
-                {
-                    data["winHttpProxyConfigured"] = key?.GetValue("WinHttpSettings") != null;
-                }
-
-                var proxyType = "Direct";
-                if (data.ContainsKey("proxyEnabled") && (bool)data["proxyEnabled"])
-                    proxyType = "Proxy";
-                else if (data.ContainsKey("autoConfigUrl") && data["autoConfigUrl"] != null)
-                    proxyType = "PAC";
-
-                data["proxyType"] = proxyType;
-
-                EmitDeviceInfoEvent(Constants.EventTypes.ProxyConfiguration, $"Proxy configuration: {proxyType}", data);
+                var settings = ProxySettingsReader.Read();
+                EmitDeviceInfoEvent(Constants.EventTypes.ProxyConfiguration, $"Proxy configuration: {settings.ProxyType}", settings.ToEventData());
             }
             catch (Exception ex)
             {
@@ -1004,7 +979,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.DeviceInfo
             var fingerprint = Persistence.StartupEventGate.ComputeFingerprint(data, excludedFields);
             if (_startupGate.ShouldEmit(eventType, fingerprint)) return true;
 
-            _logger.Debug($"EnrollmentTracker: '{eventType}' suppressed — payload unchanged since last emission (restart dedup)");
+            _logger.Debug($"EnrollmentTracker: '{eventType}' suppressed — payload unchanged since last emission (restart dedup)", repeatKey: "DeviceInfo.unchanged:" + eventType);
             return false;
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Periodic/NetworkChangeDetector.cs

@@ -160,6 +160,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Periodic
             // Suppress events when network hasn't actually changed (DHCP renewals, OS chatter)
             if (previousState != null && previousState.IsSameNetwork(newState))
             {
+                // Every occurrence on purpose, no repeatKey: when it happened is the information
+                // (did anything move on the network when uploads stopped?).
                 _logger.Debug("NetworkChangeDetector: network address changed but same logical network — suppressing");
                 return;
             }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/DistressReporter.cs

@@ -194,7 +194,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
             catch (Exception ex)
             {
                 // Swallow — distress channel must never cascade failures into the caller
-                _logger?.Debug($"[DistressChannel] Failed to send report: {ex.Message}");
+                _logger?.Debug($"[DistressChannel] Failed to send report: {TransportErrorCodes.DescribeSendFailure(ex)}");
             }
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/EmergencyReporter.cs

@@ -180,7 +180,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
             catch (Exception ex)
             {
                 // Swallow — emergency channel must never cascade failures into the caller
-                _logger?.Debug($"[EmergencyChannel] Failed to send report: {ex.Message}");
+                _logger?.Debug($"[EmergencyChannel] Failed to send report: {TransportErrorCodes.DescribeSendFailure(ex)}");
             }
 
             if (!delivered)

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Transport/TransportErrorCodes.cs

@@ -1,6 +1,8 @@
 using System;
 using System.ComponentModel;
 using System.Globalization;
+using System.Net;
+using System.Net.Sockets;
 
 namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
 {
@@ -31,6 +33,38 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Transport
             return code == null ? ex.Message : $"{ex.Message} (win32 {code})";
         }
 
+        /// <summary>
+        /// What a failed send hit, in one line: the <see cref="WebException.Status"/>, the socket error
+        /// or native code, and the innermost message. On .NET Framework a socket error's message names
+        /// the endpoint it tried, which tells a backend that does not answer from a proxy that does not.
+        /// </summary>
+        public static string DescribeSendFailure(Exception ex)
+        {
+            if (ex == null) return null;
+
+            WebExceptionStatus? status = null;
+            SocketError? socketError = null;
+            var innermost = ex;
+            for (var current = ex; current != null; current = current.InnerException)
+            {
+                innermost = current;
+                if (current is WebException web && status == null) status = web.Status;
+                if (current is SocketException socket) socketError = socket.SocketErrorCode;
+            }
+
+            var code = socketError.HasValue ? $"socket={socketError.Value}" : NativeCodePart(ex);
+            var details = status.HasValue
+                ? (code == null ? $"status={status.Value}" : $"status={status.Value}, {code}")
+                : code;
+            return details == null ? innermost.Message : $"{details}: {innermost.Message}";
+        }
+
+        private static string NativeCodePart(Exception ex)
+        {
+            var code = InnermostNativeCode(ex);
+            return code == null ? null : $"win32={code}";
+        }
+
         /// <summary>Eight-digit hex with <c>0x</c>: <c>-2146893018</c> → <c>0x80090326</c>.</summary>
         public static string Hex(int value) => "0x" + value.ToString("X8", CultureInfo.InvariantCulture);
     }

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/DefaultComponentFactory.cs

@@ -96,6 +96,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// </summary>
         private readonly DateTime? _previousRunLastAliveUtc;
 
+        private readonly Transport.ProxyObserver? _proxyObserver;
+
         public DefaultComponentFactory(
             AgentConfiguration agentConfig,
             AgentConfigResponse remoteConfig,
@@ -105,7 +107,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             Persistence.StartupEventGate? startupEventGate = null,
             DateTime? previousBootUtc = null,
             string? previousExitType = null,
-            DateTime? previousRunLastAliveUtc = null)
+            DateTime? previousRunLastAliveUtc = null,
+            Transport.ProxyObserver? proxyObserver = null)
         {
             _agentConfig = agentConfig ?? throw new ArgumentNullException(nameof(agentConfig));
             _remoteConfig = remoteConfig ?? throw new ArgumentNullException(nameof(remoteConfig));
@@ -116,6 +119,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             _previousBootUtc = previousBootUtc;
             _previousExitType = previousExitType;
             _previousRunLastAliveUtc = previousRunLastAliveUtc;
+            _proxyObserver = proxyObserver;
         }
 
         /// <summary>
@@ -352,28 +356,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             hosts.Add(aadJoinHost);
             aadJoinHostRef = aadJoinHost;
 
-            // RealmJoin support is opt-in per tenant (portal toggle → AnalyzerConfiguration.
-            // EnableRealmJoinWatcher, default off). When disabled, leave realmJoinHost null:
-            // the DesktopArrival observer above already null-guards it, so the HKU watcher is
-            // never armed and no RealmJoin signals are produced. The compile-time const
-            // RealmJoinHost.RealmJoinTrackingEnabled remains a build-time master kill-switch;
-            // the effective enable is (remote flag AND const).
             var analyzers = _remoteConfig.Analyzers ?? new AnalyzerConfiguration();
-            if (analyzers.EnableRealmJoinWatcher && RealmJoinHost.RealmJoinTrackingEnabled)
-            {
-                realmJoinHost = new RealmJoinHost(logger, ingress, clock);
-                hosts.Add(realmJoinHost);
-            }
-            else
-            {
-                logger.Info($"DefaultComponentFactory: RealmJoinHost not created (EnableRealmJoinWatcher={analyzers.EnableRealmJoinWatcher}, RealmJoinTrackingEnabled={RealmJoinHost.RealmJoinTrackingEnabled})");
-            }
 
             // Keep-awake during User-ESP — opt-in per tenant (portal toggle → AnalyzerConfiguration.
             // KeepAwakeDuringUserEsp, default off). The host observes the signal rail and holds the
-            // device awake (system + display) from AccountSetup entry until provisioning completes
-            // (or a safety cap), so idle standby cannot stall app installs / account setup. Reboots
+            // device awake (system + display) from AccountSetup entry until the user-ESP page
+            // closes — with the RealmJoin Watcher on, until RealmJoin starts its deployment (D-413) —
+            // or a safety cap, so idle standby cannot stall app installs / account setup. Reboots
             // are unaffected; the OS auto-clears the hold on process exit.
+            // ORDER: before the RealmJoinHost — after an agent restart the watcher posts
+            // realmjoin_detected from its own Start, and this host must already be subscribed.
             if (analyzers.KeepAwakeDuringUserEsp)
             {
                 hosts.Add(new UserEspKeepAwakeHost(
@@ -382,7 +374,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                     logger: logger,
                     // q8n: release on the user-ESP page exit, i.e. a Shell-Core 62407 that arrives
                     // after the AccountSetup registry left notStarted — never on the handoff exit.
-                    accountSetupProgressProbe: () => espAndHelloHost.HasAccountSetupProgress));
+                    accountSetupProgressProbe: () => espAndHelloHost.HasAccountSetupProgress,
+                    // D-414: that exit is latched here, so a later agent run does not engage again.
+                    startupGate: _startupEventGate));
+            }
+
+            // RealmJoin support is opt-in per tenant (portal toggle → AnalyzerConfiguration.
+            // EnableRealmJoinWatcher, default off). When disabled, leave realmJoinHost null:
+            // the DesktopArrival observer above already null-guards it, so the HKU watcher is
+            // never armed and no RealmJoin signals are produced. The compile-time const
+            // RealmJoinHost.RealmJoinTrackingEnabled remains a build-time master kill-switch;
+            // the effective enable is (remote flag AND const).
+            if (analyzers.EnableRealmJoinWatcher && RealmJoinHost.RealmJoinTrackingEnabled)
+            {
+                realmJoinHost = new RealmJoinHost(logger, ingress, clock);
+                hosts.Add(realmJoinHost);
+            }
+            else
+            {
+                logger.Info($"DefaultComponentFactory: RealmJoinHost not created (EnableRealmJoinWatcher={analyzers.EnableRealmJoinWatcher}, RealmJoinTrackingEnabled={RealmJoinHost.RealmJoinTrackingEnabled})");
             }
 
             // OOBE-console / Shift+F10 detection — opt-OUT per tenant (portal toggle →
@@ -666,6 +676,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 clock: clock,
                 logger: logger));
 
+            // The exact time of a proxy change for the agent log and the timeline. Always on: when
+            // this matters, nothing else from the device reaches the backend.
+            if (_proxyObserver != null)
+            {
+                hosts.Add(new ProxySettingsHost(
+                    observer: _proxyObserver,
+                    ingress: ingress,
+                    clock: clock,
+                    logger: logger));
+            }
+
             // Live AC/battery watcher — WMI Win32_PowerManagementEvent push (no polling), emits
             // power_state_change on AC↔battery transitions and 50/30/15 % downward threshold
             // crossings. Deliberately NOT under PeriodicCollectorLifecycleHost: it is push-based

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/ProxySettingsHost.cs

@@ -0,0 +1,137 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime;
+using AutopilotMonitor.Agent.V2.Core.Transport;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Win32;
+
+namespace AutopilotMonitor.Agent.V2.Core.Orchestration
+{
+    /// <summary>
+    /// Tells <see cref="ProxyObserver"/> the moment proxy settings change, so the log has the exact
+    /// time. A watcher that fails costs only that time: the observer compares again on every failed
+    /// upload.
+    /// </summary>
+    internal sealed class ProxySettingsHost : ICollectorHost
+    {
+        private const string Source = "ProxySettingsHost";
+        private const int DebounceMs = 1000;
+
+        // The whole subtree: "Connections" does not exist yet in an account nothing has written to.
+        // HKCU of a SYSTEM process is HKU\S-1-5-18.
+        private const string AccountSettingsKey = @"Software\Microsoft\Windows\CurrentVersion\Internet Settings";
+        // Holds WinHttpSettings, which netsh winhttp writes.
+        private const string MachineConnectionsKey = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections";
+
+        private const RegistryNativeMethods.RegChangeNotifyFilter Filter =
+            RegistryNativeMethods.RegChangeNotifyFilter.Name |
+            RegistryNativeMethods.RegChangeNotifyFilter.LastSet;
+
+        private readonly ProxyObserver _observer;
+        private readonly InformationalEventPost _post;
+        private readonly AgentLogger _logger;
+        private readonly List<RegistryWatcher> _watchers = new List<RegistryWatcher>();
+        private readonly Timer _debounce;
+        private int _started;
+        private int _stopped;
+
+        public string Name => "ProxySettingsWatcher";
+
+        public ProxySettingsHost(
+            ProxyObserver observer,
+            ISignalIngressSink ingress,
+            IClock clock,
+            AgentLogger logger)
+        {
+            if (ingress == null) throw new ArgumentNullException(nameof(ingress));
+            if (clock == null) throw new ArgumentNullException(nameof(clock));
+            _observer = observer ?? throw new ArgumentNullException(nameof(observer));
+            _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+            _post = new InformationalEventPost(ingress, clock);
+            _debounce = new Timer(_ => OnDebounceElapsed(), null, Timeout.Infinite, Timeout.Infinite);
+
+            AddWatcher(RegistryHive.CurrentUser, AccountSettingsKey, watchSubtree: true, "account settings");
+            AddWatcher(RegistryHive.LocalMachine, MachineConnectionsKey, watchSubtree: false, "WinHTTP settings");
+        }
+
+        private void AddWatcher(RegistryHive hive, string subKey, bool watchSubtree, string label)
+        {
+            var watcher = new RegistryWatcher(hive, subKey, watchSubtree, RegistryView.Registry64, Filter);
+            watcher.Changed += (_, _) => _debounce.Change(DebounceMs, Timeout.Infinite);
+            watcher.Error += (_, ex) => _logger.Warning($"ProxySettingsHost: {label} watcher error - {ex.GetType().Name}: {ex.Message}");
+            _watchers.Add(watcher);
+        }
+
+        public void Start()
+        {
+            if (Interlocked.Exchange(ref _started, 1) == 1) return;
+
+            _observer.SettingsChanged += OnSettingsChanged;
+            foreach (var watcher in _watchers)
+            {
+                try { watcher.Start(); }
+                catch (Exception ex) { _logger.Warning($"ProxySettingsHost: a watcher failed to start: {ex.Message}"); }
+            }
+
+            // Whatever moved between the baseline and the start of the watchers.
+            OnDebounceElapsed();
+        }
+
+        public void Stop()
+        {
+            if (Interlocked.Exchange(ref _stopped, 1) == 1) return;
+
+            DisposeWatchers();
+            _observer.SettingsChanged -= OnSettingsChanged;
+            if (Volatile.Read(ref _started) == 1) _observer.LogOpenFailures();
+        }
+
+        public void Dispose()
+        {
+            Stop();
+            _debounce.Dispose();
+        }
+
+        private void DisposeWatchers()
+        {
+            foreach (var watcher in _watchers)
+            {
+                try { watcher.Dispose(); }
+                catch (Exception ex) { _logger.Debug($"ProxySettingsHost: disposing a watcher threw: {ex.Message}"); }
+            }
+            _watchers.Clear();
+        }
+
+        private void OnDebounceElapsed()
+        {
+            _logger.Trace("ProxySettingsHost: checking the proxy settings.");
+            try { _observer.CheckForChange(); }
+            catch (Exception ex) { _logger.Warning($"ProxySettingsHost: checking the proxy settings failed: {ex.Message}"); }
+        }
+
+        /// <summary>
+        /// Waits in the spool if uploads are down, so the timeline explains the gap once they work
+        /// again. The portal shows the newest event of this type.
+        /// </summary>
+        private void OnSettingsChanged(ProxySettings settings, string what, string route)
+        {
+            var data = settings.ToEventData();
+            data["trigger"] = "changed";
+            data["change"] = what;
+            data["route"] = route;
+
+            _post.Emit(
+                eventType: Constants.EventTypes.ProxyConfiguration,
+                source: Source,
+                message: $"Proxy settings changed: {what}",
+                severity: EventSeverity.Warning,
+                typedPayload: data);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/Hosts/UserEspKeepAwakeHost.cs

@@ -1,10 +1,12 @@
 #nullable enable
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Threading;
 using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
 using AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime;
+using AutopilotMonitor.Agent.V2.Core.Persistence;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.Shared;
@@ -21,11 +23,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
     /// It observes the central signal rail (<see cref="SignalIngress.SignalPosted"/>, the same
     /// hook <c>GatherRuleExecutorHost</c> uses for phase_change triggers):
     /// <list type="bullet">
-    ///   <item><b>Engage</b> when a signal reports the ESP phase as <c>AccountSetup</c>.</item>
+    ///   <item><b>Engage</b> when a signal reports the ESP phase as <c>AccountSetup</c> — unless the
+    ///     user-ESP page already closed in this enrollment (D-414). The page exit is latched in the
+    ///     <see cref="StartupEventGate"/>, because after an agent restart the AccountSetup phase
+    ///     reaches the rail again (IME logs it at the next sign-in, and the adapter's dedup lives
+    ///     per process).</item>
     ///   <item><b>Release</b> on <see cref="DecisionSignalKind.EspExiting"/> once the AccountSetup
     ///     registry shows progress (the real user-ESP page exit — see below), on
     ///     <see cref="Stop"/> (session teardown), or on the safety-cap timer (a backstop so a
     ///     device is never held awake for the agent's full max-lifetime).</item>
+    ///   <item><b>RealmJoin hand-over</b> (D-413): RealmJoin signals only exist when the tenant runs
+    ///     the RealmJoin Watcher. When RealmJoin was detected and is still Blank as the user-ESP
+    ///     page closes, the hold stays until RealmJoin leaves Blank (it keeps the device awake
+    ///     itself from there), bounded by <see cref="RealmJoinStartWaitMinutes"/>. RealmJoin
+    ///     leaving Blank ends any hold; once it has, the host does not engage in this process.</item>
     /// </list>
     /// The hold itself is owned by <see cref="KeepAwakeController"/>; the OS also auto-clears it
     /// on process exit / reboot, so it can never leak.
@@ -57,7 +68,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
     /// than host construction) means the ESP policy is already present in the registry. When the
     /// value is unavailable (ESP skipped, WDP v2 with no ESP, or unreadable) the cap falls back to
     /// <see cref="DefaultFallbackCapMinutes"/>. The resolved cap and its source are reported on the
-    /// <c>keep_awake_engaged</c> event for fleet-wide observability.
+    /// <c>keep_awake_engaged</c> event for fleet-wide observability. The RealmJoin wait replaces
+    /// this cap when the page closes: one timer, one bound per phase of the hold.
     /// </para>
     /// </summary>
     internal sealed class UserEspKeepAwakeHost : ICollectorHost
@@ -78,9 +90,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// </summary>
         internal const int EspCapMarginMinutes = 30;
 
+        /// <summary>
+        /// How long the hold waits for RealmJoin to leave Blank after the user-ESP page closed
+        /// (D-413 has the measured start delays behind the value).
+        /// </summary>
+        internal const int RealmJoinStartWaitMinutes = 30;
+
+        /// <summary><see cref="StartupEventGate"/> latch: the user-ESP page closed in this enrollment (D-414).</summary>
+        internal const string UserEspPageClosedKey = "keep_awake.user_esp_page_closed";
+
         // Release reasons (carried on the keep_awake_released event payload). "account_setup_complete"
         // (release on the synthesized completion signal) was retired with q8n — see the class doc.
         internal const string ReasonUserEspExited = "user_esp_exited";
+        internal const string ReasonRealmJoinStarted = "realmjoin_started";
+        internal const string ReasonRealmJoinNotStarted = "realmjoin_not_started";
         internal const string ReasonHostStop = "host_stop";
         internal const string ReasonSafetyCap = "safety_cap";
 
@@ -92,13 +115,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         private static readonly string AccountSetupPhaseName = EnrollmentPhase.AccountSetup.ToString();
 
         private readonly AgentLogger _logger;
+        private readonly IClock _clock;
         private readonly InformationalEventPost _post;
         private readonly KeepAwakeController _controller;
         private readonly SignalIngress? _observableIngress;
         private readonly int _fallbackCapMinutes;
         private readonly TimeSpan? _safetyCapOverride;
+        private readonly TimeSpan _realmJoinStartWait;
         private readonly Func<int?> _espTimeoutProvider;
         private readonly Func<bool> _accountSetupProgressProbe;
+        private readonly StartupEventGate? _startupGate;
 
         private enum HoldState { Idle, Engaging, Engaged, Released }
 
@@ -107,7 +133,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         private Timer? _safetyCapTimer;
         private HoldState _state = HoldState.Idle;  // guarded by _gate
         private int _activeCapMinutes;              // guarded by _gate — for the cap-elapsed log line
+        private int _capGeneration;                 // guarded by _gate — a superseded timer callback is ignored
+        private bool _awaitingRealmJoin;            // guarded by _gate — page closed, RealmJoin still Blank
+        private DateTime _userEspExitedUtc;         // guarded by _gate — valid while _awaitingRealmJoin
         private int _disposed;
+        private int _pageClosedLatched;             // 0/1 — the latch write runs once per process
+
+        // RealmJoin observations of this process. Monotonic, written on the posting thread so the
+        // ThreadPool work that follows always sees them (0/1 for Volatile/Interlocked).
+        private int _realmJoinDetected;
+        private int _realmJoinStarted;
 
         public UserEspKeepAwakeHost(
             ISignalIngressSink ingress,
@@ -117,17 +152,20 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             KeepAwakeController? controller = null,
             TimeSpan? safetyCapOverride = null,
             Func<int?>? espTimeoutProvider = null,
-            Func<bool>? accountSetupProgressProbe = null)
+            Func<bool>? accountSetupProgressProbe = null,
+            TimeSpan? realmJoinStartWaitOverride = null,
+            StartupEventGate? startupGate = null)
         {
             if (ingress == null) throw new ArgumentNullException(nameof(ingress));
-            if (clock == null) throw new ArgumentNullException(nameof(clock));
+            _clock = clock ?? throw new ArgumentNullException(nameof(clock));
             _logger = logger ?? throw new ArgumentNullException(nameof(logger));
             _post = new InformationalEventPost(ingress, clock, logger);
             _controller = controller ?? new KeepAwakeController(logger);
             _observableIngress = ingress as SignalIngress;
             _fallbackCapMinutes = fallbackCapMinutes > 0 ? fallbackCapMinutes : DefaultFallbackCapMinutes;
-            // safetyCapOverride is a test seam for a fixed (e.g. sub-second) cap.
+            // safetyCapOverride / realmJoinStartWaitOverride are test seams for fixed (e.g. sub-second) bounds.
             _safetyCapOverride = safetyCapOverride;
+            _realmJoinStartWait = realmJoinStartWaitOverride ?? TimeSpan.FromMinutes(RealmJoinStartWaitMinutes);
             // The ESP SyncFailureTimeout is read at engage time (the ESP policy is present by then).
             _espTimeoutProvider = espTimeoutProvider
                 ?? (() => EspSkipConfigurationProbe.ReadFull(_logger).SyncFailureTimeoutMinutes);
@@ -135,6 +173,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             // lasts until the safety cap (erring long, never early). Production always wires the
             // EspAndHelloHost probe (DefaultComponentFactory).
             _accountSetupProgressProbe = accountSetupProgressProbe ?? (() => false);
+            // Without a gate (tests) the page-closed latch is off and every agent run engages anew.
+            _startupGate = startupGate;
         }
 
         /// <summary>
@@ -180,21 +220,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             // (which briefly waits on the keep-awake thread) is dispatched to the ThreadPool.
             try
             {
-                if (kind == DecisionSignalKind.EspExiting)
+                switch (kind)
                 {
-                    // Only the user-ESP page exit releases: the Device→Account handoff 62407 arrives
-                    // before any AccountSetup subcategory has left notStarted, the real exit after.
-                    // Cheap to skip while idle; the probe is a locked dictionary scan.
-                    if (IsEngagedOrEngaging() && ProbeAccountSetupProgress())
-                        ThreadPool.QueueUserWorkItem(_ => SafeRelease(ReasonUserEspExited, EventSeverity.Info));
-                    return;
+                    case DecisionSignalKind.EspExiting:
+                        // Only the user-ESP page exit counts: the Device→Account handoff 62407 arrives
+                        // before any AccountSetup subcategory has left notStarted, the real exit after.
+                        // Checked in every hold state — the page-closed latch (D-414) must also be set
+                        // while idle, capped or waiting. The probe is a locked dictionary scan.
+                        if (ProbeAccountSetupProgress())
+                            ThreadPool.QueueUserWorkItem(_ => SafeRun(OnUserEspPageClosed, "user-ESP exit"));
+                        return;
+
+                    case DecisionSignalKind.RealmJoinDetected:
+                    case DecisionSignalKind.RealmJoinPhaseChanged:
+                    case DecisionSignalKind.RealmJoinResolved:
+                        ObserveRealmJoin(kind, payload);
+                        return;
                 }
 
                 if (payload != null
                     && payload.TryGetValue(SignalPayloadKeys.EspPhase, out var phaseName)
                     && string.Equals(phaseName, AccountSetupPhaseName, StringComparison.OrdinalIgnoreCase))
                 {
-                    ThreadPool.QueueUserWorkItem(_ => SafeEngage());
+                    ThreadPool.QueueUserWorkItem(_ => SafeRun(Engage, "engage"));
                 }
             }
             catch (Exception ex)
@@ -203,15 +251,30 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             }
         }
 
-        private void SafeEngage()
+        /// <summary>
+        /// Records what the RealmJoin Watcher reported. The flags are set here, on the posting
+        /// thread, before any work is queued: the ThreadPool items run in no fixed order, and each
+        /// re-checks the hold state under <see cref="_gate"/>, so no hand-over is lost.
+        /// </summary>
+        private void ObserveRealmJoin(DecisionSignalKind kind, IReadOnlyDictionary<string, string>? payload)
         {
-            try { Engage(); }
-            catch (Exception ex) { _logger.Error("UserEspKeepAwakeHost: engage failed.", ex); }
+            Volatile.Write(ref _realmJoinDetected, 1);
+
+            // Resolved is phase 110 by definition; Detected and PhaseChanged carry the phase.
+            var leftBlank = kind == DecisionSignalKind.RealmJoinResolved
+                || (payload != null
+                    && payload.TryGetValue(DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase, out var raw)
+                    && int.TryParse(raw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var phase)
+                    && phase >= RealmJoinInfo.PhaseRunningThresholdMin);
+
+            if (leftBlank && Interlocked.Exchange(ref _realmJoinStarted, 1) == 0)
+                ThreadPool.QueueUserWorkItem(_ => SafeRun(OnRealmJoinStarted, "RealmJoin hand-over"));
         }
 
-        private bool IsEngagedOrEngaging()
+        private void SafeRun(Action work, string what)
         {
-            lock (_gate) { return _state == HoldState.Engaging || _state == HoldState.Engaged; }
+            try { work(); }
+            catch (Exception ex) { _logger.Error($"UserEspKeepAwakeHost: {what} failed.", ex); }
         }
 
         private bool ProbeAccountSetupProgress()
@@ -224,12 +287,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             }
         }
 
-        private void SafeRelease(string reason, EventSeverity severity)
-        {
-            try { Release(reason, severity, emit: true); }
-            catch (Exception ex) { _logger.Error("UserEspKeepAwakeHost: release failed.", ex); }
-        }
-
         /// <summary>Engage the hold exactly once (Idle → Engaging → Engaged). No-op from any other state.</summary>
         private void Engage()
         {
@@ -239,6 +296,22 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             lock (_gate)
             {
                 if (_state != HoldState.Idle) return;
+                if (UserEspPageClosedEarlier())
+                {
+                    // Typically after an agent restart: the AccountSetup phase reached the rail
+                    // again, but the user-ESP page of this enrollment is already gone.
+                    _state = HoldState.Released;
+                    _logger.Info("UserEspKeepAwakeHost: the user-ESP page already closed in this enrollment — keep-awake not engaged.");
+                    return;
+                }
+                if (Volatile.Read(ref _realmJoinStarted) == 1)
+                {
+                    // Only after an agent restart: RealmJoin deploys (or is done) before the
+                    // AccountSetup phase is seen again — nothing left to hand over.
+                    _state = HoldState.Released;
+                    _logger.Info("UserEspKeepAwakeHost: RealmJoin has already started its deployment — keep-awake not engaged.");
+                    return;
+                }
                 // L16 (delta review 2026-07-02): claim the transition, but run the controller's
                 // Engage OUTSIDE the lock — it can block up to ~5 s on the keep-awake thread's
                 // ready-wait, and holding _gate across that stalled a concurrent Stop→Release.
@@ -272,8 +345,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 }
 
                 _activeCapMinutes = capMinutes;
-                // One-shot backstop (NOT periodic): fire once after the cap, then release.
-                _safetyCapTimer = new Timer(OnSafetyCapElapsed, null, cap, Timeout.InfiniteTimeSpan);
+                // One-shot backstop (NOT periodic). The page may have closed while engaging — then
+                // the RealmJoin wait is the bound already.
+                ArmCapTimer(_awaitingRealmJoin ? _realmJoinStartWait : cap);
                 _state = HoldState.Engaged;
             }
 
@@ -281,7 +355,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             {
                 ["osAccepted"] = osAccepted ? "true" : "false",
                 ["scope"] = "system+display",
-                ["capMinutes"] = capMinutes.ToString(),
+                ["capMinutes"] = capMinutes.ToString(CultureInfo.InvariantCulture),
                 ["capSource"] = capSource,
             });
         }
@@ -296,41 +370,151 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             }
         }
 
+        /// <summary>
+        /// The user-ESP page closed. The fact is latched for later agent runs first. Without
+        /// RealmJoin, or with RealmJoin already past Blank, the hold ends here. With RealmJoin still
+        /// Blank it waits for the hand-over: the ESP-sized cap gives way to the RealmJoin wait.
+        /// </summary>
+        private void OnUserEspPageClosed()
+        {
+            LatchUserEspPageClosed();
+
+            lock (_gate)
+            {
+                if (_state != HoldState.Engaging && _state != HoldState.Engaged) return;
+                if (_awaitingRealmJoin) return; // a repeated exit signal
+
+                if (Volatile.Read(ref _realmJoinDetected) == 1 && Volatile.Read(ref _realmJoinStarted) == 0)
+                {
+                    _awaitingRealmJoin = true;
+                    _userEspExitedUtc = _clock.UtcNow;
+                    // While Engaging, Engage arms the wait when it completes.
+                    if (_state == HoldState.Engaged) ArmCapTimer(_realmJoinStartWait);
+                    _logger.Info($"UserEspKeepAwakeHost: user-ESP page closed before RealmJoin started its deployment — holding keep-awake until it starts (max {_realmJoinStartWait.TotalMinutes:0} min).");
+                    return;
+                }
+            }
+
+            Release(ReasonUserEspExited, EventSeverity.Info);
+        }
+
+        // MarkSucceeded persists at once (fail-soft): the page is gone for this enrollment.
+        private void LatchUserEspPageClosed()
+        {
+            if (_startupGate == null || Interlocked.Exchange(ref _pageClosedLatched, 1) == 1) return;
+            try { _startupGate.MarkSucceeded(UserEspPageClosedKey); }
+            catch (Exception ex) { _logger.Debug($"UserEspKeepAwakeHost: page-closed latch write threw: {ex.Message}"); }
+        }
+
+        // In-memory lookup (no I/O) — safe under _gate.
+        private bool UserEspPageClosedEarlier()
+        {
+            if (_startupGate == null) return false;
+            try { return _startupGate.AlreadySucceeded(UserEspPageClosedKey); }
+            catch (Exception ex)
+            {
+                _logger.Debug($"UserEspKeepAwakeHost: page-closed latch read threw: {ex.Message}");
+                return false;
+            }
+        }
+
+        /// <summary>RealmJoin left Blank — it keeps the device awake from here.</summary>
+        private void OnRealmJoinStarted()
+        {
+            Dictionary<string, string>? extra = null;
+            lock (_gate)
+            {
+                if (_state == HoldState.Released) return;
+                if (_state == HoldState.Idle)
+                {
+                    // Only after an agent restart (RealmJoin starts after the user-ESP page closed):
+                    // no hold to hand over, and none to take up later in this process.
+                    _state = HoldState.Released;
+                    _logger.Info("UserEspKeepAwakeHost: RealmJoin has already started its deployment — keep-awake will not engage.");
+                    return;
+                }
+                if (_awaitingRealmJoin)
+                {
+                    var waited = Math.Max(0, (_clock.UtcNow - _userEspExitedUtc).TotalSeconds);
+                    extra = new Dictionary<string, string>(StringComparer.Ordinal)
+                    {
+                        ["waitedSeconds"] = ((long)waited).ToString(CultureInfo.InvariantCulture),
+                    };
+                }
+            }
+
+            Release(ReasonRealmJoinStarted, EventSeverity.Info, extra);
+        }
+
         /// <summary>
         /// Release the hold exactly once (Idle/Engaging/Engaged → Released). Idempotent — a second
         /// call (or a competing completion / cap / stop trigger) is a no-op. A release that lands
         /// while an Engage is mid-flight (Engaging) wins: the engage path detects the final state
         /// after its blocking controller call and rolls the OS hold back (L16).
         /// </summary>
-        private void Release(string reason, EventSeverity severity, bool emit)
+        private void Release(string reason, EventSeverity severity, IReadOnlyDictionary<string, string>? extra = null)
         {
             bool wasEngaged;
             lock (_gate)
             {
                 if (_state == HoldState.Released) return;
-                DisarmSafetyCap();
+                DisarmCapTimer();
                 wasEngaged = _controller.Release();
                 _state = HoldState.Released;
             }
 
-            if (wasEngaged && emit)
+            if (!wasEngaged) return;
+
+            var data = new Dictionary<string, string>(StringComparer.Ordinal) { ["reason"] = reason };
+            if (extra != null)
             {
-                Emit(Constants.EventTypes.KeepAwakeReleased, severity, new Dictionary<string, string>(StringComparer.Ordinal)
-                {
-                    ["reason"] = reason,
-                });
+                foreach (var kv in extra) data[kv.Key] = kv.Value;
             }
+            Emit(Constants.EventTypes.KeepAwakeReleased, severity, data);
         }
 
-        private void OnSafetyCapElapsed(object? state)
+        private void OnCapTimerElapsed(object? timerState)
         {
-            _logger.Warning($"UserEspKeepAwakeHost: safety cap ({_activeCapMinutes} min) elapsed without User-ESP completion — releasing keep-awake.");
-            SafeRelease(ReasonSafetyCap, EventSeverity.Warning);
+            string reason;
+            EventSeverity severity;
+            Dictionary<string, string>? extra = null;
+            lock (_gate)
+            {
+                // A timer replaced at the page exit can still fire once — only the current one counts.
+                if (!(timerState is int generation) || generation != _capGeneration || _state == HoldState.Released) return;
+
+                if (_awaitingRealmJoin)
+                {
+                    reason = ReasonRealmJoinNotStarted;
+                    severity = EventSeverity.Info;
+                    extra = new Dictionary<string, string>(StringComparer.Ordinal)
+                    {
+                        ["waitMinutes"] = ((int)Math.Round(_realmJoinStartWait.TotalMinutes)).ToString(CultureInfo.InvariantCulture),
+                    };
+                    _logger.Info($"UserEspKeepAwakeHost: RealmJoin did not start within {_realmJoinStartWait.TotalMinutes:0} min after the user-ESP page closed — releasing keep-awake.");
+                }
+                else
+                {
+                    reason = ReasonSafetyCap;
+                    severity = EventSeverity.Warning;
+                    _logger.Warning($"UserEspKeepAwakeHost: safety cap ({_activeCapMinutes} min) elapsed without User-ESP completion — releasing keep-awake.");
+                }
+            }
+
+            SafeRun(() => Release(reason, severity, extra), "release");
         }
 
         // Must be called under _gate.
-        private void DisarmSafetyCap()
+        private void ArmCapTimer(TimeSpan dueIn)
         {
+            DisarmCapTimer();
+            _safetyCapTimer = new Timer(OnCapTimerElapsed, _capGeneration, dueIn, Timeout.InfiniteTimeSpan);
+        }
+
+        // Must be called under _gate.
+        private void DisarmCapTimer()
+        {
+            _capGeneration++;
             var timer = _safetyCapTimer;
             _safetyCapTimer = null;
             try { timer?.Dispose(); } catch { }
@@ -369,7 +553,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
 
             // Release synchronously on teardown. If a completion/cap release already won, this is a
             // no-op (state already Released). Emit is best-effort — the ingress may already be down.
-            Release(ReasonHostStop, EventSeverity.Info, emit: true);
+            Release(ReasonHostStop, EventSeverity.Info);
         }
 
         public void Dispose()
@@ -378,5 +562,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             Stop();
             try { _controller.Dispose(); } catch { }
         }
+
+        // Test seam — the page closed while RealmJoin was still Blank and the hold now waits for it.
+        internal bool AwaitingRealmJoinForTest
+        {
+            get { lock (_gate) { return _awaitingRealmJoin; } }
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/ProxyObserver.cs

@@ -0,0 +1,287 @@
+#nullable enable
+using System;
+using System.Globalization;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.DecisionCore.Engine;
+
+namespace AutopilotMonitor.Agent.V2.Core.Transport
+{
+    /// <summary>
+    /// Makes the agent log say which way uploads go and what happened to it. Something on the device
+    /// can change the proxy settings of the agent's account; .NET follows at once, and from then on
+    /// no channel may reach the backend, so the log on the device is the only witness.
+    /// <para>
+    /// Compares with what held at the start instead of judging a value: "no proxy" is the right
+    /// state on one network and the broken one on the next. Reads on failures and on registry
+    /// changes, never by polling. Nothing here throws into the upload path.
+    /// </para>
+    /// </summary>
+    public sealed class ProxyObserver
+    {
+        internal const string RouteUnknown = "unknown";
+
+        private static readonly TimeSpan DefaultRouteBound = TimeSpan.FromSeconds(3);
+
+        private readonly Func<ProxySettings> _readSettings;
+        private readonly Func<string> _readRoute;
+        private readonly IClock _clock;
+        private readonly AgentLogger _logger;
+        private readonly TimeSpan _routeBound;
+        private readonly object _sync = new object();
+
+        private ProxySettings? _current;
+        private string _lastRoute = RouteUnknown;
+        private Task<string>? _routeRead;
+        private DateTime? _uploadChangeAtUtc;
+        private string? _uploadChange;
+        private DateTime? _failingSinceUtc;
+        private int _failedAttempts;
+        private DateTime? _lastSuccessUtc;
+
+        /// <summary>Settings now, what changed, route now. Raised outside the lock, on the caller's thread.</summary>
+        internal event Action<ProxySettings, string, string>? SettingsChanged;
+
+        public ProxyObserver(string baseUrl, AgentLogger logger, IClock clock)
+            : this(
+                ProxySettingsReader.Read,
+                RouteReaderFor(baseUrl),
+                logger,
+                clock,
+                DefaultRouteBound)
+        {
+        }
+
+        internal ProxyObserver(
+            Func<ProxySettings> readSettings,
+            Func<string> readRoute,
+            AgentLogger logger,
+            IClock clock,
+            TimeSpan routeBound)
+        {
+            _readSettings = readSettings ?? throw new ArgumentNullException(nameof(readSettings));
+            _readRoute = readRoute ?? throw new ArgumentNullException(nameof(readRoute));
+            _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+            _clock = clock ?? throw new ArgumentNullException(nameof(clock));
+            _routeBound = routeBound;
+        }
+
+        private static Func<string> RouteReaderFor(string baseUrl)
+        {
+            if (!Uri.TryCreate(baseUrl, UriKind.Absolute, out var target)) return () => RouteUnknown;
+            return () => ProxySettingsReader.ReadRoute(target);
+        }
+
+        /// <summary>Logs the state to compare against. Runs before the first request of the agent.</summary>
+        public void CaptureBaseline()
+        {
+            var settings = ReadSettingsSafe();
+            var route = ReadRouteBounded();
+            lock (_sync)
+            {
+                if (_current == null && !settings.IsUnreadable) _current = settings;
+                _lastRoute = route;
+            }
+            // Same text on a rebuild of the clients after an endpoint migration: the repeat goes to Trace.
+            _logger.Info($"ProxyObserver: start - {settings.DescribeAll()}; route to backend: {route}", repeatKey: "ProxyObserver.baseline");
+        }
+
+        /// <summary>Re-reads the settings and reports a change of content once, whoever notices it first.</summary>
+        public void CheckForChange()
+        {
+            var settings = ReadSettingsSafe();
+            if (settings.IsUnreadable) return;
+
+            ProxySettings previous;
+            var affectsUploads = false;
+            lock (_sync)
+            {
+                if (_current == null)
+                {
+                    _current = settings;
+                    return;
+                }
+                if (_current.Equals(settings)) return;
+
+                previous = _current;
+                _current = settings;
+                if (settings.DiffersForUploadsFrom(previous))
+                {
+                    affectsUploads = true;
+                    _uploadChangeAtUtc = _clock.UtcNow;
+                    _uploadChange = settings.DescribeUploadChangeFrom(previous);
+                }
+            }
+
+            var route = ReadRouteBounded();
+            string routeBefore;
+            lock (_sync)
+            {
+                routeBefore = _lastRoute;
+                _lastRoute = route;
+            }
+
+            var what = settings.DescribeChangeFrom(previous);
+            _logger.Warning(affectsUploads
+                ? $"ProxyObserver: proxy settings changed - {what}; route to backend: {(routeBefore == route ? route : $"{routeBefore} -> {route}")}. " +
+                  "The agent's uploads follow these settings. Check with: bitsadmin /util /getieproxy localsystem"
+                : $"ProxyObserver: proxy settings changed - {what}. The agent's uploads do not use WinHTTP, services that rely on its default do.");
+
+            try
+            {
+                SettingsChanged?.Invoke(settings, what, route);
+            }
+            catch (Exception ex)
+            {
+                _logger.Debug($"ProxyObserver: change handler threw: {ex.Message}");
+            }
+        }
+
+        /// <summary>The next hop to the backend: <c>direct</c>, <c>host:port</c> or <c>unknown</c>.</summary>
+        public string RouteText() => ReadRouteBounded();
+
+        /// <summary>
+        /// An upload did not reach the backend. The first of a series says what the reader needs to
+        /// know: when it began and whether the proxy settings moved before that.
+        /// </summary>
+        public void OnSendFailed(TimeSpan attemptDuration)
+        {
+            // Also catches a change the registry watcher did not report.
+            CheckForChange();
+
+            DateTime since;
+            DateTime? lastSuccess;
+            DateTime? changedAt;
+            string? change;
+            string? current;
+            lock (_sync)
+            {
+                _failedAttempts++;
+                if (_failingSinceUtc != null) return;
+
+                since = _clock.UtcNow - attemptDuration;
+                _failingSinceUtc = since;
+                lastSuccess = _lastSuccessUtc;
+                changedAt = _uploadChangeAtUtc;
+                change = _uploadChange;
+                current = _current?.Describe();
+            }
+
+            var route = ReadRouteBounded();
+            var lastUpload = lastSuccess == null ? "No successful upload yet." : $"Last successful upload {Time(lastSuccess.Value)}.";
+
+            if (changedAt != null && (lastSuccess == null || changedAt > lastSuccess))
+            {
+                _logger.Warning(
+                    $"ProxyObserver: uploads are failing since {Time(since)}, {Span(since - changedAt.Value)} after the proxy settings changed at {Time(changedAt.Value)} ({change}). " +
+                    $"Route to backend: {route}. {lastUpload}");
+            }
+            else
+            {
+                var unchangedSince = changedAt == null ? "start" : "the last successful upload";
+                _logger.Warning(
+                    $"ProxyObserver: uploads are failing since {Time(since)}. Proxy settings of this account unchanged since {unchangedSince}: {current ?? RouteUnknown}. " +
+                    $"Route to backend: {route}. {lastUpload}");
+            }
+        }
+
+        public void OnSendSucceeded()
+        {
+            DateTime since;
+            int attempts;
+            lock (_sync)
+            {
+                _lastSuccessUtc = _clock.UtcNow;
+                if (_failingSinceUtc == null) return;
+
+                since = _failingSinceUtc.Value;
+                attempts = _failedAttempts;
+                _failingSinceUtc = null;
+                _failedAttempts = 0;
+            }
+
+            CheckForChange();
+            _logger.Info($"ProxyObserver: uploads work again after {attempts} failed attempt(s) over {Span(_clock.UtcNow - since)}; route to backend: {ReadRouteBounded()}.");
+        }
+
+        /// <summary>The end of the log is read first, so a run that ends while failing says so there.</summary>
+        public void LogOpenFailures()
+        {
+            DateTime since;
+            int attempts;
+            DateTime? lastSuccess;
+            DateTime? changedAt;
+            string? change;
+            string? current;
+            lock (_sync)
+            {
+                if (_failingSinceUtc == null) return;
+
+                since = _failingSinceUtc.Value;
+                attempts = _failedAttempts;
+                lastSuccess = _lastSuccessUtc;
+                changedAt = _uploadChangeAtUtc;
+                change = _uploadChange;
+                current = _current?.Describe();
+            }
+
+            var lastUpload = lastSuccess == null ? "no successful upload" : $"last success {Time(lastSuccess.Value)}";
+            var settings = changedAt == null
+                ? $"Proxy settings of this account unchanged since start: {current ?? RouteUnknown}."
+                : $"Proxy settings changed at {Time(changedAt.Value)} ({change}).";
+            _logger.Warning(
+                $"ProxyObserver: stopping with uploads still failing: {attempts} failed attempt(s) since {Time(since)}, {lastUpload}, route to backend: {ReadRouteBounded()}. {settings}");
+        }
+
+        private ProxySettings ReadSettingsSafe()
+        {
+            try
+            {
+                var settings = _readSettings();
+                if (settings.IsUnreadable) _logger.Debug($"ProxyObserver: proxy settings {settings.Describe()}", repeatKey: "ProxyObserver.unreadable");
+                return settings;
+            }
+            catch (Exception ex)
+            {
+                _logger.Debug($"ProxyObserver: reading the proxy settings threw: {ex.Message}", repeatKey: "ProxyObserver.readThrew");
+                return ProxySettings.Unreadable(-1);
+            }
+        }
+
+        /// <summary>
+        /// Auto-detect can hang and must hold up neither the start nor an upload. A read still under
+        /// way is joined, so a hanging one does not pile up pool threads.
+        /// </summary>
+        private string ReadRouteBounded()
+        {
+            Task<string> read;
+            lock (_sync)
+            {
+                if (_routeRead == null || _routeRead.IsCompleted) _routeRead = Task.Run(ReadRouteSafe);
+                read = _routeRead;
+            }
+            return read.Wait(_routeBound) ? read.Result : RouteUnknown;
+        }
+
+        private string ReadRouteSafe()
+        {
+            try
+            {
+                return _readRoute();
+            }
+            catch (Exception ex)
+            {
+                _logger.Debug($"ProxyObserver: reading the route threw: {ex.Message}", repeatKey: "ProxyObserver.routeThrew");
+                return RouteUnknown;
+            }
+        }
+
+        private static string Time(DateTime utc) => utc.ToString("HH:mm:ss", CultureInfo.InvariantCulture);
+
+        private static string Span(TimeSpan span)
+        {
+            var seconds = Math.Max(0, (long)span.TotalSeconds);
+            return seconds < 120 ? $"{seconds} s" : $"{seconds / 60} min";
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/ProxySettings.cs

@@ -0,0 +1,131 @@
+using System;
+using System.Collections.Generic;
+
+namespace AutopilotMonitor.Agent.V2.Core.Transport
+{
+    /// <summary>
+    /// The proxy settings Windows holds for the account this process runs as (what
+    /// <c>bitsadmin /util /getieproxy localsystem</c> shows for SYSTEM and what .NET uses), plus the
+    /// WinHTTP proxy (<c>netsh winhttp show proxy</c>). Compared by content, because WinINET rewrites
+    /// its settings blob without changing anything. The values end up in logs and events, so
+    /// credentials and PAC query strings are kept out on the way in.
+    /// </summary>
+    internal sealed class ProxySettings : IEquatable<ProxySettings>
+    {
+        internal const string CredentialsHidden = "(value with credentials, not shown)";
+
+        public bool AutoDetect { get; }
+        public string PacUrl { get; }
+        public string Proxy { get; }
+        public string Bypass { get; }
+        public string WinHttpProxy { get; }
+
+        /// <summary>Win32 error of a failed read; null when the settings were read.</summary>
+        public int? ReadError { get; }
+
+        public bool IsUnreadable => ReadError != null;
+
+        public ProxySettings(bool autoDetect, string pacUrl, string proxy, string bypass, string winHttpProxy)
+        {
+            AutoDetect = autoDetect;
+            PacUrl = SanitizeUrl(pacUrl);
+            Proxy = HideCredentials(proxy);
+            Bypass = EmptyToNull(bypass);
+            WinHttpProxy = HideCredentials(winHttpProxy);
+        }
+
+        private ProxySettings(int readError)
+        {
+            ReadError = readError;
+        }
+
+        public static ProxySettings Unreadable(int win32Error) => new ProxySettings(win32Error);
+
+        /// <summary>Kept in step with ANALYZE-CORR-003, which matches <c>Proxy|PAC</c>.</summary>
+        public string ProxyType =>
+            IsUnreadable ? "Unknown"
+            : Proxy != null ? "Proxy"
+            : PacUrl != null ? "PAC"
+            : AutoDetect ? "AutoDetect"
+            : "Direct";
+
+        public string Describe()
+        {
+            if (IsUnreadable) return $"unreadable (Win32 error {ReadError})";
+
+            var parts = new List<string>(3);
+            if (AutoDetect) parts.Add("auto-detect");
+            if (PacUrl != null) parts.Add($"PAC {PacUrl}");
+            if (Proxy != null) parts.Add($"proxy {Proxy}");
+            return parts.Count == 0 ? "no proxy" : string.Join(", ", parts);
+        }
+
+        public string DescribeWinHttp() => WinHttpProxy == null ? "direct" : $"proxy {WinHttpProxy}";
+
+        public string DescribeAll() => $"IE settings of this account: {Describe()}; WinHTTP: {DescribeWinHttp()}";
+
+        /// <summary>The account's own settings, which the agent's uploads follow; WinHTTP is apart.</summary>
+        public bool DiffersForUploadsFrom(ProxySettings other) =>
+            AutoDetect != other.AutoDetect
+            || PacUrl != other.PacUrl
+            || Proxy != other.Proxy
+            || Bypass != other.Bypass;
+
+        public string DescribeUploadChangeFrom(ProxySettings previous) =>
+            Describe() == previous.Describe()
+                ? "IE settings of this account: proxy bypass list changed"
+                : $"IE settings of this account: {previous.Describe()} -> {Describe()}";
+
+        public string DescribeChangeFrom(ProxySettings previous)
+        {
+            var parts = new List<string>(2);
+            if (DiffersForUploadsFrom(previous)) parts.Add(DescribeUploadChangeFrom(previous));
+            if (WinHttpProxy != previous.WinHttpProxy) parts.Add($"WinHTTP: {previous.DescribeWinHttp()} -> {DescribeWinHttp()}");
+            return string.Join("; ", parts);
+        }
+
+        /// <summary>Payload of the <c>proxy_configuration</c> event.</summary>
+        public Dictionary<string, object> ToEventData() => new Dictionary<string, object>
+        {
+            { "proxyType", ProxyType },
+            { "autoDetect", AutoDetect },
+            { "proxyEnabled", Proxy != null },
+            { "proxyServer", Proxy },
+            { "proxyOverride", Bypass },
+            { "autoConfigUrl", PacUrl },
+            { "winHttpProxyConfigured", WinHttpProxy != null },
+            { "winHttpProxy", WinHttpProxy },
+        };
+
+        public bool Equals(ProxySettings other) =>
+            other != null
+            && ReadError == other.ReadError
+            && !DiffersForUploadsFrom(other)
+            && WinHttpProxy == other.WinHttpProxy;
+
+        public override bool Equals(object obj) => Equals(obj as ProxySettings);
+
+        public override int GetHashCode() => (AutoDetect, PacUrl, Proxy, Bypass, WinHttpProxy, ReadError).GetHashCode();
+
+        private static string EmptyToNull(string value) => string.IsNullOrEmpty(value) ? null : value;
+
+        /// <summary>Scheme, host, port and path. A query string can carry a key; an unparsable URL is not repeated.</summary>
+        private static string SanitizeUrl(string url)
+        {
+            if (string.IsNullOrEmpty(url)) return null;
+            if (!Uri.TryCreate(url, UriKind.Absolute, out var uri) || string.IsNullOrEmpty(uri.Host)) return "(unparsable URL)";
+            var port = uri.IsDefaultPort ? string.Empty : $":{uri.Port}";
+            return $"{uri.Scheme}://{uri.Host}{port}{uri.AbsolutePath}";
+        }
+
+        /// <summary>
+        /// A proxy string has no defined form for credentials and a password can hold <c>=</c>,
+        /// <c>;</c> or <c>://</c>, so a value with an <c>@</c> is replaced as a whole, not taken apart.
+        /// </summary>
+        private static string HideCredentials(string proxy)
+        {
+            if (string.IsNullOrEmpty(proxy)) return null;
+            return proxy.IndexOf('@') < 0 ? proxy : CredentialsHidden;
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/ProxySettingsReader.cs

@@ -0,0 +1,67 @@
+using System;
+using System.Net;
+using System.Runtime.InteropServices;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Interop;
+
+namespace AutopilotMonitor.Agent.V2.Core.Transport
+{
+    internal static class ProxySettingsReader
+    {
+        public const string RouteDirect = "direct";
+
+        /// <summary>Reads the registry through WinHTTP, no network. Does not throw on a failed read.</summary>
+        public static ProxySettings Read()
+        {
+            var ie = new WinHttpNativeMethods.WINHTTP_CURRENT_USER_IE_PROXY_CONFIG();
+            var winHttp = new WinHttpNativeMethods.WINHTTP_PROXY_INFO();
+            try
+            {
+                if (!WinHttpNativeMethods.WinHttpGetIEProxyConfigForCurrentUser(ref ie))
+                {
+                    var error = Marshal.GetLastWin32Error();
+                    // The account has never had settings written, so nothing configures a proxy.
+                    if (error != WinHttpNativeMethods.ERROR_FILE_NOT_FOUND) return ProxySettings.Unreadable(error);
+                }
+
+                if (!WinHttpNativeMethods.WinHttpGetDefaultProxyConfiguration(ref winHttp))
+                {
+                    return ProxySettings.Unreadable(Marshal.GetLastWin32Error());
+                }
+
+                return new ProxySettings(
+                    autoDetect: ie.fAutoDetect,
+                    pacUrl: Marshal.PtrToStringUni(ie.lpszAutoConfigUrl),
+                    proxy: Marshal.PtrToStringUni(ie.lpszProxy),
+                    bypass: Marshal.PtrToStringUni(ie.lpszProxyBypass),
+                    winHttpProxy: winHttp.dwAccessType == WinHttpNativeMethods.WINHTTP_ACCESS_TYPE_NAMED_PROXY
+                        ? Marshal.PtrToStringUni(winHttp.lpszProxy)
+                        : null);
+            }
+            finally
+            {
+                Free(ie.lpszAutoConfigUrl);
+                Free(ie.lpszProxy);
+                Free(ie.lpszProxyBypass);
+                Free(winHttp.lpszProxy);
+                Free(winHttp.lpszProxyBypass);
+            }
+        }
+
+        /// <summary>
+        /// The next hop .NET chooses for <paramref name="target"/>: the same decision an
+        /// <c>HttpClientHandler</c> with default settings takes, PAC and auto-detect evaluated.
+        /// Auto-detect can take seconds on a network without WPAD.
+        /// </summary>
+        public static string ReadRoute(Uri target)
+        {
+            var hop = WebRequest.DefaultWebProxy?.GetProxy(target);
+            if (hop == null || string.Equals(hop.Host, target.Host, StringComparison.OrdinalIgnoreCase)) return RouteDirect;
+            return hop.IsDefaultPort ? hop.Host : $"{hop.Host}:{hop.Port}";
+        }
+
+        private static void Free(IntPtr memory)
+        {
+            if (memory != IntPtr.Zero) WinHttpNativeMethods.GlobalFree(memory);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/BackendTelemetryUploader.cs

@@ -52,6 +52,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         private readonly Logging.AgentLogger? _logger;
         private readonly ServerCertificateObserver? _serverCertificates;
         private readonly NetworkMetrics? _networkMetrics;
+        private readonly ProxyObserver? _proxy;
 
         /// <param name="serverCertificates">
         /// Observer installed on the <paramref name="httpClient"/>'s handler; its issuer becomes
@@ -60,6 +61,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         /// <param name="networkMetrics">
         /// Counts 2xx answers without the correlation echo (<c>agent_metrics_snapshot</c>). Null = not counted.
         /// </param>
+        /// <param name="proxy">
+        /// Names the route in the failure lines and hears how each upload ended. Null = neither.
+        /// </param>
         public BackendTelemetryUploader(
             HttpClient httpClient,
             string baseUrl,
@@ -72,7 +76,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             AuthFailureTracker? authFailureTracker = null,
             Logging.AgentLogger? logger = null,
             ServerCertificateObserver? serverCertificates = null,
-            NetworkMetrics? networkMetrics = null)
+            NetworkMetrics? networkMetrics = null,
+            ProxyObserver? proxy = null)
         {
             _httpClient = httpClient ?? throw new ArgumentNullException(nameof(httpClient));
             if (string.IsNullOrEmpty(baseUrl)) throw new ArgumentException("BaseUrl is mandatory.", nameof(baseUrl));
@@ -89,6 +94,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             _logger = logger;
             _serverCertificates = serverCertificates;
             _networkMetrics = networkMetrics;
+            _proxy = proxy;
         }
 
         public async Task<UploadResult> UploadBatchAsync(
@@ -153,7 +159,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                 catch (TaskCanceledException ex)
                 {
                     sw.Stop();
-                    _logger?.Warning($"BackendTelemetryUploader: ingest TIMEOUT after {sw.ElapsedMilliseconds}ms (corr={correlationId}, items={items.Count}): {ex.Message}");
+                    _logger?.Warning($"BackendTelemetryUploader: ingest TIMEOUT after {sw.ElapsedMilliseconds}ms (corr={correlationId}, items={items.Count}{RouteSuffix()}): {ex.Message}");
+                    _proxy?.OnSendFailed(sw.Elapsed);
                     // HttpClient timeout (not caller cancellation) surfaces as TaskCanceledException
                     // with cancellationToken.IsCancellationRequested == false.
                     return UploadResult.Transient($"timeout: {ex.Message}");
@@ -161,9 +168,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                 catch (HttpRequestException ex)
                 {
                     sw.Stop();
-                    _logger?.Warning($"BackendTelemetryUploader: ingest NETWORK fail after {sw.ElapsedMilliseconds}ms (corr={correlationId}, items={items.Count}): {ex.Message}");
+                    var cause = TransportErrorCodes.DescribeSendFailure(ex);
+                    _logger?.Warning($"BackendTelemetryUploader: ingest NETWORK fail after {sw.ElapsedMilliseconds}ms (corr={correlationId}, items={items.Count}{RouteSuffix()}): {cause}");
+                    _proxy?.OnSendFailed(sw.Elapsed);
                     // DNS failure, socket error, etc. — network-layer is retryable.
-                    return UploadResult.Transient($"network: {ex.Message}");
+                    return UploadResult.Transient($"network: {cause}");
                 }
 
                 using (response)
@@ -174,6 +183,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                     if (result.Success)
                     {
                         _logger?.Verbose($"BackendTelemetryUploader: ingest OK (corr={correlationId}, items={items.Count}, firstId={items[0].TelemetryItemId}, lastId={items[items.Count - 1].TelemetryItemId}, bytes={compressedBody.Length}, durationMs={sw.ElapsedMilliseconds}, status={(int)response.StatusCode}).");
+                        _proxy?.OnSendSucceeded();
                     }
                     else if (result.IsTransient)
                     {
@@ -188,7 +198,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
                             $"BackendTelemetryUploader: ingest INTERCEPTED — the answer did not come from the backend " +
                             $"(corr={correlationId}, items={items.Count}, durationMs={sw.ElapsedMilliseconds}, status={interception.StatusCode}, " +
                             $"reason={interception.ForeignReason}, pageTitle=\"{interception.PageTitle ?? "(none)"}\", " +
-                            $"serverCertIssuer=\"{interception.ServerCertIssuer ?? "(unknown)"}\").");
+                            $"serverCertIssuer=\"{interception.ServerCertIssuer ?? "(unknown)"}\"{RouteSuffix()}).");
+                        _proxy?.OnSendFailed(sw.Elapsed);
                     }
                     else if (result.IsSessionGone)
                     {
@@ -204,6 +215,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             }
         }
 
+        private string RouteSuffix() => _proxy == null ? string.Empty : $", route={_proxy.RouteText()}";
+
         private async Task<UploadResult> MapResponseAsync(HttpResponseMessage response, string correlationId)
         {
             var statusCode = (int)response.StatusCode;

src/Agent/AutopilotMonitor.Agent.V2/AutopilotMonitor.Agent.V2.csproj

@@ -78,7 +78,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
   </ItemGroup>
 
   <!-- Plan §2.16 strict separation rule — build-time enforcement. -->

src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs

@@ -99,7 +99,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 // Measured, not guessed: the reducer snapshot is rewritten on every decision step,
                 // so its mtime is the last moment the previous run is known to have been alive —
                 // and unlike LastBootUtc it exists for every exit type, exception_crash included.
-                previousRunLastAliveUtc: DefaultComponentFactory.ReadPreviousRunLastAliveUtc(stateSubdir));
+                previousRunLastAliveUtc: DefaultComponentFactory.ReadPreviousRunLastAliveUtc(stateSubdir),
+                proxyObserver: auth.ProxyObserver);
 
             var whiteGloveSealingPatternIds = (System.Collections.Generic.IReadOnlyCollection<string>)remoteConfig.WhiteGloveSealingPatternIds
                 ?? Array.Empty<string>();

src/Agent/AutopilotMonitor.Agent.V2/Runtime/BackendClientFactory.cs

@@ -52,6 +52,10 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             // outbound call (legacy BackendApiClient calls + dominant /api/agent/telemetry POSTs).
             var networkMetrics = new NetworkMetrics();
 
+            // Before the first request, so a registration that fails has the route in the log too.
+            var proxyObserver = new ProxyObserver(agentConfig.ApiBaseUrl, logger, SystemClock.Instance);
+            proxyObserver.CaptureBaseline();
+
             var hardware = HardwareInfo.GetHardwareInfo(logger);
 
             // Resolve the MDM client cert when cert-mode is on. Cert-missing is non-fatal here:
@@ -150,6 +154,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 emergencyReporter: emergencyReporter,
                 authFailureTracker: authFailureTracker,
                 serverCertificates: serverCertificates,
+                proxyObserver: proxyObserver,
                 clientCertificateThumbprint: clientCertificate?.Thumbprint);
         }
 
@@ -201,7 +206,8 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                     authFailureTracker: auth.AuthFailureTracker,
                     logger: logger,      // Plan §5 Fix 5 — upload-cadence logging
                     serverCertificates: auth.ServerCertificates,
-                    networkMetrics: auth.NetworkMetrics);
+                    networkMetrics: auth.NetworkMetrics,
+                    proxy: auth.ProxyObserver);
             }
             catch (Exception ex)
             {
@@ -291,6 +297,9 @@ namespace AutopilotMonitor.Agent.V2.Runtime
         /// </summary>
         public ServerCertificateObserver ServerCertificates { get; }
 
+        /// <summary>Shared by the telemetry uploader built in Phase 5 and the collector host.</summary>
+        public ProxyObserver ProxyObserver { get; }
+
         /// <summary>
         /// Thumbprint of the client certificate this run uses; null without one. Kept beside a
         /// failed run's record so the next successful start can tell whether the certificate changed.
@@ -308,6 +317,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             EmergencyReporter emergencyReporter,
             AuthFailureTracker authFailureTracker,
             ServerCertificateObserver serverCertificates,
+            ProxyObserver proxyObserver,
             string clientCertificateThumbprint = null)
         {
             BackendApiClient = backendApiClient;
@@ -320,6 +330,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
             EmergencyReporter = emergencyReporter;
             AuthFailureTracker = authFailureTracker;
             ServerCertificates = serverCertificates;
+            ProxyObserver = proxyObserver;
             ClientCertificateThumbprint = clientCertificateThumbprint;
         }
     }

src/Agent/AutopilotMonitor.DecisionCore.Tests/AutopilotMonitor.DecisionCore.Tests.csproj

@@ -13,9 +13,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>

src/Agent/AutopilotMonitor.SummaryDialog.Tests/AutopilotMonitor.SummaryDialog.Tests.csproj

@@ -15,9 +15,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>

src/Agent/AutopilotMonitor.SummaryDialog/AutopilotMonitor.SummaryDialog.csproj

@@ -15,7 +15,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
   </ItemGroup>
 
   <ItemGroup>

src/Backend/AutopilotMonitor.Functions.Tests/AnalyzeRuleShapeLimitsTests.cs

@@ -0,0 +1,184 @@
+using AutopilotMonitor.Functions.Functions.Rules;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The size limits of a tenant-authored analyze rule (D-410): at most 20 conditions and 10
+/// preconditions, and every value a regex or not_regex operator compares — condition value,
+/// filter value, event A filter value, precondition value — at most 2,000 characters and
+/// parseable. One implementation feeds the dry-run validation and every write path (create,
+/// update, template copy); the boundary itself is always allowed.
+/// </summary>
+public class AnalyzeRuleShapeLimitsTests
+{
+    private const string TenantId = "tenant-limits";
+
+    [Fact]
+    public void A_rule_at_every_limit_passes()
+    {
+        var rule = Rule(AnalyzeRuleLimits.MaxConditions, AnalyzeRuleLimits.MaxPreconditions);
+        var atLimit = new string('a', AnalyzeRuleLimits.MaxRegexLength);
+        rule.Conditions[0].Operator = "regex";
+        rule.Conditions[0].Value = atLimit;
+        rule.Conditions[1].FilterField = "f";
+        rule.Conditions[1].FilterOperator = "not_regex";
+        rule.Conditions[1].FilterValue = atLimit;
+        rule.Conditions[2].EventAFilterOperator = "REGEX";
+        rule.Conditions[2].EventAFilterValue = atLimit;
+        rule.Preconditions[0].Operator = "regex";
+        rule.Preconditions[0].Value = atLimit;
+
+        Assert.Empty(AnalyzeRuleService.ShapeLimitErrors(rule));
+    }
+
+    [Fact]
+    public void One_condition_or_precondition_over_the_limit_is_named()
+    {
+        var errors = AnalyzeRuleService.ShapeLimitErrors(Rule(AnalyzeRuleLimits.MaxConditions + 1, AnalyzeRuleLimits.MaxPreconditions + 1));
+
+        Assert.Contains(errors, e => e.Contains("at most 20 conditions (this one has 21)"));
+        Assert.Contains(errors, e => e.Contains("at most 10 preconditions (this one has 11)"));
+    }
+
+    [Theory]
+    [InlineData("conditions[0].value")]
+    [InlineData("conditions[0].filterValue")]
+    [InlineData("conditions[0].eventAFilterValue")]
+    [InlineData("preconditions[0].value")]
+    public void A_regex_over_the_length_limit_is_rejected_wherever_it_sits(string field)
+    {
+        var rule = Rule(1, 1);
+        Place(rule, field, "regex", new string('a', AnalyzeRuleLimits.MaxRegexLength + 1));
+
+        var error = Assert.Single(AnalyzeRuleService.ShapeLimitErrors(rule));
+        Assert.StartsWith($"{field}: a regex may be at most 2000 characters (this one has 2001)", error);
+    }
+
+    [Theory]
+    [InlineData("conditions[0].filterValue")]
+    [InlineData("conditions[0].eventAFilterValue")]
+    [InlineData("preconditions[0].value")]
+    public void An_unparseable_regex_is_rejected_beyond_the_condition_value(string field)
+    {
+        var rule = Rule(1, 1);
+        Place(rule, field, "not_regex", "([unclosed");
+
+        var error = Assert.Single(AnalyzeRuleService.ShapeLimitErrors(rule));
+        Assert.StartsWith($"{field}: value is not a valid regex", error);
+    }
+
+    [Fact]
+    public void A_long_value_of_any_other_operator_is_not_limited()
+    {
+        var rule = Rule(1, 0);
+        rule.Conditions[0].Operator = "not_in";
+        rule.Conditions[0].Value = string.Join(",", Enumerable.Range(0, 1000).Select(i => $"app-{i:D5}"));
+
+        Assert.Empty(AnalyzeRuleService.ShapeLimitErrors(rule));
+    }
+
+    [Fact]
+    public void The_dry_run_validation_carries_the_limits()
+    {
+        var rule = Rule(AnalyzeRuleLimits.MaxConditions + 1, 0);
+
+        Assert.Contains(DryRunAnalyzeRuleFunction.ValidateDraftRule(rule), e => e.Contains("at most 20 conditions"));
+    }
+
+    // ===== write paths =====
+
+    [Fact]
+    public async Task Create_rejects_an_oversized_rule_before_anything_is_stored()
+    {
+        var repo = new Mock<IRuleRepository>();
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+
+        await Assert.ThrowsAsync<ArgumentException>(() => service.CreateRuleAsync(TenantId, Rule(AnalyzeRuleLimits.MaxConditions + 1, 0)));
+        repo.Verify(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task Update_of_a_custom_rule_rejects_an_oversized_regex_before_anything_is_stored()
+    {
+        var repo = new Mock<IRuleRepository>();
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+        var rule = Rule(1, 0);
+        Place(rule, "conditions[0].value", "not_regex", new string('a', AnalyzeRuleLimits.MaxRegexLength + 1));
+
+        await Assert.ThrowsAsync<ArgumentException>(() => service.UpdateRuleAsync(TenantId, rule));
+        repo.Verify(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), It.IsAny<string>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task Template_copy_rejects_an_oversized_regex_from_its_variable()
+    {
+        // ANALYZE-SEC-006 shape: the template variable IS the tenant's not_regex allow-list.
+        var template = Rule(1, 0);
+        template.RuleId = "ANALYZE-SEC-006";
+        template.IsBuiltIn = true;
+        template.Conditions[0].Operator = "not_regex";
+        template.TemplateVariables = new List<TemplateVariable> { new() { Name = "allowList", ConditionIndex = 0, Field = "value" } };
+
+        var repo = new Mock<IRuleRepository>();
+        repo.Setup(r => r.GetAnalyzeRulesAsync("global")).ReturnsAsync(new List<AnalyzeRule> { template });
+        repo.Setup(r => r.GetAnalyzeRulesAsync(TenantId)).ReturnsAsync(new List<AnalyzeRule>());
+        repo.Setup(r => r.GetRuleStatesAsync(TenantId)).ReturnsAsync(new Dictionary<string, RuleState>());
+        var service = new AnalyzeRuleService(repo.Object, NullLogger<AnalyzeRuleService>.Instance);
+
+        await Assert.ThrowsAsync<ArgumentException>(() => service.CreateFromTemplateAsync(TenantId, "ANALYZE-SEC-006",
+            new Dictionary<string, string> { ["allowList"] = new string('a', AnalyzeRuleLimits.MaxRegexLength + 1) }));
+        repo.Verify(r => r.StoreAnalyzeRuleAsync(It.IsAny<AnalyzeRule>(), TenantId), Times.Never);
+    }
+
+    // ===== fixtures =====
+
+    private static AnalyzeRule Rule(int conditions, int preconditions) => new()
+    {
+        RuleId = "CUSTOM-LIMITS",
+        IsBuiltIn = false, // the model defaults to a built-in rule
+        Title = "limits",
+        Severity = "warning",
+        Category = "test",
+        BaseConfidence = 80,
+        ConfidenceThreshold = 40,
+        Conditions = Enumerable.Range(0, conditions).Select(i => new RuleCondition
+        {
+            Signal = $"s{i}", Source = "event_data", EventType = "app_install_failed", DataField = "errorCode",
+            Operator = "equals", Value = "1", Required = true,
+        }).ToList(),
+        Preconditions = Enumerable.Range(0, preconditions).Select(_ => new RulePrecondition
+        {
+            Source = "event_data", EventType = "os_info", DataField = "edition", Operator = "equals", Value = "Enterprise",
+        }).ToList(),
+    };
+
+    private static void Place(AnalyzeRule rule, string field, string op, string value)
+    {
+        switch (field)
+        {
+            case "conditions[0].value":
+                rule.Conditions[0].Operator = op;
+                rule.Conditions[0].Value = value;
+                break;
+            case "conditions[0].filterValue":
+                rule.Conditions[0].FilterField = "f";
+                rule.Conditions[0].FilterOperator = op;
+                rule.Conditions[0].FilterValue = value;
+                break;
+            case "conditions[0].eventAFilterValue":
+                rule.Conditions[0].EventAFilterField = "f";
+                rule.Conditions[0].EventAFilterOperator = op;
+                rule.Conditions[0].EventAFilterValue = value;
+                break;
+            default:
+                rule.Preconditions[0].Operator = op;
+                rule.Preconditions[0].Value = value;
+                break;
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AppHomingServiceTests.cs

@@ -5,6 +5,7 @@ using AutopilotMonitor.Functions.Services.GraphResolution;
 using AutopilotMonitor.Functions.Services.Notifications;
 using AutopilotMonitor.Shared.DataAccess;
 using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Models.Graph;
 using Microsoft.ApplicationInsights;
 using Microsoft.ApplicationInsights.Extensibility;
 using Microsoft.Extensions.Caching.Memory;
@@ -72,7 +73,8 @@ public class AppHomingServiceTests
             Mock.Of<System.Net.Http.IHttpClientFactory>(),
             cache,
             _registry,
-            _tenantConfigMock.Object)
+            _tenantConfigMock.Object,
+            Mock.Of<IGraphAccessHealthRecorder>())
         { CallBase = false };
         _detectorMock = new Mock<IGraphFeatureDetector>();
         _maintenanceMock = new Mock<IMaintenanceRepository>();
@@ -287,6 +289,32 @@ public class AppHomingServiceTests
         Assert.True((await _sut.ProbePrimaryConsentAsync(TenantId)).Succeeded);
     }
 
+    [Fact]
+    public async Task Probe_succeeds_when_the_budget_cuts_the_retries_of_a_missing_legacy_service_principal()
+    {
+        // The access check runs on 4 s and the first retry waits 5 s, so the answer arrives as
+        // transient. The Entra code still says the SP is gone: nothing left to lose.
+        SetupProbe(GraphTokenResult.Success(Jwt(ValidationRole)));
+        SetupLegacyToken(GraphTokenResult.TransientFailure(
+            new EntraTokenRejection(401, EntraTokenRejection.ServicePrincipalMissingCode, "no service principal")));
+
+        Assert.True((await _sut.ProbePrimaryConsentAsync(TenantId)).Succeeded);
+    }
+
+    [Fact]
+    public async Task Probe_stays_transient_when_the_budget_cuts_the_retries_of_any_other_legacy_rejection()
+    {
+        // Any other refusal proves nothing about the roles the tenant would lose with the flip.
+        SetupProbe(GraphTokenResult.Success(Jwt(ValidationRole)));
+        SetupLegacyToken(GraphTokenResult.TransientFailure(
+            new EntraTokenRejection(400, "AADSTS53003", "blocked by Conditional Access")));
+
+        var probe = await _sut.ProbePrimaryConsentAsync(TenantId);
+
+        Assert.False(probe.Succeeded);
+        Assert.True(probe.IsTransient);
+    }
+
     [Fact]
     public async Task Probe_never_mints_a_legacy_token_when_the_primary_token_fails()
     {
@@ -349,6 +377,43 @@ public class AppHomingServiceTests
         Assert.DoesNotContain(_savedOpsEvents, e => e.EventType == "AppHomingFlippedWithEntraRoles");
     }
 
+    [Fact]
+    public async Task AutoFlip_clears_the_graph_access_rejection_of_the_app_the_tenant_leaves()
+    {
+        _store.Row!.GraphAccessRejectedSince = DateTime.UtcNow.AddHours(-3);
+        _store.Row.GraphAccessRejectedCode = EntraTokenRejection.ServicePrincipalMissingCode;
+        _store.Row.GraphAccessRejectionConfirmedAt = DateTime.UtcNow.AddHours(-2);
+
+        var outcome = await _sut.TryAutoFlipToPrimaryAsync(LegacyHomedConfig(), Actor);
+
+        Assert.Equal(AppHomingAutoFlipOutcome.Flipped, outcome.Outcome);
+        Assert.Null(_store.Row!.GraphAccessRejectedSince);
+        Assert.Null(_store.Row.GraphAccessRejectedCode);
+        Assert.Null(_store.Row.GraphAccessRejectionConfirmedAt);
+        // The confirmed episode ends visibly: the ops trail never keeps an open rejection.
+        var closed = Assert.Single(_savedOpsEvents, e => e.EventType == OpsEventTypes.GraphAccessRecovered);
+        Assert.Contains("app-homing-flip", closed.Details);
+    }
+
+    [Fact]
+    public async Task AutoFlip_clears_the_addon_episodes_and_closes_only_the_confirmed_ones()
+    {
+        _store.Row!.IntuneDeviceBindingPermissionMissingSince = DateTime.UtcNow.AddHours(-3);
+        _store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt = DateTime.UtcNow.AddHours(-2);
+        _store.Row.CloudPcPermissionMissingSince = DateTime.UtcNow.AddMinutes(-5);
+
+        await _sut.TryAutoFlipToPrimaryAsync(LegacyHomedConfig(), Actor);
+
+        Assert.Null(_store.Row!.IntuneDeviceBindingPermissionMissingSince);
+        Assert.Null(_store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        Assert.Null(_store.Row.CloudPcPermissionMissingSince);
+        var resolved = Assert.Single(_savedOpsEvents, e => e.EventType == OpsEventTypes.AddOnPermissionResolved);
+        Assert.Contains(GraphFeatureCatalog.FeatureIntuneDeviceBinding, resolved.Details);
+        Assert.Contains(GraphAccessHealthRecorder.ResolvedByAppHomingFlip, resolved.Details);
+        // An unconfirmed rejection was never shown, so it ends without a trace.
+        Assert.DoesNotContain(_savedOpsEvents, e => e.EventType == OpsEventTypes.GraphAccessRecovered);
+    }
+
     [Fact]
     public async Task AutoFlip_does_not_flip_on_permanent_probe_failure()
     {

src/Backend/AutopilotMonitor.Functions.Tests/AppInsightsQueryFunctionTests.cs

@@ -2,6 +2,7 @@ using System.Text.Json;
 using AutopilotMonitor.Functions.Functions.Raw;
 using AutopilotMonitor.Functions.Middleware;
 using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
 using Xunit;
 
 namespace AutopilotMonitor.Functions.Tests;
@@ -71,7 +72,7 @@ public class AppInsightsQueryFunctionTests
             "rows":[["2026-09-04T10:00:00Z",42,"{\"TenantId\":\"t1\"}",null]]}]}
             """;
 
-        var (tables, partial) = AppInsightsQueryFunction.ParseKustoBody(body);
+        var (tables, partial) = LogQueryExecutor.ParseKustoBody(body);
 
         Assert.Null(partial);
         var table = Assert.Single(tables);
@@ -97,7 +98,7 @@ public class AppInsightsQueryFunctionTests
              "error":{"code":"PartialError","message":"There were some errors when processing your query.","innererror":{"code":"E_QUERY_RESULT_SET_TOO_LARGE","message":"Query result set has exceeded the internal record count limit 500000."}}}
             """;
 
-        var (tables, partial) = AppInsightsQueryFunction.ParseKustoBody(body);
+        var (tables, partial) = LogQueryExecutor.ParseKustoBody(body);
 
         Assert.Single(tables);
         Assert.Equal("E_QUERY_RESULT_SET_TOO_LARGE: Query result set has exceeded the internal record count limit 500000.", partial);
@@ -106,7 +107,7 @@ public class AppInsightsQueryFunctionTests
     [Fact]
     public void Empty_or_shapeless_body_yields_no_tables_and_no_partial()
     {
-        var (tables, partial) = AppInsightsQueryFunction.ParseKustoBody("{}");
+        var (tables, partial) = LogQueryExecutor.ParseKustoBody("{}");
         Assert.Empty(tables);
         Assert.Null(partial);
     }
@@ -115,16 +116,16 @@ public class AppInsightsQueryFunctionTests
     [Fact]
     public void Error_extraction_prefers_innererror_and_tolerates_non_json()
     {
-        var (msg, code) = AppInsightsQueryFunction.ExtractError(
+        var (msg, code) = LogQueryExecutor.ExtractError(
             """{"error":{"message":"The request had some invalid properties","code":"BadArgumentError","innererror":{"code":"SyntaxError","message":"Query could not be parsed at 'foo'"}}}""");
         Assert.Equal("SyntaxError", code);
         Assert.Equal("Query could not be parsed at 'foo'", msg);
 
-        var (outerMsg, outerCode) = AppInsightsQueryFunction.ExtractError("""{"error":{"message":"Forbidden","code":"InsufficientAccessError"}}""");
+        var (outerMsg, outerCode) = LogQueryExecutor.ExtractError("""{"error":{"message":"Forbidden","code":"InsufficientAccessError"}}""");
         Assert.Equal("InsufficientAccessError", outerCode);
         Assert.Equal("Forbidden", outerMsg);
 
-        var (plainMsg, plainCode) = AppInsightsQueryFunction.ExtractError("<html>502 Bad Gateway</html>");
+        var (plainMsg, plainCode) = LogQueryExecutor.ExtractError("<html>502 Bad Gateway</html>");
         Assert.Null(plainCode);
         Assert.Equal("Telemetry store query failed", plainMsg);
     }

src/Backend/AutopilotMonitor.Functions.Tests/AppVersionRadarPassTests.cs

@@ -0,0 +1,97 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// A radar pass reads one tenant at a time so its memory follows the largest tenant, and it never
+/// evaluates an empty list: re-arm would read that as "version drained" and delete open episodes.
+/// </summary>
+public class AppVersionRadarPassTests
+{
+    private static List<AppInstallSummary> Rows(string tenantId, int count)
+    {
+        var rows = new List<AppInstallSummary>();
+        for (var i = 0; i < count; i++)
+            rows.Add(new AppInstallSummary { TenantId = tenantId });
+        return rows;
+    }
+
+    [Fact]
+    public async Task Each_tenant_is_finished_before_the_next_one_is_loaded()
+    {
+        var calls = new List<string>();
+
+        await MaintenanceService.RunAppVersionRadarPassAsync(
+            new[] { "a", "b" },
+            tenantId =>
+            {
+                calls.Add($"load {tenantId}");
+                return Task.FromResult(Rows(tenantId, 2));
+            },
+            (tenantId, summaries) =>
+            {
+                calls.Add($"evaluate {tenantId}");
+                Assert.All(summaries, s => Assert.Equal(tenantId, s.TenantId));
+                return Task.FromResult((0, 0, 0));
+            },
+            (_, ex) => throw ex);
+
+        Assert.Equal(new[] { "load a", "evaluate a", "load b", "evaluate b" }, calls);
+    }
+
+    [Fact]
+    public async Task A_tenant_without_rows_is_not_evaluated()
+    {
+        var evaluated = new List<string>();
+
+        var pass = await MaintenanceService.RunAppVersionRadarPassAsync(
+            new[] { "empty", "full" },
+            tenantId => Task.FromResult(tenantId == "empty" ? new List<AppInstallSummary>() : Rows(tenantId, 3)),
+            (tenantId, _) =>
+            {
+                evaluated.Add(tenantId);
+                return Task.FromResult((0, 0, 0));
+            },
+            (_, ex) => throw ex);
+
+        Assert.Equal(new[] { "full" }, evaluated);
+        Assert.Equal(1, pass.Tenants);
+        Assert.Equal(3, pass.Rows);
+    }
+
+    [Fact]
+    public async Task A_failing_tenant_does_not_cost_the_others_their_pass()
+    {
+        var failed = new List<string>();
+
+        var pass = await MaintenanceService.RunAppVersionRadarPassAsync(
+            new[] { "load-fails", "evaluate-fails", "ok" },
+            tenantId => tenantId == "load-fails"
+                ? throw new InvalidOperationException("load")
+                : Task.FromResult(Rows(tenantId, 1)),
+            (tenantId, _) => tenantId == "evaluate-fails"
+                ? throw new InvalidOperationException("evaluate")
+                : Task.FromResult((1, 2, 3)),
+            (tenantId, _) => failed.Add(tenantId));
+
+        Assert.Equal(new[] { "load-fails", "evaluate-fails" }, failed);
+        Assert.Equal((1, 2, 3), (pass.Fired, pass.Refreshed, pass.Rearmed));
+    }
+
+    [Fact]
+    public async Task The_totals_add_up_over_the_tenants()
+    {
+        var pass = await MaintenanceService.RunAppVersionRadarPassAsync(
+            new[] { "a", "b" },
+            tenantId => Task.FromResult(Rows(tenantId, 2)),
+            (_, _) => Task.FromResult((1, 2, 3)),
+            (_, ex) => throw ex);
+
+        Assert.Equal((2, 4L, 2, 4, 6), pass);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AuthFunctionSideEffectTests.cs

@@ -35,7 +35,6 @@ public class AuthFunctionSideEffectTests
     private readonly Mock<TenantAdminsService> _tenantAdminsMock;
     private readonly Mock<PreviewWhitelistService> _previewMock;
     private readonly Mock<McpUserService> _mcpUserMock;
-    private readonly Mock<TelegramNotificationService> _telegramMock;
     private readonly Mock<OpsEventService> _opsEventsMock;
     private readonly Mock<GlobalNotificationService> _globalNotificationMock;
     private readonly Mock<IMetricsRepository> _metricsRepoMock;
@@ -84,10 +83,6 @@ public class AuthFunctionSideEffectTests
             configRepo, cache, Mock.Of<ILogger<PreviewWhitelistService>>(), _tenantConfigMock.Object)
         { CallBase = false };
 
-        _telegramMock = new Mock<TelegramNotificationService>(
-            new HttpClient(), configRepo, Mock.Of<ILogger<TelegramNotificationService>>())
-        { CallBase = false };
-
         _globalNotificationMock = new Mock<GlobalNotificationService>(
             notificationRepo, new FakeSignalRNotificationService(), Mock.Of<ILogger<GlobalNotificationService>>())
         { CallBase = false };
@@ -117,7 +112,6 @@ public class AuthFunctionSideEffectTests
             tenantAdmins ?? _tenantAdminsMock.Object,
             _metricsRepoMock.Object,
             preview ?? _previewMock.Object,
-            _telegramMock.Object,
             _globalNotificationMock.Object,
             _mcpUserMock.Object,
             _autoApproveEnqueuerMock.Object,
@@ -136,9 +130,6 @@ public class AuthFunctionSideEffectTests
         // Writes go through UpdateAsync / CreateOrUpdateAsync over one stored row (none by default:
         // a brand-new tenant). Default: all fire-and-forget calls succeed.
         _store = _tenantConfigMock.StubWrites(TenantId, row: null);
-        _telegramMock
-            .Setup(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()))
-            .Returns(Task.CompletedTask);
         _globalNotificationMock
             .Setup(x => x.CreateNotificationAsync(
                 It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>()))
@@ -190,7 +181,7 @@ public class AuthFunctionSideEffectTests
         return BuildRequest(new ClaimsPrincipal(new ClaimsIdentity(claims, "test")));
     }
 
-    private static (HttpRequestData Req, FunctionContext Ctx) BuildRequest(ClaimsPrincipal principal)
+    private static (HttpRequestData Req, FunctionContext Ctx) BuildRequest(ClaimsPrincipal principal, RequestContext? requestContext = null)
     {
         var services = new ServiceCollection();
         services.AddOptions();
@@ -199,9 +190,11 @@ public class AuthFunctionSideEffectTests
                 new System.Text.Json.JsonSerializerOptions(System.Text.Json.JsonSerializerDefaults.Web)));
         var provider = services.BuildServiceProvider();
 
+        var items = new Dictionary<object, object> { ["ClaimsPrincipal"] = principal };
+        if (requestContext != null)
+            items[RequestContext.ItemsKey] = requestContext;
         var context = new Mock<FunctionContext>();
-        context.SetupGet(c => c.Items).Returns(
-            new Dictionary<object, object> { ["ClaimsPrincipal"] = principal });
+        context.SetupGet(c => c.Items).Returns(items);
         context.SetupGet(c => c.InstanceServices).Returns(provider);
 
         var req = new Mock<HttpRequestData>(context.Object);
@@ -233,7 +226,7 @@ public class AuthFunctionSideEffectTests
         Assert.True(string.IsNullOrEmpty(config.DomainName));
         Assert.Null(config.OnboardedBy);
         Assert.Empty(_store.Writes);
-        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
     }
 
     [Fact]
@@ -261,8 +254,7 @@ public class AuthFunctionSideEffectTests
         Assert.Null(written.DpaAcceptedBy);
         Assert.Null(written.DpaAcceptedAt);
         Assert.Equal("auth", source);
-        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(TenantId, Upn), Times.Once);
-        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(TenantId, Upn), Times.Once);   // the routable record next to the ping
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(TenantId, Upn), Times.Once);   // the routable record
         _globalNotificationMock.Verify(x => x.CreateNotificationAsync(
             "preview_signup", "New Tenant Signup",
             It.Is<string>(m => m.Contains(TenantId) && m.Contains("contoso.com") && m.Contains(Upn)),
@@ -350,7 +342,7 @@ public class AuthFunctionSideEffectTests
         Assert.True(string.IsNullOrEmpty(config.DomainName));
         Assert.Null(config.OnboardedBy);
         Assert.Empty(_store.Writes);
-        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
         _autoApproveEnqueuerMock.Verify(x => x.EnqueueAsync(
             It.IsAny<AutopilotMonitor.Functions.Services.Activation.TenantAutoApproveEnvelope>(),
             It.IsAny<TimeSpan?>(), It.IsAny<CancellationToken>()), Times.Never);
@@ -371,7 +363,7 @@ public class AuthFunctionSideEffectTests
 
         Assert.Empty(_store.Writes);
         Assert.Equal("first@contoso.com", _store.Row!.OnboardedBy);
-        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
         _autoApproveEnqueuerMock.Verify(x => x.EnqueueAsync(
             It.IsAny<AutopilotMonitor.Functions.Services.Activation.TenantAutoApproveEnvelope>(),
             It.IsAny<TimeSpan?>(), It.IsAny<CancellationToken>()), Times.Never);
@@ -389,7 +381,7 @@ public class AuthFunctionSideEffectTests
         await _sut.HandleNewTenantDomainAsync(DefaultConfig(), TenantId, Upn);
 
         Assert.Empty(_store.Writes);
-        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
     }
 
     // -------------------------------------------------------------------------
@@ -624,7 +616,7 @@ public class AuthFunctionSideEffectTests
         await _sut.HandleNewTenantDomainAsync(config, TenantId, Upn);
 
         Assert.Empty(_store.Writes);
-        _telegramMock.Verify(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
     }
 
     [Fact]
@@ -650,16 +642,17 @@ public class AuthFunctionSideEffectTests
     }
 
     [Fact]
-    public async Task HandleNewTenantDomain_TelegramFailure_DoesNotThrow()
+    public async Task HandleNewTenantDomain_BellFailure_DoesNotThrow()
     {
         var config = DefaultConfig();
         config.DomainName = null!;
 
-        _telegramMock
-            .Setup(x => x.SendNewTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()))
-            .ThrowsAsync(new HttpRequestException("Telegram unreachable"));
+        _globalNotificationMock
+            .Setup(x => x.CreateNotificationAsync(
+                It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>()))
+            .ThrowsAsync(new HttpRequestException("Notification store unreachable"));
 
-        // Should not throw — Telegram is fire-and-forget
+        // Should not throw — the bell is fire-and-forget
         await _sut.HandleNewTenantDomainAsync(config, TenantId, Upn);
 
         // The write still landed before the fire-and-forget
@@ -1102,4 +1095,96 @@ public class AuthFunctionSideEffectTests
         Assert.Equal(HttpStatusCode.OK, response.StatusCode);
         Assert.Equal(Constants.Push.DeviceStatus.Active, push.Repo.Devices[(Constants.Push.PlatformScope, "ga-phone")].Status);
     }
+
+    // -------------------------------------------------------------------------
+    // GetCurrentUser under view-as: a Global Admin reads another tenant as its member
+    // -------------------------------------------------------------------------
+
+    private const string ViewedTenantId = "cccccccc-1111-2222-3333-444444444444";
+
+    /// <summary>The context PolicyEnforcementMiddleware builds for an admitted view-as request.</summary>
+    private static RequestContext ViewingAs(string role) => new()
+    {
+        TenantId = ViewedTenantId,
+        TargetTenantId = ViewedTenantId,
+        UserPrincipalName = Upn,
+        UserRole = role,
+        IsTenantAdmin = role == Constants.TenantRoles.Admin,
+        ViewAs = new ViewAsContext(TenantId, role),
+    };
+
+    [Fact]
+    public async Task GetCurrentUser_ViewAs_AnswersAsTheViewedTenantsMember_WithoutAnySignInSideEffect()
+    {
+        // The viewed tenant asks for the Terms + DPA; the caller's home row still lacks its domain — exactly the
+        // state in which an ordinary sign-in would seed it, onboard, and record a login.
+        var viewed = TenantConfiguration.CreateDefault(ViewedTenantId);
+        viewed.DomainName = "fabrikam.example";
+        viewed.CompanyName = "Fabrikam";
+        viewed.DpaAcceptancePending = true;
+        var home = DefaultConfig();
+        home.DomainName = null!;
+        _tenantConfigMock.Setup(x => x.TryGetConfigurationAsync(ViewedTenantId)).ReturnsAsync((viewed, true));
+        _tenantConfigMock.Setup(x => x.TryGetConfigurationAsync(TenantId)).ReturnsAsync((home, true));
+        var viewedStore = _tenantConfigMock.StubWrites(ViewedTenantId, row: viewed);
+        _previewMock.Setup(x => x.IsApprovedAsync(ViewedTenantId)).ReturnsAsync(true);
+        _mcpUserMock
+            .Setup(x => x.IsAllowedAsync(It.IsAny<string?>(), It.IsAny<string?>(), It.IsAny<string?>(),
+                It.IsAny<IReadOnlyList<string>?>(), It.IsAny<bool>()))
+            .ReturnsAsync(McpAccessCheckResult.Denied("not allowed"));
+        var seen = new DateTime(2026, 11, 1, 0, 0, 0, DateTimeKind.Utc);
+        _metricsRepoMock.Setup(x => x.GetUserWhatsNewSeenAsync(TenantId, Upn)).ReturnsAsync(new UserWhatsNewSeen(platformUtc: seen));
+        var (req, ctx) = BuildRequest(SignedIn(external: false), ViewingAs(Constants.TenantRoles.Viewer));
+
+        var response = await _sut.GetCurrentUser(req, ctx);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var body = await ReadBodyAsync(response);
+        Assert.Contains($"\"tenantId\":\"{ViewedTenantId}\"", body);
+        Assert.Contains("\"isGlobalAdmin\":false", body);
+        Assert.Contains("\"isGlobalReader\":false", body);
+        Assert.Contains("\"isDelegated\":false", body);
+        Assert.Contains("\"role\":\"Viewer\"", body);
+        Assert.Contains("\"isTenantAdmin\":false", body);
+        Assert.Contains("\"dpaAcceptancePending\":true", body);
+        Assert.Contains("\"whatsNewSeenPlatformUtc\":\"2026-11-01T00:00:00Z\"", body);
+        Assert.Contains(
+            $"\"viewAs\":{{\"tenantId\":\"{ViewedTenantId}\",\"tenantName\":\"Fabrikam\",\"role\":\"Viewer\",\"homeTenantId\":\"{TenantId}\"}}",
+            body);
+
+        // No sign-in side effect in either tenant, and no role lookup of the caller at all.
+        Assert.Empty(_store.Writes);
+        Assert.Empty(viewedStore.Writes);
+        _opsEventsMock.Verify(x => x.RecordTenantSignupAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _autoApproveEnqueuerMock.Verify(x => x.EnqueueAsync(
+            It.IsAny<AutopilotMonitor.Functions.Services.Activation.TenantAutoApproveEnvelope>(),
+            It.IsAny<TimeSpan?>(), It.IsAny<CancellationToken>()), Times.Never);
+        _tenantAdminsMock.Verify(x => x.TryAddTenantAdminAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _tenantAdminsMock.Verify(x => x.GetMembershipSnapshotAsync(It.IsAny<string>(), It.IsAny<string>()), Times.Never);
+        _metricsRepoMock.Verify(x => x.RecordUserLoginAsync(
+            It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Never);
+        _globalAdminMock.Verify(x => x.GetGlobalRoleAsync(It.IsAny<AdminIdentity?>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task GetCurrentUser_ViewAs_AnInactiveTenant_ShowsItsActivationGate()
+    {
+        var viewed = TenantConfiguration.CreateDefault(ViewedTenantId);
+        viewed.DomainName = "fabrikam.example";
+        _tenantConfigMock.Setup(x => x.TryGetConfigurationAsync(ViewedTenantId)).ReturnsAsync((viewed, true));
+        _tenantConfigMock.Setup(x => x.TryGetConfigurationAsync(TenantId)).ReturnsAsync((DefaultConfig(), true));
+        _previewMock.Setup(x => x.IsApprovedAsync(ViewedTenantId)).ReturnsAsync(false);
+        _mcpUserMock
+            .Setup(x => x.IsAllowedAsync(It.IsAny<string?>(), It.IsAny<string?>(), It.IsAny<string?>(),
+                It.IsAny<IReadOnlyList<string>?>(), It.IsAny<bool>()))
+            .ReturnsAsync(McpAccessCheckResult.Denied("not allowed"));
+        _metricsRepoMock.Setup(x => x.GetUserWhatsNewSeenAsync(TenantId, Upn)).ReturnsAsync(new UserWhatsNewSeen());
+        var (req, ctx) = BuildRequest(SignedIn(external: false), ViewingAs(Constants.TenantRoles.Admin));
+
+        var response = await _sut.GetCurrentUser(req, ctx);
+
+        // What the tenant's own admin gets while the tenant waits for activation — the Global Admin bypass is gone.
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Contains("PendingActivation", await ReadBodyAsync(response));
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/AutopilotDeviceValidatorTests.cs

@@ -1,4 +1,5 @@
 using System.Net;
+using System.Text.Json;
 using AutopilotMonitor.Functions.Security;
 using AutopilotMonitor.Shared.DataAccess;
 using AutopilotMonitor.Functions.Services;
@@ -69,7 +70,7 @@ public class AutopilotDeviceValidatorTests
             Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, cache)
         { CallBase = false };
         var tokenService = new Mock<GraphTokenService>(
-            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object)
+            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object, Mock.Of<IGraphAccessHealthRecorder>())
         { CallBase = false };
         tokenService.Setup(t => t.GetAccessTokenAsync(TenantId, It.IsAny<CancellationToken>()))
             .ReturnsAsync(GraphTokenResult.Success("token"));
@@ -95,7 +96,7 @@ public class AutopilotDeviceValidatorTests
         var result = await sut.ValidateAutopilotDeviceAsync(TenantId, Serial, null, CancellationToken.None);
 
         Assert.True(result.IsValid);
-        Assert.Equal("ap-1", result.AutopilotDeviceId);
+        Assert.Equal("ap-1", result.Registration!.DeviceId);
         Assert.Equal(2, handler.Requests.Count);
         tokens.Verify(t => t.InvalidateTenant(TenantId), Times.Once);
         tokens.Verify(t => t.GetAccessTokenAsync(TenantId, It.IsAny<CancellationToken>()), Times.Exactly(2));
@@ -168,7 +169,7 @@ public class AutopilotDeviceValidatorTests
         var result = await sut.ValidateAutopilotDeviceAsync(TenantId, Serial, null, CancellationToken.None);
 
         Assert.True(result.IsValid);
-        Assert.Equal("ap-1", result.AutopilotDeviceId);
+        Assert.Equal("ap-1", result.Registration!.DeviceId);
         Assert.Equal(2, handler.Requests.Count);
     }
 
@@ -201,7 +202,7 @@ public class AutopilotDeviceValidatorTests
             Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, cache)
         { CallBase = false };
         var tokenService = new Mock<GraphTokenService>(
-            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object)
+            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object, Mock.Of<IGraphAccessHealthRecorder>())
         { CallBase = false };
         CancellationToken observed = default;
         tokenService.Setup(t => t.GetAccessTokenAsync(TenantId, It.IsAny<CancellationToken>()))
@@ -213,4 +214,66 @@ public class AutopilotDeviceValidatorTests
 
         Assert.True(observed.CanBeCanceled);
     }
+
+    // ── Registration fields the session keeps ────────────────────────────────
+
+    private const string Upn = "first.last@example.invalid";
+
+    private static JsonElement Device(string json) => JsonSerializer.Deserialize<JsonElement>(json);
+
+    [Fact]
+    public void ReadRegistration_MapsTheKeptFields_AndKeepsOnlyWhetherAUserIsAssigned()
+    {
+        var device = Device(
+            "{\"id\":\"ap-1\",\"groupTag\":\" TEST \",\"purchaseOrderIdentifier\":\"PO-7\",\"displayName\":\"LAB-01\"," +
+            $"\"userPrincipalName\":\"{Upn}\",\"addressableUserName\":\"First Last\",\"productKey\":\"AAAAA-BBBBB\"}}");
+
+        var registration = AutopilotDeviceValidator.ReadRegistration(device);
+
+        Assert.Equal("ap-1", registration.DeviceId);
+        Assert.Equal("TEST", registration.GroupTag);
+        Assert.Equal("PO-7", registration.PurchaseOrderId);
+        Assert.Equal("LAB-01", registration.DisplayName);
+        Assert.True(registration.UserAssigned);
+        var kept = Newtonsoft.Json.JsonConvert.SerializeObject(registration);
+        Assert.DoesNotContain(Upn, kept);
+        Assert.DoesNotContain("First Last", kept);
+        Assert.DoesNotContain("AAAAA-BBBBB", kept);
+    }
+
+    [Fact]
+    public void ReadRegistration_TreatsBlankMissingAndNonTextValuesAsAbsent()
+    {
+        var device = Device(
+            "{\"id\":\"ap-1\",\"groupTag\":\"   \",\"purchaseOrderIdentifier\":null,\"displayName\":42,\"userPrincipalName\":\"\"}");
+
+        var registration = AutopilotDeviceValidator.ReadRegistration(device);
+
+        Assert.Null(registration.GroupTag);
+        Assert.Null(registration.PurchaseOrderId);
+        Assert.Null(registration.DisplayName);
+        Assert.False(registration.UserAssigned);
+    }
+
+    [Fact]
+    public void ReadRegistration_CutsOverlongText()
+    {
+        var longTag = new string('x', AutopilotDeviceValidator.MaxRegistrationFieldLength + 50);
+        var device = Device($"{{\"id\":\"ap-1\",\"groupTag\":\"{longTag}\"}}");
+
+        Assert.Equal(AutopilotDeviceValidator.MaxRegistrationFieldLength, AutopilotDeviceValidator.ReadRegistration(device).GroupTag!.Length);
+    }
+
+    [Fact]
+    public async Task CachedValidation_CarriesTheRegistration()
+    {
+        var (sut, handler, _) = BuildSut(Json(
+            "{\"value\":[{\"id\":\"ap-1\",\"serialNumber\":\"PF3XKQ7\",\"groupTag\":\"TEST\"}]}"));
+
+        await sut.ValidateAutopilotDeviceAsync(TenantId, Serial, null, CancellationToken.None);
+        var cached = await sut.ValidateAutopilotDeviceAsync(TenantId, Serial, null, CancellationToken.None);
+
+        Assert.Single(handler.Requests);
+        Assert.Equal("TEST", cached.Registration!.GroupTag);
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/AutopilotMonitor.Functions.Tests.csproj

@@ -13,10 +13,10 @@
          DataProtection/Cryptography.Xml 10.0.0 pulled in via Microsoft.Identity.Web),
          which would otherwise surface NU1903/NU1904 advisories here. -->
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
-    <PackageReference Include="Moq" Version="4.20.72" />
-    <PackageReference Include="xunit" Version="2.9.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.11.0" />
+    <PackageReference Include="Moq" Version="4.21.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="4.0.1">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>

src/Backend/AutopilotMonitor.Functions.Tests/ConfigBackupHookTests.cs

@@ -181,6 +181,49 @@ public class ConfigBackupHookTests
             b => b.UpsertAsync(It.IsAny<ConfigBackupEntry>(), It.IsAny<CancellationToken>()), Times.Never);
     }
 
+    [Fact]
+    public async Task NoiseOnlyChange_GraphAccessState_NoSnapshot()
+    {
+        // Token side effect: stamped and cleared without anyone changing the configuration.
+        var stored = StoredConfig();
+        var harness = new Harness(TableConfigRepository.ConvertToTenantTableEntity(stored));
+
+        var incoming = RoundtripClone(stored);
+        incoming.GraphAccessRejectedSince = DateTime.UtcNow.AddMinutes(-20);
+        incoming.GraphAccessRejectedCode = "AADSTS7000229";
+        incoming.GraphAccessRejectionConfirmedAt = DateTime.UtcNow;
+        incoming.LastUpdated = DateTime.UtcNow;
+
+        var saved = await harness.Sut.TryReplaceTenantConfigurationAsync(incoming, "\"etag\"", "graph-access", null);
+
+        Assert.True(saved);
+        Assert.Single(harness.Upserts);
+        harness.Backup.Verify(
+            b => b.UpsertAsync(It.IsAny<ConfigBackupEntry>(), It.IsAny<CancellationToken>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task NoiseOnlyChange_AddOnPermissionState_NoSnapshot()
+    {
+        // Agent and token side effect, like the Graph access state.
+        var stored = StoredConfig();
+        var harness = new Harness(TableConfigRepository.ConvertToTenantTableEntity(stored));
+
+        var incoming = RoundtripClone(stored);
+        incoming.IntuneDeviceBindingPermissionMissingSince = DateTime.UtcNow.AddMinutes(-20);
+        incoming.IntuneDeviceBindingPermissionMissingConfirmedAt = DateTime.UtcNow;
+        incoming.CloudPcPermissionMissingSince = DateTime.UtcNow.AddMinutes(-20);
+        incoming.CloudPcPermissionMissingConfirmedAt = DateTime.UtcNow;
+        incoming.LastUpdated = DateTime.UtcNow;
+
+        var saved = await harness.Sut.TryReplaceTenantConfigurationAsync(incoming, "\"etag\"", "graph-access", null);
+
+        Assert.True(saved);
+        Assert.Single(harness.Upserts);
+        harness.Backup.Verify(
+            b => b.UpsertAsync(It.IsAny<ConfigBackupEntry>(), It.IsAny<CancellationToken>()), Times.Never);
+    }
+
     [Fact]
     public async Task NoOpSave_IdenticalContent_NoSnapshot()
     {

src/Backend/AutopilotMonitor.Functions.Tests/ConnectionTypeFilterTests.cs

@@ -5,9 +5,9 @@ using Xunit;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// Cover for the ConnectionType predicate used on every search path that does NOT push the
-/// filter to OData — the deviceProperties batch-get (<c>ApplyBasicFilters</c>) and the legacy
-/// unpaged scan. Sessions that predate the projection (null ConnectionType) must never match
+/// Cover for the ConnectionType predicate used on the search path that does NOT push the
+/// filter to OData — the deviceProperties batch-get (<c>ApplyBasicFilters</c>). Sessions that
+/// predate the projection (null ConnectionType) must never match
 /// a set filter; an unset filter matches everything.
 /// </summary>
 public class ConnectionTypeFilterTests

src/Backend/AutopilotMonitor.Functions.Tests/CorporateIdentifierValidatorTests.cs

@@ -65,7 +65,7 @@ public class CorporateIdentifierValidatorTests
             Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, cache)
         { CallBase = false };
         var tokenService = new Mock<GraphTokenService>(
-            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object)
+            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object, Mock.Of<IGraphAccessHealthRecorder>())
         { CallBase = false };
         tokenService.Setup(t => t.GetAccessTokenAsync(TenantId, It.IsAny<CancellationToken>()))
             .ReturnsAsync(GraphTokenResult.Success("token"));

src/Backend/AutopilotMonitor.Functions.Tests/DerivedWriterLivenessTests.cs

@@ -95,6 +95,7 @@ public class DerivedWriterLivenessTests
             configService: null!,
             channelDispatcher: null!,
             GuardFor(row),
+            stopReporter: null!,
             NullLogger<AnalyzeOnEnrollmentEndHandler>.Instance);
 
         await handler.HandleAsync(new AnalyzeOnEnrollmentEndEnvelope
@@ -116,6 +117,7 @@ public class DerivedWriterLivenessTests
             ruleService: null!, Mock.Of<IRuleRepository>(), Mock.Of<ISessionRepository>(), Mock.Of<IMetricsRepository>(),
             signalRNotification: null!, configService: null!, channelDispatcher: null!,
             new SessionDeletionGuard(reader.Object, NullLogger<SessionDeletionGuard>.Instance),
+            stopReporter: null!,
             NullLogger<AnalyzeOnEnrollmentEndHandler>.Instance);
 
         await Assert.ThrowsAsync<Azure.RequestFailedException>(() => handler.HandleAsync(new AnalyzeOnEnrollmentEndEnvelope

src/Backend/AutopilotMonitor.Functions.Tests/DeviceAssociationValidatorTests.cs

@@ -101,9 +101,8 @@ public class DeviceAssociationValidatorTests
         Assert.Equal("preassociated", result.AssociationState);
         Assert.Equal("00000000-0000-0000-0000-000000000000", result.DevicePreparationPolicyId);
         Assert.Equal("admin@contoso.com", result.PreAssociatedByUserPrincipalName);
-        // Newtonsoft.Json yields "" for JSON null when calling .ToString() on the JToken;
-        // downstream telemetry uses IsNullOrEmpty so both null and "" surface as "absent".
-        Assert.True(string.IsNullOrEmpty(result.AssignedToUserPrincipalName));
+        // JSON null is absence (D-420); the former Newtonsoft reader turned it into "".
+        Assert.Null(result.AssignedToUserPrincipalName);
         Assert.NotNull(result.PreAssociationDateTime);
         Assert.Null(result.AssociationDateTime); // Graph "0001-01-01" → null (unset DateTimeOffset sentinel)
     }

src/Backend/AutopilotMonitor.Functions.Tests/EmailChannelProviderTests.cs

@@ -4,6 +4,7 @@ using AutopilotMonitor.Functions.Helpers;
 using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Functions.Services.Notifications;
 using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Models.Notifications;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.Logging.Abstractions;
@@ -12,8 +13,8 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;
 
 /// <summary>
-/// E-mail as a notification-channel provider (D-332): dispatch routing (never the webhook path,
-/// never the bot), recipient validation, the Global-Admin gate, the rendered message, and the
+/// E-mail as a notification-channel provider (D-332): dispatch routing (never the webhook path),
+/// recipient validation, the Global-Admin gate, the rendered message, and the
 /// send against a stubbed provider endpoint.
 /// </summary>
 public class EmailChannelProviderTests
@@ -30,15 +31,6 @@ public class EmailChannelProviderTests
         return mock;
     }
 
-    private static Mock<TelegramNotificationService> TelegramMock()
-    {
-        var mock = new Mock<TelegramNotificationService>(new HttpClient(), Mock.Of<IConfigRepository>(), NullLogger<TelegramNotificationService>.Instance)
-        { CallBase = false };
-        mock.Setup(t => t.SendAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()))
-            .ReturnsAsync(new NotificationSendResult { Success = true });
-        return mock;
-    }
-
     private static Mock<IEmailChannelSender> EmailMock()
     {
         var mock = new Mock<IEmailChannelSender>();
@@ -50,6 +42,9 @@ public class EmailChannelProviderTests
     private static NotificationChannel Channel(string? url, string id = "mail", bool enabled = true)
         => new() { Id = id, Name = id, ProviderType = Email, Url = url, Enabled = enabled };
 
+    private static NotificationChannel Webhook(WebhookProviderType provider, string url)
+        => new() { Id = provider.ToString(), Name = provider.ToString(), ProviderType = (int)provider, Url = url, Enabled = true };
+
     private static NotificationAlert Alert() => new()
     {
         EventType = "PushDeliveryFailed",
@@ -67,9 +62,8 @@ public class EmailChannelProviderTests
     public async Task Email_channel_reaches_the_email_sender_with_its_recipients_and_never_the_webhook_path()
     {
         var webhook = WebhookMock();
-        var telegram = TelegramMock();
         var email = EmailMock();
-        var dispatcher = new NotificationChannelDispatcher(webhook.Object, telegram.Object, Mock.Of<IPushChannelSender>(), email.Object);
+        var dispatcher = new NotificationChannelDispatcher(webhook.Object, Mock.Of<IPushChannelSender>(), email.Object);
         var alert = Alert();
 
         await dispatcher.SendToChannelsAsync(new[] { Channel("ops@example.invalid; two@example.invalid") }, alert, Platform);
@@ -77,7 +71,6 @@ public class EmailChannelProviderTests
         email.Verify(e => e.SendAlertAsync("ops@example.invalid; two@example.invalid", alert), Times.Once);
         webhook.Verify(w => w.SendAsync(It.IsAny<string>(), It.IsAny<WebhookProviderType>(), It.IsAny<NotificationAlert>(),
             It.IsAny<IReadOnlyDictionary<string, string>>(), It.IsAny<string>()), Times.Never);
-        telegram.Verify(t => t.SendAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()), Times.Never);
     }
 
     [Fact]
@@ -86,7 +79,7 @@ public class EmailChannelProviderTests
         var email = EmailMock();
         email.Setup(e => e.SendAlertAsync("ops@example.invalid", It.IsAny<NotificationAlert>()))
             .ReturnsAsync(new NotificationSendResult { Success = true, Message = "Sent to 1 recipient(s)." });
-        var dispatcher = new NotificationChannelDispatcher(WebhookMock().Object, TelegramMock().Object, Mock.Of<IPushChannelSender>(), email.Object);
+        var dispatcher = new NotificationChannelDispatcher(WebhookMock().Object, Mock.Of<IPushChannelSender>(), email.Object);
 
         await dispatcher.SendToChannelsAsync(new[] { Channel(""), Channel(null, "n") }, Alert(), Platform);
         email.Verify(e => e.SendAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()), Times.Never);
@@ -99,7 +92,7 @@ public class EmailChannelProviderTests
     [Fact]
     public async Task Dispatcher_without_an_email_transport_skips_the_channel_and_says_so_on_test()
     {
-        var dispatcher = new NotificationChannelDispatcher(WebhookMock().Object, TelegramMock().Object, Mock.Of<IPushChannelSender>());
+        var dispatcher = new NotificationChannelDispatcher(WebhookMock().Object, Mock.Of<IPushChannelSender>());
 
         await dispatcher.SendToChannelsAsync(new[] { Channel("ops@example.invalid") }, Alert(), Platform);   // no throw
         var result = await dispatcher.SendTestAsync(Channel("ops@example.invalid"), Alert(), Platform);
@@ -108,6 +101,54 @@ public class EmailChannelProviderTests
         Assert.Contains("not registered", result.Message);
     }
 
+    [Fact]
+    public async Task Webhook_channel_reaches_the_webhook_path_and_never_the_email_sender()
+    {
+        var webhook = WebhookMock();
+        var email = EmailMock();
+        var dispatcher = new NotificationChannelDispatcher(webhook.Object, Mock.Of<IPushChannelSender>(), email.Object);
+        var alert = Alert();
+
+        await dispatcher.SendToChannelsAsync(new[] { Webhook(WebhookProviderType.Slack, "https://hooks.slack.example/x") }, alert, Platform);
+
+        webhook.Verify(w => w.SendAsync("https://hooks.slack.example/x", WebhookProviderType.Slack, alert,
+            It.IsAny<IReadOnlyDictionary<string, string>>(), It.IsAny<string>()), Times.Once);
+        email.Verify(e => e.SendAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task Mixed_list_each_channel_reaches_its_own_transport()
+    {
+        var webhook = WebhookMock();
+        var email = EmailMock();
+        var dispatcher = new NotificationChannelDispatcher(webhook.Object, Mock.Of<IPushChannelSender>(), email.Object);
+        var alert = Alert();
+
+        await dispatcher.SendToChannelsAsync(new[]
+        {
+            Channel("ops@example.invalid"),
+            Webhook(WebhookProviderType.GenericJson, "https://sales.example/hook"),
+        }, alert, Platform);
+
+        email.Verify(e => e.SendAlertAsync("ops@example.invalid", alert), Times.Once);
+        webhook.Verify(w => w.SendAsync("https://sales.example/hook", WebhookProviderType.GenericJson, alert,
+            It.IsAny<IReadOnlyDictionary<string, string>>(), It.IsAny<string>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task Channels_without_a_destination_are_skipped_on_every_transport()
+    {
+        var webhook = WebhookMock();
+        var email = EmailMock();
+        var dispatcher = new NotificationChannelDispatcher(webhook.Object, Mock.Of<IPushChannelSender>(), email.Object);
+
+        await dispatcher.SendToChannelsAsync(new[] { Channel(null), Webhook(WebhookProviderType.Slack, "") }, Alert(), Platform);
+
+        email.Verify(e => e.SendAlertAsync(It.IsAny<string>(), It.IsAny<NotificationAlert>()), Times.Never);
+        webhook.Verify(w => w.SendAsync(It.IsAny<string>(), It.IsAny<WebhookProviderType>(), It.IsAny<NotificationAlert>(),
+            It.IsAny<IReadOnlyDictionary<string, string>>(), It.IsAny<string>()), Times.Never);
+    }
+
     // ── Validation and gate ───────────────────────────────────────────────
 
     [Theory]
@@ -138,6 +179,10 @@ public class EmailChannelProviderTests
 
         var bad = NotificationChannel.SerializeList(new[] { Channel("https://hooks.example.invalid/x") });
         Assert.Contains("not a valid e-mail address", TenantConfigValidation.ValidateNotificationChannels(bad));
+
+        // The branch is per provider: a recipient list on a webhook channel still meets the URL gate.
+        var onWebhook = NotificationChannel.SerializeList(new[] { Webhook(WebhookProviderType.Slack, "ops@example.invalid") });
+        Assert.NotNull(TenantConfigValidation.ValidateNotificationChannels(onWebhook));
     }
 
     [Fact]
@@ -146,14 +191,45 @@ public class EmailChannelProviderTests
         Assert.True(NotificationChannel.IsGlobalAdminOnlyProvider(Email));
         var candidate = NotificationChannel.SerializeList(new[] { Channel("ops@example.invalid") });
 
-        Assert.Null(TenantConfigValidation.ValidateTelegramChannelGate(candidate, null, isGlobalAdmin: true));
-        var refused = TenantConfigValidation.ValidateTelegramChannelGate(candidate, null, isGlobalAdmin: false);
+        Assert.Null(TenantConfigValidation.ValidatePlatformProviderGate(candidate, null, isGlobalAdmin: true));
+        var refused = TenantConfigValidation.ValidatePlatformProviderGate(candidate, null, isGlobalAdmin: false);
         Assert.Equal("E-mail channels can only be configured by a Global Administrator.", refused);
 
         // A GA-created channel survives a tenant admin's unrelated save; retargeting it does not.
-        Assert.Null(TenantConfigValidation.ValidateTelegramChannelGate(candidate, candidate, isGlobalAdmin: false));
+        Assert.Null(TenantConfigValidation.ValidatePlatformProviderGate(candidate, candidate, isGlobalAdmin: false));
         var retargeted = NotificationChannel.SerializeList(new[] { Channel("other@example.invalid") });
-        Assert.NotNull(TenantConfigValidation.ValidateTelegramChannelGate(retargeted, candidate, isGlobalAdmin: false));
+        Assert.NotNull(TenantConfigValidation.ValidatePlatformProviderGate(retargeted, candidate, isGlobalAdmin: false));
+    }
+
+    [Fact]
+    public void Gate_refuses_a_tenant_admin_who_flips_the_enabled_state()
+    {
+        var existing = NotificationChannel.SerializeList(new[] { Channel("ops@example.invalid", enabled: true) });
+        var disabled = NotificationChannel.SerializeList(new[] { Channel("ops@example.invalid", enabled: false) });
+
+        Assert.NotNull(TenantConfigValidation.ValidatePlatformProviderGate(disabled, existing, isGlobalAdmin: false));
+    }
+
+    [Fact]
+    public void Gate_ignores_webhook_channels()
+    {
+        var candidate = NotificationChannel.SerializeList(new[] { Webhook(WebhookProviderType.GenericJson, "https://sales.example/hook") });
+
+        Assert.Null(TenantConfigValidation.ValidatePlatformProviderGate(candidate, null, isGlobalAdmin: false));
+    }
+
+    [Fact]
+    public void ValidateModel_enforces_the_gate_for_every_client_write()
+    {
+        var candidate = new TenantConfiguration
+        {
+            TenantId = "t1",
+            NotificationChannelsJson = NotificationChannel.SerializeList(new[] { Channel("ops@example.invalid") }),
+        };
+        var existing = new TenantConfiguration { TenantId = "t1" };
+
+        Assert.NotNull(TenantConfigValidation.ValidateModel(candidate, existing, isGlobalAdmin: false));
+        Assert.Null(TenantConfigValidation.ValidateModel(candidate, existing, isGlobalAdmin: true));
     }
 
     // ── Rendering ─────────────────────────────────────────────────────────

src/Backend/AutopilotMonitor.Functions.Tests/EntraTokenRejectionTests.cs

@@ -0,0 +1,78 @@
+using AutopilotMonitor.Functions.Security;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Reads the AADSTS code out of Entra's token error body. The body below has the shape Entra
+/// really sends for a tenant whose enterprise application was removed; the ids are synthetic.
+/// </summary>
+public class EntraTokenRejectionTests
+{
+    private const string MissingServicePrincipalBody =
+        "{\"error\":\"invalid_client\"," +
+        "\"error_description\":\"AADSTS7000229: The client application aaaaaaaa-0000-0000-0000-000000000001 is missing service principal in the tenant 11111111-1111-1111-1111-111111111111. See instructions here: https://go.microsoft.com/fwlink/?linkid=2225119\\r\\nTrace ID: 00000000-0000-0000-0000-000000000002\\r\\nCorrelation ID: 00000000-0000-0000-0000-000000000003\\r\\nTimestamp: 2026-11-01 08:00:00Z\"," +
+        "\"error_codes\":[7000229]," +
+        "\"timestamp\":\"2026-11-01 08:00:00Z\"," +
+        "\"trace_id\":\"00000000-0000-0000-0000-000000000002\"," +
+        "\"correlation_id\":\"00000000-0000-0000-0000-000000000003\"," +
+        "\"error_uri\":\"https://login.microsoftonline.com/error?code=7000229\"}";
+
+    [Fact]
+    public void Parse_reads_the_code_and_keeps_only_the_first_line_of_the_description()
+    {
+        var rejection = EntraTokenRejection.Parse(401, MissingServicePrincipalBody);
+
+        Assert.Equal(401, rejection.StatusCode);
+        Assert.Equal("AADSTS7000229", rejection.ErrorCode);
+        Assert.True(rejection.IsServicePrincipalMissing);
+        Assert.False(rejection.IsOurCredential);
+        Assert.StartsWith("AADSTS7000229: The client application", rejection.Description);
+        Assert.DoesNotContain("Trace ID", rejection.Description);
+    }
+
+    [Fact]
+    public void Parse_falls_back_to_the_description_without_error_codes()
+    {
+        var rejection = EntraTokenRejection.Parse(400, "{\"error\":\"invalid_request\",\"error_description\":\"AADSTS53003: Access has been blocked by Conditional Access policies.\"}");
+
+        Assert.Equal("AADSTS53003", rejection.ErrorCode);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("<html>Bad Request</html>")]
+    [InlineData("[1,2]")]
+    [InlineData("{\"error\":\"invalid_request\"}")]
+    public void Parse_keeps_only_the_status_when_the_body_carries_no_code(string? body)
+    {
+        var rejection = EntraTokenRejection.Parse(400, body);
+
+        Assert.Equal(400, rejection.StatusCode);
+        Assert.Null(rejection.ErrorCode);
+        Assert.Null(rejection.Description);
+        Assert.False(rejection.IsServicePrincipalMissing);
+        Assert.False(rejection.IsOurCredential);
+    }
+
+    [Fact]
+    public void Parse_cuts_a_long_description()
+    {
+        var body = "{\"error_description\":\"AADSTS50000: " + new string('x', 1000) + "\"}";
+
+        Assert.Equal(300, EntraTokenRejection.Parse(400, body).Description!.Length);
+    }
+
+    [Theory]
+    [InlineData("AADSTS7000215", true)]
+    [InlineData("AADSTS7000222", true)]
+    [InlineData("AADSTS7000218", true)]
+    [InlineData("aadsts7000222", true)]
+    [InlineData("AADSTS7000229", false)]
+    [InlineData("AADSTS7000112", false)]
+    [InlineData("AADSTS53003", false)]
+    public void IsOurCredential_only_blames_our_own_secret(string code, bool expected)
+    {
+        Assert.Equal(expected, new EntraTokenRejection(401, code, null).IsOurCredential);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/FeedbackFunctionSubmitTests.cs

@@ -1,6 +1,5 @@
 using System;
 using System.Collections.Generic;
-using System.Net.Http;
 using System.Text.Json;
 using System.Threading.Tasks;
 using AutopilotMonitor.Functions.Functions.Feedback;
@@ -19,8 +18,8 @@ namespace AutopilotMonitor.Functions.Tests;
 /// <summary>
 /// The rating bubble's answer route, driven through <c>ProcessSubmitAsync</c> (the HTTP shell only
 /// reads the body and maps the validation error). Pins that a recorded rating, and nothing else,
-/// raises <c>FeedbackRatingReceived</c>, the Global Admin bell and the Telegram ping, and that the
-/// alert carries neither the comment nor the sender.
+/// raises <c>FeedbackRatingReceived</c> and the Global Admin bell, and that the alert carries neither
+/// the comment nor the sender.
 /// </summary>
 public sealed class FeedbackFunctionSubmitTests
 {
@@ -34,7 +33,7 @@ public sealed class FeedbackFunctionSubmitTests
     private static readonly string EntryPath = Constants.PortalUserFeedbackEntryPath(FeedbackId);
 
     [Fact]
-    public async Task Rating_IsStored_RaisesTheEvent_RingsTheBell_AndPings()
+    public async Task Rating_IsStored_RaisesTheEvent_AndRingsTheBell()
     {
         var h = new Harness();
 
@@ -64,13 +63,12 @@ public sealed class FeedbackFunctionSubmitTests
 
         h.Bell.Verify(b => b.CreateNotificationAsync(
             "feedback", "New Rating", $"{Upn} (contoso.invalid) · 4/5", EntryPath), Times.Once);
-        h.Telegram.Verify(t => t.SendFeedbackAsync(TenantId, Upn, DisplayName, 4, Comment), Times.Once);
     }
 
     [Fact]
     public async Task TheAlert_CarriesNeitherCommentNorSender()
     {
-        // Channels bound to FeedbackRatingReceived (Telegram, Slack, webhooks, e-mail) receive message
+        // Channels bound to FeedbackRatingReceived (Slack, webhooks, e-mail) receive message
         // and details; the comment is read in the portal. Personal data must never ride along.
         var h = new Harness();
 
@@ -160,7 +158,6 @@ public sealed class FeedbackFunctionSubmitTests
         Assert.Empty(h.OpsEvents);
         h.Bell.Verify(b => b.CreateNotificationAsync(
             "feedback", "New Rating", It.IsAny<string>(), EntryPath), Times.Once);
-        h.Telegram.Verify(t => t.SendFeedbackAsync(TenantId, Upn, DisplayName, 3, Comment), Times.Once);
     }
 
     [Fact]
@@ -183,7 +180,6 @@ public sealed class FeedbackFunctionSubmitTests
         public FakeFeedbackRepository Repo { get; }
         public List<OpsEventEntry> OpsEvents { get; } = new();
         public Mock<GlobalNotificationService> Bell { get; }
-        public Mock<TelegramNotificationService> Telegram { get; }
 
         public Harness(FeedbackEntry? current = null, bool configExists = true, bool opsEventThrows = false)
         {
@@ -203,9 +199,6 @@ public sealed class FeedbackFunctionSubmitTests
                 Mock.Of<INotificationRepository>(), new FakeSignalRNotificationService(),
                 Mock.Of<ILogger<GlobalNotificationService>>())
             { CallBase = false };
-            Telegram = new Mock<TelegramNotificationService>(
-                new HttpClient(), configRepo, Mock.Of<ILogger<TelegramNotificationService>>())
-            { CallBase = false };
 
             var adminConfig = new Mock<AdminConfigurationService>(
                 configRepo, NullLogger<AdminConfigurationService>.Instance, cache)
@@ -216,7 +209,7 @@ public sealed class FeedbackFunctionSubmitTests
 
             Sut = new FeedbackFunction(
                 NullLogger<FeedbackFunction>.Instance, tenantConfig.Object, adminConfig.Object, tenantAdmins.Object,
-                Telegram.Object, Mock.Of<ISessionRepository>(), Repo,
+                Mock.Of<ISessionRepository>(), Repo,
                 BuildOpsEventService(adminConfig.Object, opsEventThrows), Bell.Object);
         }
 
@@ -228,8 +221,6 @@ public sealed class FeedbackFunctionSubmitTests
         {
             Bell.Verify(b => b.CreateNotificationAsync(
                 It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string?>()), Times.Never);
-            Telegram.Verify(t => t.SendFeedbackAsync(
-                It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<int>(), It.IsAny<string?>()), Times.Never);
         }
 
         /// <summary>A real OpsEventService over a capturing repository, so the actual record method runs.</summary>

src/Backend/AutopilotMonitor.Functions.Tests/FleetHealthPayloadTests.cs

@@ -23,7 +23,8 @@ public class FleetHealthPayloadTests
         string manufacturer = "Contoso",
         string model = "Laptop",
         string? failureReason = null,
-        DateTime? startedAt = null)
+        DateTime? startedAt = null,
+        string? groupTag = null)
         => new()
         {
             TenantId = Guid.NewGuid().ToString(),
@@ -34,8 +35,106 @@ public class FleetHealthPayloadTests
             Model = model,
             FailureReason = failureReason!,
             StartedAt = startedAt ?? DateTime.UtcNow,
+            AutopilotGroupTag = groupTag,
         };
 
+    private static FleetGroupTagFilter Filter(string? excludeGroupTags, bool excludeUntagged = false)
+    {
+        Assert.True(FleetGroupTagFilter.TryParse(excludeGroupTags, excludeUntagged ? "true" : null, out var filter, out _));
+        return filter;
+    }
+
+    // ── Group tag breakdown and view filter ──────────────────────────────────
+
+    [Fact]
+    public void GroupTagHealth_IsEmpty_WhenNoSessionCarriesATag()
+    {
+        var payload = MetricsMath.BuildFleetHealthPayload(
+            new List<SessionSummary> { S(SessionStatus.Succeeded), S(SessionStatus.Failed) }, days: 7);
+
+        Assert.Empty(payload.GroupTagHealth);
+    }
+
+    [Fact]
+    public void GroupTagHealth_GroupsWithoutCase_InTheMostFrequentSpelling_WithANoTagBucket()
+    {
+        var sessions = new List<SessionSummary>
+        {
+            S(SessionStatus.Succeeded, groupTag: "TEST"),
+            S(SessionStatus.Failed, groupTag: "TEST"),
+            S(SessionStatus.Failed, groupTag: " test "),
+            S(SessionStatus.Succeeded, groupTag: "PROD"),
+            S(SessionStatus.InProgress),
+        };
+
+        var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 7);
+
+        Assert.Equal(new[] { "TEST", "No group tag", "PROD" }.OrderBy(l => l), payload.GroupTagHealth.Select(g => g.Label).OrderBy(l => l));
+        var test = payload.GroupTagHealth.Single(g => g.GroupTag == "TEST");
+        Assert.Equal((3, 1, 2), (test.Total, test.Succeeded, test.Failed));
+        Assert.Equal(string.Empty, payload.GroupTagHealth.Single(g => g.Label == "No group tag").GroupTag);
+        Assert.Equal("TEST", payload.GroupTagHealth[0].GroupTag); // by volume
+    }
+
+    [Fact]
+    public void Filter_TakesExcludedTagsOutOfEveryFigure_ButKeepsThemFlaggedInTheBreakdown()
+    {
+        var sessions = new List<SessionSummary>
+        {
+            S(SessionStatus.Failed, groupTag: "TEST", model: "Lab VM", failureReason: "lab"),
+            S(SessionStatus.Failed, groupTag: "test", model: "Lab VM", failureReason: "lab"),
+            S(SessionStatus.Succeeded, groupTag: "PROD"),
+            S(SessionStatus.Succeeded),
+        };
+
+        var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 7, Filter("Test"));
+
+        Assert.Equal(2, payload.ExcludedSessions);
+        Assert.Equal(new[] { "Test" }, payload.ExcludedGroupTags);
+        Assert.False(payload.ExcludeUntagged);
+        Assert.Equal(2, payload.Stats.Total);
+        Assert.Equal(100d, payload.Stats.SuccessRate);
+        Assert.Empty(payload.FailureReasons);
+        Assert.DoesNotContain(payload.ModelHealth, m => m.Model == "Lab VM");
+        Assert.Equal(0, payload.DailyData.Sum(d => d.Failed));
+        var excluded = Assert.Single(payload.GroupTagHealth, g => g.Excluded);
+        Assert.Equal(("TEST", 2), (excluded.GroupTag, excluded.Total));
+    }
+
+    [Fact]
+    public void Filter_ExcludeUntagged_TakesTheSessionsWithoutATagOut()
+    {
+        var sessions = new List<SessionSummary>
+        {
+            S(SessionStatus.Failed),
+            S(SessionStatus.Succeeded, groupTag: "PROD"),
+        };
+
+        var payload = MetricsMath.BuildFleetHealthPayload(sessions, days: 7, Filter(null, excludeUntagged: true));
+
+        Assert.Equal(1, payload.ExcludedSessions);
+        Assert.True(payload.ExcludeUntagged);
+        Assert.Equal(100d, payload.Stats.SuccessRate);
+        Assert.True(payload.GroupTagHealth.Single(g => g.GroupTag.Length == 0).Excluded);
+    }
+
+    [Fact]
+    public void TryParse_TrimsDeduplicatesAndCapsTheList()
+    {
+        Assert.True(FleetGroupTagFilter.TryParse(" TEST , test,,LAB ", null, out var filter, out _));
+        Assert.Equal(new[] { "TEST", "LAB" }, filter.ExcludedTags);
+        Assert.True(filter.IsActive);
+
+        Assert.True(FleetGroupTagFilter.TryParse(null, null, out var none, out _));
+        Assert.False(none.IsActive);
+
+        var tooMany = string.Join(",", Enumerable.Range(0, FleetGroupTagFilter.MaxExcludedTags + 1).Select(i => $"T{i}"));
+        Assert.False(FleetGroupTagFilter.TryParse(tooMany, null, out _, out var error));
+        Assert.Contains("at most", error);
+
+        Assert.False(FleetGroupTagFilter.TryParse(new string('x', 300), null, out _, out _));
+    }
+
     [Fact]
     public void EmptyInput_YieldsZeroedStats_AndOneDailyPointPerDay()
     {

src/Backend/AutopilotMonitor.Functions.Tests/GetTenantFeatureFlagsPayloadTests.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Security;
 using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Functions.Tests;
@@ -34,10 +35,13 @@ public class GetTenantFeatureFlagsPayloadTests
         // — and that forces a deliberate code review of whether the new field is non-sensitive.
         Assert.Equal(new[]
         {
+            // Non-sensitive by review: booleans only, the timestamps stay in the admin-gated config.
+            "addOnPermissionMissingBlocksAll",
             // Non-sensitive by review: bool only, exposes no client ids (dual app-reg
             // self-service migration banner).
             "appHomingFunnelActive",
             "bootstrapTokenEnabled",
+            "cloudPcPermissionMissing",
             // Non-sensitive by review: bool only ("is a company name set"), never the value
             // itself (admin-gated full config only).
             "companyNameSet",
@@ -55,6 +59,10 @@ public class GetTenantFeatureFlagsPayloadTests
             "enableIntegrityBypassAnalyzer",
             "enableSoftwareInventoryAnalyzer",
             "entitlements",
+            // Non-sensitive by review: booleans only; the Entra code stays in the admin-gated config.
+            "graphAccessAppMissing",
+            "graphAccessRejected",
+            "intuneDeviceBindingPermissionMissing",
             "isTrial",
             "showScriptOutput",
             "trialAvailable",
@@ -65,6 +73,122 @@ public class GetTenantFeatureFlagsPayloadTests
         }, fieldNames);
     }
 
+    [Fact]
+    public void Payload_GraphAccess_SuspicionAloneShowsNothing()
+    {
+        var element = Serialize(new TenantConfiguration
+        {
+            ValidateAutopilotDevice = true,
+            GraphAccessRejectedSince = Now.AddMinutes(-5),
+            GraphAccessRejectedCode = EntraTokenRejection.ServicePrincipalMissingCode,
+        });
+
+        Assert.False(element.GetProperty("graphAccessRejected").GetBoolean());
+        Assert.False(element.GetProperty("graphAccessAppMissing").GetBoolean());
+    }
+
+    [Theory]
+    [InlineData(EntraTokenRejection.ServicePrincipalMissingCode, true)]
+    [InlineData("AADSTS53003", false)]
+    [InlineData(null, false)]
+    public void Payload_GraphAccess_ConfirmedShowsTheNotice_AndNamesOnlyTheMissingApp(string? code, bool appMissing)
+    {
+        var element = Serialize(new TenantConfiguration
+        {
+            ValidateAutopilotDevice = true,
+            GraphAccessRejectedSince = Now.AddHours(-1),
+            GraphAccessRejectedCode = code,
+            GraphAccessRejectionConfirmedAt = Now.AddMinutes(-45),
+        });
+
+        Assert.True(element.GetProperty("graphAccessRejected").GetBoolean());
+        Assert.Equal(appMissing, element.GetProperty("graphAccessAppMissing").GetBoolean());
+        Assert.DoesNotContain("AADSTS", element.GetRawText());
+    }
+
+    [Fact]
+    public void Payload_GraphAccess_StaysSilentWithoutDeviceValidation()
+    {
+        // The switch being off has its own banner; the agent does not depend on Graph then.
+        var element = Serialize(new TenantConfiguration
+        {
+            GraphAccessRejectedSince = Now.AddHours(-1),
+            GraphAccessRejectedCode = EntraTokenRejection.ServicePrincipalMissingCode,
+            GraphAccessRejectionConfirmedAt = Now.AddMinutes(-45),
+        });
+
+        Assert.False(element.GetProperty("graphAccessRejected").GetBoolean());
+        Assert.False(element.GetProperty("graphAccessAppMissing").GetBoolean());
+    }
+
+    [Fact]
+    public void Payload_AddOn_SuspicionAloneShowsNothing()
+    {
+        var element = Serialize(new TenantConfiguration
+        {
+            ValidateAutopilotDevice = true,
+            ValidateIntuneDeviceBinding = true,
+            IntuneDeviceBindingPermissionMissingSince = Now.AddMinutes(-5),
+        });
+
+        Assert.False(element.GetProperty("intuneDeviceBindingPermissionMissing").GetBoolean());
+        Assert.False(element.GetProperty("addOnPermissionMissingBlocksAll").GetBoolean());
+    }
+
+    [Fact]
+    public void Payload_AddOn_ConfirmedShowsTheNotice_PerValidation()
+    {
+        var element = Serialize(new TenantConfiguration
+        {
+            ValidateAutopilotDevice = true,
+            ValidateIntuneDeviceBinding = true,
+            ValidateCloudPcDevice = true,
+            CloudPcPermissionMissingSince = Now.AddHours(-1),
+            CloudPcPermissionMissingConfirmedAt = Now.AddMinutes(-45),
+        });
+
+        Assert.True(element.GetProperty("cloudPcPermissionMissing").GetBoolean());
+        Assert.False(element.GetProperty("intuneDeviceBindingPermissionMissing").GetBoolean());
+        // Autopilot still admits its devices.
+        Assert.False(element.GetProperty("addOnPermissionMissingBlocksAll").GetBoolean());
+    }
+
+    [Fact]
+    public void Payload_AddOn_SwitchingTheValidationOffHidesTheNoticeAtOnce()
+    {
+        var element = Serialize(new TenantConfiguration
+        {
+            ValidateAutopilotDevice = true,
+            IntuneDeviceBindingPermissionMissingSince = Now.AddHours(-1),
+            IntuneDeviceBindingPermissionMissingConfirmedAt = Now.AddMinutes(-45),
+        });
+
+        Assert.False(element.GetProperty("intuneDeviceBindingPermissionMissing").GetBoolean());
+    }
+
+    [Theory]
+    // Only the binding is on: no device can be validated.
+    [InlineData(false, false, true)]
+    // The Cloud PC check is on and still works for Cloud PCs.
+    [InlineData(true, false, false)]
+    // Both are on and both are confirmed missing.
+    [InlineData(true, true, true)]
+    public void Payload_AddOn_BlocksAllOnlyWhenNoOtherValidationAdmits(bool cloudPcOn, bool cloudPcConfirmed, bool blocksAll)
+    {
+        var element = Serialize(new TenantConfiguration
+        {
+            ValidateIntuneDeviceBinding = true,
+            IntuneDeviceBindingPermissionMissingSince = Now.AddHours(-1),
+            IntuneDeviceBindingPermissionMissingConfirmedAt = Now.AddMinutes(-45),
+            ValidateCloudPcDevice = cloudPcOn,
+            CloudPcPermissionMissingSince = cloudPcConfirmed ? Now.AddHours(-1) : null,
+            CloudPcPermissionMissingConfirmedAt = cloudPcConfirmed ? Now.AddMinutes(-45) : null,
+        });
+
+        Assert.True(element.GetProperty("intuneDeviceBindingPermissionMissing").GetBoolean());
+        Assert.Equal(blocksAll, element.GetProperty("addOnPermissionMissingBlocksAll").GetBoolean());
+    }
+
     [Fact]
     public void Payload_PassesThroughExplicitFieldValues()
     {

src/Backend/AutopilotMonitor.Functions.Tests/GraphAccessHealthRecorderTests.cs

@@ -0,0 +1,460 @@
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Models.Graph;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The two stages of a lost Graph access: one refusal only stamps a suspicion, a refusal at least
+/// 15 minutes later confirms it and alerts once, a freshly issued token ends the episode. Runs on
+/// the real configuration service over a stored row, so the storage round trip of the three fields
+/// and the decision on the fresh row are part of what is proven.
+/// </summary>
+public class GraphAccessHealthRecorderTests
+{
+    private const string TenantId = "11111111-1111-1111-1111-111111111111";
+    private static readonly DateTimeOffset Start = new(2026, 11, 2, 8, 0, 0, TimeSpan.Zero);
+    private static readonly EntraTokenRejection MissingApp = new(401, EntraTokenRejection.ServicePrincipalMissingCode, "missing");
+    private static readonly EntraTokenRejection ConditionalAccess = new(400, "AADSTS53003", "blocked");
+    private static readonly EntraTokenRejection ExpiredSecret = new(401, "AADSTS7000222", "expired");
+    private static readonly string[] CoreRoles = { GraphAppPermissions.DeviceManagementServiceConfigReadAll };
+    private static readonly string[] CoreAndBindingRoles =
+        { GraphAppPermissions.DeviceManagementServiceConfigReadAll, GraphAppPermissions.DeviceManagementManagedDevicesReadAll };
+    private static readonly IReadOnlyList<AddOnValidation> Binding = new[] { AddOnValidation.IntuneDeviceBinding };
+
+    private readonly Mock<IConfigRepository> _repo = new();
+    private readonly StoredTenantConfig _store;
+    private readonly List<OpsEventEntry> _events = new();
+    private readonly TestTimeProvider _time = new(Start);
+    private readonly GraphAccessHealthRecorder _sut;
+
+    public GraphAccessHealthRecorderTests()
+    {
+        _store = _repo.BackWithRow(ValidatedRow());
+        _sut = NewInstance();
+    }
+
+    private static TenantConfiguration ValidatedRow()
+    {
+        var row = TenantConfiguration.CreateDefault(TenantId);
+        row.ValidateAutopilotDevice = true;
+        return row;
+    }
+
+    /// <summary>A backend instance of its own: its own config cache over the same stored row.</summary>
+    private GraphAccessHealthRecorder NewInstance()
+    {
+        var cache = new MemoryCache(new MemoryCacheOptions());
+        var tenantConfig = new TenantConfigurationService(_repo.Object, NullLogger<TenantConfigurationService>.Instance, cache);
+
+        var opsRepo = new Mock<IOpsEventRepository>();
+        opsRepo.Setup(r => r.SaveOpsEventAsync(It.IsAny<OpsEventEntry>()))
+            .Callback<OpsEventEntry>(e => _events.Add(e))
+            .Returns(Task.CompletedTask);
+        var adminConfig = new Mock<AdminConfigurationService>(
+            _repo.Object, NullLogger<AdminConfigurationService>.Instance, cache) { CallBase = false };
+        var opsEvents = new OpsEventService(
+            opsRepo.Object, NullLogger<OpsEventService>.Instance, TestNotifications.InertOpsAlertDispatch(adminConfig.Object));
+
+        return new GraphAccessHealthRecorder(
+            tenantConfig, new Lazy<OpsEventService>(() => opsEvents), NullLogger<GraphAccessHealthRecorder>.Instance, _time);
+    }
+
+    private void Advance(TimeSpan by) => _time.SetUtcNow(_time.GetUtcNow() + by);
+
+    // ── Rejected: the two stages ────────────────────────────────────────────
+
+    [Fact]
+    public async Task First_rejection_only_stamps_the_suspicion()
+    {
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Equal(Start.UtcDateTime, _store.Row!.GraphAccessRejectedSince);
+        Assert.Equal(EntraTokenRejection.ServicePrincipalMissingCode, _store.Row.GraphAccessRejectedCode);
+        Assert.Null(_store.Row.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task Further_rejections_inside_the_window_write_nothing()
+    {
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Advance(TimeSpan.FromMinutes(14));
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Single(_store.Writes);
+        Assert.Null(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task Rejection_after_the_window_confirms_and_alerts_once()
+    {
+        await _sut.RecordRejectedAsync(TenantId, ConditionalAccess);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Advance(TimeSpan.FromMinutes(5));
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Equal(2, _store.Writes.Count);
+        Assert.Equal(Start.UtcDateTime, _store.Row!.GraphAccessRejectedSince);
+        Assert.Equal(Start.UtcDateTime + GraphAccessHealthRecorder.ConfirmAfter, _store.Row.GraphAccessRejectionConfirmedAt);
+        // The code of the latest refusal counts: it selects the text and the repair.
+        Assert.Equal(EntraTokenRejection.ServicePrincipalMissingCode, _store.Row.GraphAccessRejectedCode);
+        var alert = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.GraphAccessRejected, alert.EventType);
+        Assert.Equal(OpsEventSeverity.Error, alert.Severity);
+        Assert.Equal(TenantId, alert.TenantId);
+        Assert.Contains(EntraTokenRejection.ServicePrincipalMissingCode, alert.Details);
+    }
+
+    [Fact]
+    public async Task Across_instances_only_one_confirms_and_alerts()
+    {
+        var other = NewInstance();
+        // The other instance holds a view from before the suspicion.
+        await other.RecordRejectedAsync(TenantId, MissingApp);
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        await other.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.NotNull(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Single(_events);
+    }
+
+    [Fact]
+    public async Task A_lost_write_alerts_nothing_and_the_next_rejection_decides_again()
+    {
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+
+        _store.RejectWrites = true;
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Assert.Null(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+
+        _store.RejectWrites = false;
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Assert.NotNull(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Single(_events);
+    }
+
+    [Fact]
+    public async Task A_token_without_a_role_runs_through_the_same_two_stages()
+    {
+        await _sut.RecordRejectedAsync(TenantId, EntraTokenRejection.NoApplicationRole);
+        Assert.Equal("NoApplicationRole", _store.Row!.GraphAccessRejectedCode);
+        Assert.Empty(_events);
+
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+        await _sut.RecordRejectedAsync(TenantId, EntraTokenRejection.NoApplicationRole);
+
+        Assert.NotNull(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Equal(OpsEventTypes.GraphAccessRejected, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task A_tenant_without_device_validation_stays_untouched()
+    {
+        _store.Row = TenantConfiguration.CreateDefault(TenantId);
+
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Empty(_store.Writes);
+    }
+
+    [Fact]
+    public async Task A_tenant_without_a_row_stays_without_one()
+    {
+        _store.Row = null;
+
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Empty(_store.Writes);
+    }
+
+    // ── Our own credentials ─────────────────────────────────────────────────
+
+    [Fact]
+    public async Task Our_expired_secret_never_touches_the_tenant_and_alerts_once_per_hour()
+    {
+        await _sut.RecordRejectedAsync(TenantId, ExpiredSecret);
+        Advance(TimeSpan.FromMinutes(59));
+        await _sut.RecordRejectedAsync(TenantId, ExpiredSecret);
+
+        Assert.Empty(_store.Writes);
+        var alert = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.GraphAppCredentialRejected, alert.EventType);
+        Assert.Equal(OpsEventSeverity.Critical, alert.Severity);
+
+        Advance(TimeSpan.FromMinutes(2));
+        await _sut.RecordRejectedAsync(TenantId, ExpiredSecret);
+
+        Assert.Equal(2, _events.Count);
+    }
+
+    // ── Minted ──────────────────────────────────────────────────────────────
+
+    [Fact]
+    public async Task A_minted_token_writes_nothing_without_a_state()
+    {
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+
+        Assert.Empty(_store.Writes);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task A_minted_token_clears_a_suspicion_silently()
+    {
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+
+        Assert.Null(_store.Row!.GraphAccessRejectedSince);
+        Assert.Null(_store.Row.GraphAccessRejectedCode);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task A_minted_token_ends_a_confirmed_episode_with_one_recovery_event()
+    {
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        _events.Clear();
+
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+
+        Assert.Null(_store.Row!.GraphAccessRejectedSince);
+        Assert.Null(_store.Row.GraphAccessRejectedCode);
+        Assert.Null(_store.Row.GraphAccessRejectionConfirmedAt);
+        var recovery = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.GraphAccessRecovered, recovery.EventType);
+        Assert.Equal(OpsEventSeverity.Info, recovery.Severity);
+    }
+
+    [Fact]
+    public async Task After_a_recovery_a_new_episode_starts_at_the_first_stage()
+    {
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Equal(_time.GetUtcNow().UtcDateTime, _store.Row!.GraphAccessRejectedSince);
+        Assert.Null(_store.Row.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+    }
+
+    // ── Add-on validations: the same two stages per validation ─────────────
+
+    private void SwitchOn(bool binding = true, bool cloudPc = false, bool autopilot = true)
+    {
+        _store.Row!.ValidateAutopilotDevice = autopilot;
+        _store.Row.ValidateIntuneDeviceBinding = binding;
+        _store.Row.ValidateCloudPcDevice = cloudPc;
+    }
+
+    [Fact]
+    public async Task First_device_kept_out_only_stamps_the_addon_suspicion()
+    {
+        SwitchOn();
+
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+
+        Assert.Equal(Start.UtcDateTime, _store.Row!.IntuneDeviceBindingPermissionMissingSince);
+        Assert.Null(_store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        Assert.Null(_store.Row.CloudPcPermissionMissingSince);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task A_device_kept_out_after_the_window_confirms_and_alerts_once()
+    {
+        SwitchOn();
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(TimeSpan.FromMinutes(14));
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(TimeSpan.FromMinutes(1));
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(TimeSpan.FromMinutes(5));
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+
+        Assert.Equal(2, _store.Writes.Count);
+        Assert.Equal(Start.UtcDateTime + GraphAccessHealthRecorder.ConfirmAfter, _store.Row!.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        var alert = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.AddOnPermissionMissing, alert.EventType);
+        Assert.Equal(OpsEventSeverity.Warning, alert.Severity);
+        Assert.Contains(GraphFeatureCatalog.FeatureIntuneDeviceBinding, alert.Details);
+        Assert.Contains(GraphAppPermissions.DeviceManagementManagedDevicesReadAll, alert.Details);
+        Assert.Contains("\"blocksAll\":false", alert.Details);
+    }
+
+    [Fact]
+    public async Task Each_addon_runs_its_own_episode()
+    {
+        SwitchOn(binding: true, cloudPc: true);
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(TimeSpan.FromMinutes(10));
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, new[] { AddOnValidation.CloudPc });
+        Advance(TimeSpan.FromMinutes(5));
+
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, new[] { AddOnValidation.CloudPc, AddOnValidation.IntuneDeviceBinding });
+
+        Assert.NotNull(_store.Row!.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        Assert.NotNull(_store.Row.CloudPcPermissionMissingSince);
+        Assert.Null(_store.Row.CloudPcPermissionMissingConfirmedAt);
+        Assert.Equal(OpsEventTypes.AddOnPermissionMissing, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task A_switched_off_validation_is_never_stamped()
+    {
+        SwitchOn(binding: false);
+
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+
+        Assert.Empty(_store.Writes);
+    }
+
+    [Fact]
+    public async Task The_only_validation_reports_that_it_blocks_all()
+    {
+        SwitchOn(binding: true, autopilot: false);
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+
+        Assert.Contains("\"blocksAll\":true", Assert.Single(_events).Details);
+        Assert.True(AddOnValidation.BlocksAllValidation(_store.Row!));
+    }
+
+    [Fact]
+    public async Task A_fresh_token_with_the_permission_ends_a_suspicion_silently()
+    {
+        SwitchOn();
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+
+        await _sut.RecordMintedAsync(TenantId, CoreAndBindingRoles);
+
+        Assert.Null(_store.Row!.IntuneDeviceBindingPermissionMissingSince);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task A_fresh_token_with_the_permission_ends_a_confirmed_episode_with_one_event()
+    {
+        SwitchOn();
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        _events.Clear();
+
+        await _sut.RecordMintedAsync(TenantId, CoreAndBindingRoles);
+        await _sut.RecordMintedAsync(TenantId, CoreAndBindingRoles);
+
+        Assert.Null(_store.Row!.IntuneDeviceBindingPermissionMissingSince);
+        Assert.Null(_store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        var resolved = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.AddOnPermissionResolved, resolved.EventType);
+        Assert.Equal(OpsEventSeverity.Info, resolved.Severity);
+        Assert.Contains(GraphAccessHealthRecorder.ResolvedByGrant, resolved.Details);
+    }
+
+    [Fact]
+    public async Task A_fresh_token_without_the_permission_confirms_only_after_the_window()
+    {
+        SwitchOn();
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(TimeSpan.FromMinutes(5));
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+        Assert.Single(_store.Writes);
+
+        Advance(TimeSpan.FromMinutes(10));
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+
+        Assert.NotNull(_store.Row!.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        Assert.Equal(OpsEventTypes.AddOnPermissionMissing, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task A_fresh_token_without_an_addon_episode_writes_nothing()
+    {
+        SwitchOn();
+
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+
+        Assert.Empty(_store.Writes);
+    }
+
+    [Fact]
+    public async Task Switching_the_validation_off_ends_a_confirmed_episode_once()
+    {
+        SwitchOn();
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        Advance(GraphAccessHealthRecorder.ConfirmAfter);
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        _events.Clear();
+        _store.Row!.ValidateIntuneDeviceBinding = false;
+
+        // The maintenance run reads fresh, like another instance.
+        var maintenance = NewInstance();
+        await maintenance.ReconcileSwitchedOffAddOnsAsync(TenantId);
+        await maintenance.ReconcileSwitchedOffAddOnsAsync(TenantId);
+
+        Assert.Null(_store.Row.IntuneDeviceBindingPermissionMissingSince);
+        Assert.Null(_store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        var resolved = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.AddOnPermissionResolved, resolved.EventType);
+        Assert.Contains(GraphAccessHealthRecorder.ResolvedBySwitchOff, resolved.Details);
+    }
+
+    [Fact]
+    public async Task Reconciling_leaves_an_episode_alone_while_its_switch_is_on()
+    {
+        SwitchOn();
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+
+        await NewInstance().ReconcileSwitchedOffAddOnsAsync(TenantId);
+
+        Assert.Single(_store.Writes);
+        Assert.NotNull(_store.Row!.IntuneDeviceBindingPermissionMissingSince);
+    }
+
+    // ── Fail-soft: the agent route must not notice ──────────────────────────
+
+    [Fact]
+    public async Task A_storage_failure_never_reaches_the_caller()
+    {
+        _store.ThrowOnRead = new InvalidOperationException("storage down");
+
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+        await _sut.RecordMintedAsync(TenantId, CoreRoles);
+        await _sut.RecordAddOnPermissionMissingAsync(TenantId, Binding);
+        await _sut.ReconcileSwitchedOffAddOnsAsync(TenantId);
+
+        Assert.Empty(_store.Writes);
+    }
+
+    [Fact]
+    public async Task A_failing_write_never_reaches_the_caller()
+    {
+        _store.ThrowOnWrite = new InvalidOperationException("storage down");
+
+        await _sut.RecordRejectedAsync(TenantId, MissingApp);
+
+        Assert.Empty(_store.Writes);
+        Assert.Empty(_events);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GraphAccessRecheckMaintenanceTests.cs

@@ -0,0 +1,310 @@
+using System.Net;
+using System.Net.Http;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Functions.Tests.GraphResolution;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Models.Graph;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The maintenance run asks Entra for every tenant with a suspicion, so the state does not depend on
+/// device traffic. Runs the real token service and recorder; only Entra's answer is scripted.
+/// </summary>
+public class GraphAccessRecheckMaintenanceTests
+{
+    private const string TenantId = "11111111-1111-1111-1111-111111111111";
+    private const string OtherTenantId = "22222222-2222-2222-2222-222222222222";
+    private const string MissingAppBody = "{\"error\":\"invalid_client\",\"error_description\":\"AADSTS7000229: missing service principal\",\"error_codes\":[7000229]}";
+    private const string ConditionalAccessBody = "{\"error\":\"invalid_request\",\"error_description\":\"AADSTS53003: blocked\",\"error_codes\":[53003]}";
+    private static readonly DateTimeOffset Now = new(2026, 11, 2, 8, 0, 0, TimeSpan.Zero);
+    private static readonly string TokenBody = TestGraphToken.Body(TestGraphToken.ValidationRole);
+
+    private readonly ScriptedEntra _entra = new();
+    private readonly Mock<IConfigRepository> _repo = new();
+    private readonly StoredTenantConfig _store;
+    private readonly List<OpsEventEntry> _events = new();
+    private readonly GraphTokenService _tokens;
+    private readonly GraphAccessRecheckMaintenance _sut;
+
+    public GraphAccessRecheckMaintenanceTests()
+    {
+        _store = _repo.BackWithRow(ValidatedRow());
+        _repo.Setup(r => r.GetAllTenantConfigurationsAsync())
+            .ReturnsAsync(() => _store.Row == null
+                ? new List<TenantConfiguration>()
+                : new List<TenantConfiguration> { ConfigRepoMockExtensions.Clone(_store.Row) });
+
+        var cache = new MemoryCache(new MemoryCacheOptions());
+        var tenantConfig = new TenantConfigurationService(_repo.Object, NullLogger<TenantConfigurationService>.Instance, cache);
+        var opsRepo = new Mock<IOpsEventRepository>();
+        opsRepo.Setup(r => r.SaveOpsEventAsync(It.IsAny<OpsEventEntry>()))
+            .Callback<OpsEventEntry>(e => _events.Add(e))
+            .Returns(Task.CompletedTask);
+        var adminConfig = new Mock<AdminConfigurationService>(
+            _repo.Object, NullLogger<AdminConfigurationService>.Instance, cache) { CallBase = false };
+        var opsEvents = new OpsEventService(
+            opsRepo.Object, NullLogger<OpsEventService>.Instance, TestNotifications.InertOpsAlertDispatch(adminConfig.Object));
+        var recorder = new GraphAccessHealthRecorder(
+            tenantConfig, new Lazy<OpsEventService>(() => opsEvents), NullLogger<GraphAccessHealthRecorder>.Instance, new TestTimeProvider(Now));
+
+        _tokens = NewTokenService(new SingleHandlerFactory(_entra), recorder, tenantConfig);
+        _sut = new GraphAccessRecheckMaintenance(_repo.Object, _tokens, recorder, NullLogger<GraphAccessRecheckMaintenance>.Instance);
+    }
+
+    private static GraphTokenService NewTokenService(
+        IHttpClientFactory factory, IGraphAccessHealthRecorder recorder, TenantConfigurationService tenantConfig)
+    {
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            ["EntraId:ClientId"] = "aaaaaaaa-0000-0000-0000-000000000001",
+            ["EntraId:ClientSecret"] = "secret",
+        }).Build();
+        return new GraphTokenService(
+            NullLogger<GraphTokenService>.Instance,
+            factory,
+            new MemoryCache(new MemoryCacheOptions()),
+            new EntraAppRegistry(configuration, NullLogger<EntraAppRegistry>.Instance),
+            tenantConfig,
+            recorder);
+    }
+
+    private static TenantConfiguration ValidatedRow()
+    {
+        var row = TenantConfiguration.CreateDefault(TenantId);
+        row.ValidateAutopilotDevice = true;
+        return row;
+    }
+
+    private void Suspect(TimeSpan age, string code = EntraTokenRejection.ServicePrincipalMissingCode)
+    {
+        _store.Row!.GraphAccessRejectedSince = Now.UtcDateTime - age;
+        _store.Row.GraphAccessRejectedCode = code;
+    }
+
+    [Fact]
+    public async Task Confirms_an_old_suspicion_without_device_traffic()
+    {
+        // A real 401 goes into the retry delay, which the budget cuts: the refusal must survive it.
+        Suspect(TimeSpan.FromMinutes(20));
+        _entra.Answer(HttpStatusCode.Unauthorized, MissingAppBody);
+
+        Assert.Equal(1, await _sut.RunAsync());
+
+        Assert.Equal(Now.UtcDateTime, _store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Equal(OpsEventTypes.GraphAccessRejected, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task A_young_suspicion_stays_a_suspicion()
+    {
+        Suspect(TimeSpan.FromMinutes(10));
+        _entra.Answer(HttpStatusCode.BadRequest, ConditionalAccessBody);
+
+        await _sut.RunAsync();
+
+        Assert.Null(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task Clears_the_notice_after_a_repair_made_directly_in_Entra()
+    {
+        Suspect(TimeSpan.FromHours(5));
+        _store.Row!.GraphAccessRejectionConfirmedAt = Now.UtcDateTime - TimeSpan.FromHours(4);
+        _entra.Answer(HttpStatusCode.OK, TokenBody);
+
+        await _sut.RunAsync();
+
+        Assert.Null(_store.Row!.GraphAccessRejectedSince);
+        Assert.Null(_store.Row.GraphAccessRejectionConfirmedAt);
+        Assert.Equal(OpsEventTypes.GraphAccessRecovered, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task A_token_without_a_role_keeps_the_notice_up()
+    {
+        // A user's sign-in re-created the removed enterprise application without any permission.
+        Suspect(TimeSpan.FromHours(5));
+        _store.Row!.GraphAccessRejectionConfirmedAt = Now.UtcDateTime - TimeSpan.FromHours(4);
+        _entra.Answer(HttpStatusCode.OK, TestGraphToken.Body());
+
+        await _sut.RunAsync();
+
+        Assert.NotNull(_store.Row!.GraphAccessRejectedSince);
+        Assert.NotNull(_store.Row.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task A_token_without_a_role_confirms_an_old_suspicion()
+    {
+        Suspect(TimeSpan.FromMinutes(20));
+        _entra.Answer(HttpStatusCode.OK, TestGraphToken.Body());
+
+        await _sut.RunAsync();
+
+        Assert.NotNull(_store.Row!.GraphAccessRejectionConfirmedAt);
+        Assert.Equal("NoApplicationRole", _store.Row.GraphAccessRejectedCode);
+        Assert.Equal(OpsEventTypes.GraphAccessRejected, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task A_cached_token_cannot_answer_the_question()
+    {
+        // The token this instance still holds stays valid after the enterprise app is gone.
+        _entra.Answer(HttpStatusCode.OK, TokenBody);
+        await _tokens.GetAccessTokenAsync(TenantId);
+        Assert.Equal(1, _entra.Posts);
+
+        Suspect(TimeSpan.FromMinutes(20));
+        _entra.Answer(HttpStatusCode.BadRequest, ConditionalAccessBody);
+
+        await _sut.RunAsync();
+
+        Assert.Equal(2, _entra.Posts);
+        Assert.NotNull(_store.Row!.GraphAccessRejectionConfirmedAt);
+    }
+
+    [Fact]
+    public async Task No_answer_from_Entra_decides_nothing()
+    {
+        Suspect(TimeSpan.FromMinutes(20));
+        _entra.Answer(HttpStatusCode.ServiceUnavailable, "{}");
+
+        await _sut.RunAsync();
+
+        Assert.NotNull(_store.Row!.GraphAccessRejectedSince);
+        Assert.Null(_store.Row.GraphAccessRejectionConfirmedAt);
+        Assert.Empty(_events);
+    }
+
+    [Fact]
+    public async Task A_tenant_without_a_suspicion_is_not_asked()
+    {
+        Assert.Equal(0, await _sut.RunAsync());
+
+        Assert.Equal(0, _entra.Posts);
+    }
+
+    [Fact]
+    public async Task A_tenant_that_switched_device_validation_off_is_not_asked()
+    {
+        Suspect(TimeSpan.FromMinutes(20));
+        _store.Row!.ValidateAutopilotDevice = false;
+
+        Assert.Equal(0, await _sut.RunAsync());
+
+        Assert.Equal(0, _entra.Posts);
+    }
+
+    [Fact]
+    public async Task A_failing_read_ends_the_run_quietly()
+    {
+        _repo.Setup(r => r.GetAllTenantConfigurationsAsync()).ThrowsAsync(new InvalidOperationException("storage down"));
+
+        Assert.Equal(0, await _sut.RunAsync());
+    }
+
+    [Fact]
+    public async Task One_failing_tenant_does_not_stop_the_next()
+    {
+        // The stub throws on the unscripted first tenant, which the token service does not catch.
+        var repo = new Mock<IConfigRepository>();
+        var first = ValidatedRow();
+        first.GraphAccessRejectedSince = Now.UtcDateTime;
+        var second = ValidatedRow();
+        second.TenantId = OtherTenantId;
+        second.GraphAccessRejectedSince = Now.UtcDateTime;
+        repo.Setup(r => r.GetAllTenantConfigurationsAsync()).ReturnsAsync(new List<TenantConfiguration> { first, second });
+        var recorder = new Mock<IGraphAccessHealthRecorder>();
+        var handler = new StubHttpMessageHandler().When($"/{OtherTenantId}/oauth2", HttpStatusCode.OK, TokenBody);
+        var tenantConfig = new TenantConfigurationService(
+            repo.Object, NullLogger<TenantConfigurationService>.Instance, new MemoryCache(new MemoryCacheOptions()));
+        var sut = new GraphAccessRecheckMaintenance(
+            repo.Object, NewTokenService(new StubHttpClientFactory(handler), recorder.Object, tenantConfig), recorder.Object,
+            NullLogger<GraphAccessRecheckMaintenance>.Instance);
+
+        Assert.Equal(2, await sut.RunAsync());
+
+        recorder.Verify(r => r.RecordMintedAsync(OtherTenantId, It.IsAny<IReadOnlyCollection<string>>()), Times.Once);
+    }
+
+    // ── Add-on episodes ─────────────────────────────────────────────────────
+
+    private void AddOnSuspect(TimeSpan age, TimeSpan? confirmedAgo = null, bool switchedOn = true)
+    {
+        _store.Row!.ValidateIntuneDeviceBinding = switchedOn;
+        _store.Row.IntuneDeviceBindingPermissionMissingSince = Now.UtcDateTime - age;
+        if (confirmedAgo is { } ago)
+            _store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt = Now.UtcDateTime - ago;
+    }
+
+    [Fact]
+    public async Task Confirms_an_old_addon_suspicion_with_a_token_that_lacks_the_permission()
+    {
+        AddOnSuspect(TimeSpan.FromMinutes(20));
+        _entra.Answer(HttpStatusCode.OK, TokenBody);
+
+        Assert.Equal(1, await _sut.RunAsync());
+
+        Assert.Equal(Now.UtcDateTime, _store.Row!.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        Assert.Equal(OpsEventTypes.AddOnPermissionMissing, Assert.Single(_events).EventType);
+    }
+
+    [Fact]
+    public async Task Ends_an_addon_episode_once_the_grant_arrives()
+    {
+        AddOnSuspect(TimeSpan.FromHours(5), confirmedAgo: TimeSpan.FromHours(4));
+        _entra.Answer(HttpStatusCode.OK,
+            TestGraphToken.Body(TestGraphToken.ValidationRole, GraphAppPermissions.DeviceManagementManagedDevicesReadAll));
+
+        await _sut.RunAsync();
+
+        Assert.Null(_store.Row!.IntuneDeviceBindingPermissionMissingSince);
+        Assert.Null(_store.Row.IntuneDeviceBindingPermissionMissingConfirmedAt);
+        var resolved = Assert.Single(_events);
+        Assert.Equal(OpsEventTypes.AddOnPermissionResolved, resolved.EventType);
+        Assert.Contains(GraphAccessHealthRecorder.ResolvedByGrant, resolved.Details);
+    }
+
+    [Fact]
+    public async Task A_switched_off_addon_ends_without_asking_Entra()
+    {
+        AddOnSuspect(TimeSpan.FromHours(5), confirmedAgo: TimeSpan.FromHours(4), switchedOn: false);
+
+        Assert.Equal(1, await _sut.RunAsync());
+
+        Assert.Equal(0, _entra.Posts);
+        Assert.Null(_store.Row!.IntuneDeviceBindingPermissionMissingSince);
+        var resolved = Assert.Single(_events);
+        Assert.Contains(GraphAccessHealthRecorder.ResolvedBySwitchOff, resolved.Details);
+    }
+
+    /// <summary>Entra's token endpoint with an answer that can change between calls.</summary>
+    private sealed class ScriptedEntra : HttpMessageHandler
+    {
+        private HttpStatusCode _status = HttpStatusCode.OK;
+        private string _body = "{}";
+
+        public int Posts { get; private set; }
+
+        public void Answer(HttpStatusCode status, string body)
+        {
+            _status = status;
+            _body = body;
+        }
+
+        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+        {
+            Posts++;
+            return Task.FromResult(new HttpResponseMessage(_status) { Content = new StringContent(_body) });
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GraphAuthFailureTests.cs

@@ -32,7 +32,7 @@ public class GraphAuthFailureTests
             Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, cache)
         { CallBase = false };
         return new Mock<GraphTokenService>(
-            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object)
+            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object, Mock.Of<IGraphAccessHealthRecorder>())
         { CallBase = false };
     }
 

src/Backend/AutopilotMonitor.Functions.Tests/GraphResolution/GraphFeatureDetectorTests.cs

@@ -342,7 +342,8 @@ public class GraphFeatureDetectorTests
             new AutopilotMonitor.Functions.Services.TenantConfigurationService(
                 Moq.Mock.Of<AutopilotMonitor.Shared.DataAccess.IConfigRepository>(),
                 NullLogger<AutopilotMonitor.Functions.Services.TenantConfigurationService>.Instance,
-                new MemoryCache(new MemoryCacheOptions())));
+                new MemoryCache(new MemoryCacheOptions())),
+            Moq.Mock.Of<IGraphAccessHealthRecorder>());
         var telemetry = new TelemetryClient(new TelemetryConfiguration { DisableTelemetry = true });
         var detector = new GraphFeatureDetector(
             tokenService, cache, NullLogger<GraphFeatureDetector>.Instance, telemetry);
@@ -497,7 +498,8 @@ public class GraphFeatureDetectorTests
                 new NoopHttpClientFactory(),
                 new MemoryCache(new MemoryCacheOptions()),
                 StubAppRegistry(),
-                StubTenantConfigService())
+                StubTenantConfigService(),
+                Moq.Mock.Of<IGraphAccessHealthRecorder>())
         {
         }
 
@@ -529,7 +531,8 @@ public class GraphFeatureDetectorTests
                 new NoopHttpClientFactory(),
                 new MemoryCache(new MemoryCacheOptions()),
                 StubAppRegistry(),
-                StubTenantConfigService())
+                StubTenantConfigService(),
+                Moq.Mock.Of<IGraphAccessHealthRecorder>())
         {
             _firstToken = firstToken;
             _laterToken = laterToken;
@@ -567,7 +570,8 @@ public class GraphFeatureDetectorTests
                 factory,
                 cache,
                 StubAppRegistry(),
-                StubTenantConfigService())
+                StubTenantConfigService(),
+                Moq.Mock.Of<IGraphAccessHealthRecorder>())
         {
             _onInvalidate = onInvalidate;
         }

src/Backend/AutopilotMonitor.Functions.Tests/GraphResolution/ScriptDisplayNameResolverTests.cs

@@ -130,6 +130,36 @@ public class ScriptDisplayNameResolverTests
         Assert.True(fix.Repo.Entries[(TenantId, ScriptKind.Platform, "deleted-id")].IsNotFound);
     }
 
+    [Theory]
+    [InlineData("{\"id\":\"nameless\",\"displayName\":null}")]
+    [InlineData("{\"id\":\"nameless\",\"displayName\":42}")]
+    [InlineData("{\"id\":\"nameless\"}")]
+    public async Task PerId_script_without_a_name_is_cached_and_not_fetched_again(string body)
+    {
+        // JSON null and a non-text name read as absent (D-420); the answer is still final, so the second view
+        // is a cache hit instead of another Graph call.
+        var fix = new Fixture();
+        fix.GivenPermission();
+        fix.Repo.Meta[(TenantId, ScriptKind.Platform)] = new ScriptNameCacheMeta
+        {
+            TenantId = TenantId,
+            Kind = ScriptKind.Platform,
+            LastFullRefreshAt = fix.FixedNow - TimeSpan.FromDays(1),
+        };
+        var r = new ScriptRef(ScriptKind.Platform, "nameless");
+        fix.Http.When("deviceManagementScripts/nameless", HttpStatusCode.OK, body);
+
+        var first = await fix.Sut.ResolveAsync(TenantId, new[] { r });
+        var second = await fix.Sut.ResolveAsync(TenantId, new[] { r });
+
+        Assert.Null(first[r]);
+        Assert.Null(second[r]);
+        Assert.Single(fix.Http.Requests);
+        var entry = fix.Repo.Entries[(TenantId, ScriptKind.Platform, "nameless")];
+        Assert.False(entry.IsNotFound);
+        Assert.Null(entry.DisplayName);
+    }
+
     [Fact]
     public async Task Empty_refs_returns_empty_dict()
     {

src/Backend/AutopilotMonitor.Functions.Tests/GraphResolution/TestGraphToken.cs

@@ -0,0 +1,21 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+
+namespace AutopilotMonitor.Functions.Tests.GraphResolution;
+
+/// <summary>What Entra's token endpoint answers on success, with the application roles of the tenant's service principal.</summary>
+internal static class TestGraphToken
+{
+    public const string ValidationRole = "DeviceManagementServiceConfig.Read.All";
+
+    public static string Body(params string[] roles)
+    {
+        var jwt = new JwtSecurityToken(
+            issuer: "https://sts.windows.net/test",
+            audience: "https://graph.microsoft.com",
+            claims: roles.Select(r => new Claim("roles", r)),
+            notBefore: null,
+            expires: DateTime.UtcNow.AddHours(1));
+        return $"{{\"access_token\":\"{new JwtSecurityTokenHandler().WriteToken(jwt)}\",\"expires_in\":3599}}";
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GraphResponseParsingTests.cs

@@ -0,0 +1,658 @@
+using System;
+using System.Globalization;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services.GraphResolution;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The contract of the Graph and Entra token-endpoint response parsers (D-420): what every realistic body,
+/// and every malformed one, yields. Written against the Newtonsoft parsers before their move to
+/// System.Text.Json and kept as their specification. Tests whose name ends in _D1 to _D7 pin a
+/// deliberate difference of that move (listed in D-420).
+/// </summary>
+public class GraphResponseParsingTests
+{
+    private const string Serial = "PF3XKQ7";
+    private const string IntuneId = "6f1c4d2a-0b3e-4c5d-8e9f-1a2b3c4d5e6f";
+
+    // ── GraphTokenService.ReadTokenResponse ─────────────────────────────────────
+
+    [Theory]
+    [InlineData("""{"access_token":"t","expires_in":3599}""", 3599L)]
+    [InlineData("""{"access_token":"t","expires_in":"3599"}""", 3599L)]
+    [InlineData("""{"access_token":"t","expires_in":" 3599 "}""", 3599L)]
+    [InlineData("""{"access_token":"t","expires_in":"+3599"}""", 3599L)]
+    [InlineData("""{"access_token":"t",/*c*/"expires_in":3599,}""", 3599L)]
+    [InlineData("""{"access_token":"t"}""", null)]
+    [InlineData("""{"access_token":"t","expires_in":null}""", null)]
+    public void Token_response_reads_the_token_and_its_lifetime(string body, long? expiresIn)
+    {
+        var (token, lifetime) = GraphTokenService.ReadTokenResponse(body);
+        Assert.Equal("t", token);
+        Assert.Equal(expiresIn, lifetime);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("null")]
+    [InlineData("{}")]
+    [InlineData("""{"access_token":""}""")]
+    [InlineData("""{"access_token":null,"expires_in":"abc"}""")]
+    public void Token_response_without_a_token_yields_none_and_ignores_the_lifetime(string body)
+    {
+        var (token, lifetime) = GraphTokenService.ReadTokenResponse(body);
+        Assert.True(string.IsNullOrEmpty(token));
+        Assert.Null(lifetime);
+    }
+
+    [Theory]
+    [InlineData("<html>busy</html>")]
+    [InlineData("[]")]
+    [InlineData("42")]
+    [InlineData("""{"access_token":"t"} x""")]
+    public void Token_response_that_is_not_one_object_throws(string body)
+        => Assert.ThrowsAny<Exception>(() => GraphTokenService.ReadTokenResponse(body));
+
+    // D5: an expires_in that is not a whole number counts as absent; the token stays usable with the
+    // default lifetime. Newtonsoft threw on the first five and coerced the last two (3600, 1).
+    [Theory]
+    [InlineData("\"abc\"")]
+    [InlineData("\"\"")]
+    [InlineData("{}")]
+    [InlineData("[]")]
+    [InlineData("99999999999999999999")]
+    [InlineData("3599.5")]
+    [InlineData("true")]
+    public void Token_response_with_an_unusable_lifetime_keeps_the_token_D5(string expiresIn)
+    {
+        var (token, lifetime) = GraphTokenService.ReadTokenResponse($$"""{"access_token":"t","expires_in":{{expiresIn}}}""");
+        Assert.Equal("t", token);
+        Assert.Null(lifetime);
+    }
+
+    // ── EntraTokenRejection.Parse ───────────────────────────────────────────────
+
+    [Theory]
+    [InlineData("""{"error_codes":[7000229],"error_description":"AADSTS7000229: missing"}""", "AADSTS7000229")]
+    [InlineData("""{"error_codes":["7000229",53003]}""", "AADSTS53003")]
+    [InlineData("""{"error_codes":[7000229.0],"error_description":"AADSTS50000: x"}""", "AADSTS50000")]
+    [InlineData("""{"error_codes":7000229,"error_description":"AADSTS50000: x"}""", "AADSTS50000")]
+    [InlineData("""{"error_codes":[],"error_description":"AADSTS50000: x"}""", "AADSTS50000")]
+    [InlineData("""{"error_codes":[1],"error_codes":[7000229]}""", "AADSTS7000229")]
+    [InlineData("""{"error_codes":[7000229,],/*c*/}""", "AADSTS7000229")]
+    public void Entra_rejection_reads_the_first_integer_code_then_the_description(string body, string code)
+        => Assert.Equal(code, EntraTokenRejection.Parse(400, body).ErrorCode);
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("null")]
+    [InlineData("\"AADSTS7000229\"")]
+    [InlineData("42")]
+    [InlineData("[1,2]")]
+    [InlineData("<html>busy</html>")]
+    [InlineData("""{"error_description":null}""")]
+    [InlineData("""{"error_description":42}""")]
+    [InlineData("""{"error_codes":[7000229]} x""")]
+    public void Entra_rejection_without_a_readable_object_keeps_only_the_status(string? body)
+    {
+        var rejection = EntraTokenRejection.Parse(400, body);
+        Assert.Equal(400, rejection.StatusCode);
+        Assert.Null(rejection.ErrorCode);
+        Assert.Null(rejection.Description);
+    }
+
+    // D3: a description is kept as sent, even when it looks like a date (Newtonsoft dropped it).
+    [Fact]
+    public void Entra_rejection_keeps_a_date_shaped_description_D3()
+        => Assert.Equal("2026-11-01T08:00:00Z", EntraTokenRejection.Parse(400, """{"error_description":"2026-11-01T08:00:00Z"}""").Description);
+
+    // D6: an error code beyond Int64 is skipped like any other unusable entry (Newtonsoft threw).
+    [Fact]
+    public void Entra_rejection_skips_an_out_of_range_code_D6()
+        => Assert.Equal("AADSTS53003", EntraTokenRejection.Parse(400, """{"error_codes":[99999999999999999999,53003]}""").ErrorCode);
+
+    // ── AutopilotDeviceValidator.FindRegistration ───────────────────────────────
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("null")]
+    [InlineData("{}")]
+    [InlineData("""{"value":"oops"}""")]
+    [InlineData("""{"value":[]}""")]
+    [InlineData("""{"value":[{"serialNumber":null}]}""")]
+    [InlineData("""{"value":[{"serialNumber":"OTHER"}]}""")]
+    public void Autopilot_list_without_the_serial_is_not_registered(string body)
+        => Assert.Null(AutopilotDeviceValidator.FindRegistration(body, Serial));
+
+    [Theory]
+    [InlineData("not json")]
+    [InlineData("[]")]
+    [InlineData("""{"value":[]} x""")]
+    public void Autopilot_list_that_is_not_one_object_throws(string body)
+        => Assert.ThrowsAny<Exception>(() => AutopilotDeviceValidator.FindRegistration(body, Serial));
+
+    [Fact]
+    public void Autopilot_list_with_a_null_entry_before_the_match_throws()
+        => Assert.Throws<InvalidOperationException>(() => AutopilotDeviceValidator.FindRegistration(
+            """{"value":[null,{"id":"ap-1","serialNumber":"PF3XKQ7"}]}""", Serial));
+
+    [Fact]
+    public void Autopilot_list_matches_the_trimmed_serial_case_insensitively_and_stops_there()
+    {
+        var registration = AutopilotDeviceValidator.FindRegistration(
+            """{"value":[{"id":"ap-1","serialNumber":" pf3xkq7 ","groupTag":" Sales ","purchaseOrderIdentifier":"PO-7","displayName":"KIOSK-1","userPrincipalName":"u@contoso.com"},null]}""",
+            Serial);
+
+        Assert.NotNull(registration);
+        Assert.Equal("ap-1", registration!.DeviceId);
+        Assert.Equal("Sales", registration.GroupTag);
+        Assert.Equal("PO-7", registration.PurchaseOrderId);
+        Assert.Equal("KIOSK-1", registration.DisplayName);
+        Assert.True(registration.UserAssigned);
+    }
+
+    [Fact]
+    public void Autopilot_registration_drops_blank_and_non_text_values_and_cuts_long_text()
+    {
+        var longText = new string('x', AutopilotDeviceValidator.MaxRegistrationFieldLength + 10);
+        var registration = AutopilotDeviceValidator.FindRegistration(
+            $$"""{"value":[{"id":"   ","serialNumber":"PF3XKQ7","groupTag":true,"purchaseOrderIdentifier":{},"displayName":"{{longText}}","userPrincipalName":null}]}""",
+            Serial);
+
+        Assert.NotNull(registration);
+        Assert.Null(registration!.DeviceId);
+        Assert.Null(registration.GroupTag);
+        Assert.Null(registration.PurchaseOrderId);
+        Assert.Equal(AutopilotDeviceValidator.MaxRegistrationFieldLength, registration.DisplayName!.Length);
+        Assert.False(registration.UserAssigned);
+    }
+
+    // D4: a serial that is not text never matches (Newtonsoft matched through its text).
+    [Fact]
+    public void Autopilot_list_with_a_numeric_serial_does_not_match_D4()
+        => Assert.Null(AutopilotDeviceValidator.FindRegistration("""{"value":[{"id":"ap-1","serialNumber":12345}]}""", "12345"));
+
+    // D3: registration text is kept as sent, even when it looks like a date (Newtonsoft dropped it).
+    [Fact]
+    public void Autopilot_registration_keeps_date_shaped_text_D3()
+    {
+        var registration = AutopilotDeviceValidator.FindRegistration(
+            """{"value":[{"id":"ap-1","serialNumber":"PF3XKQ7","groupTag":"2026-01-01T00:00:00Z","displayName":"/Date(1713096021000)/"}]}""",
+            Serial);
+
+        Assert.Equal("2026-01-01T00:00:00Z", registration!.GroupTag);
+        Assert.Equal("/Date(1713096021000)/", registration.DisplayName);
+    }
+
+    // ── CorporateIdentifierValidator.ReadIdentityPage ───────────────────────────
+
+    private static readonly string CorporateId =
+        CorporateIdentifierValidator.BuildNormalizedIdentifier("Microsoft Corporation", "Virtual Machine", "1234-5678");
+
+    [Theory]
+    [InlineData("", "")]
+    [InlineData("null", "")]
+    [InlineData("{}", "")]
+    [InlineData("""{"value":null}""", "")]
+    [InlineData("""{"value":[],"@odata.nextLink":""}""", "")]
+    [InlineData("""{"value":[],"@odata.nextLink":null}""", "")]
+    [InlineData("""{"value":{},"@odata.nextLink":"https://graph.microsoft.com/beta/next"}""", "https://graph.microsoft.com/beta/next")]
+    [InlineData("""{"value":[{"importedDeviceIdentityType":"serialNumber","importedDeviceIdentifier":"1234-5678"}]}""", "")]
+    public void Corporate_page_without_the_identifier_yields_the_next_url(string body, string nextUrl)
+        => Assert.Equal((false, nextUrl), CorporateIdentifierValidator.ReadIdentityPage(body, CorporateId));
+
+    [Theory]
+    [InlineData("""{"value":[{"importedDeviceIdentityType":"manufacturerModelSerial","importedDeviceIdentifier":"Microsoft Corporation,Virtual Machine,1234-5678"}],"@odata.nextLink":"https://graph.microsoft.com/beta/next"}""")]
+    [InlineData("""{"value":[{"importedDeviceIdentityType":"MANUFACTURERMODELSERIAL","importedDeviceIdentifier":"MICROSOFTCORPORATION,VIRTUALMACHINE,12345678"}]}""")]
+    [InlineData("""{"value":[{"importedDeviceIdentityType":"manufacturerModelSerial","importedDeviceIdentifier":null},{"importedDeviceIdentityType":"manufacturerModelSerial","importedDeviceIdentifier":"Microsoft Corporation,Virtual Machine,1234-5678"}]}""")]
+    public void Corporate_page_with_the_identifier_is_found(string body)
+        => Assert.Equal((true, string.Empty), CorporateIdentifierValidator.ReadIdentityPage(body, CorporateId));
+
+    [Theory]
+    [InlineData("not json")]
+    [InlineData("[]")]
+    public void Corporate_page_that_is_not_one_object_throws(string body)
+        => Assert.ThrowsAny<Exception>(() => CorporateIdentifierValidator.ReadIdentityPage(body, CorporateId));
+
+    [Fact]
+    public void Corporate_page_with_a_null_entry_before_the_match_throws()
+        => Assert.Throws<InvalidOperationException>(() => CorporateIdentifierValidator.ReadIdentityPage(
+            """{"value":[null,{"importedDeviceIdentityType":"manufacturerModelSerial","importedDeviceIdentifier":"Microsoft Corporation,Virtual Machine,1234-5678"}]}""",
+            CorporateId));
+
+    [Theory]
+    [InlineData("5")]
+    [InlineData("true")]
+    [InlineData("{}")]
+    public void Corporate_page_with_a_non_text_next_link_never_yields_a_page_to_follow(string nextLink)
+    {
+        // The scan must stop as a failure: either the read throws or the url cannot be requested.
+        try
+        {
+            var (found, nextUrl) = CorporateIdentifierValidator.ReadIdentityPage($$"""{"value":[],"@odata.nextLink":{{nextLink}}}""", CorporateId);
+            Assert.False(found);
+            Assert.False(string.IsNullOrEmpty(nextUrl));
+            Assert.False(Uri.IsWellFormedUriString(nextUrl, UriKind.Absolute));
+        }
+        catch (Exception ex) when (ex is not Xunit.Sdk.XunitException)
+        {
+            // Throwing ends the scan as transient, like an unusable url does.
+        }
+    }
+
+    // D4: an identifier that is not text never matches (Newtonsoft matched an array through its text).
+    [Fact]
+    public void Corporate_page_with_an_array_identifier_does_not_match_D4()
+        => Assert.False(CorporateIdentifierValidator.ReadIdentityPage(
+            """{"value":[{"importedDeviceIdentityType":"manufacturerModelSerial","importedDeviceIdentifier":["Microsoft Corporation,Virtual Machine,1234-5678"]}]}""",
+            CorporateId).Found);
+
+    // ── DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse ─────────
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("null")]
+    [InlineData("[]")]
+    [InlineData("42")]
+    [InlineData("not json")]
+    [InlineData("{} x")]
+    [InlineData("""{"value":null}""")]
+    [InlineData("""{"value":{}}""")]
+    [InlineData("""{"value":[{"serialNumber":"OTHER"}]}""")]
+    public void Association_list_without_the_serial_is_not_found(string body)
+    {
+        var result = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(body, Serial);
+        Assert.False(result.IsValid);
+        Assert.False(result.IsTransient);
+    }
+
+    [Fact]
+    public void Association_list_with_a_null_entry_before_the_match_throws()
+        => Assert.Throws<InvalidOperationException>(() => DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(
+            """{"value":[null,{"serialNumber":"PF3XKQ7"}]}""", Serial));
+
+    [Fact]
+    public void Association_list_reads_the_matching_device_and_stops_there()
+    {
+        var result = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(
+            """{"value":[{"serialNumber":" pf3xkq7 ","associationState":"associated","devicePreparationPolicyId":"pol-1","preassociatedByUserPrincipalName":"a@contoso.com","assignedToUserPrincipalName":"u@contoso.com","managedDeviceId":"md-1","preassociationDateTime":"2026-05-08T12:16:49Z"},null]}""",
+            Serial);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("associated", result.AssociationState);
+        Assert.Equal("pol-1", result.DevicePreparationPolicyId);
+        Assert.Equal("a@contoso.com", result.PreAssociatedByUserPrincipalName);
+        Assert.Equal("u@contoso.com", result.AssignedToUserPrincipalName);
+        Assert.Equal("md-1", result.ManagedDeviceId);
+        Assert.Equal(new DateTime(2026, 5, 8, 12, 16, 49, DateTimeKind.Utc), result.PreAssociationDateTime);
+        Assert.Equal(DateTimeKind.Utc, result.PreAssociationDateTime!.Value.Kind);
+    }
+
+    [Theory]
+    [InlineData("""{"value":[{"serialNumber":"PF3XKQ7"}]}""")]
+    [InlineData("""{"value":[{"serialNumber":"PF3XKQ7","associationDateTime":null}]}""")]
+    [InlineData("""{"value":[{"serialNumber":"PF3XKQ7","associationDateTime":""}]}""")]
+    [InlineData("""{"value":[{"serialNumber":"PF3XKQ7","associationDateTime":"0001-01-01T00:00:00Z"}]}""")]
+    [InlineData("""{"value":[{"serialNumber":"PF3XKQ7","associationDateTime":"not-a-date"}]}""")]
+    public void Association_date_that_is_unset_reads_as_null(string body)
+        => Assert.Null(DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(body, Serial).AssociationDateTime);
+
+    // D1: JSON null in a text field is absent (Newtonsoft read it as an empty string).
+    [Fact]
+    public void Association_fields_that_are_json_null_read_as_null_D1()
+    {
+        var result = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(
+            """{"value":[{"serialNumber":"PF3XKQ7","associationState":null,"assignedToUserPrincipalName":null,"managedDeviceId":null}]}""",
+            Serial);
+        Assert.Null(result.AssociationState);
+        Assert.Null(result.AssignedToUserPrincipalName);
+        Assert.Null(result.ManagedDeviceId);
+    }
+
+    // D4: text whose escapes are no valid UTF-16 reads as absent, in the serial of another entry and in a field
+    // of the match, instead of failing the whole lookup (Newtonsoft read it into a broken string).
+    [Fact]
+    public void Association_text_with_a_broken_escape_reads_as_null_D4()
+    {
+        var result = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(
+            """{"value":[{"serialNumber":"\ud800"},{"serialNumber":"PF3XKQ7","assignedToUserPrincipalName":"u\ud800"}]}""", Serial);
+        Assert.True(result.IsValid);
+        Assert.Null(result.AssignedToUserPrincipalName);
+    }
+
+    // D2: the date keeps its fraction, in any culture (Newtonsoft cut it to whole seconds).
+    [Theory]
+    [InlineData("en-US")]
+    [InlineData("de-DE")]
+    [InlineData("en-GB")]
+    [InlineData("th-TH")]
+    public void Association_date_keeps_its_fraction_in_any_culture_D2(string culture)
+    {
+        var date = InCulture(culture, () => DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(
+            """{"value":[{"serialNumber":"PF3XKQ7","preassociationDateTime":"2026-05-08T12:16:49.1234567Z"}]}""",
+            Serial).PreAssociationDateTime);
+
+        Assert.Equal(new DateTime(2026, 5, 8, 12, 16, 49, DateTimeKind.Utc).AddTicks(1234567), date);
+        Assert.Equal(DateTimeKind.Utc, date!.Value.Kind);
+    }
+
+    // ── CloudPcDeviceValidator.ParseCloudPcResponse ─────────────────────────────
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("null")]
+    [InlineData("[]")]
+    [InlineData("not json")]
+    [InlineData("""{"value":[]} x""")]
+    [InlineData("""{"value":null}""")]
+    [InlineData("""{"value":[{"managedDeviceId":"other"}]}""")]
+    public void CloudPc_list_without_the_device_is_not_found(string body)
+    {
+        var result = CloudPcDeviceValidator.ParseCloudPcResponse(body, IntuneId);
+        Assert.False(result.IsValid);
+        Assert.False(result.IsTransient);
+    }
+
+    [Fact]
+    public void CloudPc_list_with_a_null_entry_before_the_match_throws()
+        => Assert.Throws<InvalidOperationException>(() => CloudPcDeviceValidator.ParseCloudPcResponse(
+            $$"""{"value":[null,{"managedDeviceId":"{{IntuneId}}"}]}""", IntuneId));
+
+    [Fact]
+    public void CloudPc_list_reads_the_matching_cloud_pc()
+    {
+        var result = CloudPcDeviceValidator.ParseCloudPcResponse(
+            $$"""{"value":[{"id":"cpc-1","managedDeviceId":" {{IntuneId.ToUpperInvariant()}} ","managedDeviceName":"CPC-ADM-1","servicePlanName":"Cloud PC Enterprise"},null]}""",
+            IntuneId);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("cpc-1", result.CloudPcId);
+        Assert.Equal("CPC-ADM-1", result.ManagedDeviceName);
+        Assert.Equal("Cloud PC Enterprise", result.ServicePlanName);
+    }
+
+    // D1: JSON null in a text field is absent (Newtonsoft read it as an empty string).
+    [Fact]
+    public void CloudPc_fields_that_are_json_null_read_as_null_D1()
+    {
+        var result = CloudPcDeviceValidator.ParseCloudPcResponse(
+            $$"""{"value":[{"managedDeviceId":"{{IntuneId}}","id":null,"managedDeviceName":null,"servicePlanName":null}]}""", IntuneId);
+        Assert.True(result.IsValid);
+        Assert.Null(result.CloudPcId);
+        Assert.Null(result.ManagedDeviceName);
+        Assert.Null(result.ServicePlanName);
+    }
+
+    // ── IntuneDeviceBindingValidator.ParseManagedDeviceResponse ─────────────────
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("null")]
+    [InlineData("[]")]
+    [InlineData("42")]
+    [InlineData("not json")]
+    [InlineData("""[{"id":"6f1c4d2a-0b3e-4c5d-8e9f-1a2b3c4d5e6f"}]""")]
+    [InlineData("""{"id":"6f1c4d2a-0b3e-4c5d-8e9f-1a2b3c4d5e6f"} x""")]
+    [InlineData("""{"id":null}""")]
+    [InlineData("""{"id":42}""")]
+    [InlineData("""{"id":"other"}""")]
+    public void Managed_device_that_is_not_the_requested_one_is_not_found(string body)
+        => Assert.Equal(IntuneDeviceBindingOutcome.NotFound, IntuneDeviceBindingValidator.ParseManagedDeviceResponse(body, IntuneId).Outcome);
+
+    [Theory]
+    [InlineData("\"managed\"", IntuneDeviceBindingOutcome.Match)]
+    [InlineData("null", IntuneDeviceBindingOutcome.Match)]
+    [InlineData("\"retirePending\"", IntuneDeviceBindingOutcome.NotManaged)]
+    [InlineData("\"WIPEISSUED\"", IntuneDeviceBindingOutcome.NotManaged)]
+    [InlineData("\"deletePending\"", IntuneDeviceBindingOutcome.NotManaged)]
+    public void Managed_device_on_its_way_out_is_not_managed(string managementState, IntuneDeviceBindingOutcome outcome)
+        => Assert.Equal(outcome, IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":" {{IntuneId.ToUpperInvariant()}} ","managementState":{{managementState}}}""", IntuneId).Outcome);
+
+    [Theory]
+    [InlineData("true", true)]
+    [InlineData("false", false)]
+    [InlineData("null", null)]
+    [InlineData("\"true\"", null)]
+    [InlineData("1", null)]
+    public void Managed_device_registration_flag_is_strictly_boolean(string value, bool? expected)
+        => Assert.Equal(expected, IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","azureADRegistered":{{value}}}""", IntuneId).AzureAdRegistered);
+
+    [Theory]
+    [InlineData("null")]
+    [InlineData("\"\"")]
+    [InlineData("\"   \"")]
+    public void Managed_device_telemetry_fields_that_are_blank_read_as_null(string value)
+    {
+        var result = IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","serialNumber":{{value}},"managedDeviceOwnerType":{{value}},"deviceEnrollmentType":{{value}},"enrolledDateTime":{{value}}}""",
+            IntuneId);
+        Assert.Null(result.SerialNumber);
+        Assert.Null(result.OwnerType);
+        Assert.Null(result.EnrollmentType);
+        Assert.Null(result.EnrolledDateTime);
+    }
+
+    [Fact]
+    public void Managed_device_reads_its_fields()
+    {
+        var result = IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","deviceName":"DESKTOP-1","azureADDeviceId":"aad-1","managementState":"managed","serialNumber":"PF3XKQ7","managedDeviceOwnerType":"company","deviceEnrollmentType":"windowsAzureADJoin","enrolledDateTime":"2026-05-08T12:16:49Z"}""",
+            IntuneId);
+
+        Assert.Equal(IntuneDeviceBindingOutcome.Match, result.Outcome);
+        Assert.Equal("DESKTOP-1", result.DeviceName);
+        Assert.Equal("aad-1", result.AzureAdDeviceId);
+        Assert.Equal("PF3XKQ7", result.SerialNumber);
+        Assert.Equal("company", result.OwnerType);
+        Assert.Equal("windowsAzureADJoin", result.EnrollmentType);
+        Assert.Equal(new DateTimeOffset(2026, 5, 8, 12, 16, 49, TimeSpan.Zero), result.EnrolledDateTime);
+    }
+
+    [Fact]
+    public void Managed_device_unset_enrollment_date_reads_as_null()
+        => Assert.Null(IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","enrolledDateTime":"0001-01-01T00:00:00Z"}""", IntuneId).EnrolledDateTime);
+
+    // D1: JSON null in a text field is absent (Newtonsoft read it as an empty string).
+    [Fact]
+    public void Managed_device_fields_that_are_json_null_read_as_null_D1()
+    {
+        var result = IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","deviceName":null,"azureADDeviceId":null,"managementState":null}""", IntuneId);
+        Assert.Equal(IntuneDeviceBindingOutcome.Match, result.Outcome);
+        Assert.Null(result.DeviceName);
+        Assert.Null(result.AzureAdDeviceId);
+        Assert.Null(result.ManagementState);
+    }
+
+    // D2: the enrollment date keeps its fraction and its day and month in any culture (Newtonsoft cut the
+    // fraction and swapped day and month on day-first cultures).
+    [Theory]
+    [InlineData("en-US")]
+    [InlineData("de-DE")]
+    [InlineData("en-GB")]
+    [InlineData("th-TH")]
+    public void Managed_device_enrollment_date_is_the_same_in_any_culture_D2(string culture)
+    {
+        var date = InCulture(culture, () => IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","enrolledDateTime":"2026-05-08T12:16:49.1234567Z"}""", IntuneId).EnrolledDateTime);
+
+        Assert.Equal(new DateTimeOffset(2026, 5, 8, 12, 16, 49, TimeSpan.Zero).AddTicks(1234567), date);
+        Assert.Equal(TimeSpan.Zero, date!.Value.Offset);
+    }
+
+    // D4: an id that is not text never matches (Newtonsoft matched through its text).
+    [Fact]
+    public void Managed_device_with_a_numeric_id_is_not_found_D4()
+        => Assert.Equal(IntuneDeviceBindingOutcome.NotFound,
+            IntuneDeviceBindingValidator.ParseManagedDeviceResponse("""{"id":12345}""", "12345").Outcome);
+
+    // ── Dates in any offset (new with System.Text.Json) ─────────────────────────
+
+    // Newtonsoft turned an offset date into machine-local time and read that back as UTC, so the instant
+    // depended on the host's time zone; it was only right on a UTC host.
+    [Theory]
+    [InlineData("2026-05-08T14:16:49+02:00")]
+    [InlineData("2026-05-08T07:16:49-05:00")]
+    [InlineData("2026-05-08T12:16:49Z")]
+    [InlineData("2026-05-08T12:16:49")]
+    public void Dates_in_any_offset_read_as_the_same_utc_instant(string value)
+    {
+        var expected = new DateTime(2026, 5, 8, 12, 16, 49, DateTimeKind.Utc);
+
+        var association = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse(
+            $$"""{"value":[{"serialNumber":"PF3XKQ7","preassociationDateTime":"{{value}}"}]}""", Serial).PreAssociationDateTime;
+        var enrolled = IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","enrolledDateTime":"{{value}}"}""", IntuneId).EnrolledDateTime;
+
+        Assert.Equal(expected, association);
+        Assert.Equal(DateTimeKind.Utc, association!.Value.Kind);
+        Assert.Equal(new DateTimeOffset(expected), enrolled);
+        Assert.Equal(TimeSpan.Zero, enrolled!.Value.Offset);
+    }
+
+    // ── ScriptDisplayNameResolver.ReadScriptPage / ReadScriptDisplayName ────────
+
+    [Fact]
+    public void Script_page_keeps_object_entries_with_an_id_and_the_next_url()
+    {
+        var (scripts, next) = ScriptDisplayNameResolver.ReadScriptPage(
+            """{"value":[1,"x",null,[],{"displayName":"no id"},{"id":null},{"id":""},{"id":"s1","displayName":"A","fileName":"a.ps1"},{"id":"s2","displayName":"B"}],"@odata.nextLink":"https://graph.microsoft.com/beta/p2"}""",
+            withFileName: true);
+
+        Assert.Equal(new[]
+        {
+            new ScriptDisplayNameResolver.ScriptListItem("s1", "A", "a.ps1"),
+            new ScriptDisplayNameResolver.ScriptListItem("s2", "B", null),
+        }, scripts);
+        Assert.Equal("https://graph.microsoft.com/beta/p2", next);
+    }
+
+    [Theory]
+    [InlineData("""{"value":[{"id":"s1"}]}""")]
+    [InlineData("""{"value":[],"@odata.nextLink":null}""")]
+    [InlineData("""{"value":[],"@odata.nextLink":""}""")]
+    [InlineData("""{"value":"oops"}""")]
+    [InlineData("{}")]
+    public void Script_page_without_a_next_link_ends_the_pull(string body)
+        => Assert.True(string.IsNullOrEmpty(ScriptDisplayNameResolver.ReadScriptPage(body, withFileName: false).NextUrl));
+
+    [Fact]
+    public void Script_page_of_health_scripts_reads_no_file_name()
+        => Assert.Null(Assert.Single(ScriptDisplayNameResolver.ReadScriptPage(
+            """{"value":[{"id":"s1","displayName":"A","fileName":"a.ps1"}]}""", withFileName: false).Scripts).FileName);
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("null")]
+    [InlineData("[]")]
+    [InlineData("not json")]
+    public void Script_page_or_name_that_is_not_one_object_throws(string body)
+    {
+        Assert.ThrowsAny<Exception>(() => ScriptDisplayNameResolver.ReadScriptPage(body, withFileName: false));
+        Assert.ThrowsAny<Exception>(() => ScriptDisplayNameResolver.ReadScriptDisplayName(body));
+    }
+
+    [Theory]
+    [InlineData("""{"displayName":"Install agent"}""", "Install agent")]
+    [InlineData("""{"id":"s1"}""", null)]
+    public void Script_name_reads_the_display_name(string body, string? name)
+        => Assert.Equal(name, ScriptDisplayNameResolver.ReadScriptDisplayName(body));
+
+    // D1: a display name that is JSON null is absent (Newtonsoft read it as an empty string).
+    [Fact]
+    public void Script_name_that_is_json_null_reads_as_null_D1()
+    {
+        Assert.Null(ScriptDisplayNameResolver.ReadScriptDisplayName("""{"displayName":null}"""));
+        Assert.Null(Assert.Single(ScriptDisplayNameResolver.ReadScriptPage(
+            """{"value":[{"id":"s1","displayName":null}]}""", withFileName: false).Scripts).DisplayName);
+    }
+
+    // D3: a display name is kept as sent in any culture, even when it looks like a date (Newtonsoft
+    // rewrote it in the current culture, "1/1/2026 12:00:00 AM" in en-US).
+    [Theory]
+    [InlineData("en-US")]
+    [InlineData("de-DE")]
+    [InlineData("th-TH")]
+    public void Script_name_shaped_like_a_date_is_kept_as_sent_D3(string culture)
+        => Assert.Equal("2026-01-01T00:00:00Z", InCulture(culture, () =>
+            ScriptDisplayNameResolver.ReadScriptDisplayName("""{"displayName":"2026-01-01T00:00:00Z"}""")));
+
+    // D4: a display name that is not text is absent (Newtonsoft read a number as its text).
+    [Fact]
+    public void Script_name_that_is_a_number_reads_as_null_D4()
+        => Assert.Null(ScriptDisplayNameResolver.ReadScriptDisplayName("""{"displayName":42}"""));
+
+    // ── D7: a body cut off mid-object is unreadable ─────────────────────────────
+
+    // Newtonsoft's DeserializeObject read the part before the cut as if the open containers were closed, so a
+    // cut-off list could still match. Every parser now answers it like any other unreadable body. HttpClient
+    // throws on a premature end before a parser sees the body, so only a server-side cut can get here.
+
+    [Fact]
+    public void Token_response_cut_off_throws_D7()
+        => Assert.ThrowsAny<Exception>(() => GraphTokenService.ReadTokenResponse("""{"access_token":"t","expires_in":3599"""));
+
+    [Fact]
+    public void Entra_rejection_cut_off_keeps_only_the_status_D7()
+    {
+        var rejection = EntraTokenRejection.Parse(400, """{"error_codes":[53003""");
+        Assert.Null(rejection.ErrorCode);
+        Assert.Null(rejection.Description);
+    }
+
+    [Fact]
+    public void Autopilot_list_cut_off_throws_D7()
+        => Assert.ThrowsAny<Exception>(() => AutopilotDeviceValidator.FindRegistration(
+            """{"value":[{"id":"ap-1","serialNumber":"PF3XKQ7"}""", Serial));
+
+    [Fact]
+    public void Corporate_page_cut_off_throws_D7()
+        => Assert.ThrowsAny<Exception>(() => CorporateIdentifierValidator.ReadIdentityPage(
+            """{"value":[{"importedDeviceIdentityType":"manufacturerModelSerial","importedDeviceIdentifier":"Microsoft Corporation,Virtual Machine,1234-5678"}""",
+            CorporateId));
+
+    [Fact]
+    public void Association_list_cut_off_is_not_found_D7()
+    {
+        var result = DeviceAssociationValidator.ParseTenantAssociatedDevicesResponse("""{"value":[{"serialNumber":"PF3XKQ7"}""", Serial);
+        Assert.False(result.IsValid);
+        Assert.False(result.IsTransient);
+    }
+
+    [Fact]
+    public void CloudPc_list_cut_off_is_not_found_D7()
+    {
+        var result = CloudPcDeviceValidator.ParseCloudPcResponse($$"""{"value":[{"managedDeviceId":"{{IntuneId}}"}""", IntuneId);
+        Assert.False(result.IsValid);
+        Assert.False(result.IsTransient);
+    }
+
+    [Fact]
+    public void Managed_device_cut_off_is_not_found_D7()
+        => Assert.Equal(IntuneDeviceBindingOutcome.NotFound, IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{"id":"{{IntuneId}}","azureADRegistered":true""", IntuneId).Outcome);
+
+    private static T InCulture<T>(string culture, Func<T> read)
+    {
+        var saved = CultureInfo.CurrentCulture;
+        try
+        {
+            CultureInfo.CurrentCulture = new CultureInfo(culture);
+            return read();
+        }
+        finally
+        {
+            CultureInfo.CurrentCulture = saved;
+        }
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GraphTokenServiceTests.cs

@@ -23,7 +23,7 @@ public class GraphTokenServiceTests
     private const string TenantA = "11111111-1111-1111-1111-111111111111";
     private const string TenantB = "22222222-2222-2222-2222-222222222222";
 
-    private static (GraphTokenService svc, StubHttpMessageHandler handler) Create(StubHttpMessageHandler handler)
+    private static (GraphTokenService svc, StubHttpMessageHandler handler) Create(StubHttpMessageHandler handler, IMemoryCache? cache = null)
     {
         var config = new ConfigurationBuilder()
             .AddInMemoryCollection(new Dictionary<string, string?>
@@ -33,7 +33,7 @@ public class GraphTokenServiceTests
             })
             .Build();
 
-        var svc = NewService(config, new StubHttpClientFactory(handler));
+        var svc = NewService(config, new StubHttpClientFactory(handler), cache: cache);
 
         return (svc, handler);
     }
@@ -43,16 +43,22 @@ public class GraphTokenServiceTests
     /// these tests ⇒ the registry always resolves the primary credentials and the tenant-config
     /// lookup is never consulted for the decision — a null-returning repo is fine.
     /// </summary>
-    private static GraphTokenService NewService(IConfiguration config, System.Net.Http.IHttpClientFactory factory) =>
+    private static GraphTokenService NewService(
+        IConfiguration config,
+        System.Net.Http.IHttpClientFactory factory,
+        IGraphAccessHealthRecorder? accessHealth = null,
+        Microsoft.Extensions.Logging.ILogger<GraphTokenService>? logger = null,
+        IMemoryCache? cache = null) =>
         new GraphTokenService(
-            NullLogger<GraphTokenService>.Instance,
+            logger ?? NullLogger<GraphTokenService>.Instance,
             factory,
-            new MemoryCache(new MemoryCacheOptions()),
+            cache ?? new MemoryCache(new MemoryCacheOptions()),
             new EntraAppRegistry(config, NullLogger<EntraAppRegistry>.Instance),
             new AutopilotMonitor.Functions.Services.TenantConfigurationService(
                 Moq.Mock.Of<AutopilotMonitor.Shared.DataAccess.IConfigRepository>(),
                 NullLogger<AutopilotMonitor.Functions.Services.TenantConfigurationService>.Instance,
-                new MemoryCache(new MemoryCacheOptions())));
+                new MemoryCache(new MemoryCacheOptions())),
+            accessHealth ?? Moq.Mock.Of<IGraphAccessHealthRecorder>());
 
     private static int TokenPosts(StubHttpMessageHandler handler, string tenantId)
         => handler.Requests.Count(u => u.Contains($"/{tenantId}/oauth2/v2.0/token"));
@@ -126,6 +132,53 @@ public class GraphTokenServiceTests
         Assert.Equal(1, TokenPosts(handler, TenantA));
     }
 
+    // The token stays cached for expires_in minus the 5-minute skew, clamped to 60 s .. 55 min. An absent
+    // or unusable expires_in (D5 in D-420: text, a fraction, zero or less) falls back to the 35-minute
+    // default, so 30 minutes; a value far beyond the cap is capped instead of overflowing.
+    [Theory]
+    [InlineData("3599", 3299)]
+    [InlineData("\"3599\"", 3299)]
+    [InlineData("7200", 3300)]
+    [InlineData("120", 60)]
+    [InlineData("null", 1800)]
+    [InlineData("\"abc\"", 1800)]
+    [InlineData("3599.5", 1800)]
+    [InlineData("0", 1800)]
+    [InlineData("-5", 1800)]
+    [InlineData("9223372036854775807", 3300)]
+    public async Task Token_cache_lifetime_follows_expires_in(string expiresIn, int seconds)
+    {
+        var cache = new RecordingMemoryCache();
+        var (svc, _) = Create(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.OK, $$"""{"access_token":"tok-A","expires_in":{{expiresIn}}}"""), cache);
+
+        Assert.Equal("tok-A", (await svc.GetAccessTokenAsync(TenantA)).AccessToken);
+
+        var entry = Assert.Single(cache.Entries, e => e.Key is string key && key.StartsWith($"graph-token:{TenantA}:", StringComparison.Ordinal));
+        Assert.Equal(TimeSpan.FromSeconds(seconds), entry.AbsoluteExpirationRelativeToNow);
+    }
+
+    /// <summary>A memory cache that keeps every entry it creates, so a test can read the lifetime the service chose.</summary>
+    private sealed class RecordingMemoryCache : IMemoryCache
+    {
+        private readonly MemoryCache _inner = new(new MemoryCacheOptions());
+
+        public List<ICacheEntry> Entries { get; } = new();
+
+        public ICacheEntry CreateEntry(object key)
+        {
+            var entry = _inner.CreateEntry(key);
+            Entries.Add(entry);
+            return entry;
+        }
+
+        public bool TryGetValue(object key, out object? value) => _inner.TryGetValue(key, out value);
+
+        public void Remove(object key) => _inner.Remove(key);
+
+        public void Dispose() => _inner.Dispose();
+    }
+
     [Fact]
     public async Task InvalidateTenant_forces_fresh_token_on_next_call()
     {
@@ -240,7 +293,8 @@ public class GraphTokenServiceTests
             new AutopilotMonitor.Functions.Services.TenantConfigurationService(
                 Moq.Mock.Of<AutopilotMonitor.Shared.DataAccess.IConfigRepository>(),
                 NullLogger<AutopilotMonitor.Functions.Services.TenantConfigurationService>.Instance,
-                new MemoryCache(new MemoryCacheOptions())));
+                new MemoryCache(new MemoryCacheOptions())),
+            Moq.Mock.Of<IGraphAccessHealthRecorder>());
 
         var probe1 = await svc.GetAccessTokenForAppAsync(TenantA, registry.Primary);
         var probe2 = await svc.GetAccessTokenForAppAsync(TenantA, registry.Primary);
@@ -260,6 +314,196 @@ public class GraphTokenServiceTests
         Assert.Equal(3, TokenPosts(handler, TenantA));
     }
 
+    // ── Entra's refusal ─────────────────────────────────────────────────────
+
+    private const string MissingAppBody = "{\"error\":\"invalid_client\",\"error_description\":\"AADSTS7000229: missing service principal\",\"error_codes\":[7000229]}";
+    private const string ConditionalAccessBody = "{\"error\":\"invalid_request\",\"error_description\":\"AADSTS53003: blocked\",\"error_codes\":[53003]}";
+
+    private static GraphTokenService ServiceFor(
+        StubHttpMessageHandler handler,
+        Moq.Mock<IGraphAccessHealthRecorder> accessHealth,
+        Microsoft.Extensions.Logging.ILogger<GraphTokenService>? logger = null)
+    {
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["EntraId:ClientId"] = "test-client",
+                ["EntraId:ClientSecret"] = "test-secret",
+            })
+            .Build();
+        return NewService(config, new StubHttpClientFactory(handler), accessHealth.Object, logger);
+    }
+
+    [Fact]
+    public async Task Rejection_survives_a_budget_that_ends_the_retries()
+    {
+        // The validators run on 8 s and the recheck on 3 s; the chain's first retry waits 5 s.
+        var handler = new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.Unauthorized, MissingAppBody);
+        var (svc, _) = Create(handler);
+        using var budget = new System.Threading.CancellationTokenSource(TimeSpan.FromMilliseconds(500));
+
+        var result = await svc.GetAccessTokenAsync(TenantA, budget.Token);
+
+        Assert.Null(result.AccessToken);
+        Assert.True(result.IsTransient);
+        Assert.NotNull(result.Rejection);
+        Assert.Equal(401, result.Rejection!.StatusCode);
+        Assert.True(result.Rejection.IsServicePrincipalMissing);
+        Assert.Equal(1, TokenPosts(handler, TenantA));
+    }
+
+    [Theory]
+    [InlineData(HttpStatusCode.ServiceUnavailable)]
+    [InlineData(HttpStatusCode.TooManyRequests)]
+    [InlineData(HttpStatusCode.RequestTimeout)]
+    public async Task A_server_error_or_throttle_is_no_rejection(HttpStatusCode status)
+    {
+        var handler = new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", status, MissingAppBody);
+        var (svc, _) = Create(handler);
+        using var budget = new System.Threading.CancellationTokenSource(TimeSpan.FromMilliseconds(200));
+
+        var result = await svc.GetAccessTokenAsync(TenantA, budget.Token);
+
+        Assert.True(result.IsTransient);
+        Assert.Null(result.Rejection);
+    }
+
+    [Fact]
+    public async Task Agent_validation_reports_a_rejection()
+    {
+        var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.BadRequest, ConditionalAccessBody), health);
+
+        var result = await svc.GetAccessTokenForAgentValidationAsync(TenantA);
+
+        Assert.False(result.IsTransient);
+        health.Verify(h => h.RecordRejectedAsync(TenantA, Moq.It.Is<EntraTokenRejection>(r => r.ErrorCode == "AADSTS53003")), Moq.Times.Once);
+    }
+
+    [Fact]
+    public async Task The_portal_path_does_not_report_a_rejection()
+    {
+        // The consent flows see refusals as a matter of course while a consent propagates.
+        var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.BadRequest, ConditionalAccessBody), health);
+
+        await svc.GetAccessTokenAsync(TenantA);
+
+        health.Verify(h => h.RecordRejectedAsync(Moq.It.IsAny<string>(), Moq.It.IsAny<EntraTokenRejection>()), Moq.Times.Never);
+    }
+
+    [Fact]
+    public async Task Only_a_fresh_token_counts_as_proof_of_access()
+    {
+        var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.OK, TestGraphToken.Body(TestGraphToken.ValidationRole)), health);
+
+        var minted = await svc.GetAccessTokenForAgentValidationAsync(TenantA);
+        var cached = await svc.GetAccessTokenForAgentValidationAsync(TenantA);
+
+        Assert.True(minted.IsFreshlyMinted);
+        Assert.False(cached.IsFreshlyMinted);
+        // The roles travel along: they decide the add-on episodes.
+        health.Verify(h => h.RecordMintedAsync(TenantA, Moq.It.Is<IReadOnlyCollection<string>>(r => r.Contains(TestGraphToken.ValidationRole))), Moq.Times.Once);
+        health.Verify(h => h.RecordRejectedAsync(Moq.It.IsAny<string>(), Moq.It.IsAny<EntraTokenRejection>()), Moq.Times.Never);
+    }
+
+    [Fact]
+    public async Task A_token_without_a_role_is_no_proof_of_access()
+    {
+        // A sign-in consent re-created the removed enterprise application without any permission.
+        // The notice must survive it: this is the moment an admin signs in to read it.
+        var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.OK, TestGraphToken.Body()), health);
+
+        await svc.GetAccessTokenAsync(TenantA);
+
+        health.Verify(h => h.RecordMintedAsync(Moq.It.IsAny<string>(), Moq.It.IsAny<IReadOnlyCollection<string>>()), Moq.Times.Never);
+        health.Verify(h => h.RecordRejectedAsync(Moq.It.IsAny<string>(), Moq.It.IsAny<EntraTokenRejection>()), Moq.Times.Never);
+    }
+
+    [Fact]
+    public async Task Agent_validation_counts_a_token_without_a_role_as_a_refusal()
+    {
+        // Graph refuses every call made with it, so the agent is locked out all the same.
+        var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.OK, TestGraphToken.Body()), health);
+
+        var result = await svc.GetAccessTokenForAgentValidationAsync(TenantA);
+
+        Assert.NotNull(result.AccessToken);
+        health.Verify(h => h.RecordRejectedAsync(TenantA, EntraTokenRejection.NoApplicationRole), Moq.Times.Once);
+        health.Verify(h => h.RecordMintedAsync(Moq.It.IsAny<string>(), Moq.It.IsAny<IReadOnlyCollection<string>>()), Moq.Times.Never);
+    }
+
+    [Fact]
+    public async Task Agent_validation_does_not_judge_a_token_from_the_cache()
+    {
+        var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.OK, TestGraphToken.Body()), health);
+
+        await svc.GetAccessTokenForAgentValidationAsync(TenantA);
+        await svc.GetAccessTokenForAgentValidationAsync(TenantA);
+
+        health.Verify(h => h.RecordRejectedAsync(TenantA, EntraTokenRejection.NoApplicationRole), Moq.Times.Once);
+    }
+
+    [Fact]
+    public async Task A_probe_under_explicit_credentials_reports_nothing()
+    {
+        // A token of the app the tenant is not homed on says nothing about the tenant's access.
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["EntraId:ClientId"] = "test-client",
+                ["EntraId:ClientSecret"] = "test-secret",
+            })
+            .Build();
+        var registry = new EntraAppRegistry(config, NullLogger<EntraAppRegistry>.Instance);
+
+        foreach (var (status, body) in new[]
+        {
+            (HttpStatusCode.OK, TestGraphToken.Body(TestGraphToken.ValidationRole)),
+            (HttpStatusCode.OK, TestGraphToken.Body()),
+            (HttpStatusCode.BadRequest, ConditionalAccessBody),
+        })
+        {
+            var health = new Moq.Mock<IGraphAccessHealthRecorder>();
+            var svc = NewService(config, new StubHttpClientFactory(new StubHttpMessageHandler().When($"/{TenantA}/oauth2", status, body)), health.Object);
+
+            await svc.GetAccessTokenForAppAsync(TenantA, registry.Primary);
+
+            health.VerifyNoOtherCalls();
+        }
+    }
+
+    [Fact]
+    public async Task Entra_refusal_is_logged_once_per_window()
+    {
+        var logger = new Moq.Mock<Microsoft.Extensions.Logging.ILogger<GraphTokenService>>();
+        var svc = ServiceFor(new StubHttpMessageHandler()
+            .When($"/{TenantA}/oauth2", HttpStatusCode.BadRequest, ConditionalAccessBody),
+            new Moq.Mock<IGraphAccessHealthRecorder>(), logger.Object);
+
+        await svc.GetAccessTokenAsync(TenantA);
+        await svc.GetAccessTokenAsync(TenantA);
+
+        logger.Verify(l => l.Log(
+            Microsoft.Extensions.Logging.LogLevel.Warning,
+            Moq.It.IsAny<Microsoft.Extensions.Logging.EventId>(),
+            Moq.It.Is<Moq.It.IsAnyType>((state, _) => state != null && state.ToString()!.Contains("rejected by Entra") && state.ToString()!.Contains("AADSTS53003")),
+            Moq.It.IsAny<Exception?>(),
+            Moq.It.IsAny<Func<Moq.It.IsAnyType, Exception?, string>>()), Moq.Times.Once);
+    }
+
     private static async Task WaitUntilAsync(Func<bool> condition, TimeSpan timeout)
     {
         var deadline = DateTime.UtcNow + timeout;

src/Backend/AutopilotMonitor.Functions.Tests/GroupTagSearchFilterTests.cs

@@ -0,0 +1,74 @@
+using AutopilotMonitor.Functions.Pagination;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Cover for the group-tag search filter and for the device-snapshot path's in-memory twin of the
+/// OData push-down: a filter must answer the same on both search paths.
+/// </summary>
+public class GroupTagSearchFilterTests
+{
+    private static SessionSummary Session(string? groupTag = null) => new()
+    {
+        SessionId = "s", TenantId = "t", AutopilotGroupTag = groupTag,
+        Manufacturer = "Contoso", Model = "EliteBook 840", EnrollmentType = "v1",
+        DeviceName = "LAB-01", OsBuild = "26100.1000", Status = SessionStatus.Failed,
+    };
+
+    [Theory]
+    [InlineData("TEST", true)]
+    [InlineData("test", true)]      // Intune does not fix the casing of a tag
+    [InlineData(" Test ", true)]
+    [InlineData("TEST-LAB", false)] // exact, not prefix
+    [InlineData(null, false)]       // session without a recorded tag
+    public void GroupTagFilter_IsCaseInsensitiveAndExact(string? sessionTag, bool expected)
+    {
+        var filter = new SessionSearchFilter { GroupTag = "Test" };
+        Assert.Equal(expected, TableStorageService.MatchesGroupTag(Session(sessionTag), filter));
+    }
+
+    [Fact]
+    public void NoGroupTagFilter_MatchesEverySession()
+    {
+        Assert.True(TableStorageService.MatchesGroupTag(Session(), new SessionSearchFilter()));
+        Assert.True(TableStorageService.MatchesGroupTag(Session(), new SessionSearchFilter { GroupTag = "  " }));
+    }
+
+    [Theory]
+    [InlineData("Manufacturer", "Contoso", true)]
+    [InlineData("Manufacturer", "contoso", false)] // OData eq is ordinal: the twin is too
+    [InlineData("Model", "EliteBook 840", true)]
+    [InlineData("Model", "EliteBook", false)]
+    [InlineData("EnrollmentType", "v2", false)]
+    [InlineData("DeviceName", "LAB", true)]        // prefix, like the ge/lt range
+    [InlineData("DeviceName", "PC", false)]
+    [InlineData("OsBuild", "26100", true)]
+    [InlineData("OsBuild", "22631", false)]
+    [InlineData("Status", "Failed", true)]
+    [InlineData("Status", "Succeeded", false)]
+    public void DeviceSnapshotPath_AppliesThePushedDownColumns(string column, string value, bool expected)
+    {
+        var filter = column switch
+        {
+            "Manufacturer" => new SessionSearchFilter { Manufacturer = value },
+            "Model" => new SessionSearchFilter { Model = value },
+            "EnrollmentType" => new SessionSearchFilter { EnrollmentType = value },
+            "DeviceName" => new SessionSearchFilter { DeviceName = value },
+            "OsBuild" => new SessionSearchFilter { OsBuild = value },
+            _ => new SessionSearchFilter { Status = value },
+        };
+        Assert.Equal(expected, TableStorageService.MatchesPushedDownColumns(Session(), filter));
+    }
+
+    [Fact]
+    public void Fingerprint_BindsTheGroupTag()
+    {
+        // A continuation token minted for one group tag must not be replayed against another.
+        var a = SearchSessionsPagination.Fingerprint("tenant", "t", null, new SessionSearchFilter { GroupTag = "TEST" });
+        var b = SearchSessionsPagination.Fingerprint("tenant", "t", null, new SessionSearchFilter { GroupTag = "PROD" });
+        Assert.NotEqual(a, b);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/GrowthMetricsBuilderTests.cs

@@ -235,6 +235,26 @@ public class GrowthMetricsBuilderTests
         Assert.Null(a.MedianDaysToFirstEnrollment);
     }
 
+    [Fact]
+    public void Before_yesterday_is_aggregated_yesterdays_counters_count_as_activity_and_the_rows_end_the_day_before()
+    {
+        // Sessions yesterday after a 40-day pause; the first maintenance run after midnight has not written them yet.
+        var configs = new[] { Config('a', Utc(6, 1, 9)) };
+        var stats = new[] { Stats('a', 6, 5, Utc(10, 27, 22)) };
+        var rows = new[] { Active('a', 2026, 9, 17) };
+
+        var early = GrowthMetricsBuilder.Build(configs, stats, rows, Now, 30, TimeZoneInfo.Utc, false, NoExclusions, yesterdayAggregated: false);
+
+        Assert.Equal("2026-10-26", early.UsageDaysThrough);
+        Assert.Equal(0, early.AllTenants.Dormant);
+        Assert.Equal(1, early.AllTenants.Active7Days);
+
+        // Aggregated, yesterday has no row: the counters moved for an old session, which is no activity.
+        var later = GrowthMetricsBuilder.Build(configs, stats, rows, Now, 30, TimeZoneInfo.Utc, false, NoExclusions);
+        Assert.Equal("2026-10-27", later.UsageDaysThrough);
+        Assert.Equal(1, later.AllTenants.Dormant);
+    }
+
     [Fact]
     public void A_peak_needs_three_signups_and_twice_the_median_of_the_two_weeks_before()
     {

src/Backend/AutopilotMonitor.Functions.Tests/HardwareWhitelistValidatorTests.cs

@@ -0,0 +1,105 @@
+using System.Diagnostics;
+using System.Text.RegularExpressions;
+using AutopilotMonitor.Functions.Security;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The hardware whitelist matches tenant wildcards against device headers on every agent request
+/// without building a Regex (D-411): same results as the former regex construction for every shape
+/// an entry can take, linear work for the worst entry a tenant can write, and a device value longer
+/// than any real hardware string only meets "*".
+/// </summary>
+public class HardwareWhitelistValidatorTests
+{
+    /// <summary>The construction this replaced, kept as the oracle: '*' → '.*', '?' → '.', the rest escaped.</summary>
+    private static bool FormerRegexMatch(string text, string pattern)
+    {
+        if (pattern == "*")
+            return true;
+        var regex = "^" + Regex.Escape(pattern).Replace("\\*", ".*").Replace("\\?", ".") + "$";
+        return Regex.IsMatch(text, regex, RegexOptions.IgnoreCase, TimeSpan.FromSeconds(5));
+    }
+
+    [Theory]
+    [InlineData("Dell Inc.", "Dell*")]
+    [InlineData("dell inc.", "DELL*")]
+    [InlineData("Hewlett-Packard", "HP*")]
+    [InlineData("HP", "HP*")]
+    [InlineData("LENOVO", "Lenovo*")]
+    [InlineData("Microsoft Corporation", "Microsoft Corporation")]
+    [InlineData("Microsoft Corporation ", "Microsoft Corporation")]
+    [InlineData("Microsoft Corp", "Microsoft Corporation")]
+    [InlineData("ThinkPad T14 Gen 6", "*T14*")]
+    [InlineData("ThinkPad T14 Gen 6", "*Gen ?")]
+    [InlineData("ThinkPad T14 Gen 16", "*Gen ?")]
+    [InlineData("ThinkPad T14 Gen 6", "ThinkPad*Gen*")]
+    [InlineData("VMware20,1", "VMware??,?")]
+    [InlineData("VMware20,1", "VMware?,?")]
+    [InlineData("a.b", "a.b")]
+    [InlineData("axb", "a.b")]
+    [InlineData("f(x)", "f(x)")]
+    [InlineData("f(x)", "f(*)")]
+    [InlineData("a\\b", "a\\b")]
+    [InlineData("a\\xyzb", "a\\*b")]
+    [InlineData("a*b", "a\\*b")]
+    [InlineData("[abc]", "[abc]")]
+    [InlineData("a", "[abc]")]
+    [InlineData("x+y", "x+y")]
+    [InlineData("xxy", "x+y")]
+    [InlineData("$1.00", "$1.00")]
+    [InlineData("^start", "^start")]
+    [InlineData("abc", "**")]
+    [InlineData("abc", "*?*")]
+    [InlineData("ab", "???")]
+    [InlineData("abc", "???")]
+    [InlineData("abcc", "*c")]
+    [InlineData("ÄÖÜ GmbH", "äöü*")]
+    [InlineData("straße", "STRASSE")]
+    public void Matches_like_the_former_regex_construction(string value, string pattern)
+    {
+        Assert.Equal(FormerRegexMatch(value, pattern), HardwareWhitelistValidator.MatchesWildcard(value, pattern));
+    }
+
+    [Fact]
+    public void Case_folding_is_ordinal_the_one_deliberate_difference()
+    {
+        // The regex engine folded Turkish dotted 'İ' to 'i'; ordinal folding does not. SMBIOS strings are ASCII.
+        Assert.True(FormerRegexMatch("İstanbul", "istanbul*"));
+        Assert.False(HardwareWhitelistValidator.MatchesWildcard("İstanbul", "istanbul*"));
+    }
+
+    [Fact]
+    public void The_worst_whitelist_a_tenant_can_write_costs_milliseconds_per_request()
+    {
+        // 200 entries of 128 characters, each a chain of wildcards that never matches, against the
+        // longest value still compared (the cap) and a 32 KB header (past the cap).
+        var entry = string.Concat(Enumerable.Repeat("*a", 63)) + "*b";
+        var whitelist = Enumerable.Repeat(entry, 200).ToArray();
+        var atCap = new string('a', HardwareWhitelistValidator.MaxMatchedValueLength);
+        var huge = new string('a', 32 * 1024);
+
+        var clock = Stopwatch.StartNew();
+        var atCapResult = HardwareWhitelistValidator.ValidateHardware(atCap, "Model", whitelist, new[] { "*" });
+        var hugeResult = HardwareWhitelistValidator.ValidateHardware(huge, "Model", whitelist, new[] { "*" });
+        clock.Stop();
+
+        Assert.False(atCapResult.IsValid);
+        Assert.False(hugeResult.IsValid);
+        // The former construction spent up to 200 × 100 ms per list on this.
+        Assert.True(clock.ElapsedMilliseconds < 500, $"took {clock.ElapsedMilliseconds} ms");
+    }
+
+    [Fact]
+    public void A_value_longer_than_any_hardware_string_only_meets_the_star()
+    {
+        var longValue = "Dell" + new string('x', HardwareWhitelistValidator.MaxMatchedValueLength);
+
+        Assert.False(HardwareWhitelistValidator.MatchesWildcard(longValue, "Dell*"));
+        Assert.True(HardwareWhitelistValidator.MatchesWildcard(longValue, "*"));
+
+        var rejected = HardwareWhitelistValidator.ValidateHardware(longValue, "Model", new[] { "Dell*" }, new[] { "*" });
+        Assert.False(rejected.IsValid);
+        Assert.True(rejected.ErrorMessage!.Length < HardwareWhitelistValidator.MaxMatchedValueLength + 64, "the rejection message carries a shortened value");
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/IntuneDeviceBindingValidatorTests.cs

@@ -124,32 +124,38 @@ public class IntuneDeviceBindingValidatorTests
         Assert.Null(result.EnrolledDateTime);
     }
 
-    // -- ParseEnrolledDateTime --
+    // -- enrolledDateTime --
+
+    private static DateTimeOffset? EnrolledDateTime(string jsonValue)
+        => IntuneDeviceBindingValidator.ParseManagedDeviceResponse(
+            $$"""{ "id": "{{DeviceId}}", "enrolledDateTime": {{jsonValue}} }""", DeviceId).EnrolledDateTime;
 
     [Fact]
-    public void ParseEnrolledDateTime_IntuneZeroDate_IsAbsenceNotADate()
+    public void EnrolledDateTime_IntuneZeroDate_IsAbsenceNotADate()
     {
         // Intune returns 0001-01-01T00:00:00Z when it has no enrollment timestamp. Treating that
         // as a real date would report an object age of ~2000 years and poison the race analysis.
-        Assert.Null(IntuneDeviceBindingValidator.ParseEnrolledDateTime("0001-01-01T00:00:00Z"));
+        Assert.Null(EnrolledDateTime("\"0001-01-01T00:00:00Z\""));
     }
 
     [Theory]
-    [InlineData(null)]
-    [InlineData("")]
-    [InlineData("   ")]
-    [InlineData("not-a-date")]
-    public void ParseEnrolledDateTime_UnusableInput_IsNull(string? raw)
+    [InlineData("null")]
+    [InlineData("\"\"")]
+    [InlineData("\"   \"")]
+    [InlineData("\"not-a-date\"")]
+    [InlineData("20260824")]
+    [InlineData("true")]
+    public void EnrolledDateTime_UnusableValue_IsNull(string jsonValue)
     {
-        Assert.Null(IntuneDeviceBindingValidator.ParseEnrolledDateTime(raw));
+        Assert.Null(EnrolledDateTime(jsonValue));
     }
 
     [Fact]
-    public void ParseEnrolledDateTime_NormalizesToUtc()
+    public void EnrolledDateTime_NormalizesToUtc()
     {
         // A device object created minutes ago is the signature of an enrollment race, so the
         // instant has to be comparable regardless of the offset Graph reports it in.
-        var parsed = IntuneDeviceBindingValidator.ParseEnrolledDateTime("2026-08-24T17:20:00+02:00");
+        var parsed = EnrolledDateTime("\"2026-08-24T17:20:00+02:00\"");
 
         Assert.NotNull(parsed);
         Assert.Equal(TimeSpan.Zero, parsed!.Value.Offset);

src/Backend/AutopilotMonitor.Functions.Tests/IntuneEnrollmentValidationTests.cs

@@ -79,7 +79,7 @@ public class IntuneEnrollmentValidationTests
             Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, cache)
         { CallBase = false };
         var tokens = new Mock<GraphTokenService>(
-            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object)
+            NullLogger<GraphTokenService>.Instance, Mock.Of<IHttpClientFactory>(), cache, registry, tenantConfig.Object, Mock.Of<IGraphAccessHealthRecorder>())
         { CallBase = false };
         tokens.Setup(t => t.GetAccessTokenAsync(TenantId, It.IsAny<CancellationToken>()))
             .ReturnsAsync(GraphTokenResult.Success("token"));
@@ -290,7 +290,8 @@ public class IntuneEnrollmentValidationTests
 
     // ------------------------------------------------------------------ SecurityValidator chain
 
-    private static (SecurityValidator Validator, Mock<IntuneDeviceBindingValidator> Binding) BuildChain(TenantConfiguration config)
+    private static (SecurityValidator Validator, Mock<IntuneDeviceBindingValidator> Binding) BuildChain(
+        TenantConfiguration config, IGraphAccessHealthRecorder? accessHealth = null, CloudPcDeviceValidator? cloudPc = null)
     {
         var configRepo = Mock.Of<IConfigRepository>();
         var cache = new MemoryCache(new MemoryCacheOptions());
@@ -318,7 +319,9 @@ public class IntuneEnrollmentValidationTests
             new RateLimitService(cache, Mock.Of<ILogger<RateLimitService>>()),
             autopilotDeviceValidator: null!, corporateIdentifierValidator: null!,
             NullLogger.Instance,
-            intuneDeviceBindingValidator: binding.Object);
+            cloudPcDeviceValidator: cloudPc,
+            intuneDeviceBindingValidator: binding.Object,
+            accessHealth: accessHealth);
         return (validator, binding);
     }
 
@@ -407,6 +410,118 @@ public class IntuneEnrollmentValidationTests
         Assert.Equal(retryAfter, result.RetryAfterSeconds);
     }
 
+    // ------------------------------------------------------------------ missing add-on permission
+
+    private static Mock<CloudPcDeviceValidator> CloudPcAnswering(CloudPcValidationResult result)
+    {
+        var cloudPc = new Mock<CloudPcDeviceValidator>(
+            NullLogger<CloudPcDeviceValidator>.Instance, Mock.Of<IHttpClientFactory>(),
+            new MemoryCache(new MemoryCacheOptions()), null!)
+        { CallBase = false };
+        cloudPc.Setup(c => c.ValidateCloudPcAsync(CertTenant, DeviceId, It.IsAny<string?>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(result);
+        return cloudPc;
+    }
+
+    private static readonly CloudPcValidationResult CloudPcPermissionMissing =
+        new() { IsValid = false, PermissionMissing = true, ErrorMessage = "not permitted" };
+
+    private static Task<SecurityValidationResult> Validate(SecurityValidator validator, bool selfReportedCloudPc = false)
+        => validator.ValidateRequestAsync(CertTenantBindingTests.BuildRequestWithCert(CertTenantBindingTests.SampleCertBase64()), CertTenant,
+            selfReportedCloudPc: selfReportedCloudPc);
+
+    [Fact]
+    public async Task Chain_MissingBindingPermission_ReportsTheAddOn_AndKeepsTheResponse()
+    {
+        var recorder = new Mock<IGraphAccessHealthRecorder>();
+        var (withRecorder, binding) = BuildChain(new TenantConfiguration { ValidateIntuneDeviceBinding = true }, recorder.Object);
+        SetupAdmitting(binding, new IntuneDeviceBindingResult { Outcome = IntuneDeviceBindingOutcome.PermissionMissing, ErrorMessage = "grant" });
+        var (withoutRecorder, bindingWithout) = BuildChain(new TenantConfiguration { ValidateIntuneDeviceBinding = true });
+        SetupAdmitting(bindingWithout, new IntuneDeviceBindingResult { Outcome = IntuneDeviceBindingOutcome.PermissionMissing, ErrorMessage = "grant" });
+
+        var reported = await Validate(withRecorder);
+        var silent = await Validate(withoutRecorder);
+
+        recorder.Verify(r => r.RecordAddOnPermissionMissingAsync(CertTenant,
+            It.Is<IReadOnlyList<AddOnValidation>>(l => l.Count == 1 && l[0] == AddOnValidation.IntuneDeviceBinding)), Times.Once);
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, reported.StatusCode);
+        Assert.Equal(silent.StatusCode, reported.StatusCode);
+        Assert.Equal(silent.RetryAfterSeconds, reported.RetryAfterSeconds);
+        Assert.Equal(silent.Details, reported.Details);
+    }
+
+    [Theory]
+    [InlineData(IntuneDeviceBindingOutcome.Match)]
+    [InlineData(IntuneDeviceBindingOutcome.NotFound)]
+    [InlineData(IntuneDeviceBindingOutcome.Transient)]
+    public async Task Chain_OtherBindingOutcomes_ReportNothing(IntuneDeviceBindingOutcome outcome)
+    {
+        var recorder = new Mock<IGraphAccessHealthRecorder>();
+        var (validator, binding) = BuildChain(new TenantConfiguration { ValidateIntuneDeviceBinding = true }, recorder.Object);
+        SetupAdmitting(binding, new IntuneDeviceBindingResult { Outcome = outcome, ErrorMessage = "x" });
+
+        await Validate(validator);
+
+        recorder.VerifyNoOtherCalls();
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)] // a laptop not (yet) in Autopilot or a Hyper-V test VM: the grant would not admit it either
+    public async Task Chain_MissingCloudPcPermission_KeepsThe403_AndReportsOnlyASelfReportedCloudPc(bool selfReportedCloudPc)
+    {
+        var recorder = new Mock<IGraphAccessHealthRecorder>();
+        var (validator, _) = BuildChain(new TenantConfiguration { ValidateCloudPcDevice = true }, recorder.Object,
+            CloudPcAnswering(CloudPcPermissionMissing).Object);
+
+        var result = await Validate(validator, selfReportedCloudPc);
+
+        Assert.Equal(HttpStatusCode.Forbidden, result.StatusCode);
+        Assert.Contains("not permitted", result.Details);
+        recorder.Verify(r => r.RecordAddOnPermissionMissingAsync(CertTenant,
+                It.Is<IReadOnlyList<AddOnValidation>>(l => l.Count == 1 && l[0] == AddOnValidation.CloudPc)),
+            selfReportedCloudPc ? Times.Once() : Times.Never());
+        recorder.VerifyNoOtherCalls();
+    }
+
+    [Fact]
+    public async Task Chain_MissingCloudPcPermission_ReportsNothing_WhenTheBindingAdmits()
+    {
+        // The device got in: the missing grant had no consequence.
+        var recorder = new Mock<IGraphAccessHealthRecorder>();
+        var (validator, binding) = BuildChain(
+            new TenantConfiguration { ValidateCloudPcDevice = true, ValidateIntuneDeviceBinding = true }, recorder.Object,
+            CloudPcAnswering(CloudPcPermissionMissing).Object);
+        SetupAdmitting(binding, new IntuneDeviceBindingResult { Outcome = IntuneDeviceBindingOutcome.Match, IntuneDeviceId = DeviceId });
+
+        var result = await Validate(validator);
+
+        Assert.True(result.IsValid, result.ErrorMessage + " " + result.Details);
+        recorder.VerifyNoOtherCalls();
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)] // a Hyper-V VM outside Autopilot: only the binding's grant would admit it
+    public async Task Chain_BothPermissionsMissing_ReportsInChainOrder_CloudPcOnlyWhenSelfReported(bool selfReportedCloudPc)
+    {
+        var recorder = new Mock<IGraphAccessHealthRecorder>();
+        var (validator, binding) = BuildChain(
+            new TenantConfiguration { ValidateCloudPcDevice = true, ValidateIntuneDeviceBinding = true }, recorder.Object,
+            CloudPcAnswering(CloudPcPermissionMissing).Object);
+        SetupAdmitting(binding, new IntuneDeviceBindingResult { Outcome = IntuneDeviceBindingOutcome.PermissionMissing, ErrorMessage = "grant" });
+        AddOnValidation[] expected = selfReportedCloudPc
+            ? [AddOnValidation.CloudPc, AddOnValidation.IntuneDeviceBinding]
+            : [AddOnValidation.IntuneDeviceBinding];
+
+        var result = await Validate(validator, selfReportedCloudPc);
+
+        // The binding's missing grant keeps the device waiting rather than rejected (D-282).
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, result.StatusCode);
+        recorder.Verify(r => r.RecordAddOnPermissionMissingAsync(CertTenant,
+            It.Is<IReadOnlyList<AddOnValidation>>(l => l.SequenceEqual(expected))), Times.Once);
+    }
+
     [Fact]
     public async Task Chain_ToggleOff_NoAdmittingLookup_OnlyABackgroundObservation()
     {

src/Backend/AutopilotMonitor.Functions.Tests/LegacyUpstreamParsers.cs

@@ -0,0 +1,261 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Functions.Security;
+using AutopilotMonitor.Functions.Services.GraphResolution;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The Graph and Entra token-endpoint response parsers as they read with Newtonsoft before D-420, copied
+/// verbatim as the reference for <see cref="UpstreamJsonDifferentialTests"/>. Temporary: removed together
+/// with that test once the System.Text.Json parsers have run cleanly in production (backlog).
+/// </summary>
+internal static class LegacyUpstreamParsers
+{
+    public static (string? AccessToken, long? ExpiresInSeconds) ReadTokenResponse(string responseBody)
+    {
+        var tokenJson = JsonConvert.DeserializeObject<JObject>(responseBody);
+        var accessToken = tokenJson?["access_token"]?.ToString();
+        return string.IsNullOrEmpty(accessToken) ? (accessToken, null) : (accessToken, (long?)tokenJson?["expires_in"]);
+    }
+
+    public static EntraTokenRejection ParseEntraRejection(int statusCode, string? body)
+    {
+        JObject? json = null;
+        if (!string.IsNullOrWhiteSpace(body))
+        {
+            try { json = JsonConvert.DeserializeObject<JToken>(body) as JObject; }
+            catch (JsonException) { json = null; }
+        }
+        var description = (json?["error_description"] as JValue)?.Value as string;
+
+        string? code = null;
+        var first = (json?["error_codes"] as JArray)?.FirstOrDefault(t => t.Type == JTokenType.Integer);
+        if (first != null)
+        {
+            code = "AADSTS" + first.Value<long>();
+        }
+        else
+        {
+            var start = description?.IndexOf("AADSTS", StringComparison.Ordinal) ?? -1;
+            if (start >= 0)
+            {
+                var digits = new string(description!.Skip(start + "AADSTS".Length).TakeWhile(char.IsDigit).ToArray());
+                code = digits.Length == 0 ? null : "AADSTS" + digits;
+            }
+        }
+
+        string? shortened = null;
+        if (!string.IsNullOrWhiteSpace(description))
+        {
+            var line = description.Split('\n')[0].Trim();
+            shortened = line.Length <= 300 ? line : line.Substring(0, 300);
+        }
+        return new EntraTokenRejection(statusCode, code, shortened);
+    }
+
+    public static AutopilotRegistration? FindRegistration(string responseBody, string normalizedSerial)
+    {
+        var data = JsonConvert.DeserializeObject<JObject>(responseBody);
+        if (data?["value"] is not JArray devices || devices.Count == 0)
+            return null;
+
+        var exactDevice = devices.FirstOrDefault(d => string.Equals(
+            d?["serialNumber"]?.ToString()?.Trim(), normalizedSerial, StringComparison.OrdinalIgnoreCase));
+        if (exactDevice == null)
+            return null;
+
+        return new AutopilotRegistration
+        {
+            DeviceId = RegistrationText(exactDevice["id"]),
+            GroupTag = RegistrationText(exactDevice["groupTag"]),
+            PurchaseOrderId = RegistrationText(exactDevice["purchaseOrderIdentifier"]),
+            DisplayName = RegistrationText(exactDevice["displayName"]),
+            UserAssigned = RegistrationText(exactDevice["userPrincipalName"]) != null,
+        };
+    }
+
+    private static string? RegistrationText(JToken? token)
+    {
+        var value = token?.Type == JTokenType.String ? ((string?)token)?.Trim() : null;
+        if (string.IsNullOrEmpty(value))
+            return null;
+        return value!.Length > AutopilotDeviceValidator.MaxRegistrationFieldLength
+            ? value.Substring(0, AutopilotDeviceValidator.MaxRegistrationFieldLength)
+            : value;
+    }
+
+    public static (bool Found, string NextUrl) ReadIdentityPage(string responseBody, string normalizedIdentifier)
+    {
+        var data = JsonConvert.DeserializeObject<JObject>(responseBody);
+        if (data?["value"] is JArray identities)
+        {
+            foreach (var identity in identities)
+            {
+                var type = identity?["importedDeviceIdentityType"]?.ToString();
+                var value = identity?["importedDeviceIdentifier"]?.ToString();
+                if (string.Equals(type, "manufacturerModelSerial", StringComparison.OrdinalIgnoreCase)
+                    && value != null
+                    && string.Equals(CorporateIdentifierValidator.NormalizeStoredIdentifier(value), normalizedIdentifier, StringComparison.Ordinal))
+                {
+                    return (true, string.Empty);
+                }
+            }
+        }
+        return (false, data?["@odata.nextLink"]?.ToString() ?? string.Empty);
+    }
+
+    public static DeviceAssociationResult ParseAssociation(string responseBody, string normalizedSerial)
+    {
+        var notFound = new DeviceAssociationResult
+        {
+            IsValid = false,
+            SerialNumber = normalizedSerial,
+            ErrorMessage = $"Device with serial '{normalizedSerial}' is not associated with this tenant (device association)"
+        };
+
+        JObject? data;
+        try { data = JsonConvert.DeserializeObject<JObject>(responseBody); }
+        catch (JsonException) { return notFound; }
+
+        var devices = data?["value"] as JArray;
+        if (devices == null || devices.Count == 0)
+            return notFound;
+
+        var match = devices.FirstOrDefault(d => string.Equals(
+            d?["serialNumber"]?.ToString()?.Trim(), normalizedSerial, StringComparison.OrdinalIgnoreCase));
+        if (match == null)
+            return notFound;
+
+        return new DeviceAssociationResult
+        {
+            IsValid = true,
+            SerialNumber = normalizedSerial,
+            AssociationState = match["associationState"]?.ToString(),
+            DevicePreparationPolicyId = match["devicePreparationPolicyId"]?.ToString(),
+            PreAssociatedByUserPrincipalName = match["preassociatedByUserPrincipalName"]?.ToString(),
+            AssignedToUserPrincipalName = match["assignedToUserPrincipalName"]?.ToString(),
+            PreAssociationDateTime = ParseAssociationDate(match["preassociationDateTime"]),
+            AssociationDateTime = ParseAssociationDate(match["associationDateTime"]),
+            ManagedDeviceId = match["managedDeviceId"]?.ToString()
+        };
+    }
+
+    private static DateTime? ParseAssociationDate(JToken? token)
+    {
+        if (token == null || token.Type == JTokenType.Null) return null;
+        var s = token.ToString();
+        if (string.IsNullOrEmpty(s)) return null;
+        if (DateTime.TryParse(s, null, System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal, out var dt))
+            return dt.Year <= 1 ? null : dt;
+        return null;
+    }
+
+    public static CloudPcValidationResult ParseCloudPc(string responseBody, string normalizedId)
+    {
+        var notFound = new CloudPcValidationResult
+        {
+            IsValid = false,
+            IntuneDeviceId = normalizedId,
+            ErrorMessage = $"Device '{normalizedId}' is not a Windows 365 Cloud PC in this tenant"
+        };
+
+        JObject? data;
+        try { data = JsonConvert.DeserializeObject<JObject>(responseBody); }
+        catch (JsonException) { return notFound; }
+
+        var cloudPcs = data?["value"] as JArray;
+        if (cloudPcs == null || cloudPcs.Count == 0)
+            return notFound;
+
+        var match = cloudPcs.FirstOrDefault(c => string.Equals(
+            c?["managedDeviceId"]?.ToString()?.Trim(), normalizedId, StringComparison.OrdinalIgnoreCase));
+        if (match == null)
+            return notFound;
+
+        return new CloudPcValidationResult
+        {
+            IsValid = true,
+            IntuneDeviceId = normalizedId,
+            CloudPcId = match["id"]?.ToString(),
+            ManagedDeviceName = match["managedDeviceName"]?.ToString(),
+            ServicePlanName = match["servicePlanName"]?.ToString()
+        };
+    }
+
+    private static readonly HashSet<string> LeavingManagementStates = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "retirePending", "retireIssued", "wipePending", "wipeIssued", "deletePending",
+    };
+
+    public static IntuneDeviceBindingResult ParseManagedDevice(string responseBody, string normalizedId)
+    {
+        var notFound = new IntuneDeviceBindingResult
+        {
+            Outcome = IntuneDeviceBindingOutcome.NotFound,
+            IntuneDeviceId = normalizedId,
+            ErrorMessage = $"Device '{normalizedId}' is not an enrolled Intune device in this tenant"
+        };
+
+        JObject? device;
+        try { device = JsonConvert.DeserializeObject<JObject>(responseBody); }
+        catch (JsonException) { return notFound; }
+
+        var returnedId = device?["id"]?.ToString()?.Trim();
+        if (string.IsNullOrEmpty(returnedId) || !string.Equals(returnedId, normalizedId, StringComparison.OrdinalIgnoreCase))
+            return notFound;
+
+        var managementState = device?["managementState"]?.ToString();
+        var leaving = managementState != null && LeavingManagementStates.Contains(managementState);
+
+        return new IntuneDeviceBindingResult
+        {
+            Outcome = leaving ? IntuneDeviceBindingOutcome.NotManaged : IntuneDeviceBindingOutcome.Match,
+            IntuneDeviceId = normalizedId,
+            DeviceName = device?["deviceName"]?.ToString(),
+            AzureAdDeviceId = device?["azureADDeviceId"]?.ToString(),
+            ManagementState = managementState,
+            SerialNumber = NullIfEmpty(device?["serialNumber"]?.ToString()),
+            OwnerType = NullIfEmpty(device?["managedDeviceOwnerType"]?.ToString()),
+            EnrollmentType = NullIfEmpty(device?["deviceEnrollmentType"]?.ToString()),
+            AzureAdRegistered = device?["azureADRegistered"]?.Type == JTokenType.Boolean
+                ? device["azureADRegistered"]!.Value<bool>()
+                : null,
+            EnrolledDateTime = ParseEnrolledDateTime(device?["enrolledDateTime"]?.ToString()),
+            ErrorMessage = leaving
+                ? $"Device '{normalizedId}' is being removed from Intune management (state {managementState})"
+                : null
+        };
+    }
+
+    private static DateTimeOffset? ParseEnrolledDateTime(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return null;
+        if (!DateTimeOffset.TryParse(raw, System.Globalization.CultureInfo.InvariantCulture,
+                System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal, out var parsed))
+            return null;
+        return parsed.Year <= 1 ? null : parsed;
+    }
+
+    private static string? NullIfEmpty(string? value) => string.IsNullOrWhiteSpace(value) ? null : value;
+
+    public static (List<ScriptDisplayNameResolver.ScriptListItem> Scripts, string? NextUrl) ReadScriptPage(string body, bool withFileName)
+    {
+        var json = JObject.Parse(body);
+        var values = json["value"] as JArray ?? new JArray();
+        var scripts = new List<ScriptDisplayNameResolver.ScriptListItem>();
+        foreach (var item in values.OfType<JObject>())
+        {
+            var id = item["id"]?.ToString();
+            if (string.IsNullOrEmpty(id)) continue;
+            scripts.Add(new ScriptDisplayNameResolver.ScriptListItem(id!, item["displayName"]?.ToString(), withFileName ? item["fileName"]?.ToString() : null));
+        }
+        return (scripts, json["@odata.nextLink"]?.ToString());
+    }
+
+    public static string? ReadScriptDisplayName(string body) => JObject.Parse(body)["displayName"]?.ToString();
+}

src/Backend/AutopilotMonitor.Functions.Tests/LiveStreamPrincipalTests.cs

@@ -45,6 +45,24 @@ public class LiveStreamPrincipalTests
         Assert.Equal(new string?[] { SignalRGroupHelper.UserId(TenantId, Upn) }, signalR.NegotiatedUserIds);
     }
 
+    [Fact]
+    public async Task Negotiate_under_view_as_binds_the_sign_in_tenant_not_the_viewed_one()
+    {
+        // Removing a Global Admin cuts the connections bound to their sign-in tenant; a view-as tab must be among them.
+        var signalR = new FakeSignalRNotificationService();
+        var req = BuildRequest(new RequestContext
+        {
+            TenantId = OtherTenantId,
+            UserPrincipalName = OperatorUpn,
+            ViewAs = new ViewAsContext(TenantId, AutopilotMonitor.Shared.Constants.TenantRoles.Admin),
+        });
+
+        var response = await new SignalRNegotiateFunction(NullLogger<SignalRNegotiateFunction>.Instance, signalR).Negotiate(req);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Equal(new string?[] { SignalRGroupHelper.UserId(TenantId, OperatorUpn) }, signalR.NegotiatedUserIds);
+    }
+
     [Fact]
     public async Task Negotiate_without_a_principal_key_binds_no_user_id()
     {

src/Backend/AutopilotMonitor.Functions.Tests/MaintenanceStepTimerTests.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 using System.Threading.Tasks;
 using AutopilotMonitor.Functions.Services.Maintenance;
 using Xunit;
@@ -7,6 +8,18 @@ namespace AutopilotMonitor.Functions.Tests;
 
 public class MaintenanceStepTimerTests
 {
+    private const long Mb = 1024 * 1024;
+
+    private static MaintenanceStepTimer TimerOver(params (long PeakMb, long AllocatedMb)[] readings)
+    {
+        var queue = new Queue<(long PeakMb, long AllocatedMb)>(readings);
+        return new MaintenanceStepTimer(() =>
+        {
+            var (peakMb, allocatedMb) = queue.Dequeue();
+            return new MaintenanceMemoryReading(peakMb * Mb, allocatedMb * Mb, 1740 * Mb, 2088 * Mb);
+        });
+    }
+
     [Fact]
     public async Task Records_every_step_in_order_and_returns_the_body_result()
     {
@@ -30,4 +43,49 @@ public class MaintenanceStepTimerTests
 
         Assert.True(timer.Steps.ContainsKey("boom"));
     }
+
+    // The memory columns have to name the step that set the peak: each step records the process
+    // peak after it ran and only the allocation of its own span.
+    [Fact]
+    public async Task Each_step_reports_the_process_peak_after_it_and_its_own_allocation()
+    {
+        var timer = TimerOver((400, 100), (400, 150), (400, 150), (1900, 1450), (1900, 1450));
+
+        await timer.RunAsync("light", () => Task.CompletedTask);
+        await timer.RunAsync<int>("heavy", () => Task.FromResult(7));
+
+        var report = timer.MemoryReport();
+        Assert.Equal(400, report.StepsPeakMb["light"]);
+        Assert.Equal(50, report.StepsAllocMb["light"]);
+        Assert.Equal(1900, report.StepsPeakMb["heavy"]);
+        Assert.Equal(1300, report.StepsAllocMb["heavy"]);
+        Assert.Equal(1740, report.GcHeapLimitMb);
+        Assert.Equal(2088, report.GcHighLoadMb);
+    }
+
+    [Fact]
+    public async Task A_throwing_step_still_reports_its_memory()
+    {
+        var timer = TimerOver((300, 10), (800, 60), (800, 60));
+
+        await Assert.ThrowsAsync<InvalidOperationException>(
+            () => timer.RunAsync("boom", () => throw new InvalidOperationException("x")));
+
+        var report = timer.MemoryReport();
+        Assert.Equal(800, report.StepsPeakMb["boom"]);
+        Assert.Equal(50, report.StepsAllocMb["boom"]);
+    }
+
+    [Fact]
+    public void A_real_reading_sees_the_process_peak_and_the_gc_limits()
+    {
+        GC.Collect();
+
+        var reading = MaintenanceMemoryReading.Capture();
+
+        Assert.True(reading.PeakWorkingSetBytes > 0);
+        Assert.True(reading.AllocatedBytes > 0);
+        Assert.True(reading.GcHeapLimitBytes > 0);
+        Assert.True(reading.GcHighLoadBytes > 0);
+    }
 }

src/Backend/AutopilotMonitor.Functions.Tests/McpOrganizationUsageAggregationTests.cs

@@ -96,7 +96,7 @@ public class McpOrganizationUsageAggregationTests
             Row(Member, "20260903", 7),         // read window past today (range only)
         };
 
-        var quota = McpUsageMetricsFunction.BuildOrganizationQuota(
+        var quota = McpQuotaNodes.BuildOrganizationQuota(
             rows, new McpQuotaService.TenantPlanLimits("pro", 1500, 15000), "20260902", "20260901");
 
         Assert.Equal("pro", quota.TenantPlan);
@@ -114,7 +114,7 @@ public class McpOrganizationUsageAggregationTests
     public void OrganizationQuota_PurchasedSlots_CarryTheBreakdown()
     {
         // 3 000 + 3 × 900 = 5 700 — the limits arrive grown; the slot fields let the page show the sum.
-        var quota = McpUsageMetricsFunction.BuildOrganizationQuota(
+        var quota = McpQuotaNodes.BuildOrganizationQuota(
             new[] { Row(Member, "20260902", 3) },
             new McpQuotaService.TenantPlanLimits("pro", 5700, 114000, PurchasedDelegatedSlots: 3, SlotTenantDailyLimit: 900, SlotTenantMonthlyLimit: 18000),
             "20260902", "20260901");
@@ -145,7 +145,7 @@ public class McpOrganizationUsageAggregationTests
     [Fact]
     public void OrganizationQuota_LiftedWindows_StillReportTheCounters()
     {
-        var quota = McpUsageMetricsFunction.BuildOrganizationQuota(
+        var quota = McpQuotaNodes.BuildOrganizationQuota(
             new[] { Row(Member, "20260902", 3) }, new McpQuotaService.TenantPlanLimits("pro", 0, 0), "20260902", "20260901");
 
         Assert.Equal(0, quota.DailyLimit);

src/Backend/AutopilotMonitor.Functions.Tests/McpQuotaEnforcementMiddlewareTests.cs

@@ -96,6 +96,47 @@ public class McpQuotaEnforcementMiddlewareTests
         Assert.EndsWith("Resets at 2026-09-03T00:00:00Z.", body.Error);
     }
 
+    // ── ExceededAlertKey — one McpQuotaExceeded per account or organization, window and period ──
+
+    private const string OidA = "00000000-0000-0000-0000-00000000000a";
+    private const string OidB = "00000000-0000-0000-0000-00000000000b";
+
+    private static McpQuotaDecision UserDailyBlock(DateTime now)
+        => McpQuotaService.BuildDecision(new McpPlanLimits("community", 50, 250, "community", 100, 250),
+            dailyUsed: 50, monthlyUsed: 60, tenantDailyUsed: 60, tenantMonthlyUsed: 60, now);
+
+    [Fact]
+    public void AlertKey_AccountWindow_IsPerAccountAndDay()
+    {
+        var key = McpQuotaEnforcementMiddleware.ExceededAlertKey(OidA, Home, UserDailyBlock(Now));
+
+        Assert.Equal($"user:daily:{OidA}:20260903", key); // the period is the reset date
+        Assert.NotEqual(key, McpQuotaEnforcementMiddleware.ExceededAlertKey(OidB, Home, UserDailyBlock(Now)));
+        Assert.NotEqual(key, McpQuotaEnforcementMiddleware.ExceededAlertKey(OidA, Home, UserDailyBlock(Now.AddDays(1))));
+    }
+
+    [Fact]
+    public void AlertKey_OrganizationWindow_IsSharedByAllMembers()
+    {
+        // The organization's window is one budget: the refusal of any member raises one event for it.
+        var tenantBlock = Blocked("community");
+
+        var a = McpQuotaEnforcementMiddleware.ExceededAlertKey(OidA, Home.ToUpperInvariant(), tenantBlock);
+        var b = McpQuotaEnforcementMiddleware.ExceededAlertKey(OidB, Home, tenantBlock);
+
+        Assert.Equal(a, b);
+        Assert.Equal($"tenant:daily:{Home}:20260903", a);
+    }
+
+    [Fact]
+    public void AlertKey_MonthlyWindow_IsItsOwnKey()
+    {
+        var monthly = McpQuotaService.BuildDecision(new McpPlanLimits("community", 50, 250, "community", 100, 250),
+            dailyUsed: 10, monthlyUsed: 250, tenantDailyUsed: 10, tenantMonthlyUsed: 10, Now);
+
+        Assert.Equal($"user:monthly:{OidA}:20261001", McpQuotaEnforcementMiddleware.ExceededAlertKey(OidA, Home, monthly));
+    }
+
     [Fact]
     public void UserLevelBlock_ReportsTheUserWindow()
     {

src/Backend/AutopilotMonitor.Functions.Tests/McpQuotaServiceTests.cs

@@ -130,7 +130,8 @@ public class McpQuotaServiceTests
         Func<string?, TenantEdition>? editionResolver = null,
         Func<string?, string?>? tenantPlanOverrideResolver = null,
         Func<string?, int>? purchasedSlotsResolver = null,
-        Func<string?, EditionResolution>? resolutionResolver = null)
+        Func<string?, EditionResolution>? resolutionResolver = null,
+        TestTimeProvider? time = null)
     {
         var adminRepo = new Mock<IAdminRepository>();
         adminRepo.Setup(r => r.GetMcpUserAsync(It.IsAny<string>()))
@@ -162,9 +163,8 @@ public class McpQuotaServiceTests
             mcpUserService,
             adminConfigService,
             entitlements,
-            cache,
             NullLogger<McpQuotaService>.Instance,
-            new TestTimeProvider(Now));
+            time ?? new TestTimeProvider(Now));
     }
 
     private static Mock<IUserUsageRepository> UsageRepo(params (string Date, long Count)[] rows)
@@ -197,7 +197,7 @@ public class McpQuotaServiceTests
         // 100 requests today (catalog Community fallback: 100/day) → blocked.
         var svc = Build(UsageRepo(("20260707", 100)));
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("community", d.Plan);
@@ -210,7 +210,7 @@ public class McpQuotaServiceTests
     {
         var svc = Build(UsageRepo(("20260707", 100)), edition: TenantEdition.Pro);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal("pro", d.Plan);
@@ -224,7 +224,7 @@ public class McpQuotaServiceTests
         // 2990 across the month + 20 today = 3010 ≥ 3000 monthly Community limit.
         var svc = Build(UsageRepo(("20260701", 1500), ("20260703", 1490), ("20260707", 20)));
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("monthly", d.Scope);
@@ -238,7 +238,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"community","dailyRequestLimit":5,"monthlyRequestLimit":50,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 5)), planDefinitionsJson: json);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal(5, d.DailyLimit);
@@ -251,7 +251,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"power","dailyRequestLimit":10000,"monthlyRequestLimit":100000,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 500)), planDefinitionsJson: json, mcpUserPlanOverride: "power");
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal("power", d.Plan);
@@ -266,7 +266,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"power","dailyRequestLimit":10000,"monthlyRequestLimit":100000,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 500)), planDefinitionsJson: json, mcpUserPlanOverride: "power", bound: false);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("community", d.Plan);
@@ -279,7 +279,7 @@ public class McpQuotaServiceTests
         // Override names a plan that exists nowhere → Community fallback limits.
         var svc = Build(UsageRepo(("20260707", 100)), mcpUserPlanOverride: "no-such-plan");
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("no-such-plan", d.Plan);
@@ -300,7 +300,7 @@ public class McpQuotaServiceTests
         var svc = Build(UsageRepo(("20260707", 1200)), planDefinitionsJson: MspPlanJson,
             edition: TenantEdition.Pro, tenantPlanOverrideResolver: _ => "msp");
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal("msp", d.Plan);
@@ -318,7 +318,7 @@ public class McpQuotaServiceTests
         var svc = Build(UsageRepo(("20260707", 2000)), planDefinitionsJson: json,
             edition: TenantEdition.Pro, mcpUserPlanOverride: "power", tenantPlanOverrideResolver: _ => "msp");
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal("power", d.Plan);
@@ -335,7 +335,7 @@ public class McpQuotaServiceTests
         // falls back fail-closed (user: Community catalog; tenant: the EDITION's catalog windows).
         var svc = Build(UsageRepo(("20260707", 100)), edition: TenantEdition.Pro, tenantPlanOverrideResolver: _ => "msp");
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("msp", d.Plan);
@@ -351,7 +351,7 @@ public class McpQuotaServiceTests
         var svc = Build(UsageRepo(("20260707", 1)), planDefinitionsJson: MspPlanJson,
             edition: TenantEdition.Pro, tenantPlanOverrideResolver: _ => "msp", purchasedSlotsResolver: _ => 2);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal("msp", d.Plan);
         Assert.Equal(2100, d.DailyLimit);          // 1500 + 2 × 300
@@ -367,8 +367,8 @@ public class McpQuotaServiceTests
             .ThrowsAsync(new InvalidOperationException("storage down"));
         var svc = Build(repo);
 
-        var first = await svc.CheckAsync(Oid, Upn, TenantId);
-        var second = await svc.CheckAsync(Oid, Upn, TenantId);
+        var first = await svc.AdmitAsync(Oid, Upn, TenantId);
+        var second = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(first.Allowed);
         Assert.True(second.Allowed);
@@ -383,69 +383,144 @@ public class McpQuotaServiceTests
         var repo = UsageRepo(("20260707", 1));
         var svc = Build(repo);
 
-        await svc.CheckAsync(Oid, Upn, TenantId);
-        await svc.CheckAsync(Oid, Upn, TenantId);
+        await svc.AdmitAsync(Oid, Upn, TenantId);
+        await svc.AdmitAsync(Oid, Upn, TenantId);
 
         repo.Verify(r => r.GetUsageByUserAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()),
             Times.Once);
     }
 
-    // ── Soft-boundary contract (Codex finding 2026-07-07) ─────────────────────────
-    // The quota is DELIBERATELY soft: the per-user decision is cached for 60s, so an allowed
-    // decision keeps admitting requests inside that window even after the fire-and-forget
-    // increments push the stored counters past the limit. Overshoot is bounded (~TTL × request
-    // rate per instance) — the same posture as the sliding-window rate limiter. These tests PIN
-    // that contract; if strict limit+1 blocking is ever wanted, the decision cache must be
-    // reworked and these tests consciously rewritten.
+    // ── Boundary: exact per instance, soft across instances ──────────────────────
+    // The counters are read from storage at most every 60 s, and every request the instance admits is
+    // counted on them at once — so one instance blocks exactly at the limit, also when a tool call fans out
+    // into parallel requests. What stays soft is the part of OTHER instances: they learn of these requests
+    // only with their own next read.
 
     [Fact]
-    public async Task Check_SoftBoundary_CachedAllowedDecision_KeepsAdmitting_WithinTtl()
+    public async Task Check_SequentialRequests_BlockExactlyAtTheLimit_WithoutRereading()
     {
-        // First read: one request below the daily limit → allowed, decision cached.
-        var repo = UsageRepo(("20260707", 99));
+        // Community catalog: 100/day. 98 served before → the 99th and 100th pass, the 101st is refused.
+        var repo = UsageRepo(("20260707", 98));
         var svc = Build(repo);
 
-        var first = await svc.CheckAsync(Oid, Upn, TenantId);
-        Assert.True(first.Allowed);
+        var ninetyNinth = await svc.AdmitAsync(Oid, Upn, TenantId);
+        var hundredth = await svc.AdmitAsync(Oid, Upn, TenantId);
+        var hundredFirst = await svc.AdmitAsync(Oid, Upn, TenantId);
 
-        // The async increments land: stored counters are now OVER the limit — but the cached
-        // allowed decision keeps admitting within the TTL, without re-reading storage.
-        repo.Setup(r => r.GetUsageByUserAsync(Oid, It.IsAny<string?>(), It.IsAny<string?>()))
-            .ReturnsAsync(new List<UserUsageRecord>
-            {
-                new() { UserId = Oid, Date = "20260707", RequestCount = 150 }
-            });
-
-        var second = await svc.CheckAsync(Oid, Upn, TenantId);
-
-        Assert.True(second.Allowed, "soft boundary: cached allowed decision persists within the TTL");
-        repo.Verify(r => r.GetUsageByUserAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()),
-            Times.Once);
+        Assert.True(ninetyNinth.Allowed);
+        Assert.Equal(98, ninetyNinth.DailyUsed); // the decision reports the count BEFORE this request
+        Assert.True(hundredth.Allowed);
+        Assert.False(hundredFirst.Allowed);
+        Assert.Equal("daily", hundredFirst.Scope);
+        Assert.Equal(100, hundredFirst.DailyUsed);
+        repo.Verify(r => r.GetUsageByUserAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Once);
     }
 
     [Fact]
-    public async Task Check_SoftBoundary_AfterCacheEviction_OverLimitCounters_Block()
+    public async Task ReadState_NeverCounts_OnlyAdmitDoes()
     {
-        // Same scenario as above, but once the cached decision is gone (TTL expiry — simulated
-        // via eviction), the next check reads the over-limit counters and blocks.
-        var cache = new MemoryCache(new MemoryCacheOptions());
+        // The usage page shows the quota; viewing it is not an MCP request. Three reads leave the count at 99,
+        // so the next real request still passes and only the one after it is refused.
+        var svc = Build(UsageRepo(("20260707", 99)));
+
+        for (var i = 0; i < 3; i++)
+        {
+            var view = await svc.ReadStateAsync(Oid, Upn, TenantId);
+            Assert.True(view.Allowed);
+            Assert.Equal(99, view.DailyUsed);
+        }
+
+        Assert.True((await svc.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.False((await svc.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.Equal(100, (await svc.ReadStateAsync(Oid, Upn, TenantId)).DailyUsed);
+    }
+
+    [Fact]
+    public async Task Check_ParallelBurst_AdmitsExactlyUpToTheLimit()
+    {
+        // A tool call's parallel requests must not all pass on the same reading: 95 used, 20 at once → 5 pass.
+        var repo = UsageRepo(("20260707", 95));
+        var svc = Build(repo);
+
+        var decisions = await Task.WhenAll(Enumerable.Range(0, 20).Select(_ => Task.Run(() => svc.AdmitAsync(Oid, Upn, TenantId))));
+
+        Assert.Equal(5, decisions.Count(d => d.Allowed));
+        // Single-flight: concurrent first checks share one counter, so storage was read once.
+        repo.Verify(r => r.GetUsageByUserAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task Check_TenantWindow_CountsEveryMemberOnThisInstance()
+    {
+        // Community organization window 300/day, 298 used by the organization. Member A and member B each get one
+        // request through; the next one of A is refused at the organization level although A's own window is wide.
+        var repo = UsageRepo(new[] { ("20260707", 1L) }, tenantRows: new[] { ("20260707", 298L) });
+        repo.Setup(r => r.GetUsageByUserAsync(OtherOid, It.IsAny<string?>(), It.IsAny<string?>()))
+            .ReturnsAsync(new List<UserUsageRecord> { new() { UserId = OtherOid, Date = "20260707", RequestCount = 1 } });
+        var svc = Build(repo);
+
+        Assert.True((await svc.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.True((await svc.AdmitAsync(OtherOid, "bob@contoso.com", TenantId)).Allowed);
+        var third = await svc.AdmitAsync(Oid, Upn, TenantId);
+
+        Assert.False(third.Allowed);
+        Assert.Equal("tenant", third.Level);
+        Assert.Equal(300, third.TenantDailyUsed);
+        repo.Verify(r => r.GetTenantUsageAsync(TenantId, It.IsAny<string?>(), It.IsAny<string?>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task Check_SecondInstance_LearnsOfTheFirstOnlyWithItsOwnRead()
+    {
+        // The part that stays soft, pinned: two instances share storage, not memory. Storage still says 99 (the
+        // increments of instance A are on their way), so instance B admits one more on its own fresh reading.
         var repo = UsageRepo(("20260707", 99));
-        var svc = Build(repo, cache: cache);
+        var instanceA = Build(repo);
+        var instanceB = Build(repo);
 
-        Assert.True((await svc.CheckAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.True((await instanceA.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.False((await instanceA.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.True((await instanceB.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.False((await instanceB.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+    }
 
+    [Fact]
+    public async Task Check_CounterExpiry_RereadsStorage()
+    {
+        // After 60 s the counter is read again, so increments of other instances count from then on.
+        var time = new TestTimeProvider(Now);
+        var repo = UsageRepo(("20260707", 10));
+        var svc = Build(repo, time: time);
+
+        Assert.True((await svc.AdmitAsync(Oid, Upn, TenantId)).Allowed);
         repo.Setup(r => r.GetUsageByUserAsync(Oid, It.IsAny<string?>(), It.IsAny<string?>()))
-            .ReturnsAsync(new List<UserUsageRecord>
-            {
-                new() { UserId = Oid, Date = "20260707", RequestCount = 150 }
-            });
-        cache.Remove(McpQuotaService.UserCacheKey(Oid)); // stands in for the 60s TTL elapsing
+            .ReturnsAsync(new List<UserUsageRecord> { new() { UserId = Oid, Date = "20260707", RequestCount = 150 } });
+        time.SetUtcNow(Now.AddSeconds(61));
 
-        var decision = await svc.CheckAsync(Oid, Upn, TenantId);
+        var decision = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(decision.Allowed);
-        Assert.Equal("daily", decision.Scope);
         Assert.Equal(150, decision.DailyUsed);
+        repo.Verify(r => r.GetUsageByUserAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Exactly(2));
+    }
+
+    [Fact]
+    public async Task Check_Midnight_StartsAFreshCounter_InsideTheSixtySeconds()
+    {
+        // A counter read at 23:59:50 never answers a check at 00:00:05: the day is part of the key.
+        var lateEvening = new DateTime(2026, 7, 7, 23, 59, 50, DateTimeKind.Utc);
+        var time = new TestTimeProvider(lateEvening);
+        var repo = UsageRepo(("20260707", 100));
+        var svc = Build(repo, time: time);
+
+        Assert.False((await svc.AdmitAsync(Oid, Upn, TenantId)).Allowed);
+
+        time.SetUtcNow(lateEvening.AddSeconds(15));
+        var afterMidnight = await svc.AdmitAsync(Oid, Upn, TenantId);
+
+        Assert.True(afterMidnight.Allowed);
+        Assert.Equal(0, afterMidnight.DailyUsed);
+        Assert.Equal(new DateTime(2026, 7, 9, 0, 0, 0, DateTimeKind.Utc), afterMidnight.ResetUtc);
     }
 
     // ── Tenant (organization-wide) quota ─────────────────────────────────────────
@@ -456,7 +531,7 @@ public class McpQuotaServiceTests
         // Community catalog tenant window = 300/day; other members burned it, this caller made 5 requests.
         var svc = Build(UsageRepo(new[] { ("20260707", 5L) }, tenantRows: new[] { ("20260707", 300L) }));
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("tenant", d.Level);
@@ -474,7 +549,7 @@ public class McpQuotaServiceTests
             new[] { ("20260707", 1L) },
             tenantRows: new[] { ("20260701", 4000L), ("20260703", 4990L), ("20260707", 10L) }));
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("tenant", d.Level);
@@ -492,7 +567,7 @@ public class McpQuotaServiceTests
         var svc = Build(UsageRepo(new[] { ("20260707", 1L) }, tenantRows: new[] { ("20260707", 10L) }),
             planDefinitionsJson: json, mcpUserPlanOverride: "power");
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.False(d.Allowed);
         Assert.Equal("power", d.Plan);
@@ -509,7 +584,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"pro","dailyRequestLimit":5,"monthlyRequestLimit":50,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 1)), planDefinitionsJson: json, edition: TenantEdition.Pro);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal(5, d.DailyLimit);
@@ -524,7 +599,7 @@ public class McpQuotaServiceTests
         var repo = UsageRepo(new[] { ("20260707", 1L) }, tenantRows: new[] { ("20260707", 999999L) });
         var svc = Build(repo, planDefinitionsJson: json);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal(0, d.TenantDailyLimit);
@@ -537,7 +612,7 @@ public class McpQuotaServiceTests
         var repo = UsageRepo(("20260707", 1));
         var svc = Build(repo);
 
-        var d = await svc.CheckAsync(Oid, Upn, tenantId: null);
+        var d = await svc.AdmitAsync(Oid, Upn, tenantId: null);
 
         Assert.True(d.Allowed);
         repo.Verify(r => r.GetTenantUsageAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Never);
@@ -551,8 +626,8 @@ public class McpQuotaServiceTests
             .ThrowsAsync(new InvalidOperationException("storage down"));
         var svc = Build(repo);
 
-        var first = await svc.CheckAsync(Oid, Upn, TenantId);
-        var second = await svc.CheckAsync(Oid, Upn, TenantId);
+        var first = await svc.AdmitAsync(Oid, Upn, TenantId);
+        var second = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(first.Allowed);
         Assert.True(second.Allowed);
@@ -573,7 +648,7 @@ public class McpQuotaServiceTests
         // Pro home with 3 purchased slots: 1000 + 3 × 300 per account, 3000 + 3 × 900 for the organization.
         var svc = Build(UsageRepo(("20260707", 1)), edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 3);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal(1900, d.DailyLimit);
         Assert.Equal(38000, d.MonthlyLimit);
@@ -592,7 +667,7 @@ public class McpQuotaServiceTests
         // A Pro tenant on its two included slots (purchased = 0) keeps the plain Pro windows.
         var svc = Build(UsageRepo(("20260707", 1)), edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 0);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal(1000, d.DailyLimit);
         Assert.Equal(3000, d.TenantDailyLimit);
@@ -607,7 +682,7 @@ public class McpQuotaServiceTests
         var conferred = new EditionResolution(TenantEdition.Pro, EditionSource.Msp, OwnPro: false);
         var svc = Build(UsageRepo(("20260707", 1)), resolutionResolver: _ => conferred, purchasedSlotsResolver: _ => 3);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal("pro", d.Plan);
         Assert.Equal(1000, d.DailyLimit);
@@ -625,7 +700,7 @@ public class McpQuotaServiceTests
         var svc = Build(UsageRepo(("20260707", 1)), planDefinitionsJson: json, edition: TenantEdition.Pro,
             mcpUserPlanOverride: "power", purchasedSlotsResolver: _ => 2);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal("power", d.Plan);
         Assert.Equal(10600, d.DailyLimit);
@@ -639,7 +714,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"pro","dailyRequestLimit":1000,"monthlyRequestLimit":20000,"slotDailyRequestLimit":0,"slotMonthlyRequestLimit":0,"slotTenantDailyRequestLimit":0,"slotTenantMonthlyRequestLimit":0,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 1)), planDefinitionsJson: json, edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 5);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal(1000, d.DailyLimit);
         Assert.Equal(3000, d.TenantDailyLimit);
@@ -653,7 +728,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"pro","dailyRequestLimit":1000,"monthlyRequestLimit":20000,"slotDailyRequestLimit":50,"slotMonthlyRequestLimit":500,"slotTenantDailyRequestLimit":100,"slotTenantMonthlyRequestLimit":1000,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 1)), planDefinitionsJson: json, edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 2);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal(1100, d.DailyLimit);
         Assert.Equal(21000, d.MonthlyLimit);
@@ -668,7 +743,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"pro","dailyRequestLimit":1000,"monthlyRequestLimit":20000,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 1)), planDefinitionsJson: json, edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 1);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.Equal(1300, d.DailyLimit);
         Assert.Equal(3900, d.TenantDailyLimit);
@@ -682,7 +757,7 @@ public class McpQuotaServiceTests
         var json = """[{"name":"pro","dailyRequestLimit":0,"monthlyRequestLimit":20000,"tenantDailyRequestLimit":0,"tenantMonthlyRequestLimit":60000,"description":""}]""";
         var svc = Build(UsageRepo(("20260707", 30000)), planDefinitionsJson: json, edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 4);
 
-        var d = await svc.CheckAsync(Oid, Upn, TenantId);
+        var d = await svc.AdmitAsync(Oid, Upn, TenantId);
 
         Assert.True(d.Allowed);
         Assert.Equal(0, d.DailyLimit);
@@ -705,10 +780,10 @@ public class McpQuotaServiceTests
     {
         // Pro 1000 + 1 × 300 = 1300: the 1300th request of the day is the first blocked one.
         var below = Build(UsageRepo(("20260707", 1299)), edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 1);
-        Assert.True((await below.CheckAsync(Oid, Upn, TenantId)).Allowed);
+        Assert.True((await below.AdmitAsync(Oid, Upn, TenantId)).Allowed);
 
         var at = Build(UsageRepo(("20260707", 1300)), edition: TenantEdition.Pro, purchasedSlotsResolver: _ => 1);
-        var d = await at.CheckAsync(Oid, Upn, TenantId);
+        var d = await at.AdmitAsync(Oid, Upn, TenantId);
         Assert.False(d.Allowed);
         Assert.Equal("daily", d.Scope);
         Assert.Equal("user", d.Level);
@@ -726,8 +801,8 @@ public class McpQuotaServiceTests
             .ReturnsAsync(new List<UserUsageRecord>());
         var svc = Build(repo);
 
-        await svc.CheckAsync(Oid, Upn, TenantId);
-        await svc.CheckAsync(OtherOid, "bob@contoso.com", TenantId);
+        await svc.AdmitAsync(Oid, Upn, TenantId);
+        await svc.AdmitAsync(OtherOid, "bob@contoso.com", TenantId);
 
         repo.Verify(r => r.GetTenantUsageAsync(TenantId, It.IsAny<string?>(), It.IsAny<string?>()), Times.Once);
         repo.Verify(r => r.GetUsageByUserAsync(It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<string?>()), Times.Exactly(2));

src/Backend/AutopilotMonitor.Functions.Tests/McpUsageOverviewAssemblyTests.cs

@@ -0,0 +1,323 @@
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.DataAccess;
+using AutopilotMonitor.Shared.Models;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+using static AutopilotMonitor.Functions.Services.McpUsageOverviewService;
+using static AutopilotMonitor.Functions.Services.McpUsageTelemetryQueries;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The pure fold behind GET global/metrics/mcp-usage/overview: which numbers come from the quota counters and
+/// which from the telemetry, how platform admins drop out (but never out of a tenant's real organization
+/// windows), what a call costs, MCP-only tools, the daily trend and the per-minute ranking.
+/// </summary>
+public class McpUsageOverviewAssemblyTests
+{
+    private const string TenantA = "aaaaaaaa-0000-0000-0000-00000000000a";
+    private const string TenantB = "bbbbbbbb-0000-0000-0000-00000000000b";
+    private const string Alice = "alice@contoso.com";
+    private const string App = "app:11111111-2222-3333-4444-555555555555";
+    private const string Operator = "ops@fabrikam.com";
+    private const string Bob = "bob@fabrikam.com";
+    private const string Carol = "carol@contoso.com";
+
+    // Window 3 days (Nov 3–5); the month started Nov 1, so Nov 1 rows count for the quota, not for the window.
+    private static readonly Dates ThreeDays = new("20261103", "20261105", "20261101");
+    private static readonly DateTime At = new(2026, 11, 5, 10, 0, 0, DateTimeKind.Utc);
+
+    private static TenantUsageRecord Counter(string tenant, string oid, string upn, string day, long requests)
+        => new() { TenantId = tenant, UserId = oid, UserPrincipalName = upn, Date = day, RequestCount = requests, LastRequestAt = At };
+
+    private static readonly TenantUsageRecord[] Counters =
+    {
+        Counter(TenantA, "oid-alice", Alice, "20261101", 10),
+        Counter(TenantA, "oid-alice", Alice, "20261104", 20),
+        Counter(TenantA, "oid-alice", Alice, "20261105", 30),
+        Counter(TenantA, "oid-app", App, "20261105", 5),
+        Counter(TenantA, "oid-ops", Operator, "20261105", 100),
+        Counter(TenantB, "oid-bob", Bob, "20261103", 7),
+    };
+
+    private static CallRow Call(string day, string tool, string tenant, string principal, long calls, long served, long requests, string role)
+        => new(day, tool, tenant, principal, calls, served, requests, At, role);
+
+    private static readonly CallRow[] Calls =
+    {
+        Call("20261104", "get_session_summary", TenantA, Alice, 2, 2, 10, "Admin"),
+        Call("20261105", "search_events", TenantA, Alice, 1, 1, 14, "Admin"),
+        Call("20261105", "get_session_events", TenantA, Alice, 3, 3, 3, "Admin"),
+        Call("20261105", "list_tenants", TenantA, Alice, 1, 1, 1, "Admin"),
+        Call("20261105", "get_session_summary", TenantA, App, 1, 1, 5, "Viewer"),
+        Call("20261105", "query_table", TenantA, Operator, 50, 50, 50, "GlobalAdmin"),
+        Call("20261103", "search_sessions", TenantB, Bob, 2, 2, 7, "Admin"),
+        Call("20261105", "get_time_attribution", TenantA, Carol, 4, 0, 0, "Admin"),
+    };
+
+    private static McpQuotaDecision State(string plan, int daily, int monthly, long dailyUsed, long monthlyUsed)
+        => new() { Allowed = true, Plan = plan, DailyLimit = daily, MonthlyLimit = monthly, DailyUsed = dailyUsed, MonthlyUsed = monthlyUsed };
+
+    private static TelemetryResult Telemetry(bool available = true) => !available
+        ? new TelemetryResult(false, false, false, new(), new(), new(), new(), new(), new(), new ServerFacts(null, null))
+        : new TelemetryResult(
+            RequestsAvailable: true, McpLogAvailable: true, Partial: false,
+            Calls: Calls.ToList(),
+            Routes: new()
+            {
+                new("get_session_summary", "GET sessions/{id}/events", 3),
+                new("get_session_summary", "GET sessions/{id}", 3),
+            },
+            Refusals: new()
+            {
+                new(RefusalQuota, "20261105", TenantA, Alice, "user", "daily", "community", 3, At, At.AddSeconds(9), 50, 50),
+                new(RefusalMinute, "20261103", TenantB, Bob, "", "", "", 2, At, At, 120, 120),
+            },
+            Peaks: new()
+            {
+                new(PeakCalls, TenantA, Alice, 12, At),
+                new(PeakRequests, TenantA, Alice, 40, At),
+                new(PeakRequests, TenantB, Bob, 120, At),
+                new(PeakCalls, TenantB, Bob, 5, At),
+            },
+            ToolQuality: new()
+            {
+                new("get_session_summary", 3, 0, 0, 0, 600, 19000.4),
+                new("search_docs", 4, 1, 0, 0, 80, 5000),
+            },
+            McpRefusals: new() { new(Alice, 7, At) },
+            ServerFacts: new ServerFacts(new DateTime(2026, 11, 4, 1, 0, 0, DateTimeKind.Utc), 60));
+
+    private static GetGlobalMcpUsageOverviewResponse Overview(bool includePlatformAdmins = false, bool telemetry = true)
+    {
+        var result = Telemetry(telemetry);
+        var facts = new Dictionary<(string Tenant, string Principal), AccountFacts>
+        {
+            [(TenantA, Alice)] = new("oid-alice", null, State("community", 50, 250, 30, 60)),
+            [(TenantA, App)] = new("oid-app", null, State("community", 50, 250, 5, 5)),
+            [(TenantA, Operator)] = new("oid-ops", "GlobalAdmin", State("community", 50, 250, 100, 100)),
+            [(TenantB, Bob)] = new("oid-bob", null, State("pro", 500, 6000, 0, 7)),
+        };
+        var limits = new Dictionary<string, McpQuotaService.TenantPlanLimits>
+        {
+            [TenantA] = new("community", 100, 250),
+            [TenantB] = new("pro", 1500, 15000),
+        };
+        // TenantB has no readable configuration: no name.
+        var names = new Dictionary<string, string> { [TenantA] = "contoso.com" };
+        var minute = new Dictionary<(string Tenant, string Principal), int> { [(TenantA, Alice)] = 120, [(TenantB, Bob)] = 150 };
+
+        return Assemble(new OverviewInputs(ThreeDays, includePlatformAdmins, Counters, facts, limits, names, LatestRoles(result.Calls), minute, result));
+    }
+
+    [Fact]
+    public void PlatformAdmins_DropOutOfEveryNumber_ButNotOutOfTheOrganizationWindows()
+    {
+        var overview = Overview();
+        var tenantA = overview.Tenants.Single(t => t.TenantId == TenantA);
+
+        Assert.DoesNotContain(tenantA.Accounts, a => a.Principal == Operator);
+        Assert.DoesNotContain(overview.Tools, t => t.Tool == "query_table");
+        Assert.Equal(55, tenantA.Requests); // alice 20 + 30, app 5 — the operator's 100 left out
+        // The organization windows stay the tenant's real counters: today 30 + 5 + 100, the month 10 + 20 + 30 + 5 + 100.
+        Assert.Equal(135, tenantA.Quota.DailyUsed);
+        Assert.Equal(165, tenantA.Quota.MonthlyUsed);
+        Assert.Equal("community", tenantA.Quota.TenantPlan);
+    }
+
+    [Fact]
+    public void PlatformAdmins_WhenIncluded_AreMarked()
+    {
+        var tenantA = Overview(includePlatformAdmins: true).Tenants.Single(t => t.TenantId == TenantA);
+        var op = tenantA.Accounts.Single(a => a.Principal == Operator);
+
+        Assert.True(op.IsPlatformAdmin);
+        Assert.Equal("GlobalAdmin", op.Role);
+        Assert.Equal(155, tenantA.Requests);
+    }
+
+    [Fact]
+    public void Accounts_RequestsComeFromTheCounters_CallsFromTheTelemetry()
+    {
+        var tenants = Overview().Tenants;
+        Assert.Equal(new[] { TenantA, TenantB }, tenants.Select(t => t.TenantId)); // most calls first
+        var accounts = tenants[0].Accounts;
+        Assert.Equal(new[] { Alice, Carol, App }, accounts.Select(a => a.Principal));
+
+        var alice = accounts[0];
+        Assert.Equal("oid-alice", alice.UserId);
+        Assert.Equal(7, alice.Calls);
+        Assert.Equal(50, alice.Requests); // Nov 1 lies before the window
+        Assert.Equal("20261105", alice.PeakDay);
+        Assert.Equal(30, alice.PeakDayRequests);
+        Assert.Equal(1, alice.QuotaHits);
+        Assert.Equal("Admin", alice.Role);
+        Assert.Equal(new[] { ("get_session_events", 3L), ("get_session_summary", 2L), ("list_tenants", 1L) },
+            alice.TopTools.Select(t => (t.Tool, t.Calls)));
+        Assert.Equal(("community", 50, 250, 30L, 60L),
+            (alice.Quota!.Plan, alice.Quota.DailyLimit, alice.Quota.MonthlyLimit, alice.Quota.DailyUsed, alice.Quota.MonthlyUsed));
+    }
+
+    [Fact]
+    public void AnAccountKnownOnlyFromTheTelemetry_HasNoObjectIdAndNoQuota()
+    {
+        // Every request refused: no counter row, but the calls happened.
+        var carol = Overview().Tenants.Single(t => t.TenantId == TenantA).Accounts.Single(a => a.Principal == Carol);
+
+        Assert.Null(carol.UserId);
+        Assert.Null(carol.Quota);
+        Assert.Equal(4, carol.Calls);
+        Assert.Equal(0, carol.Requests);
+        Assert.Null(carol.PeakDay);
+    }
+
+    [Fact]
+    public void Tools_RankByCalls_CostPerServedCall_AndMcpOnlyToolsFromTheLog()
+    {
+        var tools = Overview().Tools;
+
+        Assert.Equal(
+            new[] { "get_time_attribution", "search_docs", "get_session_events", "get_session_summary", "search_sessions", "list_tenants", "search_events" },
+            tools.Select(t => t.Tool));
+
+        var summary = tools.Single(t => t.Tool == "get_session_summary");
+        Assert.Equal(3, summary.Calls);
+        Assert.Equal(2, summary.Accounts);
+        Assert.Equal(1, summary.Tenants);
+        Assert.Equal(5.0, summary.RequestsPerCall); // (10 + 5) requests over 3 served calls
+        Assert.Equal(0.0, summary.ErrorRate);
+        Assert.Equal(600, summary.P95DurationMs);
+        Assert.Equal(19000, summary.AvgResultChars);
+        Assert.Equal(new[] { "GET sessions/{id}", "GET sessions/{id}/events" }, summary.Routes.Select(r => r.Route));
+
+        var docs = tools.Single(t => t.Tool == "search_docs");
+        Assert.Equal(4, docs.Calls);
+        Assert.Null(docs.Accounts);
+        Assert.Null(docs.Tenants);
+        Assert.Equal(0, docs.RequestsPerCall);
+        Assert.Equal(0.25, docs.ErrorRate);
+
+        // Every call refused: no served call, no cost to report.
+        Assert.Equal(0, tools.Single(t => t.Tool == "get_time_attribution").RequestsPerCall);
+    }
+
+    [Fact]
+    public void Daily_HasEveryDayOfTheWindow_WithCallsByPlan()
+    {
+        var daily = Overview().Daily;
+
+        Assert.Equal(new[] { "20261103", "20261104", "20261105" }, daily.Select(d => d.Date));
+        var today = daily[2];
+        Assert.Equal(10, today.Calls);    // alice 5, app 1, carol 4 — the operator's 50 left out
+        Assert.Equal(35, today.Requests); // alice 30, app 5
+        Assert.Equal(3, today.Accounts);
+        Assert.Equal(new[] { ("community", 10L) }, today.CallsByPlan.Select(p => (p.Plan, p.Calls)));
+        Assert.Equal(new[] { ("pro", 2L) }, daily[0].CallsByPlan.Select(p => (p.Plan, p.Calls)));
+    }
+
+    [Fact]
+    public void QuotaHits_AndMinuteLimits_RankTheAccountsClosestToALimit()
+    {
+        var overview = Overview();
+
+        var hit = Assert.Single(overview.QuotaHits);
+        Assert.Equal((Alice, "user", "daily", 50L, 50L, 3L), (hit.Principal, hit.Level, hit.Scope, hit.Limit, hit.Used, hit.Refused));
+
+        Assert.Equal(60, overview.MinuteLimits.McpServerLimit);
+        var minute = overview.MinuteLimits.Accounts;
+        Assert.Equal(new[] { Bob, Alice }, minute.Select(m => m.Principal)); // 120/150 before 40/120 and 12/60
+        Assert.Equal((120L, 150, 2L), (minute[0].PeakRequests, minute[0].BackendLimit, minute[0].BackendRefused));
+        Assert.Equal((TenantA, 12L, 7L, 0L), (minute[1].TenantId, minute[1].PeakCalls, minute[1].McpRefused, minute[1].BackendRefused));
+        // The share the list ranks by, in whole percent: the higher of calls/MCP limit and requests/backend limit.
+        Assert.Equal(new[] { 80, 33 }, minute.Select(m => m.SharePercent)); // 120/150; max(12/60, 40/120)
+    }
+
+    [Fact]
+    public void Totals_SumTheLists_OnceForEveryConsumer()
+    {
+        var totals = Overview().Totals;
+
+        Assert.Equal(18, totals.Calls);       // every tool of the ranking, search_docs' 4 MCP-only calls included
+        Assert.Equal(4, totals.McpOnlyCalls);
+        Assert.Equal(7, totals.Tools);
+        Assert.Equal(62, totals.Requests);    // tenant A 55, tenant B 7 — the operator's 100 left out
+        Assert.Equal(2, totals.Tenants);
+        Assert.Equal(4, totals.Accounts);     // alice, carol, the app, bob
+        Assert.Equal(1, totals.ServicePrincipals);
+        Assert.Equal(1, totals.QuotaHitAccounts);      // alice's daily window
+        Assert.Equal(2, totals.MinuteRefusedAccounts); // alice at the MCP server, bob at the backend
+        Assert.Equal(2, totals.LimitAccounts);
+    }
+
+    [Fact]
+    public void Totals_WithoutTheirStore_AreAbsent_NotAPartialSum()
+    {
+        var totals = Overview(telemetry: false).Totals;
+
+        Assert.Null(totals.Calls);
+        Assert.Null(totals.McpOnlyCalls);
+        Assert.Equal(0, totals.Tools);
+        Assert.Equal(62, totals.Requests); // the counters still answer
+        Assert.Equal(3, totals.Accounts);
+    }
+
+    [Fact]
+    public void Tenants_CarryTheirDomain_WhenTheConfigurationNamesOne()
+    {
+        var tenants = Overview().Tenants;
+
+        Assert.Equal("contoso.com", tenants.Single(t => t.TenantId == TenantA).DomainName);
+        Assert.Null(tenants.Single(t => t.TenantId == TenantB).DomainName);
+    }
+
+    [Fact]
+    public async Task AnUnreadableTenantConfiguration_LeavesOnlyTheNameOut()
+    {
+        var config = new Mock<TenantConfigurationService>(
+            Mock.Of<IConfigRepository>(), NullLogger<TenantConfigurationService>.Instance, new MemoryCache(new MemoryCacheOptions()))
+        { CallBase = false };
+        config.Setup(c => c.GetConfigurationIfExistsAsync(TenantA)).ThrowsAsync(new InvalidOperationException("storage down"));
+        config.Setup(c => c.GetConfigurationIfExistsAsync(TenantB)).ReturnsAsync(new TenantConfiguration { TenantId = TenantB, DomainName = "fabrikam.com" });
+        // Only the configuration read is exercised; the other collaborators stay unused.
+        var service = new McpUsageOverviewService(
+            null!, null!, null!, null!, config.Object, null!, null!, null!, NullLogger<McpUsageOverviewService>.Instance, TimeProvider.System);
+
+        Assert.Null(await service.ReadTenantConfigurationAsync(TenantA));
+        Assert.Equal("fabrikam.com", (await service.ReadTenantConfigurationAsync(TenantB))?.DomainName);
+    }
+
+    [Theory]
+    [InlineData(null, null, 30, false, null)]
+    [InlineData("7", "include", 7, true, null)]
+    [InlineData("90", "exclude", 90, false, null)]
+    [InlineData("91", null, 0, false, "days must be between 1 and 90")]
+    [InlineData("0", null, 0, false, "days must be between 1 and 90")]
+    [InlineData("-5", null, 0, false, "days must be between 1 and 90")]
+    [InlineData("7.5", null, 0, false, "days must be an integer")]
+    [InlineData("30", "all", 0, false, "platformAdmins must be include or exclude")]
+    public void OverviewQuery_DefaultsAndBounds(string? days, string? platformAdmins, int expectedDays, bool expectedInclude, string? expectedError)
+    {
+        var parsed = AutopilotMonitor.Functions.Functions.Metrics.McpUsageMetricsFunction.ParseOverviewQuery(days, platformAdmins);
+
+        Assert.Equal((expectedDays, expectedInclude, expectedError), parsed);
+    }
+
+    [Fact]
+    public void Status_NamesTheMcpLogCoverage_AndATelemetryOutageEmptiesOnlyItsParts()
+    {
+        Assert.Equal("20261104", Overview().Telemetry.McpLogFrom);
+
+        var dark = Overview(telemetry: false);
+        Assert.False(dark.Telemetry.RequestsAvailable);
+        Assert.False(dark.Telemetry.McpLogAvailable);
+        Assert.Empty(dark.Tools);
+        Assert.Empty(dark.QuotaHits);
+        // The counters still carry tenants, accounts, requests and the quota.
+        var tenantA = dark.Tenants.Single(t => t.TenantId == TenantA);
+        Assert.Equal(new[] { Alice, App }, tenantA.Accounts.Select(a => a.Principal).OrderBy(p => p, StringComparer.Ordinal));
+        Assert.Equal(0, tenantA.Calls);
+        Assert.Equal(55, tenantA.Requests);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/McpUsageTelemetryQueriesTests.cs

@@ -0,0 +1,203 @@
+using System.Text.Json;
+using System.Text.RegularExpressions;
+using AutopilotMonitor.Functions.Middleware;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+using static AutopilotMonitor.Functions.Services.McpUsageTelemetryQueries;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// The fixed KQL of the MCP usage overview: which rows it reads (the worker's request row, MCP only, no access
+/// probe), that it counts calls exactly, leaves platform admins out unless asked, matches log lines by their
+/// start, reads only fields the MCP server writes (tests/fixtures/mcp-log-lines, proven on the MCP side by
+/// usage-log-fields.test.ts) — and that the parsers read the result tables by column name.
+/// </summary>
+public class McpUsageTelemetryQueriesTests
+{
+    private static readonly Window Customers = new(new DateTime(2026, 10, 7, 0, 0, 0, DateTimeKind.Utc), new DateTime(2026, 11, 6, 0, 0, 0, DateTimeKind.Utc), IncludePlatformAdmins: false);
+    private static readonly Window Everyone = Customers with { IncludePlatformAdmins = true };
+
+    private static IEnumerable<string> RequestQueries(Window w) => new[] { Calls(w), Routes(w), Refusals(w), Peaks(w) };
+    private static IEnumerable<string> McpLogQueries(Window w) => new[] { ToolQuality(w), McpRefusals(w), McpServerFacts(w) };
+
+    [Fact]
+    public void Window_CoversWholeUtcDays()
+    {
+        Assert.Equal("datetime(2026-10-07T00:00:00Z)", Customers.From);
+        Assert.Equal("datetime(2026-11-06T00:00:00Z)", Customers.To);
+        Assert.Equal("P31D", Customers.Timespan); // the where clauses bound the window; the timespan only has to cover it
+        foreach (var query in RequestQueries(Customers).Concat(McpLogQueries(Customers)))
+        {
+            Assert.Contains(">= datetime(2026-10-07T00:00:00Z)", query);
+            Assert.Contains("< datetime(2026-11-06T00:00:00Z)", query);
+        }
+    }
+
+    [Fact]
+    public void RequestQueries_ReadTheWorkerRow_McpOnly_WithoutTheAccessProbe()
+    {
+        foreach (var query in RequestQueries(Customers))
+        {
+            Assert.Contains("customDimensions.Source) == 'WorkerMiddleware'", query);
+            Assert.Contains("customDimensions.ClientSource) =~ 'mcp'", query);
+            Assert.Contains("customDimensions.FunctionName) != 'GlobalAccessProbe'", query);
+            Assert.Contains("customDimensions.McpToolName", query);
+            Assert.Contains("customDimensions.CorrelationId", query);
+            Assert.Contains("tolower(tostring(customDimensions.TenantId))", query);
+            Assert.Contains("tolower(tostring(customDimensions.UserId))", query);
+        }
+    }
+
+    [Fact]
+    public void Calls_AreCountedOncePerCorrelationId_NeverEstimated()
+    {
+        var query = Calls(Customers);
+
+        Assert.Contains("by corr, tool, tenant, principal", query);
+        Assert.Contains("calls = count()", query);
+        foreach (var q in RequestQueries(Customers).Concat(McpLogQueries(Customers)))
+            Assert.DoesNotContain("dcount(", q);
+    }
+
+    [Fact]
+    public void PlatformAdmins_AreLeftOut_UnlessIncluded()
+    {
+        foreach (var query in RequestQueries(Customers))
+            Assert.Contains("role !in ('GlobalAdmin', 'GlobalReader')", query);
+        Assert.Contains("tostring(d.scope) != 'ga'", ToolQuality(Customers));
+
+        foreach (var query in RequestQueries(Everyone).Concat(McpLogQueries(Everyone)))
+        {
+            Assert.DoesNotContain("'GlobalAdmin'", query);
+            Assert.DoesNotContain("!= 'ga'", query);
+        }
+    }
+
+    [Fact]
+    public void Refusals_AreClassifiedByTheLinesTheMiddlewaresWrite()
+    {
+        var query = Refusals(Customers);
+
+        Assert.Contains($"startswith '{McpQuotaEnforcementMiddleware.BlockedLogPrefix}'", query);
+        Assert.Contains($"startswith '{UserRateLimitMiddleware.ThrottledLogPrefix}'", query);
+        Assert.Equal("[McpQuota] BLOCKED", McpQuotaEnforcementMiddleware.BlockedLogPrefix);
+        Assert.Equal("[UserRateLimit] THROTTLED", UserRateLimitMiddleware.ThrottledLogPrefix);
+        Assert.Contains("join kind=inner lines on operation_Id", query);
+    }
+
+    [Fact]
+    public void Peaks_SlideASixtySecondWindowInTenSecondSteps()
+    {
+        var query = Peaks(Customers);
+
+        Assert.Contains("bin(timestamp, 10s)", query);
+        Assert.Contains("bin(at, 10s)", query);
+        Assert.Equal(2, Regex.Matches(query, Regex.Escape("mv-expand k = range(0, 5, 1)")).Count);
+    }
+
+    [Fact]
+    public void McpLogLines_AreMatchedByTheirStart_NeverByHas()
+    {
+        Assert.Contains($"Log_s startswith '{ToolCallLinePrefix}'", ToolQuality(Customers));
+        Assert.Contains($"Log_s startswith '{McpRefusalLinePrefix}'", McpRefusals(Customers));
+        Assert.Contains($"Log_s startswith '{BootLinePrefix}'", McpServerFacts(Customers));
+        foreach (var query in McpLogQueries(Customers))
+            Assert.DoesNotContain("Log_s has", query);
+    }
+
+    [Fact]
+    public void McpLogQueries_ReadOnlyWhatTheServerWrites()
+    {
+        using var contract = JsonDocument.Parse(File.ReadAllText(Path.Combine(FindRepoRoot(), "tests", "fixtures", "mcp-log-lines", "fields.json")));
+        var prefixes = contract.RootElement.GetProperty("prefixes");
+        var fields = contract.RootElement.GetProperty("fields");
+
+        Assert.Equal(ToolCallLinePrefix, prefixes.GetProperty("tool_call").GetString());
+        Assert.Equal(BootLinePrefix, prefixes.GetProperty("boot").GetString());
+        Assert.Equal(McpRefusalLinePrefix, prefixes.GetProperty("mcp_refusal").GetString());
+
+        var toolCallFields = fields.GetProperty("tool_call").EnumerateArray().Select(f => f.GetString()!).ToHashSet();
+        var readFromToolCall = Regex.Matches(ToolQuality(Everyone), @"\bd\.(\w+)").Select(m => m.Groups[1].Value).ToHashSet();
+        Assert.NotEmpty(readFromToolCall);
+        Assert.Subset(toolCallFields, readFromToolCall);
+
+        var bootFields = fields.GetProperty("boot").EnumerateArray().Select(f => f.GetString()!).ToHashSet();
+        var readFromBoot = Regex.Matches(McpServerFacts(Everyone), @"parse_json\(Log_s\)\.(\w+)").Select(m => m.Groups[1].Value).ToHashSet();
+        Assert.Equal(new[] { "rateLimitPerMinute" }, readFromBoot);
+        Assert.Subset(bootFields, readFromBoot);
+    }
+
+    // ── Parsers ──
+
+    private static KqlTable Table(string[] columns, params object?[][] rows)
+        => new()
+        {
+            Name = "PrimaryResult",
+            Columns = columns.Select(c => new KqlColumn { Name = c, Type = "dynamic" }).ToList(),
+            Rows = rows.Select(r => (IReadOnlyList<JsonElement>)r.Select(cell => JsonSerializer.SerializeToElement(cell)).ToList()).ToList(),
+        };
+
+    [Fact]
+    public void ParseCalls_ReadsByColumnName_WhateverTheOrder()
+    {
+        var table = Table(
+            new[] { "role", "charged", "day", "principal", "tool", "calls", "tenant", "servedCalls", "firstAt" },
+            new object?[] { "Admin", 59L, "20261028", "user@contoso.com", "get_time_attribution", 64L, "t1", 59L, "2026-10-28T16:12:30.4442709Z" });
+
+        var row = Assert.Single(ParseCalls(table));
+
+        Assert.Equal(new CallRow("20261028", "get_time_attribution", "t1", "user@contoso.com", 64, 59, 59,
+            new DateTime(2026, 10, 28, 16, 12, 30, 444, DateTimeKind.Utc).AddTicks(2709), "Admin"), row);
+        Assert.Equal(DateTimeKind.Utc, row.LastAt!.Value.Kind);
+    }
+
+    [Fact]
+    public void ParseRefusals_KeepsMissingCountsMissing()
+    {
+        var table = Table(
+            new[] { "gate", "day", "tenant", "principal", "level", "scope", "plan", "refused", "firstAt", "lastAt", "usedCount", "limitValue" },
+            new object?[] { "minute", "20261026", "t1", "user@contoso.com", "", "", "", 2L, "2026-10-26T07:55:42Z", "2026-10-26T07:55:43Z", null, null });
+
+        var row = Assert.Single(ParseRefusals(table));
+
+        Assert.Equal("minute", row.Gate);
+        Assert.Equal(2, row.Refused);
+        Assert.Null(row.Used);
+        Assert.Null(row.Limit);
+    }
+
+    [Fact]
+    public void ParseToolQuality_RoundsAFractionalCount_AndKeepsTheMean()
+    {
+        var table = Table(
+            new[] { "tool", "calls", "errors", "cancelled", "overCap", "p95Ms", "avgChars" },
+            new object?[] { "search_events", 26L, 1L, 0L, 0L, 1029.6, 10602.5 });
+
+        var row = Assert.Single(ParseToolQuality(table));
+
+        Assert.Equal(26, row.Calls);
+        Assert.Equal(1030, row.P95Ms);
+        Assert.Equal(10602.5, row.AvgChars);
+    }
+
+    [Fact]
+    public void ParseServerFacts_WithoutABootLine_HasNoLimit()
+    {
+        var facts = ParseServerFacts(Table(new[] { "oldest", "rateLimitPerMinute" }, new object?[] { "2026-10-07T01:52:43.167992Z", null }));
+
+        Assert.Equal(new DateTime(2026, 10, 7, 1, 52, 43, DateTimeKind.Utc).AddTicks(1_679_920), facts.Oldest);
+        Assert.Null(facts.RateLimitPerMinute);
+        Assert.Equal(new ServerFacts(null, null), ParseServerFacts(Table(new[] { "oldest", "rateLimitPerMinute" })));
+    }
+
+    private static string FindRepoRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null && !File.Exists(Path.Combine(dir.FullName, "AutopilotMonitor.sln")))
+            dir = dir.Parent;
+        Assert.NotNull(dir);
+        return dir!.FullName;
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/MetricsFilterInjectionTests.cs

@@ -108,16 +108,10 @@ public class MetricsFilterInjectionTests
     }
 
     [Fact]
-    public void BuildTenantUsageFilter_TenantInjection_StaysInsideLiteral()
+    public void BuildUserUsageFilter_BothDates_NormalizeTheShapeAndBoundTheRange()
     {
-        var filter = TableUserUsageRepository.BuildTenantUsageFilter("' or TenantId ne '", null, null);
+        var filter = TableUserUsageRepository.BuildUserUsageFilter("user1", "2026-11-01", "2026-11-05");
 
-        Assert.Equal("TenantId eq ''' or TenantId ne '''", filter);
-    }
-
-    [Fact]
-    public void BuildTenantUsageFilter_NoScope_ReturnsNull()
-    {
-        Assert.Null(TableUserUsageRepository.BuildTenantUsageFilter(null, null, null));
+        Assert.Equal("PartitionKey eq 'user1' and Date ge '20261101' and Date le '20261105'", filter);
     }
 }

src/Backend/AutopilotMonitor.Functions.Tests/MetricsWireParityTests.cs

@@ -548,64 +548,6 @@ public class MetricsWireParityTests
             new GetMcpUserUsageResponse { UserId = userId, Records = records });
     }
 
-    // ---- GetGlobalMcpUsage ---------------------------------------------------------------
-
-    [Fact]
-    public void GetGlobalMcpUsageResponse_matches_the_tenant_usage_shape()
-    {
-        string? tenantId = "6a6a35a2-30b2-4f2f-9a1b-6d9f1a2b3c4d";
-        var records = SampleUsageRecords("9cc42e33-0004-4b7c-a1d2-52f3aaaa0010");
-
-        AssertParity(
-            new { tenantId, records },
-            new GetGlobalMcpUsageResponse { TenantId = tenantId, Records = records });
-    }
-
-    [Fact]
-    public void GetGlobalMcpUsageResponse_omits_a_null_tenantId()
-    {
-        string? tenantId = null;
-        var records = new List<UserUsageRecord>();
-
-        AssertParity(
-            new { tenantId, records },
-            new GetGlobalMcpUsageResponse { TenantId = null, Records = records });
-    }
-
-    // ---- GetGlobalMcpUsageDaily ----------------------------------------------------------
-
-    [Fact]
-    public void GetGlobalMcpUsageDailyResponse_matches_the_daily_summary_shape()
-    {
-        string? tenantId = "6a6a35a2-30b2-4f2f-9a1b-6d9f1a2b3c4d";
-        var summaries = new List<UserUsageDailySummary>
-        {
-            new UserUsageDailySummary
-            {
-                Date = "20260830",
-                TenantId = tenantId,
-                TotalRequests = 321,
-                UniqueUsers = 4,
-                UniqueEndpoints = 11,
-            },
-        };
-
-        AssertParity(
-            new { tenantId, summaries },
-            new GetGlobalMcpUsageDailyResponse { TenantId = tenantId, Summaries = summaries });
-    }
-
-    [Fact]
-    public void GetGlobalMcpUsageDailyResponse_omits_a_null_tenantId()
-    {
-        string? tenantId = null;
-        var summaries = new List<UserUsageDailySummary>();
-
-        AssertParity(
-            new { tenantId, summaries },
-            new GetGlobalMcpUsageDailyResponse { TenantId = null, Summaries = summaries });
-    }
-
     // ---- MetricsSummary / MetricsSummaryGlobal -------------------------------------------
 
     [Fact]
@@ -832,6 +774,250 @@ public class MetricsWireParityTests
             });
     }
 
+    // ---- GetGlobalMcpUsageOverview ------------------------------------------------------
+
+    [Fact]
+    public void GetGlobalMcpUsageOverviewResponse_matches_the_overview_shape()
+    {
+        // One tenant with one account, one tool with one route, one quota refusal, one per-minute row — every
+        // optional slot filled, so every key is pinned in its wire position.
+        var at = new DateTime(2026, 11, 5, 10, 0, 0, DateTimeKind.Utc);
+        var tenantId = "7aa20c11-0002-4b7c-a1d2-52f3aaaa0001";
+        var quota = new McpOrganizationQuotaNode { TenantPlan = "community", DailyLimit = 100, MonthlyLimit = 250, DailyUsed = 35, MonthlyUsed = 60 };
+
+        AssertParity(
+            new
+            {
+                dateFrom = "20261103",
+                dateTo = "20261105",
+                includesPlatformAdmins = false,
+                telemetry = new { requestsAvailable = true, mcpLogAvailable = true, mcpLogFrom = "20261104", partial = true },
+                totals = new
+                {
+                    calls = 10L, mcpOnlyCalls = 4L, tools = 2, requests = 50L, tenants = 1, accounts = 1, servicePrincipals = 0,
+                    quotaHitAccounts = 1, minuteRefusedAccounts = 1, limitAccounts = 1,
+                },
+                daily = new[] { new { date = "20261105", calls = 10L, requests = 35L, accounts = 3, callsByPlan = new[] { new { plan = "community", calls = 10L } } } },
+                tenants = new[]
+                {
+                    new
+                    {
+                        tenantId,
+                        domainName = "contoso.com",
+                        quota,
+                        calls = 7L,
+                        requests = 50L,
+                        quotaHits = 1,
+                        lastRequestAt = at,
+                        accounts = new[]
+                        {
+                            new
+                            {
+                                userId = "oid-1",
+                                principal = "admin@contoso.com",
+                                role = "Admin",
+                                isPlatformAdmin = false,
+                                quota = new { plan = "community", dailyLimit = 50, monthlyLimit = 250, dailyUsed = 30L, monthlyUsed = 60L },
+                                calls = 7L,
+                                requests = 50L,
+                                peakDay = "20261105",
+                                peakDayRequests = 30L,
+                                quotaHits = 1,
+                                topTools = new[] { new { tool = "get_session_events", calls = 3L } },
+                                lastRequestAt = at,
+                            },
+                        },
+                    },
+                },
+                tools = new[]
+                {
+                    new
+                    {
+                        tool = "get_session_summary",
+                        calls = 3L,
+                        accounts = 2,
+                        tenants = 1,
+                        requestsPerCall = 5.0,
+                        errorRate = 0.0,
+                        p95DurationMs = 600L,
+                        avgResultChars = 19000L,
+                        overCapCalls = 0L,
+                        routes = new[] { new { route = "GET sessions/{id}", requests = 3L } },
+                    },
+                },
+                quotaHits = new[]
+                {
+                    new
+                    {
+                        date = "20261105", tenantId, principal = "admin@contoso.com", level = "user", scope = "daily", plan = "community",
+                        limit = 50L, used = 50L, refused = 3L, firstAt = at, lastAt = at,
+                    },
+                },
+                minuteLimits = new
+                {
+                    mcpServerLimit = 60,
+                    accounts = new[]
+                    {
+                        new
+                        {
+                            tenantId, principal = "admin@contoso.com", sharePercent = 33,
+                            peakCalls = 12L, peakCallsAt = at, mcpRefused = 7L, mcpLastRefusedAt = at,
+                            peakRequests = 40L, peakRequestsAt = at, backendLimit = 120, backendRefused = 2L, backendLastRefusedAt = at,
+                        },
+                    },
+                },
+            },
+            new GetGlobalMcpUsageOverviewResponse
+            {
+                DateFrom = "20261103",
+                DateTo = "20261105",
+                IncludesPlatformAdmins = false,
+                Telemetry = new McpUsageTelemetryStatus { RequestsAvailable = true, McpLogAvailable = true, McpLogFrom = "20261104", Partial = true },
+                Totals = new McpUsageTotalsNode
+                {
+                    Calls = 10, McpOnlyCalls = 4, Tools = 2, Requests = 50, Tenants = 1, Accounts = 1, ServicePrincipals = 0,
+                    QuotaHitAccounts = 1, MinuteRefusedAccounts = 1, LimitAccounts = 1,
+                },
+                Daily = new List<McpUsageDayItem>
+                {
+                    new() { Date = "20261105", Calls = 10, Requests = 35, Accounts = 3, CallsByPlan = new List<McpUsagePlanCallsItem> { new() { Plan = "community", Calls = 10 } } },
+                },
+                Tenants = new List<McpUsageTenantItem>
+                {
+                    new()
+                    {
+                        TenantId = tenantId,
+                        DomainName = "contoso.com",
+                        Quota = quota,
+                        Calls = 7,
+                        Requests = 50,
+                        QuotaHits = 1,
+                        LastRequestAt = at,
+                        Accounts = new List<McpUsageAccountItem>
+                        {
+                            new()
+                            {
+                                UserId = "oid-1",
+                                Principal = "admin@contoso.com",
+                                Role = "Admin",
+                                IsPlatformAdmin = false,
+                                Quota = new McpUsageAccountQuotaNode { Plan = "community", DailyLimit = 50, MonthlyLimit = 250, DailyUsed = 30, MonthlyUsed = 60 },
+                                Calls = 7,
+                                Requests = 50,
+                                PeakDay = "20261105",
+                                PeakDayRequests = 30,
+                                QuotaHits = 1,
+                                TopTools = new List<McpUsageToolCallsItem> { new() { Tool = "get_session_events", Calls = 3 } },
+                                LastRequestAt = at,
+                            },
+                        },
+                    },
+                },
+                Tools = new List<McpUsageToolItem>
+                {
+                    new()
+                    {
+                        Tool = "get_session_summary",
+                        Calls = 3,
+                        Accounts = 2,
+                        Tenants = 1,
+                        RequestsPerCall = 5.0,
+                        ErrorRate = 0.0,
+                        P95DurationMs = 600,
+                        AvgResultChars = 19000,
+                        OverCapCalls = 0,
+                        Routes = new List<McpUsageRouteItem> { new() { Route = "GET sessions/{id}", Requests = 3 } },
+                    },
+                },
+                QuotaHits = new List<McpUsageQuotaHitItem>
+                {
+                    new()
+                    {
+                        Date = "20261105", TenantId = tenantId, Principal = "admin@contoso.com", Level = "user", Scope = "daily", Plan = "community",
+                        Limit = 50, Used = 50, Refused = 3, FirstAt = at, LastAt = at,
+                    },
+                },
+                MinuteLimits = new McpUsageMinuteLimits
+                {
+                    McpServerLimit = 60,
+                    Accounts = new List<McpUsageMinuteItem>
+                    {
+                        new()
+                        {
+                            TenantId = tenantId, Principal = "admin@contoso.com", SharePercent = 33,
+                            PeakCalls = 12, PeakCallsAt = at, McpRefused = 7, McpLastRefusedAt = at,
+                            PeakRequests = 40, PeakRequestsAt = at, BackendLimit = 120, BackendRefused = 2, BackendLastRefusedAt = at,
+                        },
+                    },
+                },
+            });
+    }
+
+    [Fact]
+    public void GetGlobalMcpUsageOverviewResponse_omits_what_a_store_did_not_answer()
+    {
+        // Telemetry down, an account known only from the telemetry shape (no object id, no quota), an MCP-only
+        // tool (no reach, no quality), no MCP limit reported yet: every nullable key vanishes.
+        var tenantId = "7aa20c11-0002-4b7c-a1d2-52f3aaaa0001";
+        var quota = new McpOrganizationQuotaNode { TenantPlan = "community", DailyLimit = 100, MonthlyLimit = 250, DailyUsed = 0, MonthlyUsed = 0 };
+
+        AssertParity(
+            new
+            {
+                dateFrom = "20261105",
+                dateTo = "20261105",
+                includesPlatformAdmins = true,
+                telemetry = new { requestsAvailable = false, mcpLogAvailable = false },
+                totals = new { tools = 1, requests = 0L, tenants = 1, accounts = 1, servicePrincipals = 1, quotaHitAccounts = 0, minuteRefusedAccounts = 0, limitAccounts = 0 },
+                daily = Array.Empty<object>(),
+                tenants = new[]
+                {
+                    new
+                    {
+                        tenantId,
+                        quota,
+                        calls = 4L,
+                        requests = 0L,
+                        quotaHits = 0,
+                        accounts = new[]
+                        {
+                            new { principal = "app:11111111-2222-3333-4444-555555555555", isPlatformAdmin = false, calls = 4L, requests = 0L, quotaHits = 0, topTools = Array.Empty<object>() },
+                        },
+                    },
+                },
+                tools = new[] { new { tool = "search_docs", calls = 4L, requestsPerCall = 0.0, routes = Array.Empty<object>() } },
+                quotaHits = Array.Empty<object>(),
+                minuteLimits = new { accounts = Array.Empty<object>() },
+            },
+            new GetGlobalMcpUsageOverviewResponse
+            {
+                DateFrom = "20261105",
+                DateTo = "20261105",
+                IncludesPlatformAdmins = true,
+                Telemetry = new McpUsageTelemetryStatus { RequestsAvailable = false, McpLogAvailable = false },
+                Totals = new McpUsageTotalsNode { Tools = 1, Requests = 0, Tenants = 1, Accounts = 1, ServicePrincipals = 1 },
+                Daily = new List<McpUsageDayItem>(),
+                Tenants = new List<McpUsageTenantItem>
+                {
+                    new()
+                    {
+                        TenantId = tenantId,
+                        Quota = quota,
+                        Calls = 4,
+                        Requests = 0,
+                        QuotaHits = 0,
+                        Accounts = new List<McpUsageAccountItem>
+                        {
+                            new() { Principal = "app:11111111-2222-3333-4444-555555555555", Calls = 4, TopTools = new List<McpUsageToolCallsItem>() },
+                        },
+                    },
+                },
+                Tools = new List<McpUsageToolItem> { new() { Tool = "search_docs", Calls = 4, RequestsPerCall = 0, Routes = new List<McpUsageRouteItem>() } },
+                QuotaHits = new List<McpUsageQuotaHitItem>(),
+                MinuteLimits = new McpUsageMinuteLimits { Accounts = new List<McpUsageMinuteItem>() },
+            });
+    }
+
     // ---- GetGrowthMetrics ---------------------------------------------------------------
 
     private static GrowthMetricsResponse GrowthResponse(double? median, IReadOnlyList<GrowthTenantRow>? tenants) => new()
@@ -962,6 +1148,177 @@ public class MetricsWireParityTests
         AssertParity(GrowthLiteral(null, null), GrowthResponse(null, null));
     }
 
+    // ---------- GET global/metrics/tenant-activity ----------
+
+    private const string ActivityTenantId = "8bb31d22-0004-4c8d-b2e3-63f4bbbb0001";
+    private static readonly DateTime ActivityOnboardedAt = new(2026, 6, 30, 9, 0, 0, DateTimeKind.Utc);
+    private static readonly DateTime ActivityCounterAt = new(2026, 11, 6, 7, 30, 0, DateTimeKind.Utc);
+    private static readonly DateTime ActivityVisitAt = new(2026, 11, 6, 8, 15, 0, DateTimeKind.Utc);
+
+    private static GetTenantActivityResponse TenantActivityResponse(bool full) => new()
+    {
+        WindowDays = 30,
+        WindowStart = "2026-10-07",
+        UsageDaysThrough = "2026-11-05",
+        PreviousWindowStart = "2026-09-07",
+        RowsFrom = "2026-05-10",
+        PortalActivityAvailable = full,
+        Totals = new TenantActivityTotals
+        {
+            SignedUpTenants = 2,
+            ActiveTenants = 1,
+            ActiveTenantsPrevious = 1,
+            ActiveTenantsTrendPercent = full ? 0 : null,
+            Enrollments = 6,
+            EnrollmentsPrevious = 4,
+            EnrollmentsTrendPercent = full ? 50 : null,
+            Succeeded = 5,
+            Failed = 1,
+            SuccessPercent = full ? 83 : null,
+            Top10SharePercent = full ? 100 : null,
+            Stages = new TenantActivityStageCounts { NeverEnrolled = 1, Active = 1 },
+            PortalUsers = full ? 3 : null,
+            PortalTenants = full ? 1 : null,
+        },
+        Daily = new List<TenantActivityDailyItem>
+        {
+            new() { Day = "2026-11-05", Enrollments = 6, Succeeded = 5, Failed = 1, ActiveTenants = 1 },
+        },
+        Tenants = new List<TenantActivityTenantItem>
+        {
+            new()
+            {
+                TenantId = ActivityTenantId,
+                DomainName = "contoso.example",
+                CompanyName = full ? "Contoso" : null,
+                Edition = TenantEditionNames.ProTrial,
+                Stage = TenantActivityStages.Active,
+                OnboardedAt = full ? ActivityOnboardedAt : null,
+                Enrollments = 6,
+                EnrollmentsPrevious = 4,
+                TrendPercent = full ? 50 : null,
+                Succeeded = 5,
+                Failed = 1,
+                SuccessPercent = full ? 83 : null,
+                ActiveDays = 1,
+                DailyEnrollments = full ? new[] { 6 } : null,
+                FirstEnrollmentDay = full ? "2026-07-01" : null,
+                LastActiveDay = full ? "2026-11-05" : null,
+                LastCounterUpdateAt = full ? ActivityCounterAt : null,
+                LifetimeEnrollments = 120,
+                LifetimeSucceeded = 100,
+                LifetimeEvents = 50_000,
+                PortalUsers = full ? 3 : null,
+                LastPortalVisitAt = full ? ActivityVisitAt : null,
+            },
+        },
+    };
+
+    [Fact]
+    public void GetTenantActivityResponse_matches_the_shape_with_every_optional_key()
+    {
+        AssertParity(new
+        {
+            windowDays = 30,
+            windowStart = "2026-10-07",
+            usageDaysThrough = "2026-11-05",
+            previousWindowStart = "2026-09-07",
+            rowsFrom = "2026-05-10",
+            portalActivityAvailable = true,
+            totals = new
+            {
+                signedUpTenants = 2,
+                activeTenants = 1,
+                activeTenantsPrevious = 1,
+                activeTenantsTrendPercent = 0,
+                enrollments = 6,
+                enrollmentsPrevious = 4,
+                enrollmentsTrendPercent = 50,
+                succeeded = 5,
+                failed = 1,
+                successPercent = 83,
+                top10SharePercent = 100,
+                stages = new { neverEnrolled = 1, dormant = 0, @new = 0, declining = 0, active = 1, quiet = 0 },
+                portalUsers = 3,
+                portalTenants = 1,
+            },
+            daily = new[] { new { day = "2026-11-05", enrollments = 6, succeeded = 5, failed = 1, activeTenants = 1 } },
+            tenants = new[]
+            {
+                new
+                {
+                    tenantId = ActivityTenantId,
+                    domainName = "contoso.example",
+                    companyName = "Contoso",
+                    edition = "pro-trial",
+                    stage = "active",
+                    onboardedAt = ActivityOnboardedAt,
+                    enrollments = 6,
+                    enrollmentsPrevious = 4,
+                    trendPercent = 50,
+                    succeeded = 5,
+                    failed = 1,
+                    successPercent = 83,
+                    activeDays = 1,
+                    dailyEnrollments = new[] { 6 },
+                    firstEnrollmentDay = "2026-07-01",
+                    lastActiveDay = "2026-11-05",
+                    lastCounterUpdateAt = ActivityCounterAt,
+                    lifetimeEnrollments = 120L,
+                    lifetimeSucceeded = 100L,
+                    lifetimeEvents = 50_000L,
+                    portalUsers = 3,
+                    lastPortalVisitAt = ActivityVisitAt,
+                },
+            },
+        }, TenantActivityResponse(full: true));
+    }
+
+    [Fact]
+    public void GetTenantActivityResponse_omits_every_absent_figure()
+    {
+        // No sign-in history, no previous window, no finished session, no names beyond the domain.
+        AssertParity(new
+        {
+            windowDays = 30,
+            windowStart = "2026-10-07",
+            usageDaysThrough = "2026-11-05",
+            previousWindowStart = "2026-09-07",
+            rowsFrom = "2026-05-10",
+            portalActivityAvailable = false,
+            totals = new
+            {
+                signedUpTenants = 2,
+                activeTenants = 1,
+                activeTenantsPrevious = 1,
+                enrollments = 6,
+                enrollmentsPrevious = 4,
+                succeeded = 5,
+                failed = 1,
+                stages = new { neverEnrolled = 1, dormant = 0, @new = 0, declining = 0, active = 1, quiet = 0 },
+            },
+            daily = new[] { new { day = "2026-11-05", enrollments = 6, succeeded = 5, failed = 1, activeTenants = 1 } },
+            tenants = new[]
+            {
+                new
+                {
+                    tenantId = ActivityTenantId,
+                    domainName = "contoso.example",
+                    edition = "pro-trial",
+                    stage = "active",
+                    enrollments = 6,
+                    enrollmentsPrevious = 4,
+                    succeeded = 5,
+                    failed = 1,
+                    activeDays = 1,
+                    lifetimeEnrollments = 120L,
+                    lifetimeSucceeded = 100L,
+                    lifetimeEvents = 50_000L,
+                },
+            },
+        }, TenantActivityResponse(full: false));
+    }
+
     private static void AssertParity(object anonymousLiteral, IApiResponse typed)
         => ApiResponseWireParityTests.AssertWireIdentical(anonymousLiteral, typed);
 }