mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
197de1d718
IME's trace listener opens every log once per process with FileMode.Append and FileShare.ReadWrite and writes at its own stream position afterwards. AgentExecutor.exe (two processes per user-context script, one per detection script) has such a listener on AgentExecutor.log and on IntuneManagementExtension.log, so a process that resumes logging after another one appended overwrites those bytes: the final file holds the last writer, a byte-position tailer has read the first version. Session 46749560 lost 6 of 16 platform-script results and 4 of 16 executor end blocks with every tracker health counter at zero — results fell back to the exit code (one Success where IME said Failed), one finished script stayed Incomplete. The agentexecutor_fallback results in the fleet are this race, not late IME logging. The tracker now keeps a fingerprint ledger of every entry it processed from the two multi-writer files (FNV-1a 64 over the decoded bytes, one CmTraceEntryAssembler shared by the read loop and the verification so entry boundaries are identical by construction), verifies it on every script end signal, on a byte-budgeted cadence while an invocation is in flight (256 KB/s, at least 1 s apart), in a 4 KB guard zone on every growth pass and on a fragment at the bookmark, and rewinds to the first changed entry; entries whose (offset, hash) still read unchanged are skipped, everything else is processed as backlog (never fresh, never a calibration anchor). The policyId-less executor lines are owned by the nearest preceding invocation marker in their file (PS-AGENT-ARG opens, PS-AGENT-SCRIPT-START upgrades to the platform script, PS-AGENT-INVOCATION and PS-AGENT-COMPLETED close) instead of a last-started pointer, so an end block a rewind uncovers reaches its own script. Restart seeds the ledger from the 64 KB behind the persisted bookmark; a rollover clears it. Four restart-safe counters (ime_overwrite_rewinds, ime_overwrite_bytes_reprocessed, ime_verify_passes, ime_verified_bytes) ride agent_metrics_snapshot and ime_pattern_hits — recovered data, not skipped work, no new event type. Tests: ImeLogTrackerOverwriteRewindTests (15) drive the positional-overwrite write pattern against both files, including the two field scenarios with the shipped patterns; agent suite 2921 green, backend known-actions list extended for the two new patterns. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>