mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
08455cc5f9
Report 3a2207978e4c: a session was failed 30 min after the ESP exit while Windows installed its OOBE quality update. The update watcher had been blind since July and the engine had no notion of the phase. - Windows Update client: 19/20/43/44 come from the System log (provider-filtered XPath), as the provider manifest routes them; 25/26/31/41 from Operational via their own config list. Updates are classified os/defender/store/other: only Windows/.NET updates become rows, the rest is counted into windows_update_activity_summary. Per-channel watermarks persist a record only after its row and engine signal were handed to the ingress. - Servicing: CBS steps from the Setup log (windows_update_servicing), client UpdateAgentLCU. - Engine: OsUpdateActivity and OsUpdateFacts (event-time ordered) anchor an OOBE update phase after the ESP exit. Each state has its own bound: the update runs at most 3 h (then Failed oobe_update_not_finished), after it the user has 60 min to sign in (then the engine stops waiting without a verdict), after the sign-in one window of grace. - The phase acts only in OobeUpdatePhaseMode=Active. Shadow, the default, reports what it would decide as oobe_update_phase_shadow right before today's verdict. The agent stamps the mode on EnrollmentFactsObserved at every start; a later stamp can take Active away, never grant it. - Agent: a stop without a verdict ends the session like the max-lifetime watchdog (agent_shutting_down reason=stopped_waiting); the backend classifies it honestly (verdict origin stopwait), never Failed. - Measurement: oobe_update_page (the update page and its ExpeditedUpdate_* names; a 62407 value only as boolean, integer or HRESULT) and oobe_update_state (NDUP and ESP-policy registry values), both Debug and bounded per run. - ANALYZE-DEV-004 1.2.0 counts install and download failures only, never scan failures. - Event types in Constants, MCP catalog and web; shared manifests regenerated; privacy page names Windows updates installed during the enrollment. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>