mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
dcf89a83f7
Pre-existing package sub-keys observed at arming time (typically RJ packages installed during ESP before DeploymentPhase >= 100) were silently fired as realmjoin_package_started by the initial CheckMachinePackages sweep. The phase gate only prevented IME/RJ subtree-write misattribution; it did not distinguish historical RJ rows from rows that genuinely appear after arming. Attach now seeds both _*PackagesStarted and _*PackagesCompleted with every sub-key already present under HKLM\SOFTWARE\RealmJoin\Packages (and the HKU\<sid>\... mirror), without firing events. The seed runs inside the state-lock BEFORE RegistryWatcher.Start() so no subtree wake-up can race past it. Only sub-keys that appear AFTER arming surface as events. Added 3 unit tests covering the ESP-leftover suppression, the per-PackageId scope of the suppression (siblings still fire), and the HKU mirror. Outdated comment on the immediate-arm test corrected. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>