BIOS sub-stage: switch to flag-file signaling, move push after W: copies

check-bios.cmd: drop literal `^` from BIOS_STATUS (caret survives quoted
SET so substring search for `->` never matched). Write X:\bios-fired.flag
on flash_done + staged paths so startnet.cmd can detect via if-exist.

startnet.cmd: replace `call set` substring-replace with `if exist
X:\bios-fired.flag`. Move push to after W:\Enrollment xcopy completes
(before Y: cleanup) so dashboard reflects "BIOS firmware update" stage
once file staging is done, matching user mental model of imaging order.

Tested flag-file logic in win11 VM cmd.exe: missing -> SKIPS, present
-> FIRES, removed -> SKIPS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/BIOS/check-bios.cmd

@@ -110,7 +110,8 @@ exit /b 0
 
 :flash_done
 echo   BIOS update complete.
-set "BIOS_STATUS=%SYSMODEL% updated %BIOSVER% -^> %TARGETVER%"
+set "BIOS_STATUS=%SYSMODEL% updated %BIOSVER% to %TARGETVER%"
+echo flash_done %SYSMODEL% %BIOSVER% to %TARGETVER%> X:\bios-fired.flag
 exit /b 0
 
 :staged
@@ -121,7 +122,8 @@ echo     It will flash during POST after the
 echo     post-imaging reboot.
 echo   ========================================
 echo.
-set "BIOS_STATUS=%SYSMODEL% STAGED %BIOSVER% -^> %TARGETVER% (flashes on reboot)"
+set "BIOS_STATUS=%SYSMODEL% STAGED %BIOSVER% to %TARGETVER% (flashes on reboot)"
+echo staged %SYSMODEL% %BIOSVER% to %TARGETVER%> X:\bios-fired.flag
 exit /b 0
 
 :compare_versions

playbook/startnet.cmd

@@ -254,26 +254,6 @@ if exist "Y:\scripts\winpe-status-push.ps1" (
     powershell -NoProfile -ExecutionPolicy Bypass -File "Y:\scripts\winpe-status-push.ps1"
 )
 
-REM --- BIOS update sub-stage push ---
-REM If check-bios.cmd actually applied or staged a firmware update, push
-REM a second idx=1 status with a BIOS-specific stage string so the
-REM dashboard friendly-label swaps to "Updating BIOS firmware". The "->"
-REM marker is what check-bios writes for both "updated" and "STAGED"
-REM cases. No-op states ("up to date", "no update in catalog", "Skipped",
-REM "missing") never contain the arrow and stay on the default label.
-REM
-REM CAUTION: cannot use `echo %BIOS_STATUS% | findstr /C:"->"` - the `>`
-REM inside the value gets parsed as a redirect operator before the pipe,
-REM breaking the pipeline. Use substring-replace trick: if removing "->"
-REM from BIOS_STATUS yields a different string, the arrow was present.
-call set "BIOS_STATUS_STRIPPED=%%BIOS_STATUS:->=%%"
-if not "%BIOS_STATUS%"=="%BIOS_STATUS_STRIPPED%" (
-    if exist "Y:\scripts\winpe-status-push.ps1" (
-        powershell -NoProfile -ExecutionPolicy Bypass -File "Y:\scripts\winpe-status-push.ps1" -CurrentStage "WinPE: BIOS firmware update"
-    )
-)
-set "BIOS_STATUS_STRIPPED="
-
 echo Waiting for PESetup.exe to start...
 :wait_start
 ping -n 3 127.0.0.1 >NUL
@@ -399,6 +379,18 @@ if exist "Y:\installers-post\cmm\cmm-manifest.json" (
 :skip_cmm_stage
 :pctype_done
 
+REM --- BIOS update sub-stage push (fires AFTER W: copies complete) ---
+REM check-bios.cmd drops X:\bios-fired.flag iff it actually flashed or
+REM staged a firmware update. Reading the flag file is more reliable than
+REM scanning BIOS_STATUS for substrings (caret escaping inside quoted SET
+REM is subtle in WinPE cmd.exe). Push must happen before Y: cleanup since
+REM the push script lives on the share.
+if exist X:\bios-fired.flag (
+    if exist "Y:\scripts\winpe-status-push.ps1" (
+        powershell -NoProfile -ExecutionPolicy Bypass -File "Y:\scripts\winpe-status-push.ps1" -CurrentStage "WinPE: BIOS firmware update"
+    )
+)
+
 :cleanup_enroll
 net use Y: /delete 2>NUL