From 8907a86c42cd2bbfe8e02d3248c1ef61043e997b Mon Sep 17 00:00:00 2001
From: cproudlock <cproudlock@localhost>
Date: Thu, 6 Aug 2026 17:16:57 -0400
Subject: [PATCH] Collector: decode StartupApproved 0x04 and 0x05

The post-fix capture from 579C144 reported three entries as unknown(0x04) -
SecurityHealth, RtkAudUService, WavesSvc. The decoder only knew 02/06 enabled and
03/07 disabled. 04 is also enabled and 05 also disabled; without them the report
says 'unknown' for entries that are perfectly ordinary.
---
 playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1 b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
index a11c3ee..0534fa3 100644
--- a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
+++ b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
@@ -188,7 +188,7 @@ Section 'autostart.txt' {
             foreach ($n in $props.Property) {
                 $v = (Get-ItemProperty $k -Name $n).$n
                 $state = if ($v -is [byte[]] -and $v.Length -ge 1) {
-                    switch ($v[0]) { 2 {'ENABLED'} 6 {'ENABLED'} 3 {'disabled'} 7 {'disabled'} default {"unknown(0x{0:X2})" -f $v[0]} }
+                    switch ($v[0]) { 2 {'ENABLED'} 4 {'ENABLED'} 6 {'ENABLED'} 3 {'disabled'} 5 {'disabled'} 7 {'disabled'} default {"unknown(0x{0:X2})" -f $v[0]} }
                 } else { 'unknown' }
                 "{0,-10} {1}" -f $state, $n
             }