New section 9a - five design rules, each from a bug fixed on 2026-08-06 and each
cheap to honour in a new design but expensive to retrofit:
Absent and empty are different. Four scripts tested config as
"not null AND Count > 0", so an explicitly empty list fell through to a
hardcoded default - a kiosk configured with "desktopApps": [] was given the
full machine-tool set. Configuring "none" produced "everything".
Deny by default. preinstall.json had 16 of 21 entries at PCTypes ['*'] and the
SMB manifest 18 of 25 unfiltered. Both filters worked perfectly; they just were
not applied.
Gate at the point of action. Call-site gates on PC type were bypassed by the
finalization phase, silently.
The image carries configuration. WJ Shopfloor.lnk is inside the WIM, so no
pipeline change removes it.
The ppkg is a hard boundary. Chrome, RealVNC, Tanium, CyberArk and the rest come
from the package - thinning the image does not thin them.
Also corrects a premise in section 4.2: a first-boot selection UI cannot assume
the API is reachable, because ShopDB needs the AESFMA wifi SSID and the imaging
LAN has no route to it. Points at Install-ShopdbKiosk-WhenOnline.ps1 as the
reusable shape - arm a task at imaging, do nothing until the API answers, act
once, verify, self-remove.
Plus two risks, the diagnostics collector in the reference map, and a gotchas
section: HardwareDriver.json defeats ConvertFrom-Json on every PowerShell
version, Compress-Archive caps at 2 GB against an 8 GB package, and PowerShell
Core normalises backslashes on Linux so bay scripts can be tested here.
6d5fee786c