Independent review in the win11 VM found four things worth fixing before
the fleet sync:
- The task action ran powershell -WindowStyle Hidden, which on Win11
(Windows Terminal as console host) flashes a window and steals
foreground for ~0.5 s on every fire. Action is now
conhost.exe --headless powershell.exe ..., verified silent.
- If the share copy of Map-SfldShare.ps1 changes without the manifest
DetectionValue being bumped, the engine calls the registrar every
cycle. The registrar now takes an idempotent fast path (staged hash
matches, task present with our action -> re-stamp and exit, no task
churn) and logs one WARN per hash when -ExpectedHash disagrees with
the share file.
- Replacing a wrong or unreadable mapping now pre-flights the new
mapping on a spare letter and keeps the old S: when that fails
(except on 1219, where the old session is what blocks the new one).
- Credential Manager is re-seeded whenever the HKLM credential changes
(password rotation) and after every repair, instead of once per
profile. Set-State no longer wipes the stored hash on suspect writes.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011boHjE3EeexwszdiKDZ7iX
2ec097069c