Endpoint telemetry, PC Detail rework and a checked backup/restore path

plugins/endpoints/eventcatalog.py

@@ -24,7 +24,14 @@ EVENT_CATALOG = {
     55: ('File system corruption', 'critical', 'System'),
     7011: ('Service timeout', 'critical', 'System'),
     10016: ('DCOM permission error', 'warning', 'System'),
+    # Windows Error Reporting trio on the Application channel. 1000 is the
+    # faulting-application record (app name, version, faulting module, exception
+    # code) and is the one that says what actually broke; 1001 is the WER bucket
+    # record Windows writes alongside it; 1002 is a hang rather than a crash, so
+    # it is a warning - the app is unresponsive, not gone.
+    1000: ('Application error', 'critical', 'Application'),
     1001: ('Application crash', 'critical', 'Application'),
+    1002: ('Application hang', 'warning', 'Application'),
 }
 
 # The IDs a tech should see surfaced fleet-wide on the dashboard stability card.