Merge the wilm work, act on the five-agent review, verify the launch-path policy on Windows

plugins/endpoints/plugin.py

@@ -486,6 +486,23 @@ class EndpointsPlugin(BasePlugin):
                 # the installed-software inventory
                 'group': 'software',
             },
+            {
+                # Operator-submitted issue reports: a free-text note and an
+                # optional screenshot the operator captured from the tray. Sits
+                # in the Monitors tab beside the other watch-and-observe panels.
+                # A custom render carries the thumbnail grid and the expanding
+                # lightbox with left/right cycling the generic modes cannot.
+                'id': 'endpoints-operator-reports',
+                'title': 'Operator Reports',
+                'assettypes': ['computer'],
+                'endpoint': '/api/endpoints/panel/{assetid}/operatorreports',
+                'render': 'operatorreports',
+                'imagebase': '/api/endpoints/operatorreports',
+                'collapsible': True,
+                'empty': 'No operator reports for this endpoint.',
+                'position': 18,
+                'group': 'monitors',
+            },
         ]
 
     def get_dashboard_widgets(self) -> List[Dict]:
@@ -802,6 +819,26 @@ class EndpointsPlugin(BasePlugin):
 
         state.lastreportedat = datetime.utcnow()
 
+        # Warn-only reconciler: on this check-in, compare the monitors site
+        # policy expects to be running against what the snapshot reports, and
+        # cache the drift on the state in THIS transaction (same ledger commit as
+        # servicesjson). No start/stop is issued - drift is surfaced for an
+        # operator to act on. Reads the freshly reported services when present,
+        # else the last-known snapshot, so a report that omits services still
+        # reconciles against what we last saw. Fail-open: a reconciler error must
+        # never fail an otherwise-good check-in, so drift is left unchanged.
+        try:
+            if 'services' in payload:
+                reported_services = payload.get('services') or []
+            else:
+                reported_services = json.loads(state.servicesjson or '[]')
+            from .services.reconciler import compute_drift
+            state.driftjson = _as_json(compute_drift(assetid, reported_services))
+        except Exception:
+            logger.exception(
+                'reconciler failed for asset %s; leaving drift unchanged',
+                assetid)
+
         # Log any keys the agent sent that the ingest path does not consume yet.
         # New agent telemetry (disks, bios, memory, ...) lands here first: it is
         # not persisted until the server grows columns for it, but logging the