[WINA-2940] Report per-scope CSE truncation, and fix the bounds comments

The invocation cap dropped what it cut silently while the GPO cap next to it
reported GPOsOmitted, so the payload annotated one cap and not the other. Add
computer_cses_omitted / user_cses_omitted, omitempty and therefore free on
every payload that does not overflow.

The cap has less headroom than "backstop" implied: a stock Windows 11 26200
registers 57 client-side extensions under Winlogon\GPExtensions, seven below
the cap of 64, and third-party extensions register into the same key.

The byte-limit comment claimed one rationale for two constants that have
different origins - 128 cannot be a 256-character budget under any encoding -
and "worst UTF-8 case" understated it, since 512 is two bytes per character
rather than the three or four a worst case implies. Each constant now carries
its own derivation.

Also guard seven unchecked slice indexes in the tests. Indexing before
establishing the length turns a one-assertion regression into a panic that
aborts the whole test binary and names an indexing expression rather than the
invariant that broke. TestGPOMultiplePerCSE additionally states the ordering
its [1] depends on instead of assuming it.

TestSubmitEvent_WorstCasePayloadSize carries both new fields, so they sit
inside the one byte budget that couples the four caps: 2,373,788 bytes of
3,000,000, up 54 bytes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: briantu

comp/logonduration/impl/grouppolicy.go

@@ -27,7 +27,11 @@ import (
 // discarded there long after the send returned nil. A worst-case-size test derives one
 // byte budget from all four.
 const (
-	// maxCSEInvocationsPerScope is a backstop: one invocation per extension per pass.
+	// maxCSEInvocationsPerScope bounds the invocations one pass reports: one per
+	// extension, and a stock Windows 11 registers 57 of them under Winlogon\GPExtensions,
+	// which third-party extensions add to. So this is a backstop with little headroom
+	// rather than an unreachable ceiling, and what it drops is reported per scope in
+	// ComputerCSEsOmitted / UserCSEsOmitted.
 	maxCSEInvocationsPerScope = 64
 
 	// maxGPOsPerCSE bounds the GPO references carried by one invocation. GPOs are
@@ -36,8 +40,14 @@ const (
 	// GPOsOmitted.
 	maxGPOsPerCSE = 32
 
-	// Byte limits, sized for the worst UTF-8 case: AD permits a 256-character name.
+	// maxCSENameBytes bounds a name the provider registers rather than one anybody
+	// chose: the longest of those 57 is 38 characters.
 	maxCSENameBytes = 128
+
+	// maxGPONameBytes bounds a display name chosen in AD, where 256 characters is the
+	// ceiling, so this carries one whole at two bytes per character - the boundary
+	// TestGPONamesSurviveNonLatinScripts pins. A name in a three-byte script is cut on
+	// a UTF-8 boundary instead, which is why the character figure need not be exact.
 	maxGPONameBytes = 512
 )
 
@@ -63,7 +73,12 @@ const (
 // and user_group_policy entries; a populated array implies its parent milestone.
 type GroupPolicyDetails struct {
 	Computer []CSEInvocation `json:"computer,omitempty"`
-	User     []CSEInvocation `json:"user,omitempty"`
+	// ComputerCSEsOmitted counts what maxCSEInvocationsPerScope cut from Computer.
+	ComputerCSEsOmitted int `json:"computer_cses_omitted,omitempty"`
+
+	User []CSEInvocation `json:"user,omitempty"`
+	// UserCSEsOmitted counts what maxCSEInvocationsPerScope cut from User.
+	UserCSEsOmitted int `json:"user_cses_omitted,omitempty"`
 }
 
 // CSEInvocation is one measured CSE invocation; the array it appears in sets the scope.
@@ -257,24 +272,28 @@ func (a *gpAccumulator) mergeGPONames(names map[string]string) {
 // Still-open records have no interval and are never closed against the trace end.
 func (a *gpAccumulator) finalize(tl BootTimeline) *GroupPolicyDetails {
 	offsetOf := bootOffsetFunc(tl)
-	details := &GroupPolicyDetails{
-		Computer: a.buildScope(gpScopeComputer, offsetOf),
-		User:     a.buildScope(gpScopeUser, offsetOf),
-	}
-	if len(details.Computer) == 0 && len(details.User) == 0 {
+	computer, computerOmitted := a.buildScope(gpScopeComputer, offsetOf)
+	user, userOmitted := a.buildScope(gpScopeUser, offsetOf)
+	if len(computer) == 0 && len(user) == 0 {
 		return nil
 	}
-	return details
+	return &GroupPolicyDetails{
+		Computer:            computer,
+		ComputerCSEsOmitted: computerOmitted,
+		User:                user,
+		UserCSEsOmitted:     userOmitted,
+	}
 }
 
-// buildScope converts the invocations belonging to one boot pass.
-func (a *gpAccumulator) buildScope(scope gpScope, offsetOf func(time.Time) int64) []CSEInvocation {
+// buildScope converts the invocations belonging to one boot pass, reporting how many
+// the invocation cap cut.
+func (a *gpAccumulator) buildScope(scope gpScope, offsetOf func(time.Time) int64) ([]CSEInvocation, int) {
 	if !a.passPinned[scope] {
-		return nil
+		return nil, 0
 	}
 	records := a.done[a.passActivity[scope]]
 	if len(records) == 0 {
-		return nil
+		return nil, 0
 	}
 
 	out := make([]CSEInvocation, 0, len(records))
@@ -291,7 +310,9 @@ func (a *gpAccumulator) buildScope(scope gpScope, offsetOf func(time.Time) int64
 		})
 	}
 
+	omitted := 0
 	if len(out) > maxCSEInvocationsPerScope {
+		omitted = len(out) - maxCSEInvocationsPerScope
 		log.Warnf("Logon duration: %d Group Policy extension invocations in one pass exceeds the %d the payload carries, keeping the least healthy and the slowest",
 			len(out), maxCSEInvocationsPerScope)
 		out = retainMostRelevant(out)
@@ -303,7 +324,7 @@ func (a *gpAccumulator) buildScope(scope gpScope, offsetOf func(time.Time) int64
 		}
 		return out[i].CSEID < out[j].CSEID
 	})
-	return out
+	return out, omitted
 }
 
 // retainMostRelevant cuts an over-long list to maxCSEInvocationsPerScope: non-success

comp/logonduration/impl/grouppolicy_test.go

@@ -185,7 +185,9 @@ func TestCSEZeroDurationIsReported(t *testing.T) {
 	f.cseStart(gpTestActivity, 13*time.Second, cseRegistryGUID, "Registry", false, "")
 	f.cseStop(gpTestActivity, 13*time.Second, evtCSEStopSuccess, cseRegistryGUID, "Registry")
 
-	inv := f.details().Computer[0]
+	invs := f.details().Computer
+	require.Len(t, invs, 1)
+	inv := invs[0]
 	assert.Equal(t, int64(0), inv.DurationMs)
 
 	raw, err := json.Marshal(inv)
@@ -199,7 +201,9 @@ func TestCSEAsyncIsFlagged(t *testing.T) {
 	f.cseStart(gpTestActivity, 13*time.Second, cseAuditGUID, "Audit Policy", true, "")
 	f.cseStop(gpTestActivity, 13100*time.Millisecond, evtCSEStopSuccess, cseAuditGUID, "Audit Policy")
 
-	inv := f.details().Computer[0]
+	invs := f.details().Computer
+	require.Len(t, invs, 1)
+	inv := invs[0]
 	assert.True(t, inv.Async)
 	assert.Equal(t, cseResultSuccess, inv.Result)
 	assert.Equal(t, int64(100), inv.DurationMs)
@@ -350,6 +354,14 @@ func TestInvocationBackstopKeepsTheLeastHealthyAndTheSlowest(t *testing.T) {
 
 	d := f.details()
 	require.Len(t, d.Computer, maxCSEInvocationsPerScope)
+	assert.Equal(t, extra, d.ComputerCSEsOmitted, "the count the payload carries is what the cap cut")
+	assert.Zero(t, d.UserCSEsOmitted, "the count belongs to the scope that overflowed, not to the block")
+
+	raw, err := json.Marshal(d)
+	require.NoError(t, err)
+	assert.Contains(t, string(raw), fmt.Sprintf(`"computer_cses_omitted":%d`, extra),
+		"a truncated pass says so on the wire")
+	assert.NotContains(t, string(raw), "user_cses_omitted", "the untruncated scope stays silent")
 
 	kept := make(map[string]CSEInvocation, len(d.Computer))
 	for _, inv := range d.Computer {
@@ -445,7 +457,9 @@ func TestCSEOffsetsShareTheBootTimelineAxis(t *testing.T) {
 	f.cseStop(gpUserActivity, 73*time.Second, evtCSEStopSuccess, cseRegistryGUID, "Registry")
 	f.send(gpUserActivity, evtUserGPEnd, 75*time.Second)
 
-	inv := f.details().User[0]
+	invs := f.details().User
+	require.Len(t, invs, 1)
+	inv := invs[0]
 
 	var parent Milestone
 	for _, m := range buildTimelineMilestones(f.coll.timeline) {
@@ -526,7 +540,9 @@ func TestGPONamesComeFromTheApplicableList(t *testing.T) {
 		gpoFragment(gpoRichEntry(gpoDefaultDomainGUID, "Default Domain Policy")))
 	f.cseStop(gpTestActivity, 14*time.Second, evtCSEStopSuccess, cseRegistryGUID, "Registry")
 
-	gpos := f.details().Computer[0].GPOs
+	invs := f.details().Computer
+	require.Len(t, invs, 1)
+	gpos := invs[0].GPOs
 	require.Len(t, gpos, 1, "the extension GUID inside <Extensions> is not a GPO")
 	assert.Equal(t, gpoDefaultDomainGUID, gpos[0].ID)
 	assert.Equal(t, "Default Domain Policy", gpos[0].Name)
@@ -543,11 +559,13 @@ func TestGPONamesSurviveUnescapedAmpersand(t *testing.T) {
 		))
 	f.cseStop(gpTestActivity, 14*time.Second, evtCSEStopSuccess, cseRegistryGUID, "Registry")
 
+	invs := f.details().Computer
+	require.Len(t, invs, 1)
 	assert.Equal(t, []GPORef{
 		{ID: gpoDefaultDomainGUID, Name: "R&D Baseline"},
 		{ID: gpoDomainCtlGUID, Name: "Sales & Marketing"},
 		{ID: gpoThirdGUID, Name: "Plain Name"},
-	}, f.details().Computer[0].GPOs)
+	}, invs[0].GPOs)
 }
 
 func TestGPONameSharedFromAnotherInvocationsList(t *testing.T) {
@@ -580,7 +598,10 @@ func TestGPOMultiplePerCSE(t *testing.T) {
 		gpoDefaultDomainGUID+";"+gpoDomainCtlGUID+";"+gpoThirdGUID)
 	f.cseStop(gpTestActivity, 14*time.Second, evtCSEStopSuccess, cseRegistryGUID, "Registry")
 
-	gpos := f.details().Computer[1].GPOs
+	invs := f.details().Computer
+	require.Len(t, invs, 2)
+	require.Equal(t, cseRegistryGUID, invs[1].CSEID, "the chronological sort puts Registry second")
+	gpos := invs[1].GPOs
 	require.Len(t, gpos, 3)
 	assert.Equal(t, "Default Domain Policy", gpos[0].Name)
 	assert.Equal(t, "Default Domain Controllers Policy", gpos[1].Name)
@@ -597,7 +618,9 @@ func TestGPODuplicateDisplayNamesStayDistinct(t *testing.T) {
 	))
 	f.cseStop(gpTestActivity, 14*time.Second, evtCSEStopSuccess, cseRegistryGUID, "Registry")
 
-	gpos := f.details().Computer[0].GPOs
+	invs := f.details().Computer
+	require.Len(t, invs, 1)
+	gpos := invs[0].GPOs
 	require.Len(t, gpos, 2)
 	assert.NotEqual(t, gpos[0].ID, gpos[1].ID)
 	assert.Equal(t, "Baseline", gpos[0].Name)

comp/logonduration/impl/impl_windows_test.go

@@ -422,6 +422,7 @@ func TestSubmitEvent_GroupPolicyReachesTheWire(t *testing.T) {
 	assert.Equal(t, "Default Domain Policy", gpos[0].(map[string]interface{})["name"])
 
 	assert.NotContains(t, block, "user")
+	assert.NotContains(t, block, "computer_cses_omitted", "a pass under the cap carries no truncation count")
 
 	assert.Contains(t, custom, "boot_timeline")
 }
@@ -459,8 +460,13 @@ func TestSubmitEvent_WorstCasePayloadSize(t *testing.T) {
 	}
 
 	_, size := submitAndDecodeCustom(t, &AnalysisResult{
-		Timeline:    fullBootTimeline(boot),
-		GroupPolicy: &GroupPolicyDetails{Computer: pass(), User: pass()},
+		Timeline: fullBootTimeline(boot),
+		GroupPolicy: &GroupPolicyDetails{
+			Computer:            pass(),
+			ComputerCSEsOmitted: 4096,
+			User:                pass(),
+			UserCSEsOmitted:     4096,
+		},
 	})
 
 	t.Logf("worst case %d bytes of %d (%d invocations x %d GPO refs at %d-byte names), %d bytes of margin",