@@ -609,6 +609,16 @@ jobs:
           } >> "$GITHUB_OUTPUT"
           echo "Running $COUNT packages in chunk $CHUNK of $TOTAL_CHUNKS"
 
+      # services/rds docker tests pull these on demand; a throttled or dropped
+      # pull mid-test surfaces as a failed DB instance (gopherstack-vl8f4).
+      - name: Pre-pull RDS engine images
+        if: contains(steps.pkgs.outputs.pkgs, 'services/rds ') || endsWith(steps.pkgs.outputs.pkgs, 'services/rds')
+        run: |
+          for img in postgres:17 postgis/postgis:17-3.5 pgvector/pgvector:0.8.6-pg17-bookworm mysql:8.4 mariadb:11.4; do
+            (for i in 1 2 3; do docker pull -q "$img" >/dev/null && exit 0; sleep $((i * 5)); done; echo "pre-pull of $img failed") &
+          done
+          wait
+
       - name: Run Unit Tests (chunk ${{ matrix.chunk }})
         run: |
           go tool gotestsum --format pkgname -- \
 
@@ -107,3 +107,6 @@ checkpoint.md
 .ua/intermediate/*
 !.ua/intermediate/scan-result.json
 .ua/diff-overlay.json
+
+# go build output of the desktop module
+/desktop/desktop
@@ -84,6 +84,8 @@ That said, MQTT's fixed port (`1883`) happens to fall *outside* `--port-range-st
 - **M0 (done)** — `pkgs/azureauth` (SharedKey canonicalization + fixed devstoreaccount1 constants); `services/azureblob` wired into `cli.go` and bound to its own fixed port (synchronous bind, fail-fast, no `PortAlloc` fallback — see section 4's port-selection note); Create/Delete/List Container, Put/Get/Delete Blob, List Blobs; `PARITY.md`; unit tests + Go integration tests using `azure-sdk-for-go`. Properties/metadata, block-blob multipart (Put Block/Put Block List), and an `errorDetails`-style error-mapping table (mirroring `services/sqs`'s pattern) remain deferred -- see `services/azureblob/README.md`/`PARITY.md` for current status and known gaps.
 - **M1 (done)** — `services/azurequeue`: List/Create/Delete Queue, full message lifecycle (Put/Get/Peek/Delete/Update/Clear Messages), visibility timeout with pop-receipt rotation, message TTL swept by a background `Janitor`, wired into `cli.go` and bound to its own fixed port (10001, Azurite's own Queue port; synchronous bind, fail-fast, no `PortAlloc` fallback -- mirrors Azure Blob's M0 port strategy, see section 4). See `services/azurequeue/README.md`/`PARITY.md` for current status and known gaps.
 - **M2 (done)** — `services/azuretable`: table CRUD (Create/Delete/List Table), full entity lifecycle (Insert/Get/Query/Replace/Merge/Delete), a hand-written `$filter` lexer/parser/evaluator (eq/ne/lt/le/gt/ge, and/or/not, parentheses, every OData literal form -- string/int/Int64/float/bool/datetime/guid/binary -- against `PartitionKey`/`RowKey`/`Timestamp` and scalar properties), all eight EDM property types (String/Int32/Int64/Double/Boolean/DateTime/Guid/Binary) with `@odata.type` annotation round-tripping matching `azure-sdk-for-go/sdk/data/aztables`'s own client-side inference, and ETag-based optimistic concurrency (If-Match `*`/specific/absent -> upsert), wired into `cli.go` and bound to its own fixed port (10002, Azurite's own Table port; synchronous bind, fail-fast, no `PortAlloc` fallback -- mirrors Blob's M0 and Queue's M1 port strategy, see section 4). Batch (`$batch` multipart/mixed changesets) and continuation-token pagination are deferred -- see `services/azuretable/PARITY.md`. See `services/azuretable/README.md`/`PARITY.md` for current status and known gaps.
+- **Azure Files (done)** -- `services/azurefile` (PARITY.md is the authority): the file shares data plane (service properties, shares with snapshots/leases/ACLs/soft delete, directories, files with sparse ranges, copy and rename) on fixed port 10009 (`--azure-file-port`), account by path or `<account>.file.<host>`, `.file.` also reachable through the shared storage vhost listener, ARM `primaryEndpoints.file` advertised, share soft delete driven by ARM `fileServices/default` `shareDeleteRetentionPolicy`. Tests are driven through `azure-sdk-for-go/sdk/storage/azfile`.
+- **Azure Monitor Logs (done)** -- `services/azuremonitor` (PARITY.md is the authority): the Logs Ingestion API (`POST /dataCollectionRules/{immutableId}/streams/{stream}`, gzip, 1 MB limit, stream schema checks that drop bad records like Azure, or reject the upload with `--azure-monitor-strict-ingest`, `transformKql` through the in-tree KQL engine) and the Logs Query API (`/v1/workspaces/{id}/query`, `$batch`, resource-centric queries) on one HTTPS listener, fixed port 10013 (`--azure-monitor-port`), bearer auth (optionally JWT-shape checked). `services/azuremonitor/kql` is a KQL subset engine (tables, let, union, where, project/extend/summarize/sort/top/distinct and about 70 scalar functions); unsupported operators answer 400 SemanticError. ARM `Microsoft.OperationalInsights` (workspaces, tables, shared keys) and `Microsoft.Insights` (data collection endpoints and rules) live in `services/azurearm` over the `MonitorLogs` seam. Tests are driven through `azure-sdk-for-go/sdk/monitor/ingestion/azlogs`, `sdk/monitor/query/azlogs`, `armoperationalinsights` and `armmonitor`.
 - **M3 (done)** — `services/cosmosdb`: database/container CRUD (with a single-path partition-key declaration; hierarchical/multi-path partition keys deferred), full document CRUD including upsert (`x-ms-documentdb-is-upsert`) and ETag-based optimistic concurrency (If-Match absent/specific -> upsert/conditional), and a hand-written SQL-subset query engine (tokenizer -> recursive-descent parser -> AST -> executor, directly reusing `services/azuretable/odata_filter.go`'s and `services/s3/select_sql_*.go`'s shape per this section's own M3 rationale below) supporting `SELECT *`/projections with `AS` aliasing, `FROM <alias> [<realias>]`, `WHERE` with the full comparison/boolean/`IS NULL` grammar and `@param` bindings, `ORDER BY`, `TOP`, and `OFFSET`/`LIMIT`. Auth is Cosmos's own master-key HMAC-SHA256 scheme (`services/cosmosdb/masterkey.go`, deliberately NOT `pkgs/azureauth` -- see section 3), opt-in verification via `--cosmosdb-validate-auth`, defaulting to the real Cosmos DB Local Emulator's well-known fixed master key. Bound to its own fixed port (8081, the real emulator's own published default -- NOT an Azurite-style 1000x number, since Cosmos's real emulator is a separate tool; synchronous bind, fail-fast, no `PortAlloc` fallback, and -- unlike M0/M1/M2's ports -- 8081 sits *outside* `--port-range-start`/`--port-range-end`'s own default range, mirroring `services/iot`'s MQTT precedent; see section 4). Fake `x-ms-request-charge`/`x-ms-session-token`/`x-ms-activity-id` headers on every response (real RU accounting is out of scope). Integration tests against `azure-sdk-for-go/sdk/data/azcosmos`; JS/Python SDK cross-compat smoke tests remain M4 scope. See `services/cosmosdb/README.md`/`PARITY.md` for current status and known gaps. **This completes the full 4-service Azure support plan** (Blob, Queue, Table, Cosmos); M4 (docs/polish, cross-SDK e2e) has since landed as well.
 - **M4 (done)** — Docs/polish: the four services now render under their own **Azure** heading in the root `README.md` services table with curated display names (`cmd/gendocs/categories.go`) rather than falling through to "Other" as auto-title-cased slugs; per-service guides at `docs/services/azureblob.md`/`azurequeue.md`/`azuretable.md`/`cosmosdb.md` following the established AWS guide format; a four-service docker-compose example at `examples/azure-services/` (indexed in `examples/README.md`), with `Dockerfile`/`Dockerfile.goreleaser` now exposing 10000/10001/10002/8081; and the cross-SDK smoke suite from section 7 -- `test/e2e/crosssdk/azure_smoke.mjs` (`@azure/storage-blob`, `@azure/storage-queue`, `@azure/data-tables`, `@azure/cosmos`) and `azure_smoke.py` (`azure-storage-blob`, `azure-storage-queue`, `azure-data-tables`, `azure-cosmos`), driven by `test/e2e/azure_crosssdk_test.go`, which starts gopherstack on ephemeral ports and runs both scripts in CI's `e2e-tests` job. Note: no per-service badges were added -- `.badges/` holds only repo-level aggregate badges (services/operations/parity counts), which already include the Azure services, so "badges/icons" resolved to verifying zero `cmd/gendocs` drift rather than adding new SVGs. The cross-SDK suite immediately earned its keep by catching a real wire-compatibility gap: `Get Blob` accepted only the `Range` header, but the Python/JS SDKs send `x-ms-range` exclusively, so single-range downloads were unreachable from those SDKs despite the Go SDK passing (fixed in `services/azureblob/handler.go`; see that service's `PARITY.md`).
 
@@ -263,7 +265,7 @@ One useful relaxation this resolution surfaces: `FromEndpoint` reads `resourceMa
 
 **Build plan given this**: extract `cli.go`'s existing `generateSelfSignedCert` into a shared `pkgs/devtls` (it already exists for the main port's optional TLS mode, so this is a lift-and-share, not new crypto code), serve `services/azurearm` over HTTPS with a cert covering `localhost`/`127.0.0.1`/the container's DNS name, and have the Terraform test harness (`test/terraform/azure/`) trust that cert for the `tofu` child process — via `SSL_CERT_FILE` in `applyTofu`'s `env` slice on Linux/CI, with a documented fallback (install into the login keychain, or run the suite in a Linux container) if `SSL_CERT_FILE` doesn't get picked up by Go's darwin verifier; this is worth a five-minute check at implementation time but is no longer a design-blocking unknown; also model the metadata document against the real `2022-09-01` schema fields (`authentication`, `resourceManager`, `graphAudience`/`graph`, `suffixes`), since `FromEndpoint` hard-fails on missing `name`, `resourceManagerEndpoint`, and `microsoftGraphResourceId` — the last of which is easy to miss because most public "custom cloud" examples predate the schema version that requires it, and easy to get *wrong even when present*: it is a **top-level** field (`json:"microsoftGraphResourceId"` directly on the document root), not nested under a `resourceIdentifiers` object the way `hashicorp/go-azure-sdk`'s own *exported* `MetaData`/`ResourceIdentifiers` types (a separate, post-parse convenience shape) might suggest by name — the actual wire-level unexported `metaDataResponse` struct (`sdk/internal/metadata/client.go`) has no such nesting. Nesting it silently zero-values the field on unmarshal, so `FromEndpoint` fails with "no `microsoftGraphResourceId` was returned" rather than a JSON error, which is why this survived one full CI run of M8's own metadata reshape fix before being caught.
 
-**Resolved: azurerm's *direct data-plane* resources (`azurerm_storage_container`/`_blob`/`_queue`/`_table`) can be redirected, and don't need any suffix trickery.** (`azurerm_storage_share`/`_file`, Azure Files, stay out of scope -- gopherstack has no File Share service to back them, unrelated to this finding.) This was flagged as the plan's single biggest open risk before M7 shipped; verified directly against the provider's source once M7's `properties.primaryEndpoints` shape existed to check it against. `terraform-provider-azurerm`'s storage data-plane clients (`internal/services/storage/client/data_plane.go`'s `ContainersDataPlaneClient`/`QueuesDataPlaneClient`/etc.) call `account.DataPlaneEndpoint(EndpointTypeBlob|Queue|Table)`, which (`client/helpers.go`) returns `ad.primaryBlobEndpoint`/`primaryQueueEndpoint`/`primaryTableEndpoint` -- fields populated straight from the ARM `GetProperties`/`Create` response body's `properties.primaryEndpoints.*`, i.e. exactly the values M7's `rp_storage.go` `buildBody` already returns (`http://<host>:10000/<account>/`, `:10001/`, `:10002/`). The `{account}.{suffixes.storage}` virtual-host construction is only a *fallback* (`client/helpers.go`'s `if baseUri == nil`) for when ARM didn't return a primary endpoint at all -- never our case. The client library underneath (`hashicorp/go-azure-sdk`'s `sdk/client/dataplane/storage`) makes this explicit in its own source comment: `NewStorageClient` "require[s] the baseUri is provided" because "both the domain name _and_ the domain format can change entirely" -- it never reconstructs or validates the host, it just uses whatever URI ARM handed back. **Net effect: no new gopherstack code is required in `services/azureblob`/`azurequeue`/`azuretable` at all** -- M0-M2's existing path-style listeners are already exactly what these clients expect once ARM (M7) is advertising them. The only remaining work is Terraform fixtures/tests proving it (see M8 below); this is why M8 is scoped as a small, mechanical milestone rather than another RP.
+**Resolved: azurerm's *direct data-plane* resources (`azurerm_storage_container`/`_blob`/`_queue`/`_table`) can be redirected, and don't need any suffix trickery.** (`azurerm_storage_share`/`_file`, Azure Files, were out of scope when this was written; `services/azurefile` now backs the data plane, but Terraform coverage of it is unverified.) This was flagged as the plan's single biggest open risk before M7 shipped; verified directly against the provider's source once M7's `properties.primaryEndpoints` shape existed to check it against. `terraform-provider-azurerm`'s storage data-plane clients (`internal/services/storage/client/data_plane.go`'s `ContainersDataPlaneClient`/`QueuesDataPlaneClient`/etc.) call `account.DataPlaneEndpoint(EndpointTypeBlob|Queue|Table)`, which (`client/helpers.go`) returns `ad.primaryBlobEndpoint`/`primaryQueueEndpoint`/`primaryTableEndpoint` -- fields populated straight from the ARM `GetProperties`/`Create` response body's `properties.primaryEndpoints.*`, i.e. exactly the values M7's `rp_storage.go` `buildBody` already returns (`http://<host>:10000/<account>/`, `:10001/`, `:10002/`). The `{account}.{suffixes.storage}` virtual-host construction is only a *fallback* (`client/helpers.go`'s `if baseUri == nil`) for when ARM didn't return a primary endpoint at all -- never our case. The client library underneath (`hashicorp/go-azure-sdk`'s `sdk/client/dataplane/storage`) makes this explicit in its own source comment: `NewStorageClient` "require[s] the baseUri is provided" because "both the domain name _and_ the domain format can change entirely" -- it never reconstructs or validates the host, it just uses whatever URI ARM handed back. **Net effect: no new gopherstack code is required in `services/azureblob`/`azurequeue`/`azuretable` at all** -- M0-M2's existing path-style listeners are already exactly what these clients expect once ARM (M7) is advertising them. The only remaining work is Terraform fixtures/tests proving it (see M8 below); this is why M8 is scoped as a small, mechanical milestone rather than another RP.
 
 For everything ARM-mediated — resource groups, storage accounts, Service Bus namespaces/queues/topics/subscriptions, Cosmos accounts/databases/containers, and later Key Vault vaults and App Configuration stores — no such uncertainty exists: those are pure ARM calls and the metadata document fully controls where they go.
 
 
@@ -22,7 +22,7 @@ COPY . .
 # to avoid OOM inside the container. Fall back to building in-container if assets are absent.
 RUN if [ ! -f dashboard/static/spa/index.html ]; then \
         npm --prefix ui ci --include=optional && \
-        NODE_OPTIONS="--max-old-space-size=4096" npm --prefix ui run build; \
+        NODE_OPTIONS="--max-old-space-size=8192" npm --prefix ui run build; \
     fi
 
 # Build the Go app