Header.ps1

<#
.SYNOPSIS
    RackStack - All-in-one Windows Server setup utility (Monolithic Build).

.DESCRIPTION
    This is the MONOLITHIC BUILD -- all 81 modules combined into a single file.
    Generated by sync-to-monolithic.ps1 from the modular source in Modules/.
    The .exe embeds this file and runs it under the Windows PowerShell console host (see dist/launcher/).

    For development, use RackStack.ps1 (the modular loader) instead.

    Features include:
    - Configure Host or Virtual Machine networking (IP, DNS, VLAN)
    - Configure Switch Embedded Teaming (SET) for Hyper-V hosts
    - Configure iSCSI NICs with proper isolation
    - Set hostname with validation
    - Join Active Directory domain
    - Set timezone (world timezones with continent-based selection)
    - Install Windows Updates with timeout protection
    - Enable Remote Desktop with firewall rules
    - Configure Windows Firewall profiles
    - License Windows Server (volume, AVMA, manual)
    - Create local administrator accounts with password complexity
    - Disable built-in Administrator account with self-cleanup
    - Test network connectivity
    - Configure power plans
    - Generate batch configuration templates

.AUTHOR
    7h3 4b1d3r

.VERSION
    1.123.1
.LAST UPDATED
    09/08/2026

.CHANGELOG v1.21.1
    ROBUSTNESS, UX, CACHE CONSISTENCY:
    - CIM timeout hardening — 25+ bare Get-CimInstance calls wrapped with Invoke-WithTimeout to prevent UI hangs
    - Cache invalidation — 30+ state-changing operations now call Clear-MenuCache so menu status stays current
    - Dashboard pause — 11 utility dashboard/viewer functions now pause for user to read output before returning
    - Write-PressEnter — 5 action functions now pause after completion so results don't flash away
    - Domain join — spinner during Add-Computer, 2-minute timeout, consistent message indentation
    - Auto-reboot delay — reduced from 10 to 5 seconds for faster workflow
    - Bug fixes — null-safe Get-Content check in FileServer, error message indentation fixes

.CHANGELOG v1.21.0
    RESILIENCE, UX, BUG FIXES:
    - NEW: Performance Dashboard Copy to Clipboard — [C] key copies full system snapshot to clipboard (Performance Dashboard)
    - FIX: OS detection uses registry-first approach — immune to WMI/CIM service hangs (Initialization, System Check)
    - FIX: Firewall state detection uses registry-first approach — prevents hang when CIM is unresponsive (System Check)
    - FIX: Drag-and-drop paths auto-trim surrounding quotes across 12+ modules (Defender Exclusions, Failover Clustering, Batch Config, Config Export, VM Export/Import, BitLocker, Storage Backends, Hyper-V Replica, Scheduled Tasks, Operations Menu)
    - FIX: PS 5.1 pipeline .Count bug — single pipeline results wrapped with @() for consistent counting (VM Deployment, Config Export, Agent Installer)
    - FIX: Agent Installer single-match auto-install was broken on PS 5.1 — search results now properly wrapped (Agent Installer)
    - FIX: Quorum witness share path navigation uses return instead of break (Failover Clustering)
    - FIX: VM Import destination path supports navigation commands (VM Export/Import)
    64 modules, 2087 tests

.CHANGELOG v1.20.9
    BUG FIXES — ERROR HANDLING, CONFIRM PROMPTS, STATE ROLLBACK:
    - FIX: Remote directory creation in VM deployment uses -ErrorAction Stop — prevents silent failure when WinRM fails (VM Deployment)
    - FIX: Remove-SRPartnership and Initialize-Disk include -Confirm:$false — prevents hanging in non-interactive contexts (Storage Replica, Storage Manager)
    - FIX: Set-Partition drive letter assignment uses -ErrorAction Stop — reports failure instead of showing incorrect success (Storage Manager)
    - FIX: VM NIC configuration wrapped in per-NIC try/catch — reports individual NIC failures (VM Deployment)
    - FIX: Remote profile copy Invoke-Command uses -ErrorAction Stop — prevents false success message (Utilities)
    - FIX: VM deployment storage init failure resets all connection state variables (VM Deployment)
    - FIX: Windows Update install job extracts error details before Remove-Job (Windows Updates)
    - FIX: Disable Administrator error message follows codebase convention (Disable Admin)
    64 modules, 1873 tests

.CHANGELOG v1.20.8
    BUG FIXES — INPUT VALIDATION, DEAD CODE CLEANUP:
    - FIX: Storage Replica replication mode prompt validates input and supports navigation — prevents silently selecting Asynchronous mode for any non-"1" input (Storage Replica)
    - FIX: License type selection validates input as "1" or "2" — prevents silently selecting AVMA for any non-"1" input including nav commands (Operations Menu)
    - FIX: Host Storage "0" back option checked before Test-NavigationCommand — restores "No changes made." feedback message (Host Storage)
    - CLEANUP: Removed unreachable dead code — 3 "^[Bb]$" switch cases in timezone functions already handled by navigation system, duplicate nav check in Host Storage, dead 'b'/'B' check in Agent Installer
    64 modules, 1873 tests

.CHANGELOG v1.20.7
    BUG FIXES — COMPREHENSIVE GET-CHILDITEM, TEST-PATH, REMOVE-ITEM -LITERALPATH SWEEP:
    - FIX: Get-ChildItem uses -LiteralPath across Disk Cleanup, Utilities disk analysis, Config Export baselines, Exit Cleanup profile scan, Entry Point transcript cleanup, HTML Reports metrics, Operations Menu company defaults (12 instances)
    - FIX: Test-Path uses -LiteralPath for temp paths, WU cache, CBS logs, disk analysis paths, defaults path, agent installer temp path, exit cleanup folder checks (10 instances)
    - FIX: Remove-Item uses -LiteralPath via ForEach-Object for pipeline operations — prevents wildcard interpretation when piping FileInfo objects (Disk Cleanup WU cache, Entry Point old logs)
    64 modules, 1873 tests

.CHANGELOG v1.20.6
    BUG FIXES — HARDCODED PATHS, LITERALPATH, DNS RECORDS, EMPTY RESPONSE GUARD:
    - FIX: Disk Cleanup uses $env:SystemDrive instead of hardcoded C: for cleanmgr — works correctly when OS is on non-C: drive (Disk Cleanup)
    - FIX: Remove-Item uses -LiteralPath for temp file and transcript log cleanup — prevents wildcard interpretation on bracket-containing filenames (Disk Cleanup, Entry Point)
    - FIX: FileServer guards against empty HTTP response body before ConvertFrom-Json — gives clear error message instead of cryptic JSON parse error (FileServer)
    - FIX: Domain join filters DNS response for A records before displaying IP — prevents showing blank IP when first result is CNAME/SOA (Domain Join)
    - FIX: Get-FileHash uses -LiteralPath inside hash computation job — prevents hash failure on files with bracket characters in name (Navigation)
    - FIX: Help text displays actual $script:TempPath instead of hardcoded C:\Temp — shows correct path when overridden via defaults.json (Help)
    - FIX: Sysprep guidance text uses $env:SystemRoot and $env:SystemDrive instead of hardcoded C: paths (VHD Management)
    64 modules, 1873 tests

.CHANGELOG v1.20.5
    BUG FIXES — OUT-FILE AND EXPORT-CSV -LITERALPATH:
    - FIX: Out-File calls use -LiteralPath for favorites, history, session state, and defaults file writes — prevents wildcard interpretation on config paths (QoL Features, Operations Menu)
    - FIX: Export-Csv calls use -LiteralPath for event log and software inventory exports — prevents wildcard interpretation on constructed paths (Event Log Viewer, Utilities)
    64 modules, 1873 tests

.CHANGELOG v1.20.4
    BUG FIXES — GET-CONTENT -LITERALPATH + NAVIGATION TRAPS:
    - FIX: Get-Content calls use -LiteralPath across 10 instances in 7 modules — prevents wildcard interpretation on config-derived paths (Navigation, Help, FileServer, Config Export, Entry Point, HTML Reports, QoL Features, Operations Menu)
    - FIX: VM Deployment standard and custom summary loops now handle "home" and "back" navigation — prevents users getting trapped in edit loop (VM Deployment)
    - FIX: Add-MultipleVNICs loop checks ReturnToMainMenu flag after each vNIC creation — prevents re-prompting after "home" navigation (SET)
    64 modules, 1873 tests

.CHANGELOG v1.20.3
    BUG FIXES — DEEP -LITERALPATH SWEEP ACROSS ALL FILE OPERATIONS:
    - FIX: Get-Item calls use -LiteralPath for all config-derived/user-input paths across FileServer, VHD Management, Navigation (10 instances)
    - FIX: Remove-Item calls use -LiteralPath for all constructed paths across Utilities, FileServer, VHD Management, ISO Download, QoL Features, Agent Installer (20+ instances)
    - FIX: Get-ChildItem calls use -LiteralPath for config-derived directory paths in VHD Management and ISO Download
    - FIX: Copy-Item and Move-Item calls use -LiteralPath for source paths across VHD Management, Utilities, Navigation
    - FIX: Add-Content and Set-Content calls use -LiteralPath for log files and generated scripts across Logging, Navigation, FileServer, Offline VHD
    - FIX: Hash computation job cleanup includes Stop-Job before Remove-Job (Navigation)
    - FIX: Empty catch blocks explicitly assign $null in Disk Cleanup, Utilities reboot checks, VM Deployment CSV check
    64 modules, 1873 tests

.CHANGELOG v1.20.2
    BUG FIXES — HARDENING SWEEP MODULES 25-43:
    - FIX: Disk space checks in FileServer and VHD downloads guard against UNC paths — prevents silent failures when destination is a network share or CSV path (FileServer, VHD Management)
    - FIX: Stop-Job called before Remove-Job in VHD copy/convert finally block — prevents orphaned background processes on failure (VHD Management)
    - FIX: Test-Path calls use -LiteralPath across 5 modules for all constructed/config-derived paths (VHD Management, ISO Download, Offline VHD, Utilities, Host Storage)
    - FIX: Get-ClusterResource includes -ErrorAction SilentlyContinue to prevent crashes when Cluster service is unavailable (Failover Clustering)
    - FIX: CSV removal and Live Migration network changes now track session changes (Failover Clustering)
    - FIX: Silent catch block in scheduled task info retrieval explicitly sets null (Utilities)
    - FIX: Remote temp path fallback uses $env:SystemRoot instead of hardcoded C:\Windows (Utilities)
    64 modules, 1873 tests

.CHANGELOG v1.20.1
    BUG FIXES — HARDENING SWEEP ACROSS 15 MODULES:
    - FIX: Test-Path calls use -LiteralPath across 15 modules for all constructed, user-input, and config-derived paths — prevents wildcard interpretation on paths with bracket characters (Navigation, Defender, Operations Menu, Agent Installer, Session Summary, Entry Point, Config Export, HTML Reports, QoL Features, VM Deployment)
    - FIX: Subnet sweep and port scan properly stop timed-out background jobs before cleanup — prevents orphaned processes (Network Diagnostics)
    - FIX: Agent installer properly stops background install job in finally block (Agent Installer)
    - FIX: Hardcoded C:\Windows paths replaced with $env:SystemRoot in AD DC promotion display (Active Directory)
    - FIX: Hardcoded C:\Hyper-V fallback paths replaced with $env:SystemDrive (Hyper-V Replica, Operations Menu)
    - FIX: Get-MpPreference wrapped in try/catch with -ErrorAction Stop in secondary Defender functions (Defender Exclusions)
    - FIX: Disable-AllIPv6 guards against null adapter list (IP Configuration)
    - FIX: Invoke-WithTimeout returns consistent keys across all code paths (Navigation)
    - FIX: Windows activation tracks session change (Licensing)
    - FIX: ReturnToMainMenu checks added to SNMP config, Edit Defaults, and Edit Licenses menu loops (QoL Features, Operations Menu)
    64 modules, 1873 tests

.CHANGELOG v1.20.0
    NEW FEATURE + HARDENING — 28 CHANGES:
    - NEW: Scheduled Task Manager — view, search, enable/disable, run, export/import scheduled tasks with full XML backup/restore support (Module 63)
    - FIX: Discovery cmdlets (Get-NetAdapter, Get-Disk, Get-Volume, Get-NetIPAddress) across 9 modules now include -ErrorAction SilentlyContinue to prevent unhandled terminating errors when WMI/CIM queries fail on disconnected or degraded hardware
    - FIX: ISO download disk space check no longer fails on UNC/network paths — guards against non-drive-letter paths (ISO Download)
    - FIX: Test-Path calls use -LiteralPath for user-input profile path to prevent wildcard interpretation (Utilities)
    - FIX: Test-Path calls use -LiteralPath for FileServer download destination paths (FileServer)
    - FIX: VHD conversion retry properly stops timed-out background job before cleanup (VHD Management)
    64 modules, 1873 tests

.CHANGELOG v1.19.1
    BUG FIXES — 4 FIXES:
    - FIX: Port scan results now correctly match ports when some scans time out — results tracked per-job index instead of sequential array (Network Diagnostics)
    - FIX: Subnet sweep batches jobs (50 at a time) instead of spawning up to 254 concurrent processes which could exhaust system memory (Network Diagnostics)
    - FIX: Hyper-V Replica status shows HTTP/HTTPS as Disabled when auth type doesn't include that protocol, instead of always showing port numbers (Hyper-V Replica)
    - FIX: VM Deployment fallback paths use $env:SystemDrive instead of hardcoded C:\ (VM Deployment)

.CHANGELOG v1.19.0
    NAVIGATION + RESILIENCE SWEEP — 20 FIXES:
    - FIX: "Home" navigation now works from all nested menus — added ReturnToMainMenu checks to 17 menu loops across iSCSI, Firewall Templates, NTP, Disk Cleanup, BitLocker, ISO Download, Cluster Dashboard, VM Checkpoints, VM Export/Import, Network Diagnostics, Hyper-V Replica, Storage Backends, and Settings
    - FIX: Disk space pre-checks no longer fail on UNC/network paths — VM Export, VM Checkpoints, and VM Deployment now guard against non-drive-letter paths (clusters with CSVs, SMB shares)
    - FIX: Hardcoded slmgr.vbs paths replaced with $env:SystemRoot for non-standard Windows installations (Licensing)
    - FIX: Defender threat count logged correctly when query fails — $threats initialized before try block to prevent false "Threats=1" in session log (Defender Exclusions)
    - FIX: IPv6 disable now reports actual failures instead of silent success — changed from SilentlyContinue to Stop error action (IP Configuration)
    - FIX: Export VM cleanup now properly stops orphaned background jobs before removing them (VM Export/Import)
    - FIX: $Matches automatic variable captured immediately per project convention (NTP Configuration)
    - FIX: Test-Path calls use -LiteralPath for all constructed paths in exit cleanup to prevent wildcard interpretation (Exit Cleanup)
    - CLEANUP: Removed unused $script:BITSPreferred variable (Initialization)

.CHANGELOG v1.18.2
    ROBUSTNESS + CONSISTENCY SWEEP — 14 FIXES:
    - FIX: HTML reports encode all dynamic values — VM names, adapter names, CPU model, process names, and config profile comparison data now use HtmlEncode to prevent display issues with special characters like & < > in generated HTML (54-HTMLReports)
    - FIX: Hardcoded power plan GUID in first-boot script uses centralized $script:PowerPlanGUID constant (43-OfflineVHD)
    - FIX: Firewall rule .Enabled comparison uses boolean ($true) instead of string ("True") for consistency with GpoBoolean enum (35-Utilities, 16-Firewall)
    - FIX: Save-StoredCredential clears plaintext password on exception path (35-Utilities)
    - FIX: Install-HyperVRole adds -ErrorAction on Get-CimInstance with graceful fallback (25-HyperV)
    - FIX: SHA256 hash verification guards against null stream/hasher in finally block (35-Utilities)
    - FIX: Clear-MenuCache called after SET, vSwitch, and vNIC creation/removal to prevent stale menu data (09-SET)
    - FIX: Disk cleanup uses try/catch instead of TOCTOU Test-Path pattern for deletion counting (20-DiskCleanup)
    - FIX: Disk cleanup uses $env:SystemRoot instead of hardcoded C:\Windows paths (20-DiskCleanup)
    - FIX: VHD Management, Deduplication, and Storage Replica menu loops check $global:ReturnToMainMenu (41-VHDManagement, 32-Deduplication, 33-StorageReplica)
    - FIX: Get-Volume and Get-Service calls add -ErrorAction SilentlyContinue (38-StorageManager, 30-ServiceManager)

.CHANGELOG v1.18.1
    LOGIC BUG FIXES — ADDRESSFAMILY SCOPING + ISCSI MULTIPATH:
    - FIX: Remove-NetIPAddress/Remove-NetRoute calls now specify -AddressFamily IPv4 — without this, IPv6 link-local addresses and routes were stripped unnecessarily during IP reconfiguration (09-SET, 45-ConfigExport, 50-EntryPoint)
    - FIX: Standard vSwitch creation uses $ManagementName variable instead of hardcoded "Management" — respects defaults.json override for management NIC naming (09-SET)
    - FIX: iSCSI target discovery no longer filters out already-connected targets — the IsConnected filter prevented multipath connections through additional portals; now attempts connection through each portal and gracefully handles already-connected sessions (10-iSCSI)

.CHANGELOG v1.18.0
    NEW FEATURES — REBOOT DETAILS + MEMORY DIAGNOSTICS:
    - NEW: Reboot Pending Details — enumerates every registry/WMI source that signals a pending reboot and shows the exact reason: CBS packages, Windows Update, pending file renames, hostname change, SCCM client, domain join (35-Utilities, 56-OperationsMenu [29])
    - NEW: Memory Pressure Diagnostics — shows physical memory usage, page file utilization, committed memory ratio, top 15 processes by working set, and per-VM memory allocation on Hyper-V hosts with dynamic memory status (35-Utilities, 56-OperationsMenu [30])

.CHANGELOG v1.17.2
    ROBUSTNESS SWEEP — 8 FIXES:
    - FIX: Process handle leak in credential storage — cmdkey.exe process was never disposed; timeout path would also crash reading ExitCode on a still-running process (35-Utilities)
    - FIX: Script initialization falls back to registry when CIM service is unresponsive — unguarded Get-CimInstance at top level would crash the entire tool before any menu could display (00-Initialization)
    - FIX: Port scan disposes TcpClient on error — if BeginConnect or WaitOne threw, the socket handle leaked; now uses try/finally (58-NetworkDiagnostics)
    - FIX: Certificate display guards against null Subject — certs with Subject Alternative Names only have null Subject, causing blank output (37-HealthCheck, 35-Utilities)
    - FIX: Command history display guards against null Command — corrupted or hand-edited history JSON would crash PadRight on null (55-QoLFeatures)
    - FIX: VHD download checks cache path before use — if host storage was never initialized, Substring on null path would crash (41-VHDManagement)
    - FIX: Adapter table guards against null InterfaceDescription — virtual or transitional adapters can have null description, crashing PadRight (06-NetworkAdapters)
    - FIX: Quick setup storage detection uses @() wrapper for PS 5.1 — single-item pipeline results lack .Count property without array wrapping (50-EntryPoint)

.CHANGELOG v1.17.1
    PS 5.1 COMPATIBILITY FIX:
    - FIX: VM Checkpoint Management uses *-VMSnapshot cmdlets instead of *-VMCheckpoint — Server 2012 R2 only has the VMSnapshot variants; VMCheckpoint was added in Server 2016 (52-VMCheckpoints)

.CHANGELOG v1.17.0
    NEW FEATURES — SCHEDULED TASKS + FIREWALL SUMMARY:
    - NEW: Scheduled Task Overview — shows all custom (non-Windows) scheduled tasks with state, next run time, and highlights tasks with non-zero last run results; filtered to avoid noise from built-in Windows tasks (35-Utilities, 56-OperationsMenu [27])
    - NEW: Firewall Rule Summary — shows profile status (enabled/disabled, default actions), rule counts by direction and action, and top inbound allow groups for quick security audit (35-Utilities, 56-OperationsMenu [28])

.CHANGELOG v1.16.7
    SECURITY HARDENING (8 FIXES):
    - FIX: Remote service management rejects wildcard characters in service names — entering '*' could match all services, causing a mass stop/restart on the target (56-OperationsMenu)
    - FIX: Subnet sweep validates three-octet base format — invalid input like four-octet IPs would spawn 254 failing background jobs, exhausting resources (58-NetworkDiagnostics)
    - FIX: Self-update batch script uses random filename in TEMP — eliminates predictable path that could be pre-created by another user for privilege escalation (35-Utilities)
    - FIX: NTP server custom entry validates hostname/IP format — prevents misconfiguration that could cascade into Kerberos and iSCSI failures (19-NTPConfiguration)
    - FIX: Temp path setting validates format and warns on UNC paths — transcripts written to network shares could expose session activity (56-OperationsMenu)
    - FIX: BitLocker key save validates directory exists and warns on UNC paths — recovery keys are highly sensitive and should stay local (31-BitLocker)
    - FIX: BitLocker show recovery key warns about transcript capture — keys displayed on-screen are recorded in the session transcript log (31-BitLocker)
    - FIX: Credential storage uses ProcessStartInfo instead of pipeline cmdkey call — keeps plaintext password out of PowerShell transcript logging (35-Utilities)

.CHANGELOG v1.16.6
    RESOURCE LEAK + VALIDATION BYPASS FIXES:
    - FIX: FileServer HEAD request wraps response in try/finally — if ContentLength threw, the HTTP connection was never closed, leaking sockets under repeated failures (39-FileServer)
    - FIX: Storage Replica volume validation uses flag instead of break inside foreach/switch — break inside foreach inside switch exits the switch in PowerShell, not the foreach; now reports ALL invalid volumes and properly blocks partnership creation (33-StorageReplica)

.CHANGELOG v1.16.5
    NULL SAFETY SWEEP ACROSS 5 MODULES:
    - FIX: Health Check guards against null CPU properties from Get-CimInstance — $cpu.Name, NumberOfCores, NumberOfLogicalProcessors now safe when CIM query fails (37-HealthCheck)
    - FIX: Health Check guards against null $proc.CPU in top processes — System/Idle processes have null CPU property in PS 5.1 (37-HealthCheck)
    - FIX: HTML Reports guards against null CIM results — CPU load, memory values, CPU info in HTML template all null-safe (54-HTMLReports)
    - FIX: HTML Reports guards against null $p.CPU in top processes table (54-HTMLReports)
    - FIX: Service Manager uses actual service DisplayName with null fallback — custom MonitoredServices entries without DisplayName no longer crash (30-ServiceManager)
    - FIX: Cluster Dashboard guards against null node State on .ToString() (51-ClusterDashboard)
    - FIX: Network Diagnostics casts integer fallback to string for adapter alias — .Length on integer returns null in PS 5.1 (58-NetworkDiagnostics)
    - FIX: Network Diagnostics uses null-safe string interpolation for DNS default case and ARP state (58-NetworkDiagnostics)

.CHANGELOG v1.16.4
    NULL PROPERTY GUARDS ON TOSTRING CALLS:
    - FIX: Event Log Viewer guards against null TimeCreated — events with null timestamps caused "cannot call method on null-valued expression" on .ToString() (29-EventLogViewer)
    - FIX: Event Log Alert Summary guards against null TimeCreated on latest events — same .ToString() crash on null (35-Utilities)
    - FIX: BitLocker encryption progress guards against null VolumeStatus — the .ToString() call could crash if the volume status property was null (31-BitLocker)

.CHANGELOG v1.16.3
    NULL PROVIDER NAME GUARD IN EVENT LOG ALERTS:
    - FIX: Event Log Alert Summary guards against null ProviderName — events with null provider caused a "cannot call method on null-valued expression" error on .PadRight() in both the top sources list and the latest events list (35-Utilities)

.CHANGELOG v1.16.2
    DRIFT BASELINE INPUT VALIDATION:
    - FIX: Drift detection baseline comparison validates user input before integer cast — previously, non-numeric input to the baseline number prompts was cast via -as [int] which returns $null, then subtracted by 1 producing -1, silently failing the range check without user feedback. Now validates with regex and shows an error message (45-ConfigExport)

.CHANGELOG v1.16.1
    VARIABLE INITIALIZATION FIXES:
    - FIX: Driver Health Check initializes $allDevices before try/catch — if Get-CimInstance failed, references outside the try block would hit an uninitialized variable (35-Utilities)
    - FIX: Uptime & Reboot History initializes $uptimeStr and $unexpectedCount before their conditional blocks — Add-SessionChange at the end of the function referenced both variables which were only set inside try/catch and if/else branches respectively (35-Utilities)
    - FIX: Windows Update Status initializes $daysSince before try/catch — the session change description referenced $daysSince which was only set inside a nested if block within a try block, producing malformed output on failure (35-Utilities)
    - FIX: Disk Space Analyzer initializes $totalScanGB before the results conditional — the session change description referenced $totalScanGB which was only set inside the if ($results.Count -gt 0) block, producing null output when no paths existed (35-Utilities)

.CHANGELOG v1.16.0
    WINDOWS UPDATE STATUS & LISTENING PORTS:
    - NEW: Windows Update Status — shows last installed hotfix with age, lists 15 most recent updates with KB IDs and dates, checks Windows Update service status (wuauserv, BITS, CryptSvc, TrustedInstaller). Color-coded warnings for stale patches (30+ days yellow, 60+ days red). Accessible from Operations menu option [25] (35-Utilities, 56-OperationsMenu)
    - NEW: Listening Ports & Services — scans all TCP listening endpoints, shows well-known ports (0-1023) with service labels (SSH, DNS, HTTP, SMB, LDAP, etc.) and owning process, lists high ports (1024+). Accessible from Operations menu option [26] (35-Utilities, 56-OperationsMenu)

.CHANGELOG v1.15.0
    DRIVER HEALTH & DISK SPACE ANALYZER:
    - NEW: Driver Health Check — scans all PnP devices, flags problem devices with error descriptions, lists unsigned drivers, shows oldest third-party drivers sorted by date with version info. Accessible from Operations menu option [23] (35-Utilities, 56-OperationsMenu)
    - NEW: Disk Space Analyzer — shows all volumes with visual usage bars and color-coded thresholds (85%/95%), scans 8 common space consumers on the system drive (Windows Temp, Update Cache, Installer Cache, WinSxS, IIS Logs, etc.) sorted by size. Accessible from Operations menu option [24] (35-Utilities, 56-OperationsMenu)

.CHANGELOG v1.14.0
    EVENT LOG ALERTS & UPTIME DASHBOARD:
    - NEW: Event Log Alert Summary — scans System and Application logs for critical, error, and warning events in the last 24 hours. Groups by source with event counts, shows latest critical/error events with timestamps. Accessible from Operations menu option [21] (35-Utilities, 56-OperationsMenu)
    - NEW: Uptime & Reboot History — shows current system uptime with color-coded warnings (30+ days yellow, 60+ days red), lists last 15 planned and unexpected reboots from event log with timestamps. Accessible from Operations menu option [22] (35-Utilities, 56-OperationsMenu)

.CHANGELOG v1.13.0
    VSS WRITER STATUS & AD PREREQUISITES FIX:
    - NEW: VSS Writer Status Dashboard — queries all Volume Shadow Copy writers via vssadmin, shows stable/failed/unknown counts, lists failed writers with error details. Useful before backups and replica operations. Accessible from Operations menu option [20] (35-Utilities, 56-OperationsMenu)
    - FIX: Active Directory prerequisites check uses safe @() wrapping for IPv4Address.Count — previously, a single-NIC server could fail the static IP prerequisite check because .Count returns $null on single objects in PS 5.1 (61-ActiveDirectory)

.CHANGELOG v1.12.0
    DEFENDER STATUS DASHBOARD & SECURITY MENU EXPANSION:
    - NEW: Windows Defender Status Dashboard — shows real-time protection status (RT, behavior monitor, download scanning, network inspection, antispyware), signature version/age/update date, engine version, scan history (last full/quick scan), and recent threat detections. Color-coded warnings for disabled protections and stale signatures. Accessible from Security & Access menu option [7] (17-DefenderExclusions, 48-MenuDisplay, 49-MenuRunner)
    - Security & Access menu expanded from 9 to 10 items with Defender Status at [7], admin accounts renumbered to [8]-[10]

.CHANGELOG v1.11.0
    CERTIFICATE CHECK & ERROR HANDLING:
    - NEW: Certificate Expiry Check — scans Personal, Root CA, Intermediate CA, Web Hosting, and Remote Desktop certificate stores. Groups by expired/expiring soon (90 days)/valid with color-coded output. Shows certificate count by store. Accessible from Operations menu option [19] (35-Utilities, 56-OperationsMenu)
    - FIX: Scheduled task info query logs warning on failure instead of bare catch {} — previously, if Get-ScheduledTaskInfo threw for a specific task, the error was silently discarded (35-Utilities)
    - FIX: SMB security configuration query logs warning on failure instead of bare catch {} — previously, Get-SmbServerConfiguration failures (e.g., SMB feature not installed) were silently ignored, hiding whether SMBv1 check succeeded (35-Utilities)
    - FIX: Software inventory registry scan logs warning on failure instead of bare catch {} — if one of the two registry paths failed, the error was silently swallowed (35-Utilities)
    - FIX: HTML report disk growth calculation has documented catch instead of bare catch {} — non-critical calculation failure now has inline comment explaining the intentional suppression (54-HTMLReports)

.CHANGELOG v1.10.0
    FIREWALL SEARCH, SOFTWARE INVENTORY & MENU EXPANSION:
    - NEW: Firewall Rule Search — search by name (wildcard), port number, show enabled inbound allow rules, all block rules, or custom/recently created rules. Color-coded results with direction and action. Accessible from Security & Access menu option [5] (16-Firewall, 48-MenuDisplay, 49-MenuRunner)
    - NEW: Installed Software Inventory — scans registry for all installed programs, deduplicates 32/64-bit entries, groups by publisher, supports name search and CSV export. Accessible from Operations menu option [18] (35-Utilities, 56-OperationsMenu)
    - FIX: Network Diagnostics ARP table adapter lookup uses -ErrorAction Stop — SilentlyContinue inside try/catch made the catch unreachable (58-NetworkDiagnostics)
    - Security & Access menu expanded from 8 to 9 items with renumbered admin account options (48-MenuDisplay, 49-MenuRunner)

.CHANGELOG v1.9.67
    TASK VIEWER, SHARE AUDIT & ERROR HANDLING:
    - NEW: Scheduled Task Viewer — shows all tasks with status, last run time, and result codes. Highlights custom (non-Microsoft) tasks, failed tasks with hex error codes, and disabled tasks. Accessible from Operations menu option [16] (35-Utilities, 56-OperationsMenu)
    - NEW: SMB Share Audit — lists all SMB shares with NTFS permissions, flags Everyone write access, checks SMB encryption status and SMBv1 protocol. Shows security issue summary. Accessible from Operations menu option [17] (35-Utilities, 56-OperationsMenu)
    - FIX: Windows Update scan job error extraction logs warning instead of bare catch {} — previously silently discarded ChildJobs error details when parsing failed (14-WindowsUpdates)
    - FIX: Hyper-V install job error extraction logs warning instead of bare catch {} — same pattern as above (25-HyperV)

.CHANGELOG v1.9.66
    DISK HEALTH, STORAGE SAFETY & INPUT HARDENING:
    - NEW: Server readiness dashboard includes disk health check — detects unhealthy disks and predictive failure warnings via Get-PhysicalDisk
    - NEW: Server readiness dashboard includes disk temperature monitoring (Server 2016+) — warns when any disk exceeds 55°C via StorageReliabilityCounter
    - FIX: Storage Manager disk online/read-only operations use -ErrorAction Stop — 3 instances where SilentlyContinue inside try/catch silently swallowed Set-Disk failures, hiding read-only flag errors
    - FIX: Storage Manager drive letter assignment uses -ErrorAction Stop — Set-Partition failure was silently ignored, causing misleading success/failure messages
    - FIX: Feature install job error extraction logs warning instead of bare catch {} — previously discarded exception details when ChildJobs error parsing failed
    - FIX: Network adapter selection uses Test-NavigationCommand and case-insensitive matching — 2 instances of manual case checks replaced with standard navigation helper

.CHANGELOG v1.9.65
    EXPORTS, SESSION & LICENSING:
    - NEW: Config export includes key services section (WinRM, Defender, Cluster, DNS, etc.) with status and startup type
    - NEW: Config export includes security baseline (Secure Boot, UAC, Defender status, signature date)
    - NEW: Config export shows RDP port number in remote access section
    - NEW: Session summary offers JSON export for automation — hostname, runtime, and all changes in structured format
    - FIX: Session summary reboot logic now correctly distinguishes between session-only, Windows-only, and combined pending reboots
    - FIX: License activation detection uses case-insensitive regex — locale variations of slmgr output (e.g., "Successfully" vs "successfully") no longer cause false failures

.CHANGELOG v1.9.64
    ACCOUNT AUDIT, DEPENDENCIES & ERROR HANDLING:
    - NEW: Local Account Audit — scans all local users showing password age, last login, expiry status, and flags stale/expired accounts (Security & Access menu option 8)
    - NEW: Service Dependency Viewer — shows full dependency tree (depends on + depended on by) for any service in Service Manager (option D)
    - FIX: VM RAM validation uses -ErrorAction Stop on Get-VM — previously, SilentlyContinue inside try/catch made the catch block unreachable dead code
    - FIX: Batch config Defender exclusion check uses -ErrorAction Stop on Get-MpPreference — previously, SilentlyContinue prevented error detection when Defender is unavailable
    - FIX: HTML report NIC statistics uses -ErrorAction Stop — previously, SilentlyContinue inside try/catch swallowed errors silently
    - FIX: Storage backend auto-detection uses -ErrorAction Stop on Get-ClusterS2D and Get-ClusterResource — 3 instances where SilentlyContinue defeated try/catch error handling

.CHANGELOG v1.9.63
    CERTIFICATE CHECKS, READINESS & SAFETY:
    - NEW: Server readiness dashboard now checks for expired and soon-to-expire SSL/TLS certificates in LocalMachine\My store
    - NEW: Server readiness dashboard now checks server uptime — warns at 30+ days, flags at 60+ days without reboot
    - NEW: System health check includes full certificate inventory with expiry dates, status tags, and thumbprints
    - FIX: AD replication partner metadata wraps result in @() — single-partner DCs no longer skip replication status/force-sync due to .Count returning null
    - FIX: BitLocker key backup adds null guard and -ErrorAction Stop on Get-BitLockerVolume — prevents crash when volume info is unavailable
    - FIX: IP configuration subnet validation surfaces errors instead of silently swallowing with bare catch {}
    - FIX: Server role template viewer wraps Where-Object results in @() at assignment — consistent .Count behavior on single-role servers

.CHANGELOG v1.9.62
    MONITORING & EXPORT PATCH:
    - FIX: Health check disk latency pipeline wraps result in @() — single-disk systems no longer falsely report "GOOD" when latency is between 10-20ms
    - FIX: VM export job uses -ErrorAction Stop on Export-VM — export failures now propagate as terminating errors instead of silently completing with missing/corrupt files
    - IMPROVED: VM export disk space pre-check surfaces errors instead of silently swallowing them with bare catch {}

.CHANGELOG v1.9.61
    STORAGE & DATA PATH PATCH:
    - FIX: iSCSI target discovery now uses -ErrorAction Stop — previously, Get-IscsiTarget failures produced a non-terminating error that silently skipped all target connections
    - FIX: Partition selector wraps Get-Partition in @() — single-partition disks no longer falsely report "No eligible partitions" due to PS 5.1 .Count returning null on single objects
    - IMPROVED: Config export wraps Get-Disk and Get-Volume in individual try/catch blocks — storage section failures now show an error message instead of producing a silently blank export

.CHANGELOG v1.9.60
    VM DEPLOYMENT & SAFETY PATCH:
    - FIX: VM disk attachment now uses -ErrorAction Stop — previously, Add-VMHardDiskDrive failures were silently swallowed, leaving VMs with missing disks while reporting success
    - IMPROVED: CSV path extraction filters out degraded volumes with null SharedVolumeInfo — prevents null-dereference causing silent fallback to wrong VM storage path
    - IMPROVED: Default NIC removal on new VMs uses try/catch with warning instead of -ErrorAction SilentlyContinue — surfaces errors that would leave phantom NICs
    - IMPROVED: Batch config firewall idempotency check guards against null Get-FirewallState return value

.CHANGELOG v1.9.59
    NAVIGATION & CLEANUP PATCH:
    - FIX: "home"/"main" navigation command now works from all submenus — previously fell through to "Invalid choice" in 10 submenu runners
    - FIX: Return-to-main-menu flag now properly bubbles up through Configure Server menu — previously cleared the flag without returning, trapping the user one level deep
    - IMPROVED: Exit cleanup path deduplication now uses case-insensitive Sort-Object -Unique instead of case-sensitive Select-Object -Unique
    - IMPROVED: Exit cleanup scheduled task uses -Recurse universally for all paths — eliminates stale-path-type risk from test-at-exit vs delete-at-reboot timing gap

.CHANGELOG v1.9.58
    DATA SAFETY & VALIDATION PATCH:
    - FIX: Agent installer site number parsing now wraps pipeline in @() — single-site filenames no longer fail .Count check in PS 5.1
    - FIX: Favorites and Command History import now wraps ConvertFrom-Json in @() — single-entry JSON files no longer lose array type
    - IMPROVED: File server download validation uses -ErrorAction SilentlyContinue on Get-Item calls — prevents terminating error if file vanishes between download and size check
    - IMPROVED: SNMP Add Manager validates hostname/IP format before writing to registry

.CHANGELOG v1.9.57
    CORE INFRASTRUCTURE PATCH:
    - IMPROVED: Invoke-WithTimeout now detects failed background jobs and returns error details instead of silently returning null — callers can distinguish failure from timeout
    - IMPROVED: Get-FileHashBackground validates file exists before launching background job — returns null with error message instead of silent failure
    - FIX: Adapter info box now handles multi-homed adapters (multiple IPv4 addresses) by selecting the primary IP instead of returning an array that breaks box alignment
    - IMPROVED: Add-SessionChange guards against empty/null AppConfigDir before attempting disk writes

.CHANGELOG v1.9.56
    OPERATIONS & SAFETY PATCH:
    - IMPROVED: Batch role template install pre-fetches all feature states in one query instead of per-feature Get-WindowsFeature calls (N+1 optimization)
    - FIX: Transcript cleanup .Count on single-object result now wrapped in @() for PS 5.1 safety
    - IMPROVED: Remote service manager requires confirmation before start/stop/restart on remote servers
    - IMPROVED: Remote service manager pre-checks connectivity before attempting RPC service query
    - FIX: Storage backend detection no longer false-positives SMB3 on servers with unrelated mapped drives — now checks for cluster SMB resources specifically

.CHANGELOG v1.9.55
    REPORTING & TEMPLATES PATCH:
    - IMPROVED: Server role templates validate PostInstall function exists before invocation — prevents confusing errors from custom templates referencing missing functions
    - NEW: All 3 HTML report functions validate output directory exists before writing (health, readiness, profile comparison)
    - IMPROVED: Hyper-V Replica Server firewall rules use per-group error reporting instead of SilentlyContinue
    - IMPROVED: Cluster Dashboard pre-fetches VM groups once instead of querying per-node (N+1 optimization)

.CHANGELOG v1.9.54
    FIREWALL & SECURITY PATCH:
    - FIX: All 6 firewall template functions now use -ErrorAction Stop instead of SilentlyContinue — errors are reported per-group instead of silently swallowed
    - IMPROVED: Firewall rule viewer shows "Not Found" for missing rule groups instead of hiding them
    - NEW: Defender Hyper-V exclusions warn when Hyper-V is not installed before adding exclusions
    - IMPROVED: Local admin account creation verifies group membership after adding to Administrators

.CHANGELOG v1.9.53
    DIAGNOSTICS & SAFETY PATCH:
    - IMPROVED: Network diagnostics timed-out job cleanup — subnet sweep and port scan now detect and report timed-out background jobs instead of leaving orphans
    - IMPROVED: Active connections and ARP table wrapped in @() for PS 5.1 .Count safety, empty result fallback messages added
    - NEW: Service Manager warns about dependent services before stop/restart — shows list of running dependents that will be affected
    - NEW: Config export validates destination directory exists before gathering data
    - NEW: VM Export disk space pre-check — warns when export destination has less free space than estimated VHD sizes
    - NEW: VM Checkpoint and Export/Import menus pre-check Hyper-V installation before entering management screens

.CHANGELOG v1.9.52
    DEPLOYMENT SAFETY PATCH:
    - IMPROVED: Offline VHD registry hive unload with retry — detects failed unloads, retries after GC, shows manual fix command if still locked
    - IMPROVED: VM deployment CPU/memory configuration errors now reported instead of silently swallowed
    - NEW: VHD download disk space pre-check — warns when destination has less than 60 GB free before downloading sysprepped VHDs
    - NEW: ISO download disk space pre-check — blocks download when destination has less than 10 GB free
    - NEW: Host storage drive selection warns on low free space (<50 GB) for VM storage paths
    - IMPROVED: Session summary groups changes by category with counts, offers export to Desktop as text file

.CHANGELOG v1.9.51
    DEFENSIVE HARDENING PATCH:
    - IMPROVED: Hyper-V client-side job error extraction uses defensive pattern (ChildJobs guard, Out-String, state check, fallback message)
    - NEW: Firewall per-profile toggle — choose [1] recommended config or [2] toggle individual Domain/Private/Public profiles
    - NEW: Firewall undo support — both recommended and toggle operations register Add-UndoAction with previous state
    - IMPROVED: Event Log Viewer pre-checks Hyper-V and Cluster feature installation before querying their event logs
    - FIX: Event log export count wrapped in @() for PS 5.1 single-object .Count safety
    - FIX: Batch config export uses $script:localadminaccountname (was unscoped, exported null)
    - IMPROVED: Batch config save validates directory existence and warns on file overwrite (both template and export)
    - IMPROVED: Performance dashboard shows fallback message when no fixed volumes or active adapters are detected
    - NEW: Storage Manager ReFS allocation unit size guard — auto-overrides to 64K minimum on Windows Server

.CHANGELOG v1.9.50
    VALIDATION & RELIABILITY PATCH:
    - IMPROVED: Storage Replica uses Install-WindowsFeatureWithTimeout for progress feedback, timeout protection, and error details
    - IMPROVED: Storage Replica partnership creation validates all required fields and volume format (drive letter with colon)
    - NEW: IP configuration gateway subnet validation — warns when gateway is in a different subnet than the configured IP
    - IMPROVED: DNS configuration detects and skips duplicate primary/secondary entries
    - IMPROVED: Adapter rename trims whitespace and enforces 64-character name length limit
    - NEW: Cluster creation pre-checks node reachability before attempting New-Cluster
    - IMPROVED: Cluster quorum file share witness validates UNC path format and adds navigation support

.CHANGELOG v1.9.49
    INFRASTRUCTURE HARDENING PATCH:
    - IMPROVED: Feature install job error extraction — Install-WindowsFeatureWithTimeout now captures and displays specific error messages instead of generic "may not have completed"
    - IMPROVED: Windows Update scan failure detection — failed scan jobs now report errors instead of falsely showing "System is up to date"
    - IMPROVED: RDP enable requires confirmation before making changes, firewall service pre-check prevents silent rule failures
    - NEW: iSCSI target connection pre-checks MSiSCSI service — auto-starts if stopped, blocks with clear error if unavailable
    - NEW: SET adapter link speed mismatch warning — alerts when selected adapters have different speeds
    - IMPROVED: MPIO post-install verification — confirms cmdlet availability, shows next-step guidance for iSCSI configuration

.CHANGELOG v1.9.48
    SAFETY & FEEDBACK PATCH:
    - NEW: Disable admin lockout prevention — verifies alternate admin account exists before allowing disable
    - IMPROVED: Domain join detects partial join state after errors (prevents retry on already-joined servers)
    - IMPROVED: Timezone sync pre-flight — starts W32Time service if stopped, specific error guidance for NTP failures
    - NEW: Deduplication shows last optimization timestamp per volume
    - NEW: Password complexity visual checklist — shows pass/fail per requirement after validation

.CHANGELOG v1.9.47
    VALIDATION & SAFETY PATCH:
    - NEW: VLAN reserved range warnings (VLAN 1 default/native, 1002-1005 legacy, 4094 GVRP) with confirmation prompts
    - NEW: Hostname DNS collision check — warns if name already resolves in DNS before renaming
    - NEW: BitLocker recovery key storage guidance — prominent warning banner after enabling with secure storage options
    - NEW: BitLocker encryption progress check (option [5]) — shows per-volume encryption percentage
    - IMPROVED: Licensing activation error parsing — user-friendly messages for common error codes (edition mismatch, KMS unreachable, key blocked)
    - IMPROVED: Licensing pre-flight — automatically starts Software Protection service if stopped

.CHANGELOG v1.9.46
    MONITORING & UX PATCH:
    - NEW: Service Manager shows startup type (Auto/Manual/Disabled) with color-coded status
    - NEW: Service Manager option to change startup type (Automatic/Manual/Disabled)
    - NEW: NTP time skew detection with threshold warnings (>1s warning, >30s critical)
    - NEW: Health check disk I/O shows separate read/write latency with aggregate score
    - NEW: Disk cleanup shows real-time progress (file count + MB freed)
    - NEW: AD DS standalone replication health monitor with force-sync option

.CHANGELOG v1.9.45
    RELIABILITY & DIAGNOSTICS PATCH:
    - NEW: Enhanced ping with 20-packet statistics (min/max/avg/P95/jitter/packet loss) and color-coded thresholds
    - NEW: Quick port scan with presets for Standard, Hyper-V/Cluster, Domain Controller services
    - NEW: VM checkpoint disk space validation before creation (warns on low space)
    - NEW: VHD conversion failure handling with retry option and explicit performance warning
    - NEW: AD DS post-promotion replication health check (SYSVOL, DNS zone, replication partners)

.CHANGELOG v1.9.44
    FEATURES & QOL PATCH:
    - NEW: "home" / "main" / "m" navigation command — jump to main menu from any submenu
    - NEW: Performance Dashboard auto-refresh loop with [R] to refresh and top 5 processes display
    - NEW: Event Log Viewer custom search (log name, keyword, event ID, time range) with CSV export
    - NEW: Configurable Service Manager — override monitored services via defaults.json MonitoredServices
    - NEW: Changelog loaded from Changelog.md file instead of hardcoded heredoc
    - NEW: Batch mode pre-execution summary showing all planned actions before starting
    - NEW: Cluster operation timeouts via Invoke-WithTimeout — Get-Cluster/Get-ClusterNode/Get-ClusterResource no longer hang indefinitely
    - Expanded default service list from 10 to 15 (added Server, Workstation, EventLog, Netlogon, NTDS)
    - Added MonitoredServices config section to defaults.example.json

.CHANGELOG v1.9.43
    HARDENING & DOCS PATCH:
    - FIXED: 23 bugs across 21 modules (DNS CNAME nulls, PS 5.1 .Count issues, scriptblock injection, dead code, error handling gaps)
    - FIXED: Get-StoredCredential now returns actual credentials instead of always returning $null
    - FIXED: Session summary hours wrapping at 24, VM NIC deletion by reference equality, HTML report shallow comparison
    - FIXED: Batch config template using unscoped variables, domain join fallback defaulting to $true
    - Updated README/CONTRIBUTING test counts (1787→1854), added BOM encoding requirement
    - Added batch_config*.json and .env* to .gitignore

.CHANGELOG v1.9.42
    BUG FIXES:
    - FIXED: Firewall profile .Enabled property compared to string "True" instead of boolean $true — GpoBoolean enum comparison was fragile across PowerShell versions and inconsistent with 05-SystemCheck (16-Firewall)
    - FIXED: Admin account status display used redundant string comparison fallback — removed unnecessary -eq "True" check since Get-LocalUser.Enabled returns native boolean (48-MenuDisplay)
    - FIXED: Export-VM background job did not pass $Credential parameter — remote exports with explicit credentials failed with authentication error inside the job (53-VMExportImport)
    - FIXED: Get-VHD called without -ComputerName when listing remote VMs — VHD sizes showed "N/A" for all VMs on remote Hyper-V hosts (53-VMExportImport)
    - FIXED: Remote profile push used local $script:TempPath as remote file path — path could be wrong if remote server had different temp directory. Now queries remote $env:TEMP first (35-Utilities)
    - FIXED: User-provided file paths used -Path instead of -LiteralPath in profile comparison, HTML report comparison, config export/import, drift analysis, and baseline comparison — paths containing brackets or wildcards would silently fail (35-Utilities, 45-ConfigExport, 54-HTMLReports, 62-HyperVReplica)
    - FIXED: New-Item for directory creation outside try/catch in VHD copy, VM export, and app config initialization — failures produced cascading confusing errors instead of clear messages (41-VHDManagement, 53-VMExportImport, 55-QoLFeatures)
    - FIXED: Move-Item on converted VHD used -ErrorAction SilentlyContinue — critical file rename failure was silently swallowed, potentially returning wrong path to downstream code (41-VHDManagement)
    - FIXED: First-boot script Set-Content calls used -ErrorAction SilentlyContinue inside try/catch — write failures were suppressed so catch block never fired, user saw "success" when scripts weren't actually written (43-OfflineVHD)
    - FIXED: New-Item for first-boot Scripts directory missing -ErrorAction Stop — error not caught by enclosing try/catch due to default Continue preference (43-OfflineVHD)
    - FIXED: SNMP registry key creation used -ErrorAction SilentlyContinue — if key creation failed, subsequent New-ItemProperty threw unclear "path not found" error (55-QoLFeatures)
    - FIXED: Favorites and command history silently reset to empty array on corrupt JSON — no warning shown to user when their saved data was lost due to file corruption (55-QoLFeatures)
    - FIXED: Format-Volume pipeline output leaked to console — volume object displayed interleaved with user-facing messages (38-StorageManager)
    - FIXED: NTP source string split assumed colon present — w32tm output without colon caused index-out-of-range error on exotic locales (19-NTPConfiguration)
    - FIXED: Subnet sweep IP split assumed 4 octets — non-IPv4 address in adapter list caused index-out-of-range (58-NetworkDiagnostics)
    - FIXED: WinRM readiness check compared against "Running" but Get-WinRMState returns "Enabled" — WinRM always showed as incomplete in server readiness checks and HTML readiness reports (37-HealthCheck, 54-HTMLReports)
    - FIXED: DSRM password comparison used PtrToStringAuto instead of PtrToStringBSTR for SecureStringToBSTR pointer — violates BSTR API contract, could silently truncate passwords with embedded null characters (61-ActiveDirectory)
    - FIXED: Pagefile drive detection used $matches directly instead of codebase-standard $regexMatches pattern — fragile if code is later inserted between -match and $matches access (55-QoLFeatures)

.CHANGELOG v1.9.41
    BUG FIXES:
    - FIXED: VM export, VHD copy/convert, and Windows Update background jobs leaked on error — missing finally blocks left jobs running when exceptions occurred mid-operation (53-VMExportImport, 41-VHDManagement, 14-WindowsUpdates)
    - FIXED: PSSession leaked in remote readiness test when session creation succeeded but subsequent commands threw (35-Utilities)
    - FIXED: TcpClient socket leaked on RDP port check when BeginConnect threw — moved Close() to finally block (44-VMDeployment)
    - FIXED: Agent installer job not cleaned up in finally block — leaked on unexpected errors after job completion (57-AgentInstaller)
    - FIXED: Partial download file left in TEMP on failed self-update — now cleaned up in catch block (35-Utilities)
    - FIXED: Windows Update install silently reported success when job failed — now checks job state and shows appropriate message (14-WindowsUpdates)
    - FIXED: Division by zero in menu dashboard when WMI returned 0 for TotalVisibleMemorySize (48-MenuDisplay)
    - FIXED: Array index out of bounds when SAN target pairs were empty — accessing [0] on empty array produced null cascading through iSCSI connection logic (10-iSCSI)
    - FIXED: Metric collection interval parameter could be 0, causing division by zero — now defaults to 5 if <= 0 (54-HTMLReports)

.CHANGELOG v1.9.40
    BUG FIXES:
    - FIXED: 52 PadRight(72) overflow bugs across 15 modules — dynamic content (adapter names, IQN strings, FQDNs, VM names, user input, joined lists) could exceed 72 chars, breaking TUI box-drawing borders. All instances now truncate at 69 chars with ellipsis before padding (09-SET, 10-iSCSI, 12-DomainJoin, 19-NTPConfiguration, 27-FailoverClustering, 37-HealthCheck, 44-VMDeployment, 51-ClusterDashboard, 55-QoLFeatures, 56-OperationsMenu, 57-AgentInstaller, 58-NetworkDiagnostics, 60-ServerRoleTemplates, 61-ActiveDirectory, 62-HyperVReplica)

.CHANGELOG v1.9.39
    BUG FIXES:
    - FIXED: 10 remaining -f format string calls in disk/partition/volume display converted to string interpolation — prevents FormatException on hardware names containing curly braces (38-StorageManager, 44-VMDeployment)
    - FIXED: Test-WindowsServer returned true when WMI failed — null ProductType evaluated as $null -ne 1 = true, causing server-only features to be offered on workstations with broken WMI (05-SystemCheck)
    - FIXED: 3 Get-NetFirewallProfile calls in firewall configuration missing -ErrorAction SilentlyContinue — threw terminating error when Windows Firewall service was unavailable (16-Firewall)
    - FIXED: Get-SRGroup replication status query had no -ErrorAction — race condition if group removed between list and detail query caused unhandled exception (33-StorageReplica)
    - FIXED: Get-BitLockerVolume recovery key lookup had no -ErrorAction — threw unhandled error when BitLocker not available, showed misleading "no key" message (31-BitLocker)
    - FIXED: VHD copy progress bar received null source size when source file inaccessible — null Length passed to Write-ProgressBar caused display errors (41-VHDManagement)
    - FIXED: Get-CimInstance in domain join check missing -ErrorAction SilentlyContinue — WMI failure threw raw PowerShell error instead of graceful handling (12-DomainJoin)
    - FIXED: Batch config domain join attempted when WMI failed — null PartOfDomain evaluated as -not $null = true, triggering unwanted join attempt. Now defaults to skipping join on WMI failure (50-EntryPoint)
    - FIXED: VM switch pre-flight check produced @($null) when Hyper-V unavailable — Get-VMSwitch returning null then .Name produced null inside @(), corrupting the switch presence check (44-VMDeployment)

.CHANGELOG v1.9.38
    BUG FIXES:
    - FIXED: Unescaped single quotes in adapter name broke batch config network undo scriptblock — same class of bug as v1.9.33's fix for admin/vSwitch/vNIC names, but the adapter name in the network undo was missed (50-EntryPoint)
    - FIXED: 5 -f format string calls threw FormatException when user-settable names (volume labels, VM names, disk names, adapter names, switch names) contained curly braces — replaced with string interpolation (06-NetworkAdapters, 38-StorageManager, 44-VMDeployment)
    - FIXED: VM name prefix containing $ followed by digits silently dropped characters in -replace — regex backreference interpretation on replacement side. Now uses .Replace() for literal substitution (44-VMDeployment)
    - FIXED: VM export progress showed 0 bytes when VM name contained brackets — Test-Path and Get-ChildItem -Path interpreted [] as wildcard classes. Now uses -LiteralPath (53-VMExportImport)
    - FIXED: VM directory creation skipped when VM name contained brackets — Test-Path without -LiteralPath incorrectly reported directory exists (44-VMDeployment)
    - CLEANUP: Removed dead $script:IsEXE reference that was never assigned anywhere in the codebase (47-ExitCleanup)

.CHANGELOG v1.9.37
    BUG FIXES:
    - FIXED: 10 Get-CimInstance/Get-Partition calls inside try/catch missing -ErrorAction Stop — non-terminating errors silently bypassed catch blocks:
      * Get-CimInstance Win32_OperatingSystem in Hyper-V detection and licensing — incorrect server/client classification on WMI failure (05-SystemCheck, 21-Licensing)
      * Get-CimInstance Win32_ComputerSystem/Win32_OperatingSystem/Win32_Processor in config export — silently produced empty values in exported config (45-ConfigExport)
      * Get-CimInstance Win32_ComputerSystem in profile import domain join check — could trigger re-join attempt on WMI failure (45-ConfigExport)
      * Get-CimInstance Win32_ComputerSystem in pagefile management — null object caused confusing downstream errors in Set-CimInstance (55-QoLFeatures)
      * Get-Partition in offline VHD mount — error swallowed with no diagnostic output (43-OfflineVHD)

.CHANGELOG v1.9.36
    BUG FIXES:
    - FIXED: Config profile export saved SubnetCIDR as an array instead of integer when adapter had multiple IPv4 addresses — Get-NetIPAddress returned multiple objects, property unrolling produced [24, 16] instead of 24, which broke profile import with New-NetIPAddress -PrefixLength (45-ConfigExport)
    - FIXED: Config drift detection falsely reported IP and gateway mismatch on adapters with multiple addresses — Get-NetIPAddress and Get-NetRoute returning arrays caused scalar-to-array comparisons to always return false (45-ConfigExport)
    - FIXED: iSCSI adapter config displayed garbled IP when adapter had multiple IPv4 addresses — property unrolling on array produced concatenated output like "10.0.0.100 169.254.1.1/24 16" (10-iSCSI)
    - FIXED: 6 Test-Path calls threw terminating error when user pressed Enter without typing a path — empty string from Read-Host flowed through Test-NavigationCommand and Trim() to Test-Path which cannot bind empty string (35-Utilities, 53-VMExportImport, 54-HTMLReports)
    - FIXED: VM export default path resolved to root of C: drive when HostVMStoragePath was null — string interpolation of "$null\Exports" produced "\Exports" which resolved to C:\Exports (53-VMExportImport)

.CHANGELOG v1.9.35
    BUG FIXES:
    - FIXED: 18 TUI box-drawing lines overflowed borders when content exceeded 72 characters — long disk names, cluster node lists, FQDNs, file paths, and exception messages pushed past the right border character. Now truncates with ellipsis before padding (09-SET, 10-iSCSI, 17-DefenderExclusions, 27-FailoverClustering, 33-StorageReplica, 35-Utilities, 59-StorageBackends, 61-ActiveDirectory)
    - FIXED: Batch config accepted non-boolean strings for InstallAgent and ValidateCluster fields without error — these boolean fields were missing from the validation list, so values like "yes" or "1" passed validation but evaluated as truthy strings instead of proper booleans (50-EntryPoint)
    - FIXED: $driveLetter uninitialized in VM deployment space check when CSV path resolves successfully — returned hash included DriveLetter key with undefined value (44-VMDeployment)

.CHANGELOG v1.9.34
    BUG FIXES:
    - FIXED: VLAN IDs 5-9 silently not applied to custom vNICs in batch mode when JSON value is a quoted string — validation passed but execution-path comparison used string ordering ("5" > "4094") instead of numeric. Now casts to [int] before range check (50-EntryPoint)
    - FIXED: iSCSI host numbers 3-9 silently skipped in batch mode when JSON value is a quoted string — same root cause as VLAN bug. Validation accepted the value but execution-path comparison failed on string ordering, falling through to "Could not determine host number" with no error (50-EntryPoint)

.CHANGELOG v1.9.33
    BUG FIXES:
    - FIXED: BitLocker encryption method prompt accepted invalid input then falsely reported success — typing anything other than 1/2/3 at the encryption method menu silently skipped encryption but displayed "BitLocker enabled" and logged a session change, making the user believe the volume was encrypted (31-BitLocker)
    - FIXED: Undo stack registered a "Remove virtual switch" entry even when no switch was created — entering an unknown switch type hit the default case but the undo entry was unconditionally added outside the switch, creating a phantom undo action (50-EntryPoint)
    - FIXED: Single quotes in user-provided names broke undo scriptblocks — names like O'Brien in local admin accounts, virtual switch names, or vNIC names caused [scriptblock]::Create() to produce malformed PowerShell when building the undo command string. Now escapes single quotes before interpolation (50-EntryPoint)
    - FIXED: Single quotes in ToolName broke the self-destruct cleanup scheduled task — ToolName interpolated unescaped into the encoded cleanup command string, producing a syntax error in the post-reboot cleanup task (47-ExitCleanup)
    - PERF: Consolidated 4 separate recursive Get-ChildItem traversals of the Administrator profile into 2 — self-destruct cleanup scanned the same directory tree 4 times (once for files, 3 times for directories). Now performs one file pass and one directory pass with combined filtering (47-ExitCleanup)

.CHANGELOG v1.9.32
    BUG FIXES:
    - FIXED: 11 cmdlets inside try/catch blocks missing -ErrorAction Stop — non-terminating errors silently swallowed instead of caught:
      * Set-DnsClientServerAddress silently failed during config apply and batch mode — IP configured but DNS left unconfigured with success reported (45-ConfigExport, 50-EntryPoint)
      * Get-Partition returned stale data after Set-Partition — Format-Volume could format based on stale partition object (38-StorageManager)
      * Get-Disk, Get-Service, Get-NetAdapter, Get-WindowsFeature failed silently — misleading "not found" messages instead of actual errors (15-RDP, 38-StorageManager, 43-OfflineVHD, 45-ConfigExport, 50-EntryPoint, 59-StorageBackends, 60-ServerRoleTemplates, 09-SET)
    - FIXED: WebClient not disposed on download failure — TCP connection leaked on network timeout, 404, or disk full errors during FileServer downloads (39-FileServer)
    - FIXED: StreamReader and WebResponse not disposed on mid-stream network failure — resources leaked when reading SHA256 hash files (39-FileServer)
    - FIXED: IP sweep created O(n^2) array copies — $jobs += inside 254-iteration loop replaced with List<object> for linear performance (58-NetworkDiagnostics)

.CHANGELOG v1.9.31
    BUG FIXES:
    - FIXED: Confirm-UserAction rejected valid "yes" responses with leading/trailing whitespace — Read-Host not trimmed, causing " y" to fail the regex match (03-InputValidation, ~175 call sites affected)
    - FIXED: Typing "back" at Defender custom exclusion prompts added "back" as an actual Windows Defender exclusion path/process instead of navigating back (17-DefenderExclusions)
    - FIXED: Typing "back" at VM Export path prompt created a directory named "back" instead of navigating back (53-VMExportImport)
    - FIXED: Navigation commands ignored at remote session credential prompt, BitLocker key save path, batch config save paths, and Hyper-V Replica cleanup choice (56-OperationsMenu, 31-BitLocker, 36-BatchConfig, 62-HyperVReplica)
    - FIXED: Integer overflow crash when entering numbers larger than 2,147,483,647 at IP sweep range, pagefile size, virtual disk size, VM disk size, and metric interval/duration prompts — [int] cast throws OverflowException after regex validation passes (58-NetworkDiagnostics, 55-QoLFeatures, 59-StorageBackends, 44-VMDeployment, 56-OperationsMenu)
    - FIXED: Volume label with leading/trailing whitespace passed to Set-Volume — could create labels with invisible characters (38-StorageManager)
    - FIXED: Destructive confirmation prompts (YES/DELETE/FORMAT) rejected valid input with accidental whitespace — Read-Host not trimmed (38-StorageManager)

.CHANGELOG v1.9.30
    BUG FIXES:
    - FIXED: File integrity check crashed when hash computation failed — .Substring() called on null hash value, throwing "cannot call method on null" (39-FileServer)
    - FIXED: VM deployment disk space check reported wrong free space for Cluster Shared Volumes — drive letter extraction pointed to OS drive instead of the CSV (44-VMDeployment)
    - FIXED: Self-update temp files not cleaned up when read-only — Remove-Item missing -Force flag on 4 cleanup paths (35-Utilities)
    - FIXED: Audit log (JSONL) written in system-default encoding instead of UTF-8 — non-ASCII characters in VM names/hostnames produced corrupt JSON records (04-Navigation)
    - FIXED: Session log written in system-default encoding instead of UTF-8 (04-Navigation)
    - FIXED: Core logging function wrote in system-default encoding instead of UTF-8 (02-Logging)
    - FIXED: SHA256 hash file written without UTF-8 encoding — filenames with non-ASCII characters could cause hash verification mismatches (39-FileServer)
    - FIXED: First-boot script written to offline VHD without UTF-8 encoding — could cause parse errors on systems with different locale (43-OfflineVHD)
    - FIXED: Post-reboot cleanup task used -Path instead of -LiteralPath — paths with bracket characters silently failed to delete (47-ExitCleanup)

.CHANGELOG v1.9.29
    BUG FIXES:
    - FIXED: RDP status reported "Enabled" when registry key was inaccessible — $null -eq 0 returns $true in PowerShell, causing false positive (05-SystemCheck)
    - FIXED: Performance dashboard showed "0 GB" memory when CIM query failed — missing null guard on Get-CimInstance result (28-PerformanceDashboard)
    - FIXED: Health check showed "0 GB" memory when CIM query failed — missing null guard on $os despite other properties being guarded (37-HealthCheck)
    - FIXED: Metric collection crashed with DivideByZeroException when interval set to 0 — input validation accepted "0" as valid (56-OperationsMenu)
    - FIXED: Company defaults silently lost when defaults.json was corrupted — empty catch {} swallowed JSON parse errors (56-OperationsMenu)
    - FIXED: Trend report silently skipped corrupted snapshot files — empty catch {} with no feedback on how many files failed to parse (54-HTMLReports)
    - FIXED: Audit log rotation errors silently discarded — Write-LogMessage called without -logFilePath parameter, making it a no-op (04-Navigation)
    - FIXED: Navigation commands (back/exit) ignored at manual license key prompts — Test-NavigationCommand result checked but function never returned (21-Licensing)

.CHANGELOG v1.9.28
    BUG FIXES:
    - FIXED: File search in single-file folders returned a hashtable instead of array — Get-FileServerFiles result not wrapped in @(), causing .Count to return key count and foreach to iterate DictionaryEntry objects (39-FileServer)
    - FIXED: Pagefile drive detection skipped when exactly one pagefile existed — Get-CimInstance result not wrapped in @(), .Count returned $null and array indexing failed (55-QoLFeatures)
    - FIXED: Snapshot count displayed blank when exactly one metrics JSON existed — Get-ChildItem result not wrapped in @() (54-HTMLReports)
    - FIXED: Cluster resources "and X more" message never appeared with single resource — Get-ClusterResource .Count failed without @() wrapping (27-FailoverClustering)
    - FIXED: Installed features count check failed with single installed feature — Get-WindowsFeature pipeline not wrapped in @() (60-ServerRoleTemplates)
    - FIXED: RDP listener count displayed blank with single WSMan listener — Get-ChildItem result not wrapped in @() (15-RDP)
    - FIXED: SET team NIC count displayed blank with single-NIC team — NetAdapterInterfaceDescription property not wrapped in @() (09-SET)
    - FIXED: Deep clean reported success even when DISM component store cleanup failed — Dism.exe exit code not checked (20-DiskCleanup)
    - FIXED: Batch config reported power plan set even when powercfg failed — exit code not checked, changes counter incremented unconditionally (50-EntryPoint)
    - FIXED: Profile apply reported power plan set even when powercfg failed — exit code not checked (45-ConfigExport)

.CHANGELOG v1.9.27
    BUG FIXES:
    - CRITICAL: VHD conversion deleted the converted fixed VHD — Remove-Item targeted the same path as Move-Item destination, destroying the just-converted file (41-VHDManagement)
    - FIXED: VM import failed with single .vmcx file — Get-ChildItem result not wrapped in @(), .Count and array indexing broken on single FileInfo object (53-VMExportImport)
    - FIXED: VM checkpoint and export menus reported "No VMs available" with exactly one VM — pipeline result .Count failed on single objects (52-VMCheckpoints, 53-VMExportImport)
    - FIXED: Agent installer always showed multi-agent menu even with one agent — Get-AllAgentConfigs return value unwrapped from single-element array, .Count returned hashtable key count (57-AgentInstaller)
    - FIXED: Agent auto-match routed single match to multi-agent branch — Search-AgentInstaller result not wrapped in @() (57-AgentInstaller)
    - FIXED: Profile import crashed on old/manual JSON files missing _ProfileInfo — .PadRight() called on null property values (45-ConfigExport)
    - FIXED: VM deployment cluster discovery reported wrong NodeCount for single-node clusters — Get-ClusterNode not wrapped in @() (44-VMDeployment)
    - FIXED: VM deployment couldn't select virtual switch when only one existed — .Count on single VMSwitch was null, blocking index validation (44-VMDeployment)
    - FIXED: VM management "Total VMs" count blank with one VM — Get-VM result not wrapped in @() (44-VMDeployment)
    - FIXED: Storage backend disk counts displayed blank with single FC/NVMe/eligible disk — pipeline results not wrapped in @() (59-StorageBackends)
    - FIXED: Offline disk detection failed with single offline disk — Get-Disk pipeline not wrapped in @() (38-StorageManager)
    - FIXED: Roles & Features summary showed wrong installed count — Where-Object result not wrapped in @() (48-MenuDisplay)
    - FIXED: Hyper-V Replica VM selection reported "No VMs found" with one VM — Get-VM not wrapped in @() (62-HyperVReplica)

.CHANGELOG v1.9.26
    BUG FIXES:
    - FIXED: Disk cleanup byte counter included directory name lengths instead of file sizes — Get-ChildItem without -File counted DirectoryInfo.Length (name char count) as freed bytes (20-DiskCleanup)
    - FIXED: NTP configuration reported success even when w32tm failed — native exe exit codes were piped to Out-Null and never checked (19-NTPConfiguration)
    - FIXED: Detailed time status display broke on w32tm error output — ErrorRecord objects from 2>&1 lack .Length property, causing truncation logic to silently fail (19-NTPConfiguration)
    - FIXED: Navigation commands (exit, help, back) ignored in Host IP Network and VM Network menus — missing Test-NavigationCommand call before switch statement (49-MenuRunner)
    - FIXED: Firewall state check compared .Enabled to string "True" instead of boolean $true — also added null guard for missing firewall profiles (05-SystemCheck)
    - FIXED: Current IP display garbled when adapter had multiple IPv4 addresses — Get-NetIPAddress can return multiple objects (07-IPConfiguration)
    - FIXED: Cluster dashboard crashed on faulted/offline CSVs — SharedVolumeInfo.Partition is null when CSV is unavailable, causing division on null (51-ClusterDashboard)
    - FIXED: NIC identification menu failed with single physical adapter — pipeline result not wrapped in @() for reliable .Count and array indexing (10-iSCSI)

.CHANGELOG v1.9.25
    BUG FIXES:
    - FIXED: Bare Exit statements caused "System error" dialog when running as compiled EXE — ps2exe requires [Environment]::Exit() instead of Exit (47-ExitCleanup, 50-EntryPoint)

.CHANGELOG v1.9.24
    BUG FIXES:
    - FIXED: Batch mode internet adapter detection failed with single adapter — .Count undefined on single Where-Object result, skipped management NIC rename (50-EntryPoint)
    - FIXED: Batch mode iSCSI candidate adapter detection failed with single adapter — same .Count issue, skipped iSCSI configuration entirely (50-EntryPoint)
    - FIXED: Batch mode iSCSI adapter assignment failed with single adapter result — both primary and fallback pipelines returned scalar instead of array (50-EntryPoint)

.CHANGELOG v1.9.23
    BUG FIXES:
    - FIXED: Division by zero in readiness score calculation when no checks were evaluated (37-HealthCheck, 2 functions)
    - FIXED: Division by zero in HTML readiness report generation (54-HTMLReports)
    - FIXED: Configuration drift comparison crashed on malformed or empty JSON profile — unhandled ConvertFrom-Json exception (45-ConfigExport)

.CHANGELOG v1.9.22
    BUG FIXES:
    - FIXED: Storage Manager disk/volume selection failed with zero results — .Count on null pipeline result (38-StorageManager, 6 functions)
    - FIXED: VLAN partial match returned multiple adapters — caused wrong adapter to get VLAN tagged (08-VLAN)
    - FIXED: IP rollback failed when adapter had multiple IPv4 addresses — arrays passed where singles expected (07-IPConfiguration)
    - FIXED: Adapter status display garbled with multiple IPv4 addresses (06-NetworkAdapters)

.CHANGELOG v1.9.21
    BUG FIXES:
    - FIXED: Cluster disk/CSV selection failed with single item — .Count undefined on single pipeline result in PS 5.1 (27-FailoverClustering)
    - FIXED: Quorum disk witness selection failed with single disk — same .Count issue (27-FailoverClustering)
    - FIXED: Agent installer dropped all arguments after the first — Start-Job ArgumentList flattened array, scriptblock only received first arg (57-AgentInstaller)
    - FIXED: Paused nodes header box misaligned — .PadRight(72) applied to wrong string in box-drawing (51-ClusterDashboard)

.CHANGELOG v1.9.20
    BUG FIXES:
    - FIXED: Batch undo firewall restore produced undefined variable references — undo silently failed, leaving firewall disabled (50-EntryPoint)
    - FIXED: VM pre-flight switch validation always passed — checked non-existent top-level SwitchName instead of NICs[].SwitchName (44-VMDeployment)
    - FIXED: Deleting a VM disk removed all disks with identical properties instead of just the selected one (44-VMDeployment)
    - CLEANUP: Removed dead $initMethod variable with incorrect mapping in Hyper-V Replica initial replication (62-HyperVReplica)

.CHANGELOG v1.9.19
    BUG FIXES:
    - FIXED: Event log viewer crashed on events with null Message property — common with security audit and Hyper-V events (29-EventLogViewer)
    - FIXED: Certificate viewer/exporter crashed on certs with null Subject — self-signed and auto-enrolled certs (55-QoLFeatures)
    - FIXED: Multiple external switches caused mass deletion — Remove-VMSwitch received array of names instead of single switch (09-SET)
    - FIXED: VM export/import failed with bracket characters in VM names — Test-Path treated [] as wildcards (53-VMExportImport)
    - FIXED: SMB share connectivity test failed on share names with brackets (59-StorageBackends)
    - FIXED: iSCSI side comparison produced wrong results with single adapter result (10-iSCSI)

.CHANGELOG v1.9.18
    BUG FIXES:
    - FIXED: Single pipeline result .Count returns null in PS 5.1 — SET team detection missed single no-internet adapter for iSCSI (09-SET)
    - FIXED: FC adapter detection returned false for single HBA — storage backend misidentified as Local (59-StorageBackends)
    - FIXED: NVMe disk detection returned false for single drive — storage backend misidentified as Local (59-StorageBackends)
    - FIXED: FC port display skipped when only one HBA present (59-StorageBackends)
    - FIXED: Network sweep "No hosts responded" message never shown when zero hosts alive (58-NetworkDiagnostics)

.CHANGELOG v1.9.17
    BUG FIXES:
    - FIXED: Division by zero / NaN in performance dashboard when CIM returns null (28-PerformanceDashboard)
    - FIXED: Division by zero in health check memory percentage when CIM fails (37-HealthCheck)
    - FIXED: HTML reports uptime crash and memory division by zero on CIM failure (54-HTMLReports)
    - FIXED: Remote health check memory percentage and uptime crash on CIM failure (56-OperationsMenu)
    - FIXED: Missing -ErrorAction SilentlyContinue on CIM calls in dashboard and health check
    - FIXED: Disk usage calculations unguarded in health check and HTML reports

.CHANGELOG v1.9.16
    BUG FIXES:
    - FIXED: SAN target pairing loop skipped last entry on odd-count custom mappings (56-OperationsMenu)
    - FIXED: Batch mode virtual switch undo registered even when creation failed (50-EntryPoint)

.CHANGELOG v1.9.15
    BUG FIXES:
    - FIXED: Firewall profile status always showed "Enabled" due to GpoBoolean enum truthiness (05-SystemCheck, 16-Firewall)
    - FIXED: Firewall configuration function never enabled Public profile when disabled (16-Firewall)
    - FIXED: Connectivity test summary showed wrong pass/fail counts for single-result filters (05-SystemCheck)
    - FIXED: iSCSI SAN reachability count showed 0 when exactly 1 target reachable (10-iSCSI)
    - FIXED: VM deployment preflight check missed single-item failures/warnings (44-VMDeployment)
    - FIXED: VM smoke test pass/fail counts null for single-result filters (44-VMDeployment)
    - FIXED: Smoke test summary always reported failures when all VMs passed (44-VMDeployment)
    - FIXED: Cluster dashboard VM count blank in node selection menu (51-ClusterDashboard)
    - FIXED: AD prerequisite check reported failures even when all checks passed (61-ActiveDirectory)

.CHANGELOG v1.9.14
    BUG FIXES:
    - FIXED: Cluster dashboard VM count shows blank for nodes with 0 or 1 VM (missing array wrapping)

.CHANGELOG v1.9.13
    BUG FIXES:
    - FIXED: VM deployment site detection .Count on single cluster node (missing array wrapping)
    - FIXED: VM checkpoint list .Count on single checkpoint result (missing array wrapping)

.CHANGELOG v1.9.12
    BUG FIXES:
    - FIXED: BitLocker volume list .Count fails on single-volume systems (missing array wrapping)

.CHANGELOG v1.9.11
    BUG FIXES:
    - FIXED: Cluster dashboard node drain/resume .Count on single-item Where-Object results
    - FIXED: Firewall template status .Count on single-item rule results
    - FIXED: Defender exclusion array wrapping handles null ExclusionPath correctly

.CHANGELOG v1.9.10
    BUG FIXES:
    - FIXED: Firewall readiness check compared strings as booleans (always showed incorrect state)
    - FIXED: Batch mode firewall idempotency check had same string/boolean comparison bug
    - FIXED: Defender exclusion count fails on single-item lists (missing array wrapping)

.CHANGELOG v1.9.9
    BUG FIXES:
    - FIXED: CPU dashboard null-safe when Measure-Object returns no average
    - FIXED: Ping average null-safe in network diagnostics
    - FIXED: SET adapter connectivity results wrapped as array for consistent .Count

.CHANGELOG v1.9.8
    BUG FIXES:
    - FIXED: Deduplication status query now passes volume with drive letter colon (was silently failing)
    - FIXED: VM export size display handles null VHD sizes gracefully instead of dividing null by 1GB
    - FIXED: VHD cache size mismatch now prompts user instead of silently deleting cached file
    - FIXED: Array handling hardened for single-item results in cluster, replica, and storage modules

.CHANGELOG v1.9.7
    IMPROVEMENTS:
    - ADDED: Edit Defaults menu expanded with Auto-Update toggle, Temp Path, and Timezone Region options
    - MOVED: Validate-Release.ps1 to local/ (no longer tracked in public repo)

.CHANGELOG v1.9.6
    BUG FIXES:
    - FIXED: Disk cleanup now only counts freed bytes after successful file deletion
    - FIXED: First-run wizard auto-adopts company defaults without unnecessary prompts
    IMPROVEMENTS:
    - ADDED: Transcript directory size-based cleanup (removes oldest if directory exceeds 500MB)

.CHANGELOG v1.9.5
    NEW FEATURES:
    - ADDED: World timezone support with 7 continent-based regions (58 curated timezones)
    - ADDED: Browse all system timezones with paginated view
    - ADDED: TimeZoneRegion default to skip region picker for known deployments
    BUG FIXES:
    - FIXED: Disk space check skipped entirely when volume has exactly 0 bytes free
    - FIXED: Audit log rotation failures now logged instead of silently swallowed
    TESTS:
    - ADDED: Server Role Templates (Module 60) test coverage (Section 141)

.CHANGELOG v1.9.4
    IMPROVEMENTS:
    - ADDED: Documentation integrity and UTF-8 BOM checks in release validation pipeline
    - FIXED: Batch mode agent install uses unattended mode (no interactive prompts)
    - FIXED: Null safety for CIM queries, IP state checks, and timezone display
    - FIXED: Zero-search normalization in agent installer

.CHANGELOG v1.9.3
    BUG FIXES:
    - FIXED: Agent search supports partial site number matching and raw filename search
    - FIXED: Agent filename parser handles any prefix format (flexible regex)
    - FIXED: Agent list shows filename instead of "(unknown)" for unparsed entries

.CHANGELOG v1.4.1
    BUG FIXES:
    - FIXED: Undo stack parameter ordering now uses hashtable splatting instead of positional array
    - FIXED: Bare Exit replaced with [Environment]::Exit(0) for ps2exe EXE compatibility
    - FIXED: Per-adapter internet detection on PS 5.x uses ping.exe -S for source-bound ping
    - FIXED: NIC disable for identification now warns if adapter carries default route (management NIC)

.CHANGELOG v1.4.0
    NEW FEATURES:
    - ADDED: Server Role Templates (Module 60) - 10 built-in templates (DC, FS, WEB, DHCP, DNS, PRINT, WSUS, NPS, HV, RDS) with custom templates via defaults.json
    - ADDED: AD DS Promotion (Module 61) - New Forest, Additional DC, RODC wizards with prerequisite checks
    - ADDED: Hyper-V Replica Management (Module 62) - Enable replica server, replication wizard, status dashboard, test/planned failover, reverse replication
    - ADDED: 2 new batch steps (14: Server Role Template, 15: DC Promotion), total steps 20 -> 22
    - ADDED: System Config menu option [3] Promote to Domain Controller, renumbered [3]-[6] -> [4]-[7]
    - ADDED: Storage & Clustering menu option [6] Hyper-V Replica Management
    - ADDED: Tools menu [8] now launches full template installer (was simple role list)
    - ADDED: Add-CommandHistory function for recording menu navigation
    BUG FIXES:
    - FIXED: Undo stack corrupted when single item (array slice [0..-1] returned item instead of empty)
    - FIXED: Install-WindowsFeatureWithTimeout checking non-existent $result.Success instead of $result.ExitCode
    - FIXED: Get-WindowsVersionInfo error path returning inconsistent keys
    - FIXED: Duplicate Defender process exclusion (vmwp.exe / Vmwp.exe case duplicate)
    - FIXED: Command history never recording
    - FIXED: $localadminaccountname missing $script: prefix in batch mode
    - FIXED: Test-Connection -Source failing on PowerShell < 6 (Server 2012 R2)

.CHANGELOG v1.3.0
    NEW FEATURES:
    - ADDED: Storage Backend Generalization - iSCSI, Fibre Channel, S2D, SMB3, NVMe-oF, Local backends
    - ADDED: Module 59-StorageBackends with unified abstraction layer and per-backend management menus
    - ADDED: FC support (HBAs, WWPNs, MPIO), S2D (pool/virtual disk management), SMB3, NVMe-oF
    - ADDED: Initialize-MPIOForBackend dispatches to correct bus type
    - ADDED: Storage & SAN Management menu adapts to active backend
    - ADDED: Backend-aware batch mode with StorageBackendType and ConfigureSharedStorage keys
    - ADDED: Settings menu option [8] to change storage backend
    - 60 modules (was 59), backward compatible with all existing configs

.CHANGELOG v1.2.0
    NEW FEATURES:
    - ADDED: Custom SET vNICs with Add-CustomVNIC (preset or custom names, VLAN, inline IP config)
    - ADDED: iSCSI A/B Side Ping Check via Test-iSCSICabling (auto-detect adapter-to-switch mapping)
    - ADDED: iSCSI auto-config integration (ping check before manual A/B selection)
    - ADDED: Batch mode CustomVNICs key, total batch steps 19 -> 20
    - ADDED: Export-BatchConfigFromState detects vNICs on SET
    - ADDED: iSCSI menu option [3] Test iSCSI Cabling
    - RENAMED: Host Network [2] from "Add Backup NIC to SET" to "Add Virtual NIC to SET"
    - RENAMED: FileServer config key for agent folder (backward-compatible)

.CHANGELOG v1.1.0
    NEW FEATURES:
    - ADDED: Dynamic Defender paths auto-generated from selected host drive
    - ADDED: 5 new HOST batch steps (Host Storage, SET, iSCSI, MPIO, Defender Exclusions)
    - ADDED: Batch Config from State - detect live config and generate batch_config.json
    - ADDED: Executable Favorites - selecting a favorite runs the action directly
    - ADDED: Configuration Drift Detection in Operations menu

.CHANGELOG v1.0.18
    MAINTENANCE:
    - Minor refinements and cleanup

.CHANGELOG v1.0.17
    IMPROVEMENTS:
    - ADDED: 123 new tests across 8 sections (94-101), total now 1187
    - UPDATED: Reorganized local-only files into local/ directory

.CHANGELOG v1.0.16
    IMPROVEMENTS:
    - ADDED: Branding assets (banner, social preview, icon SVG/PNGs, favicon)
    - UPDATED: Self-hosted CI runner for pushes, GitHub-hosted for PRs

.CHANGELOG v1.0.15
    IMPROVEMENTS:
    - UPDATED: Rewrote defaults.example.json with comprehensive beginner-friendly comments
    - ADDED: New server rack icon

.CHANGELOG v1.0.14
    IMPROVEMENTS:
    - RENAMED: AbiderCloud to FileServer across all modules, config keys, functions, tests, docs
    - FIXED: Exit cleanup targeting for EXE, monolithic, and config files

.CHANGELOG v1.0.13
    NEW FEATURES:
    - ADDED: Generic VM Templates (DC, FS, WEB) with CustomVMTemplates in defaults.json
    - ADDED: Configurable VM Naming with token-based patterns via VMNaming config
    - ADDED: Linux VHD cloud-init preparation guide
    - ADDED: Dynamic agent naming via AgentInstaller.ToolName

.CHANGELOG v1.0.12
    NEW FEATURES:
    - ADDED: AutoUpdate flag in defaults.json for automatic update-on-startup

.CHANGELOG v1.0.11
    BUG FIXES:
    - FIXED: Console auto-sizing via Win32 API (maximizes window, expands buffer)

.CHANGELOG v1.0.10
    IMPROVEMENTS:
    - ADDED: 4 new test sections (90-93), ~50 new tests, total 1040+

.CHANGELOG v1.0.9
    IMPROVEMENTS:
    - REFACTORED: New-DeployedVM split into 8 focused helpers
    - ADDED: Remote Pre-flight Checks (Test-RemoteReadiness, 5-step connectivity check)

.CHANGELOG v1.0.8
    NEW FEATURES:
    - ADDED: Configurable Agent Installer (MSP-agnostic framework via defaults.json)
    - ADDED: Configurable SAN target mappings, Defender paths, storage paths, temp directory
    - ADDED: Batch mode pre-flight validation (Test-BatchConfig)

.CHANGELOG v1.0.7
    IMPROVEMENTS:
    - FIXED: EXE monolithic build-from-scratch appends Assert-Elevation entry point
    - FIXED: EXE self-update uses [Environment]::Exit(0) for ps2exe compatibility
    - ADDED: EXE icon via -IconFile in release.ps1
    - ADDED: Error handling audit, inline docs, troubleshooting guide, operations runbooks

.CHANGELOG v1.0.6
    IMPROVEMENTS:
    - ADDED: GitHub Actions CI (test suite, PSScriptAnalyzer, monolithic sync)
    - ADDED: Build from scratch when monolithic doesn't exist (CI mode)
    - ADDED: CI-safe tests skip gracefully when defaults.json absent

.CHANGELOG v1.0.5
    NEW FEATURES:
    - ADDED: Configurable VM Templates via CustomVMTemplates in defaults.json
    - ADDED: Custom VM Defaults (vCPU, RAM, memory type, disk size, disk type)
    - ADDED: Partial overrides, re-import safe, disk conversion

.CHANGELOG v1.0.4
    BUG FIXES:
    - FIXED: $script:ModuleRoot detection in compiled EXE mode (ps2exe fallback)

.CHANGELOG v1.0.3
    IMPROVEMENTS:
    - ADDED: Automatic update check on startup with main menu banner notification
    - ADDED: [U] shortcut on main menu to install updates directly
    - ADDED: Custom exe icon (RackStack.ico)
    - FIXED: Auto-update not detecting new versions (was manual-only, now checks on startup)
    - FIXED: Secret scan false positives in test code (use variables instead of literals)
    - FIXED: PSAvoidUsingWMICmdlet exclusion for PS 2.0 bootstrap script

.CHANGELOG v1.0.2
    COMPATIBILITY:
    - ADDED: Install-Prerequisites.ps1 bootstrap for WMF 5.1 (Server 2008 R2 SP1, 2012, 2012 R2)
    - ADDED: Server 2012 (non-R2) and Server 2008 R2 SP1 OS detection
    - UPDATED: OS support range now 2008 R2 SP1 through 2025

.CHANGELOG v1.0.1
    FIXES & IMPROVEMENTS:
    - ADDED: First-run setup wizard (generates defaults.json interactively on first launch)
    - ADDED: Auto-update from GitHub releases (exe and ps1 self-update)
    - ADDED: Windows Server 2012 R2 compatibility (SET/StorageReplica/Defender guards, TLS 1.2)
    - FIXED: Changelog version numbering (pre-release versions renumbered to 0.x.y)
    - FIXED: Monolithic filename defaults to "RackStack" instead of deriving from ToolFullName
    - FIXED: PSScriptAnalyzer settings cover test scripts
    - UPDATED: README with exe+json download instructions

.CHANGELOG v1.0.0
    INITIAL OPEN SOURCE RELEASE:
    - ADDED: defaults.example.json template for environment configuration
    - ADDED: docs/FileServer-Setup.md guide for setting up file server
    - ADDED: Modular architecture (63 modules) with sync-to-monolithic build
    - ADDED: 905 automated tests, PSScriptAnalyzer validation, release checks
    - ADDED: Batch mode for unattended server builds via JSON config
    - UPDATED: All paths use $PSScriptRoot-relative (no hardcoded user paths)
    - UPDATED: Semantic versioning starting at v1.0.0

.CHANGELOG v0.11.0 (internal v2.9.0)
    NEW FEATURES:
    - ADDED: Pre-flight validation (Show-PreFlightCheck) - network, domain, storage readiness checks
    - ADDED: Menu status indicators - live [OK]/[--] status for configure server menu items
    - ADDED: Role templates (Show-RoleTemplates) - auto-configure common server roles (File, Print, PACS, etc.)
    - ADDED: JSON audit logging (Show-AuditLog) - structured change tracking with export
    - ADDED: Network Diagnostics submenu - ping, port test, traceroute, subnet sweep, DNS lookup, connections, ARP
    - ADDED: Operations Menu - Remote PS Session, Remote Health Check, Remote Service Manager
    - ADDED: FileServer integration (replaced Nextcloud) - ISOs, VHDs, agent installers via REST API
    - ADDED: Quick Setup Wizard (Show-QuickSetupWizard) - guided initial server configuration
    - ADDED: Server Readiness report (Show-ServerReadiness) - comprehensive deployment readiness score
    - ADDED: Performance Dashboard (Show-PerformanceDashboard) - real-time CPU/RAM/disk/network monitoring
    - ADDED: Health dashboard on main menu - hostname, OS, uptime, CPU%, RAM%, C: free space
    - ADDED: Write-MenuItem helper for theme-aware menu rendering
    - ADDED: Get-CachedValue TTL caching system
    - ADDED: Test-WindowsServer function with client OS guards on server-only features
    - ADDED: Centralized constants ($script:PowerPlanGUID, $script:WindowsLicensingAppId)
    - ADDED: Agent post-install verification with service polling
    - ADDED: Domain join pre-flight DNS resolution check
    - ADDED: IP config rollback on failure
    - ADDED: Disk space validation before cloud downloads
    - ADDED: SET creation polling loop for vNIC appearance
    - ADDED: MPIO failure logging via Add-SessionChange
    IMPROVEMENTS:
    - UPDATED: Navigation labels with descriptive [B] Back to {parent}
    - UPDATED: RDP NLA uses proper try/catch with warning
    - UPDATED: iSCSI adapter validation with partial failure tracking
    - UPDATED: Agent installer pagination, sorting, dedup, hostname flow
    - UPDATED: DNS menu refactored to dynamic preset list
    - UPDATED: Console resize uses Win32 P/Invoke for ps2exe compatibility
    - UPDATED: defaults.json ships with custom values + KMS keys
    - UPDATED: All regions flattened to top-level (non-nested)
    - UPDATED: 755 automated tests (63 sections), PSScriptAnalyzer 0 errors

.CHANGELOG v0.10.0 (internal v2.6.0)
    NEW FEATURES - SET SMART AUTO-DETECTION:
    - ADDED: Test-AdapterInternetConnectivity - identifies which NICs have internet
    - ADDED: Auto-detect mode in SET configuration - selects NICs with internet automatically
    - ADDED: Automatic identification of iSCSI candidate adapters (NICs without internet)
    - ADDED: Option to configure iSCSI immediately after SET creation
    NEW FEATURES - iSCSI SMART AUTO-CONFIGURATION:
    - ADDED: Get-HostNumberFromHostname - extracts host number from hostname (e.g., HV2 = 2)
    - ADDED: Get-iSCSIAutoIP - calculates iSCSI IPs based on host number (172.16.1.{host}x)
    - ADDED: Test-SANTargetConnectivity - pings SAN targets to verify connectivity
    - ADDED: iSCSI auto-configure mode - detects host#, calculates IPs, configures A/B sides
    - ADDED: Get-SANTargetsForHost - returns correct SAN targets per host (cycling A0/B1, A1/B0, etc.)
    NEW FEATURES - iSCSI & SAN MANAGEMENT MENU:
    - ADDED: New submenu for complete iSCSI/SAN management
    - ADDED: Disable-NICForIdentification - temporarily disable NICs to identify on switch
    - ADDED: Connect-iSCSITargets - connect to SAN with multipath support
    - ADDED: Initialize-MPIOForISCSI - configure MPIO for iSCSI (Round Robin)
    - ADDED: Show-iSCSIStatus - display sessions, targets, MPIO status, disk mappings
    - ADDED: Disconnect-iSCSITargets - gracefully disconnect iSCSI sessions
    NEW FEATURES - UTILITIES:
    - ADDED: Compare-ConfigurationProfiles - diff two JSON profiles with color output
    - ADDED: Test-ScriptUpdate - check for script updates (configurable URL)
    - ADDED: Test-ComputerNameInAD - pre-check if computer name exists in AD
    - ADDED: Test-IPAddressInUse - check if IP is already in use (ping + DNS + ARP)
    - ADDED: Invoke-RemoteProfileApply - apply profiles to remote servers via WinRM
    - ADDED: Credential Manager - store/retrieve domain and remote server credentials
    MENU CHANGES:
    - UPDATED: Host Network menu [4] now opens iSCSI & SAN Management submenu
    - UPDATED: Settings menu now has 9 options with Utilities section
    - ADDED: [5] Compare Configuration Profiles in Settings
    - ADDED: [6] Check for Script Updates in Settings
    - ADDED: [7] Manage Stored Credentials in Settings
    - ADDED: [8] Remote Profile Application in Settings

.CHANGELOG v0.9.0 (internal v2.5.0)
    HELP & DOCUMENTATION:
    - UPDATED: Configure Server menu items renumbered (MPIO [5], Clustering [6] added)
    - ADDED: VHD & ISO Management section to Help
    - ADDED: Deployment options documentation (VHD/blank disk/batch queue)
    - ADDED: Two new tips for VHD deploy and VM queue
    CONFIGURATION PROFILES:
    - ADDED: InstallMPIO flag in Save-ConfigurationProfile
    - ADDED: InstallFailoverClustering flag in Save-ConfigurationProfile
    - ADDED: MPIO install step in Import-ConfigurationProfile (step 9/13)
    - ADDED: Failover Clustering install step in Import-ConfigurationProfile (step 10/13)
    - ADDED: Local Admin creation step in Import-ConfigurationProfile (step 11/13)
    - ADDED: Disable Built-in Admin step in Import-ConfigurationProfile (step 12/13)
    - ADDED: Preview lines for MPIO/Clustering in profile apply preview
    BATCH CONFIGURATION:
    - ADDED: InstallMPIO field in batch template
    - ADDED: InstallFailoverClustering field in batch template
    - ADDED: CreateLocalAdmin field in batch template
    - ADDED: LocalAdminName field in batch template
    - ADDED: DisableBuiltInAdmin field in batch template
    - UPDATED: Start-BatchMode now has 14 steps (was 10)
    EXPORT:
    - ADDED: MPIO status section in Export-ServerConfiguration
    - ADDED: Failover Clustering status section in Export-ServerConfiguration
    - ADDED: Cluster name and node list in export when clustered
    SETTINGS MENU:
    - ADDED: View Changelog option in Settings menu
    MAINTENANCE:
    - ADDED: Automatic transcript cleanup (removes logs older than 30 days)
    UI/UX:
    - FIXED: All menu boxes standardized to 72-char inner width
    - FIXED: Host IP Config and VM Network menu PadRight(58→60) for 72-char alignment
    - FIXED: Firewall color logic (Green = Domain:Off Private:Off Public:On)

.CHANGELOG v0.8.0 (internal v2.4.0)
    NEW FEATURES - SYSPREPPED VHD DEPLOYMENT:
    - ADDED: Download sysprepped VHDs from Google Drive (Server 2019/2022/2025)
    - ADDED: VHD caching - checks if already downloaded, offers to reuse or re-download
    - ADDED: Copy cached dynamic VHD per VM, convert to fixed, rename for VM
    - ADDED: Offline VHD customization before first boot (mount, inject registry settings)
    - ADDED: Pre-boot configuration: computer name, RDP, timezone, power plan, PS Remoting
    - ADDED: SetupComplete.cmd first-boot script for firewall rules and PS Remoting
    - ADDED: VHD Management menu with download status for all OS versions
    - ADDED: Sysprep VHD creation guide (step-by-step instructions)
    NEW FEATURES - ISO DOWNLOAD:
    - ADDED: Download Server ISOs from Google Drive (2019/2022/2025)
    - ADDED: Host ISOs stored in D:\ISOs, Cluster ISOs in C:\ClusterStorage\Volume1\ISOs
    - ADDED: ISO download status and management menu
    NEW FEATURES - HOST STORAGE SETUP:
    - ADDED: D: drive validation - checks if D: is a data drive vs optical/DVD
    - ADDED: Automatic DVD/CD drive remount from D: to free letter
    - ADDED: Disk size check (rejects drives < 20GB)
    - ADDED: Opens Disk Management if no D: data drive found
    - ADDED: Creates D:\Virtual Machines, D:\ISOs, D:\Virtual Machines\_BaseImages
    - ADDED: Sets Hyper-V default VM and VHD paths to D:\Virtual Machines
    HELPER FUNCTIONS:
    - ADDED: Get-GoogleDriveFile - reusable Google Drive download with progress
    - ADDED: Test-OpticalDrive - detects CD/DVD/ISO mounted drives
    - ADDED: Get-NextAvailableDriveLetter - finds free drive letters
    - ADDED: Move-OpticalDriveFromD - remounts optical drives off D:
    - ADDED: Initialize-HostStorage - full D: drive setup workflow
    - ADDED: Get-SyspreppedVHD - download/cache sysprepped VHDs
    - ADDED: Copy-VHDForVM - copy and convert dynamic VHD to fixed
    - ADDED: Set-OfflineVHDConfiguration - offline registry injection
    - ADDED: Show-OfflineCustomizationPrompt - pre-boot config wizard
    NEW FEATURES - VM DEPLOYMENT:
    - ADDED: Full VM Deployment system for Standalone hosts and Failover Clusters
    - ADDED: Connection modes - Local host, Remote host, or Failover Cluster
    - ADDED: Automatic site number detection from hostname (e.g., 123456-HV1 -> 123456)
    - ADDED: Standard VM templates: FS, PS, PACS, EVP, APP, COMM, REPT
    - ADDED: OS Type support (Windows/Linux) with automatic Secure Boot template selection
    - ADDED: Multi-disk template support (C + D drives defined per template)
    - ADDED: Custom VM deployment with full configuration options
    - ADDED: VM name collision detection (checks Hyper-V and DNS)
    - ADDED: Automatic next-available name suggestion (e.g., FS1 exists -> suggest FS2)
    - ADDED: Multiple disk configuration with Fixed (default) or Dynamic types
    - ADDED: Multiple NIC configuration with VLAN support
    - ADDED: Virtual switch detection and selection
    - ADDED: Generation 2 VMs with Secure Boot by default
    - ADDED: Guest Services integration configuration
    - ADDED: Time Sync auto-disabled for Domain Controllers
    - ADDED: Cluster Shared Volume (CSV) path detection for clusters
    - ADDED: View existing VMs on connected host/cluster
    - ADDED: VM-specific subdirectories for organization
    - ADDED: Automatic start/stop action configuration
    - ADDED: Production checkpoints enabled, automatic checkpoints disabled
    - ADDED: VM notes with creation timestamp
    - ADDED: Improved dynamic memory settings (sensible min/startup/max)
    HELPER FUNCTIONS:
    - ADDED: Get-SiteNumberFromHostname - extract site from naming convention
    - ADDED: Test-HyperVConnection - verify Hyper-V connectivity
    - ADDED: Test-ClusterConnection - verify cluster connectivity
    - ADDED: Find-LocalCluster - detect if running on cluster node
    - ADDED: Test-VMNameExists - check for VM name collisions
    - ADDED: Test-VMNameInDNS - check DNS for existing records
    - ADDED: Get-NextAvailableVMName - suggest available names
    - ADDED: Get-AvailableVirtualSwitches - list switches on host
    - ADDED: Get-AvailableVMStoragePaths - get default storage locations
    CONFIGURATION SYSTEM:
    - ADDED: VM Configuration builder with editable settings
    - ADDED: CPU configuration (1-64 vCPUs)
    - ADDED: Memory configuration (Static or Dynamic, 1-1024 GB)
    - ADDED: Disk management (add, edit, delete disks)
    - ADDED: NIC management (add, edit, delete, VLAN assignment)
    - ADDED: Configuration summary with full review before creation
    STORAGE MANAGER IMPROVEMENTS (v2.3 fixes):
    - IMPROVED: Get-DiskHealthStatus now uses multiple correlation methods
    - IMPROVED: Select-Partition now filters Recovery partitions and uses GPT GUIDs
    - IMPROVED: Select-Disk now identifies and warns about OS disk
    - IMPROVED: Clear-DiskData excludes OS disk from selection for safety
    - ADDED: Allocation unit size option in Format Volume (4K-64K)
    - ADDED: OS disk protection with extra confirmation warnings
    - ADDED: Better error messages with troubleshooting tips

.CHANGELOG v0.7.0 (internal v2.3.0)
    NEW FEATURES - STORAGE MANAGER:
    - ADDED: Full Storage Manager with 14 disk management options
    - ADDED: View All Disks - shows disk status, health, size, partition style, bus type
    - ADDED: View All Volumes - shows drive letters, labels, file systems, space usage
    - ADDED: View Disk Partitions - detailed partition information per disk
    - ADDED: Initialize Disk - initialize RAW disks as GPT or MBR
    - ADDED: Set Disk Online/Offline - bring disks online or take them offline
    - ADDED: Clear Disk - wipe all partitions and data (with safety confirmations)
    - ADDED: Create Partition - create new partitions with size and drive letter options
    - ADDED: Delete Partition - remove partitions (with safety warnings for system partitions)
    - ADDED: Format Volume - format with NTFS, ReFS, or exFAT, quick or full format
    - ADDED: Extend Volume - extend partitions into unallocated space
    - ADDED: Shrink Volume - shrink partitions to create free space
    - ADDED: Change Drive Letter - assign, change, or remove drive letters
    - ADDED: Change Volume Label - rename volume labels
    HELPER FUNCTIONS:
    - ADDED: Format-ByteSize - human-readable byte formatting (KB/MB/GB/TB)
    - ADDED: Get-DiskHealthStatus - retrieve physical disk health
    - ADDED: Select-Disk - disk selection with filtering options
    - ADDED: Select-Partition - partition selection helper
    SAFETY FEATURES:
    - Multiple confirmation prompts for destructive operations
    - Type-to-confirm (YES/DELETE/FORMAT) for dangerous operations
    - Warnings for system/boot partitions
    - Color-coded health and usage indicators

.CHANGELOG v0.6.0 (internal v2.2.0)
    NEW FEATURES:
    - ADDED: Restructured main menu with "Configure Server" and "Deploy VMs"
    - ADDED: System Health Check - CPU, RAM, disk, network, services status (now option 1)
    - ADDED: Enable PowerShell Remoting - secure WinRM configuration with Kerberos auth
    - ADDED: Install Agent - downloads MSP agent installer from file server by site number
    - ADDED: Save Configuration Profile - export settings as JSON for cloning to other servers
    - ADDED: Load Configuration Profile - apply saved settings to new servers
    - ADDED: Disable IPv6 option in VM Network configuration menu
    - ADDED: Undo functionality for network, system, and security changes
    - ADDED: Network adapter rename option in Host Network menu
    - ADDED: Transcript logging to C:\Temp\ with timestamped filenames
    - ADDED: Write-PressEnter helper function for consistent UX
    - ADDED: Smart caching for Configure Server menu status display
    SECURITY:
    - IMPROVED: Password handling now uses ZeroFreeBSTR for secure memory cleanup
    - ADDED: Clear-SecureMemory function for proper plaintext password disposal
    - IMPROVED: try/finally blocks ensure passwords are always cleaned from memory
    BUG FIXES:
    - FIXED: Duplicate $script:ScriptStartTime assignment removed
    - FIXED: Batch config template now uses dynamic version number
    - FIXED: Added error handling to Format-LinkSpeed function
    - FIXED: Password attempt counter now shows correct remaining attempts
    - FIXED: Removed duplicate Undo-LastChange function
    - FIXED: Consolidated Add-UndoAction/Add-UndoOperation into single function
    CODE QUALITY:
    - RENAMED: Is-HyperVInstalled to Test-HyperVInstalled (PowerShell convention)
    - RENAMED: Is-RebootPending to Test-RebootPending (PowerShell convention)
    - RENAMED: Is-ServerActivated to Test-ServerActivated (PowerShell convention)
    - RENAMED: Check-PasswordComplexity to Test-PasswordComplexity
    - RENAMED: Check-WindowsVersion to Get-WindowsVersionInfo
    - RENAMED: Configure-VM-IP to Set-VMIPAddress
    - RENAMED: Configure-VM-DNS to Set-VMDNSAddress
    - RENAMED: Configure-VLAN to Set-AdapterVLAN
    - RENAMED: Configure-SET to New-SwitchEmbeddedTeam
    - RENAMED: Configure-iSCSI to Set-iSCSIConfiguration
    - RENAMED: Display-AdaptersTable to Show-AdaptersTable
    - RENAMED: Ensure-Elevation to Assert-Elevation
    - RENAMED: Log-MessageToFile to Write-LogMessage
    - REFACTORED: DNS preset configuration to use helper function
    - IMPROVED: Session tracking for Enable-RDP, local admin, firewall, hostname, domain join
    - IMPROVED: Consistent Write-PressEnter usage throughout


.CHANGELOG v0.5.1 (internal v2.1.1)
    RESTORED FEATURES:
    - RESTORED: Full Register-ServerLicense functionality from v1.7.0
    - RESTORED: KMS client setup keys for Server 2008 through 2025
    - RESTORED: AVMA keys for Server 2012 R2 through 2025 (including Essentials and Azure editions)
    - RESTORED: Guided workflow asking Host vs VM licensing path
    - RESTORED: Datacenter host detection for AVMA eligibility
    - RESTORED: Retry logic with attempt counter for manual key entry
    BUG FIXES:
    - FIXED: Duplicate $script:ScriptStartTime assignment removed
    - FIXED: Batch config template now uses dynamic version number
    - FIXED: Added error handling to Format-LinkSpeed function
    IMPROVEMENTS:
    - ADDED: Session tracking for Enable-RDP function
    - ADDED: Session tracking for local admin account creation
    - ADDED: Session tracking for firewall configuration
    - ADDED: Session tracking for hostname changes
    - ADDED: Session tracking for domain join
    - ADDED: Session tracking for disabling built-in admin
    - ADDED: Navigation command support in Select-Physical-Adapters
    - ADDED: Navigation command support in Select-iSCSI-Adapters
    - ADDED: Navigation command support throughout licensing menus
    - IMPROVED: Shows available editions when license key not found
    - IMPROVED: Confirmation prompt before applying AVMA keys

.CHANGELOG v0.5.0 (internal v2.1.0)
    NEW FEATURES:
    - ADDED: NIC link speed display in adapter tables (10Mbps to 10Gbps+)
    - ADDED: Refresh option ('R') in adapter selection menus
    - ADDED: Test Network Connectivity function (pings gateway, DNS, internet)
    - ADDED: Power Plan configuration (High Performance recommended)
    - ADDED: Batch config template generator (creates JSON with all options)
    - ADDED: Color themes (Default, Dark, Light, Matrix, Ocean)
    - ADDED: Help system (type 'help' at main menu)
    - ADDED: Undo framework for reverting changes
    - ADDED: Settings menu (Theme/Help/Undo)
    - ADDED: DNS presets expanded (Custom, Google, Cloudflare, OpenDNS, Quad9)
    - MOVED: Test Connectivity to option 2 for quick access
    - IMPROVED: Status column widened for "Disconnected"
    - IMPROVED: Better error messages with examples

.CHANGELOG v0.4.0 (internal v2.0.0)
    NEW FEATURES:
    - ADDED: Disable IPv6 option in Host Network menu
    - ADDED: Install Hyper-V as main menu option
    - ADDED: Backup NIC creation option for SET configurations
    - ADDED: Universal "back", "cancel", "exit" command handling
    - ADDED: DNS presets (Custom Domain DNS via defaults.json)
    - ADDED: Progress indicators for long operations
    - ADDED: Session summary on exit with runtime
    - ADDED: Export configuration to file
    - ADDED: Batch mode support (JSON config file)
    BUG FIXES:
    - FIXED: Timezone function name conflict (renamed to Set-ServerTimeZone)
    - FIXED: Hyper-V detection for Windows Client vs Server
    - FIXED: Reboot detection in session summary
    - FIXED: Main Menu navigation from sub-menus
    - FIXED: Windows version detection (Windows 10/11 with version)
    - IMPROVED: VLAN error handling with adapter name detection
    - IMPROVED: Network status refresh after configuration

.CHANGELOG v0.3.0 (internal v1.9.0)
    IMPROVEMENTS:
    - FIXED: Clear-Host added before all adapter selection tables
    - FIXED: All adapter selections now show both UP and DOWN adapters
    - IMPROVED: Consistent screen clearing throughout
    - IMPROVED: Color-coded adapter status
    - KEPT: Hyper-V check before SET configuration

.CHANGELOG v0.2.0 (internal v1.8.0)
    BUG FIXES:
    - FIXED: iSCSI confirmation logic (changed -or to -and)
    - FIXED: Typo 'col1umnWidths' breaking parameter passing
    - FIXED: Typo 'R ead-Host' with extra space
    - FIXED: Wrong parameter '-ForegroundColor' should be '-color'
    - FIXED: Invalid 'Break 2' syntax - changed to 'Exit'
    - FIXED: $null comparison order
    - FIXED: VLAN menu calling wrong function
    - FIXED: $MyInvocation.MyCommand.Path scope issue
    - FIXED: Domain join credential re-prompting
    - FIXED: Duplicate timezone prompts
    NEW FEATURES:
    - ADDED: Input validation for hostnames, IPs, VLANs
    - ADDED: Windows Update timeout protection (5 min)
    - ADDED: VLAN configuration for Hyper-V adapters
    - ADDED: Network connectivity checks
    - ADDED: "back" command in menus
    IMPROVEMENTS:
    - IMPROVED: Global variable initialization
    - IMPROVED: Error messages with hints
    - IMPROVED: Password minimum 14 characters

.CHANGELOG v0.1.0 (internal v1.7.0)
    - ADDED: iSCSI NIC configuration with isolation
    - ADDED: Separate Host vs VM network menus
    - IMPROVED: Menu organization

.EXAMPLE
    .\RackStack.ps1

.EXAMPLE
    # Batch mode - create batch_config.json in same folder, then run script

.NOTES
    - Requires Windows Server 2008 R2 SP1 or later (or Windows 10/11 for testing)
    - Must be run as Administrator
    - Network changes may disconnect remote sessions
    - For batch mode on Hyper-V hosts: Install Hyper-V and build SET via GUI first
#>

#Requires -Version 5.1

# PSScriptAnalyzer suppressions for by-design patterns
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost', '', Justification='Console UI tool requires Write-Host for colored output')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidGlobalVars', '', Justification='Global RebootNeeded flag used for cross-function state')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification='Interactive tool with built-in confirmations')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingEmptyCatchBlock', '', Justification='Intentional silent error handling for optional features')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseUsingScopeModifierInNewRunspaces', '', Justification='Start-Job uses param() with -ArgumentList pattern')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseSingularNouns', '', Justification='Plural nouns used for clarity when dealing with collections')]
[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '', Justification='Operator-supplied secrets (Azure Arc SP secret, test fixtures) arrive as plaintext at the boundary; ConvertTo-SecureString is the securing step, paired with prompt scrub via Clear-SecureMemory')]
param(
    # CLI headless mode: run a specific action without interactive menus
    # Usage: RackStack.exe -Action Cleanup [-Tier Standard] [-Silent] [-OutputFormat JSON]
    [ValidateSet('Cleanup', 'Debloat', 'HealthCheck', 'Batch', 'QuickScan', 'Inventory', 'DriftCheck', 'Snapshot', 'Compliance', 'Harden', 'Remediate', 'Aggregate', 'Compare', 'Export', 'Trend', 'CertCheck', 'ReportHTML', 'ListeningPorts', 'SoftwareList', 'Uptime', 'ServiceAudit', 'EventAudit', 'NetInfo', 'ScheduledExport', 'ValidateConfig', 'Watch', 'Query', 'Diff', 'Baseline', 'Alert', 'FleetScan', 'PatchStatus', 'UserAudit', 'FirewallAudit', 'TaskAudit', 'DiskAudit', 'TLSAudit', 'SMBAudit', 'DriverAudit', 'TimeAudit', 'BootAudit', 'GPOAudit', 'MemoryAudit', 'ProcessAudit', 'BackupAudit', 'ShareAudit', 'DNSAudit', 'PowerAudit', 'RegistryAudit', 'ProfileAudit', 'HyperVAudit', 'NetworkAudit', 'StorageAudit', 'FeatureAudit', 'AutoStartAudit', 'BIOSAudit', 'ClusterAudit', 'AuditPolicyAudit', 'EnvAudit', 'CrashAudit', 'LocalGroupAudit', 'WMIAudit', 'TempAudit', 'UpdatePolicyAudit', 'IISAudit', 'SSHAudit', 'BitLockerAudit', 'PrintAudit', 'CredGuardAudit', 'PortAudit', 'AntivirusAudit', 'DotNetAudit', 'RDPAudit', 'VPNAudit', 'HostsFileAudit', 'NetStatAudit', 'LicenseAudit', 'USBDeviceAudit', 'AppLockerAudit', 'EventSubAudit', 'HotfixAudit', 'SysInfoAudit', 'LogonAudit', 'ACLAudit', 'RecoveryAudit', 'ServiceAccountAudit', 'ProxyAudit', 'PendingRebootAudit', 'PageFileAudit', 'CPUAudit', 'DefenderExclusionAudit', 'KerberosAudit', 'DHCPAudit', 'NUMAAudit', 'SymlinkAudit', 'StartupScriptAudit', 'SecureChannelAudit', 'ComObjectAudit', 'FirewallLogAudit', 'ScheduledRebootAudit', 'PowerShellAudit', 'RouteTableAudit', 'TokenPrivilegeAudit', 'WindowsCapabilityAudit', 'ARPTableAudit', 'LocaleAudit', 'TaskHistoryAudit', 'NTFSAudit', 'Win11Cleanup', 'DarkMode', 'LightMode', 'iSCSIAudit', 'NICTeamAudit', 'SMBSessionAudit', 'WindowsUpdateAudit', 'ClusterQuorumAudit', 'S2DAudit', 'VirtualSwitchAudit', 'MPIOPathAudit', 'ServiceRecoveryAudit', 'VMOvercommitAudit', 'DedupAudit', 'ClusterNetworkAudit', 'ReplicaLagAudit', 'HandleLeakAudit', 'ShadowCopyAudit', 'QoSPolicyAudit', 'LiveMigrationAudit', 'DomainTrustAudit', 'DiskLatencyAudit', 'NICOffloadAudit', 'StorageTimeoutAudit', 'EventLogCapacityAudit', 'TcpSettingsAudit', 'WinRMAudit', 'ClusterHealthScore', 'VMInventoryExport', 'VMSnapshotAudit', 'StorageHealthScore', 'CSVSpaceAudit', 'SMBConnectionAudit', 'VolumeLabelAudit', 'NICErrorAudit', 'VMResourceWaste', 'HealthDashboard', 'SCCMClientAudit', 'SCOMAgentAudit', 'WACConnectivityAudit', 'AzureADAudit', 'ServerScore', 'FleetReport', 'PasswordPolicy', 'FirewallRuleAudit', 'GPResultAudit', 'DNSCacheAudit', 'TPMAudit', 'SecureBootAudit', 'TimeSkewAudit', 'NetworkProfileAudit', 'InsecureServiceAudit', 'SelfTest', 'CheckForUpdate', 'ExportLogs', 'UpdateSelf', 'Rollback', 'ScheduleUpdateCheck', 'Dashboard', 'History', 'Replay', 'AzureArcEnroll', 'DefenderEndpointOnboard', 'WSUSSetup', 'ADCSSetup', 'StorageMigrationSetup', 'GPOBackup', 'GPODrift', 'JEAList', 'NPSSetup', 'AlwaysOnVPNSetup', 'CISScan', 'SIEMSetup', 'SIEMStatus', 'WACSetup', 'WACStatus', 'VHDXEncryptionAudit', 'ADRecycleBin', 'ClusterValidationReport', 'SmbEnforce', 'SmbSecurityCheck', 'PrintServerAudit', 'NtpHardeningAudit', 'CertBindingAudit', 'DFSAudit', 'RDSAudit')]
    [string]$Action,

    [ValidateSet('Light', 'Standard', 'Aggressive')]
    [string]$Tier = 'Standard',

    [string]$Config,

    [switch]$Silent,

    [ValidateSet('Console', 'JSON')]
    [string]$OutputFormat = 'Console',

    # Save CLI action output to file (works with any -Action)
    [string]$OutputFile,

    # Show version and exit
    [switch]$Version,

    # List all available CLI actions and exit
    [switch]$ListActions,

    # Suppress console box-drawing output (only emit JSON when -OutputFormat JSON)
    [switch]$Quiet,

    # Emit newline-delimited JSON events for long-running actions instead of a single
    # summary at the end. Works in combination with -OutputFormat JSON. Consumers can
    # parse line-by-line to drive progress UIs or pipeline orchestration.
    [switch]$Stream
)