From 5da3df76bec6fcfc3e61e6c30d5c25ead05b275d Mon Sep 17 00:00:00 2001
From: fadwen <110697945+fadwen@users.noreply.github.com>
Date: Mon, 5 Oct 2026 22:01:41 -0700
Subject: [PATCH] perf(validation): Collect moves its payload in one guest
 agent call, gzipped

The payload went through 179 guest exec calls of 100,000 characters at about 6 seconds each, 25 minutes for one Collect. The device now gzips the JSON (13.4 MB to 380 KB) and the driver reads it with the agent's file-read call in one reply; scripts go in through file-write, 30,000 characters per call instead of 1,200. Both checked by SHA-256. Collect -Since keeps only the probe records from a time on. 3.9 minutes for the same run, 2 with -Since.

REM-INSTALL-MODULE hangs for its 60-minute timeout every hour and held round 10's seven detections for 70 minutes; its assignment is removed, the policy stays.
---
 CHANGELOG.md                                  |  10 +-
 Validation/Findings.md                        |   2 +-
 Validation/GuestAgent.ps1                     | 131 +++++++++----
 Validation/Invoke-LabGuestScript.ps1          |  22 +--
 Validation/Invoke-ValidationRound.ps1         |  77 ++++----
 Validation/README.md                          |  17 +-
 .../Unit/Invoke-ValidationRound.Tests.ps1     | 180 +++++++++++-------
 7 files changed, 282 insertions(+), 157 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7cb3960..037fd0e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,15 @@ release notes.
 
 ## [Unreleased]
 
-Nothing yet.
+### Changed
+
+- Validation kit: `Collect` moves its payload through the guest agent's file-read call in one
+  reply, gzipped on the device before base64, instead of 179 guest exec calls of 100,000
+  characters; scripts go in through the agent's file-write call, 30,000 characters per call
+  instead of 1,200 (`Send-GuestFile`, `Receive-GuestFile` in `GuestAgent.ps1`). `Collect -Since`
+  keeps only the probe records written from that time on. The round-7 experiment
+  `REM-INSTALL-MODULE`, which hangs for its 60-minute timeout every hour and holds the lab's
+  remediation runner, is no longer assigned.
 
 ## [0.27.0] - 2026-10-05
 
diff --git a/Validation/Findings.md b/Validation/Findings.md
index 1008528..e49a1b4 100644
--- a/Validation/Findings.md
+++ b/Validation/Findings.md
@@ -287,7 +287,7 @@ device, the agent restarted once to fetch them.
 |---|---|---|---|
 | Execution policy | Scripts run regardless of the device's execution policy (PS) | AgentExecutor launches every script as `powershell.exe -NoProfile -executionPolicy bypass -file <script>`; inside a remediation `Get-ExecutionPolicy -List` read `MachinePolicy=Undefined;UserPolicy=Undefined;Process=Bypass;CurrentUser=Undefined;LocalMachine=Undefined` (REM-EXECPOLICY). A `Set-ExecutionPolicy` in a script changes nothing for that run; any scope but Process changes the device's policy as SYSTEM | ✅ |
 | Module path under SYSTEM | Not documented | `$env:PSModulePath` in a SYSTEM remediation is `WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules`: the first entry is a **relative** path, because SYSTEM has no Documents folder to resolve, so a module installed with `-Scope CurrentUser` as SYSTEM lands nowhere useful. 90 modules were available on a plain Windows 11 device, the same list as `Get-Module -ListAvailable` under SYSTEM outside the agent (REM-PSMODULEPATH; the list is Get-IslInboxModule) | ⚠️ |
-| `Install-Module` from a remediation | Not documented | **Hangs the queue.** `Find-Module` and `Install-Module -Scope CurrentUser -Force` in a SYSTEM detection script never returned: no NuGet provider on the device, no network connection from the process, 12 s of CPU in 20 minutes, 14 threads, stuck on the provider-bootstrap prompt that a non-interactive session cannot answer. Because remediations run one at a time, every remediation queued behind it waited too; the agent killed it at exactly 60 minutes (AgentExecutor.log `Error:Powershell script execution timed out. timeout = 3600 seconds`, agent log `exitCode = 2147483647`), Graph reports `detectionState scriptError`, and the queue moved on; the two remediations behind it ran an hour late (REM-INSTALL-MODULE) | ⚠️ |
+| `Install-Module` from a remediation | Not documented | **Hangs the queue.** `Find-Module` and `Install-Module -Scope CurrentUser -Force` in a SYSTEM detection script never returned: no NuGet provider on the device, no network connection from the process, 12 s of CPU in 20 minutes, 14 threads, stuck on the provider-bootstrap prompt that a non-interactive session cannot answer. Because remediations run one at a time, every remediation queued behind it waited too; the agent killed it at exactly 60 minutes (AgentExecutor.log `Error:Powershell script execution timed out. timeout = 3600 seconds`, agent log `exitCode = 2147483647`), Graph reports `detectionState scriptError`, and the queue moved on; the two remediations behind it ran an hour late (REM-INSTALL-MODULE). It did the same every hourly cycle afterwards and held round 10's seven detections for 70 minutes, so its assignment was removed on 2026-10-06; the policy stays in the tenant, unassigned | ⚠️ |
 | `#Requires -Modules` for a module the device lacks | The script does not run (PS docs on #Requires) | As documented, and what Intune makes of it: the detection exits 1 without running, stderr `The script 'detect.ps1' cannot be run because the following modules that are specified by the "#requires" statements of the script are missing: IslNoSuchModule` (`ScriptRequiresMissingModules`), so the remediation script **runs** (exit 0), the post-detection fails the same way, and Graph reports `detectionState fail, remediationState remediationFailed` with the error text in both detection outputs (REM-REQUIRES-MODULE) | ✅ |
 | Script size | "Scripts must be less than 200 KB" (REM, PS) | Not enforced at 200 KB. Through the Graph API a remediation of 504 KB and a platform script of 660 KB were accepted; 512 KB and 680 KB were refused with a generic "An error has occurred" (no size in the message). On the device a 500 KB platform script ran (PS-SIZE-500KB, probe record at 00:31:49) and a 250 KB remediation ran and reported `big script ran` with `detectionState success` (REM-SIZE-250KB) | ❌ |
 
diff --git a/Validation/GuestAgent.ps1 b/Validation/GuestAgent.ps1
index 57a4222..f39a4a0 100644
--- a/Validation/GuestAgent.ps1
+++ b/Validation/GuestAgent.ps1
@@ -143,32 +143,98 @@ function Invoke-GuestPowerShell {
     $output
 }
 
-function Read-GuestPayload {
+function Send-GuestFile {
     <#
     .SYNOPSIS
-        Fetches a base64 text file from the VM in chunks and checks it against the VM's own hash.
+        Writes a file into the VM through the guest agent's file-write call and checks its hash.
 
     .DESCRIPTION
-        A payload of megabytes returned in one reply makes the guest agent time out its own status
-        call, so it is read 100,000 characters at a time. A chunk that comes back short is asked
-        again. The whole text is then hashed and compared with the SHA-256 the VM computed over its
-        copy: a chunk with the right length and the wrong content is otherwise found only as a
-        parse error somewhere in the middle of the result, if at all.
+        The agent's file-write call takes the content as text on the host's command line, about
+        30,000 characters at a time here, against 1,200 per guest exec before (a 140 KB module zip
+        went over as five parts in under a minute, where guest exec needs about 6 seconds per part).
+        The bytes go as base64 in numbered part files, which a guest command joins, decodes and
+        removes; a part written twice replaces itself. The VM's SHA-256 of the written file is
+        compared with the local one.
 
     .PARAMETER RemotePath
-        The file on the VM. ASCII text (base64).
+        Where the file lands on the VM.
 
-    .PARAMETER Size
-        Its length in characters, as the VM reported it.
+    .PARAMETER Bytes
+        The file's bytes.
+
+    .PARAMETER PartSize
+        Base64 characters per file-write call. Default 30000, which keeps the whole ssh command
+        line under the 32,767 characters Windows allows.
+
+    .EXAMPLE
+        Send-GuestFile -RemotePath 'C:\ProgramData\IntuneScriptLab\collect.ps1' -Bytes $bytes
+
+        The script is on the VM, byte for byte.
+
+    .OUTPUTS
+        None.
+    #>
+    [CmdletBinding()]
+    [OutputType([void])]
+    param(
+        [Parameter(Mandatory)]
+        [string]$RemotePath,
+
+        [Parameter(Mandatory)]
+        [byte[]]$Bytes,
+
+        [int]$PartSize = 30000
+    )
+
+    $null = Invoke-GuestPowerShell -Script ("`$null = New-Item -ItemType Directory -Path " +
+        "'$(Split-Path -Path $RemotePath -Parent)' -Force; " +
+        "Remove-Item -Path '$RemotePath.b64.*' -ErrorAction SilentlyContinue")
+    $b64 = [Convert]::ToBase64String($Bytes)
+    $index = 0
+    for ($offset = 0; $offset -lt $b64.Length; $offset += $PartSize) {
+        $part = $b64.Substring($offset, [Math]::Min($PartSize, $b64.Length - $offset))
+        $partPath = '{0}.b64.{1:D4}' -f $RemotePath, $index++
+        $command = "pvesh create /nodes/`$(hostname)/qemu/$VmId/agent/file-write " +
+            "--file '$partPath' --content '$part'"
+        $raw = ssh -o BatchMode=yes $ProxmoxHost $command 2>&1
+        if ($LASTEXITCODE -ne 0) {
+            throw "file-write of $partPath failed on ${ProxmoxHost}: $(($raw -join ' ').Trim())"
+        }
+    }
+    $join = "`$parts = Get-ChildItem -Path '$RemotePath.b64.*' | Sort-Object Name | " +
+        "ForEach-Object { (Get-Content -Path `$_.FullName -Raw).Trim() }; " +
+        "[IO.File]::WriteAllBytes('$RemotePath', [Convert]::FromBase64String((-join `$parts))); " +
+        "Remove-Item -Path '$RemotePath.b64.*'; (Get-FileHash -Path '$RemotePath' -Algorithm SHA256).Hash"
+    $remoteHash = "$(Invoke-GuestPowerShell -Script $join)".Trim()
+    $sha = [Security.Cryptography.SHA256]::Create()
+    try { $localHash = [BitConverter]::ToString($sha.ComputeHash($Bytes)) -replace '-', '' }
+    finally { $sha.Dispose() }
+    if ($remoteHash -ne $localHash) {
+        throw "$RemotePath did not arrive intact: the VM hashes it $remoteHash, the local bytes hash $localHash"
+    }
+    Write-Verbose "Sent $($Bytes.Length) bytes to $RemotePath in $index part(s)"
+}
+
+function Receive-GuestFile {
+    <#
+    .SYNOPSIS
+        Reads a text file from the VM in one guest agent call and checks it against the VM's hash.
+
+    .DESCRIPTION
+        The agent's file-read call returns a file of up to 16 MB in one reply; 507,000 characters
+        came back in 2 seconds, where reading the same text through guest exec took 179 calls of
+        100,000 characters. The text is hashed and compared with the SHA-256 the VM computed over
+        its copy, so a reply that is not the file is refused with both hashes rather than found
+        as a parse error later.
+
+    .PARAMETER RemotePath
+        The file on the VM. ASCII text, base64 as the collect script writes it.
 
     .PARAMETER Sha256
         The SHA-256 of its text as the VM computed it, in hex.
 
-    .PARAMETER ChunkSize
-        Characters per call. Default 100000.
-
     .EXAMPLE
-        Read-GuestPayload -RemotePath 'C:\ProgramData\IntuneScriptLab\collect.b64' -Size 17838300 -Sha256 $hash
+        Receive-GuestFile -RemotePath 'C:\ProgramData\IntuneScriptLab\collect.b64' -Sha256 $hash
 
         The file's text, or an error naming both hashes when it did not arrive intact.
 
@@ -182,36 +248,29 @@ function Read-GuestPayload {
         [string]$RemotePath,
 
         [Parameter(Mandatory)]
-        [int]$Size,
-
-        [Parameter(Mandatory)]
-        [string]$Sha256,
-
-        [int]$ChunkSize = 100000
+        [string]$Sha256
     )
 
-    $parts = for ($offset = 0; $offset -lt $Size; $offset += $ChunkSize) {
-        $length = [Math]::Min($ChunkSize, $Size - $offset)
-        $read = "[IO.File]::ReadAllText('$RemotePath').Substring($offset, $length)"
-        # A reply without its output (the agent occasionally returns none for a large chunk) is asked again
-        $part = $null
-        for ($try = 1; $try -le 3 -and "$part".Trim().Length -ne $length; $try++) {
-            if ($try -gt 1) { Write-Warning "Payload chunk at $offset came back short; retrying"; Start-Sleep 5 }
-            $part = Invoke-GuestPowerShell -TimeoutSeconds 120 -Script $read
-        }
-        if ("$part".Trim().Length -ne $length) { throw "Payload chunk at $offset could not be read" }
-        "$part".Trim()
+    $command = "pvesh get /nodes/`$(hostname)/qemu/$VmId/agent/file-read --file '$RemotePath' --output-format json"
+    $raw = ssh -o BatchMode=yes $ProxmoxHost $command 2>&1
+    $text = ($raw -join "`n").Trim()
+    if ($LASTEXITCODE -ne 0 -or -not $text.StartsWith('{')) {
+        throw "file-read of $RemotePath failed on ${ProxmoxHost}: $text"
+    }
+    $reply = $text | ConvertFrom-Json
+    if ($reply.truncated) {
+        throw "$RemotePath is longer than the 16 MB the guest agent's file-read call returns"
     }
-    $text = -join $parts
+    $content = "$($reply.content)"
     $sha = [Security.Cryptography.SHA256]::Create()
     try {
-        $digest = $sha.ComputeHash([Text.Encoding]::ASCII.GetBytes($text))
+        $digest = $sha.ComputeHash([Text.Encoding]::ASCII.GetBytes($content))
         $actual = [BitConverter]::ToString($digest) -replace '-', ''
     }
     finally { $sha.Dispose() }
     if ($actual -ne $Sha256) {
-        throw ("The payload from $RemotePath did not arrive intact: $($text.Length) characters with SHA-256 " +
-            "$actual, the VM's copy has $Sha256")
+        throw ("$RemotePath did not arrive intact: $($content.Length) characters with SHA-256 $actual, " +
+            "the VM's copy has $Sha256")
     }
-    $text
+    $content
 }
diff --git a/Validation/Invoke-LabGuestScript.ps1 b/Validation/Invoke-LabGuestScript.ps1
index 95cfa7e..1a9d53b 100644
--- a/Validation/Invoke-LabGuestScript.ps1
+++ b/Validation/Invoke-LabGuestScript.ps1
@@ -81,26 +81,14 @@ $ErrorActionPreference = 'Stop'
 
 $remote = "C:\ProgramData\IntuneScriptLab\$RemoteName"
 $content = Get-Content -Path (Resolve-Path -Path $ScriptPath) -Raw
-$b64 = [Convert]::ToBase64String([Text.UTF8Encoding]::new($true).GetPreamble() +
-    [Text.Encoding]::UTF8.GetBytes($content))
-$null = Invoke-GuestPowerShell -Script ("New-Item -ItemType Directory -Path 'C:\ProgramData\IntuneScriptLab' " +
-    "-Force | Out-Null; Remove-Item -Path '$remote.b64.*' -ErrorAction SilentlyContinue")
-$index = 0
-for ($offset = 0; $offset -lt $b64.Length; $offset += 1200) {
-    $part = $b64.Substring($offset, [Math]::Min(1200, $b64.Length - $offset))
-    $partPath = '{0}.b64.{1:D4}' -f $remote, $index++
-    $null = Invoke-GuestPowerShell -Script "Set-Content -Path '$partPath' -Value '$part' -NoNewline"
-}
-$deliveredMessage = "Delivered $ScriptPath to VM $VmId as $remote ($index parts)"
-Write-Information -InformationAction Continue -MessageData $deliveredMessage
-
-$decode = "`$parts = Get-ChildItem -Path '$remote.b64.*' | Sort-Object Name | " +
-    "ForEach-Object { Get-Content -Path `$_.FullName -Raw }; " +
-    "[IO.File]::WriteAllBytes('$remote', [Convert]::FromBase64String((-join `$parts)))"
+$bytes = [Text.UTF8Encoding]::new($true).GetPreamble() + [Text.Encoding]::UTF8.GetBytes($content)
+Send-GuestFile -RemotePath $remote -Bytes $bytes
+Write-Information -InformationAction Continue -MessageData "Delivered $ScriptPath to VM $VmId as $remote"
+
 # A parameter name (-AutoLogon) must reach the script bare, or it binds as a positional string;
 # only values with spaces or quotes are quoted
 $arguments = ($ArgumentList | ForEach-Object {
         if ($_ -match '^-[A-Za-z]' -or $_ -notmatch "[\s']") { $_ } else { "'$($_ -replace "'", "''")'" }
     }) -join ' '
 Invoke-GuestPowerShell -TimeoutSeconds $TimeoutSeconds -Script (
-    "$decode; Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; & '$remote' $arguments")
+    "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; & '$remote' $arguments")
diff --git a/Validation/Invoke-ValidationRound.ps1 b/Validation/Invoke-ValidationRound.ps1
index a3b8096..3d682a9 100644
--- a/Validation/Invoke-ValidationRound.ps1
+++ b/Validation/Invoke-ValidationRound.ps1
@@ -51,6 +51,10 @@ param(
     # install-status export job of 20-30 seconds
     [string[]]$AppName,
 
+    # Collect: only the probe records written at or after this time (the records of a device that
+    # has run the hourly experiments for weeks are most of the payload); every record when omitted
+    [datetime]$Since,
+
     [string]$GroupName = 'ISL-Validation-Devices',
 
     # Deploy: leave the group's membership alone (a user group for user-targeted experiments)
@@ -157,10 +161,21 @@ function ConvertTo-ScriptContent {
     }
 }
 
+function Expand-GzipText {
+    # The collect payload as the device wrote it: base64 of gzip of UTF-8 JSON, back to the JSON text
+    param([Parameter(Mandatory)][string]$Base64)
+    $packed = [System.IO.MemoryStream]::new([Convert]::FromBase64String($Base64))
+    $gzip = [System.IO.Compression.GZipStream]::new($packed, [System.IO.Compression.CompressionMode]::Decompress)
+    $plain = [System.IO.MemoryStream]::new()
+    try { $gzip.CopyTo($plain) }
+    finally { $gzip.Dispose(); $packed.Dispose() }
+    [Text.Encoding]::UTF8.GetString($plain.ToArray())
+}
+
 function Invoke-GuestScriptFile {
     # Runs a script that is too long for the guest agent's command line (a few KB): the script is
-    # delivered as base64 in numbered part files, decoded on the VM and run by path. The guest agent
-    # calls themselves are Invoke-GuestPowerShell's, in GuestAgent.ps1.
+    # written to the VM through Send-GuestFile and run by path. The guest agent calls themselves
+    # are in GuestAgent.ps1.
     param(
         [Parameter(Mandatory)][string]$Script,
         [int]$TimeoutSeconds = 900,
@@ -169,27 +184,14 @@ function Invoke-GuestScriptFile {
         [switch]$Detach
     )
     $remote = "C:\ProgramData\IntuneScriptLab\$RemoteName"
-    $b64 = [Convert]::ToBase64String([Text.UTF8Encoding]::new($true).GetPreamble() +
-        [Text.Encoding]::UTF8.GetBytes($Script))
-    # One file per chunk, written with Set-Content: a chunk call that ran twice (a start call retried
-    # after a host-side timeout) then rewrites the same part instead of appending it twice, which once
-    # produced a script that no longer parsed; the device joins the parts in order
-    $null = Invoke-GuestPowerShell -Script "Remove-Item -Path '$remote.b64*' -ErrorAction SilentlyContinue"
-    $index = 0
-    for ($offset = 0; $offset -lt $b64.Length; $offset += 1200) {
-        $part = $b64.Substring($offset, [Math]::Min(1200, $b64.Length - $offset))
-        $partPath = '{0}.b64.{1:D4}' -f $remote, $index++
-        $null = Invoke-GuestPowerShell -Script "Set-Content -Path '$partPath' -Value '$part' -NoNewline"
-    }
-    $decode = "`$parts = Get-ChildItem -Path '$remote.b64.*' | Sort-Object Name | " +
-        "ForEach-Object { Get-Content -Path `$_.FullName -Raw }; " +
-        "[IO.File]::WriteAllBytes('$remote', [Convert]::FromBase64String((-join `$parts)))"
+    $bytes = [Text.UTF8Encoding]::new($true).GetPreamble() + [Text.Encoding]::UTF8.GetBytes($Script)
+    Send-GuestFile -RemotePath $remote -Bytes $bytes
     if (-not $Detach) {
         # The agent's own powershell.exe runs under the machine execution policy, which refuses a
         # script file on a fresh device; the process-scoped bypass is what -File -ExecutionPolicy
         # Bypass would have given
         return Invoke-GuestPowerShell -TimeoutSeconds $TimeoutSeconds -Script (
-            "$decode; Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; & '$remote'")
+            "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; & '$remote'")
     }
     # A script that runs for minutes is started detached and watched through a done marker with short
     # calls, so no single guest agent call has to stay open for it; its output is read from a file
@@ -208,7 +210,7 @@ function Invoke-GuestScriptFile {
     # by the first, skip the script and write the done marker at once: the started marker makes a
     # repeated launch a no-op
     $launch = "if (-not (Test-Path -Path '$remote.started')) { " +
-        "Set-Content -Path '$remote.started' -Value started; $decode; [IO.File]::WriteAllText('$remote.cmd', " +
+        "Set-Content -Path '$remote.started' -Value started; [IO.File]::WriteAllText('$remote.cmd', " +
         "[Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('$runnerB64'))); " +
         "Start-Process -FilePath '$remote.cmd' -WindowStyle Hidden }"
     $null = Invoke-GuestPowerShell -Script $launch
@@ -683,8 +685,11 @@ function Get-RegTree($Path) {
 }
 $ime = 'HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension'
 [ordered]@{
+    # Every probe record, or only those from -Since on: Time is written with ToString('o') in UTC,
+    # so the strings compare in time order
     Probes          = Get-ChildItem 'C:\ProgramData\IntuneScriptLab\*.jsonl' | ForEach-Object {
-        Get-Content -Path $_.FullName -Encoding UTF8 | ForEach-Object { $_ | ConvertFrom-Json }
+        Get-Content -Path $_.FullName -Encoding UTF8 | ForEach-Object { $_ | ConvertFrom-Json } |
+            Where-Object { -not '--SINCE--' -or "$($_.Time)" -ge '--SINCE--' }
     }
     Markers         = @(Get-ChildItem 'C:\ProgramData\IntuneScriptLab' -File |
         Where-Object { $_.Extension -in '.marker', '.uninstalled', '.installed' } | ForEach-Object Name)
@@ -718,31 +723,35 @@ $ime = 'HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension'
         } |
         Select-Object -Last 600)
 } | ConvertTo-Json -Depth 8 -Compress | ForEach-Object {
-    # Base64 so non-ASCII survives the guest agent's console code page. Written to a file and
-    # fetched in chunks: returned in one piece, the payload (27 apps' registry trees plus the log
-    # tail) made the guest agent time out its own status call
-    $b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($_))
+    # Gzip, then base64 so non-ASCII survives the guest agent's console code page: the JSON of a
+    # device with a month of hourly probe records is 13 MB and packs to under 400 KB, which the
+    # host reads in one guest agent call
+    $json = [Text.Encoding]::UTF8.GetBytes($_)
+    $packed = New-Object System.IO.MemoryStream
+    $mode = [System.IO.Compression.CompressionMode]::Compress
+    $gzip = New-Object System.IO.Compression.GZipStream $packed, $mode
+    $gzip.Write($json, 0, $json.Length)
+    $gzip.Dispose()
+    $b64 = [Convert]::ToBase64String($packed.ToArray())
     [IO.File]::WriteAllText('C:\ProgramData\IntuneScriptLab\collect.b64', $b64)
-    # The length and a hash of the text, so the host can tell whether every chunk arrived as written
+    # The length and a hash of the text, so the host can tell whether it arrived as written
     $sha = [Security.Cryptography.SHA256]::Create()
     $hash = [BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::ASCII.GetBytes($b64))) -replace '-', ''
     "$($b64.Length) $hash"
 }
 '@
-    # The log filters need the policy ids; the device script is a literal, so they are spliced in
+    # The log filters need the policy ids and the probe filter its time; the device script is a
+    # literal, so they are spliced in
     $policyIds = @($remediations.Id) + @($platform.Id) | Where-Object { $_ }
-    $deviceScript = $deviceScript.Replace('--POLICYIDS--', ($policyIds -join '|'))
+    # A nested function's $PSBoundParameters is its own; an unbound [datetime] is MinValue
+    $sinceText = if ($Since -gt [datetime]::MinValue) { $Since.ToUniversalTime().ToString('o') } else { '' }
+    $deviceScript = $deviceScript.Replace('--POLICYIDS--', ($policyIds -join '|')).Replace('--SINCE--', $sinceText)
     $summary = Invoke-GuestScriptFile -Script $deviceScript -TimeoutSeconds 1500 -Detach
     if ("$summary" -notmatch '^\s*(\d+) ([0-9A-Fa-f]{64})\s*$') {
         throw "The device collect script returned no payload size and hash ('$summary'); see the warning above"
     }
-    $payloadSplat = @{
-        RemotePath = 'C:\ProgramData\IntuneScriptLab\collect.b64'
-        Size       = [int]$Matches[1]
-        Sha256     = $Matches[2]
-    }
-    $encoded = Read-GuestPayload @payloadSplat
-    $device = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)) | ConvertFrom-Json
+    $encoded = Receive-GuestFile -RemotePath 'C:\ProgramData\IntuneScriptLab\collect.b64' -Sha256 $Matches[2]
+    $device = Expand-GzipText -Base64 $encoded | ConvertFrom-Json
 
     $null = New-Item -ItemType Directory -Path $ResultsPath -Force
     $file = Join-Path -Path $ResultsPath -ChildPath ("round-{0:yyyyMMdd-HHmmss}.json" -f (Get-Date))
diff --git a/Validation/README.md b/Validation/README.md
index e1654ec..47ecc36 100644
--- a/Validation/README.md
+++ b/Validation/README.md
@@ -12,7 +12,7 @@ with the documented behaviour next to the observed one.
 | `Probe.ps1` | Header prepended to every experiment. Records user, bitness, PowerShell version, command line, encoding and paths to `C:\ProgramData\IntuneScriptLab\<experiment>.jsonl` on the device. Windows PowerShell 5.1 only. |
 | `Experiments.psd1` | The experiments: `Remediations`, `PlatformScripts` and `Win32Apps`. Each has a `Question`, a script body and optional `RunAs32Bit`, `RunAsAccount`, `Bom`, `Requirement`. Win32 entries can also carry `DetectionRules` / `RequirementRules` (file, registry, product code and script rule specs), `Intent` (`required` or `uninstall`), `EnforceSignatureCheck`, `Requirements` (base requirement properties by Graph name), `Filter` (an assignment filter rule and mode), `InstallContext`, `DependsOn`, `Supersedes`, `Assign = $false` and `Package` (a real MSI); remediations a `Schedule` (`RunOnce`, `Daily` or hourly with an `Interval`) and `DetectOnly`. |
 | `GraphRules.ps1` | Builds the Graph rule objects (`win32LobAppFileSystemRule`, `win32LobAppRegistryRule`, `win32LobAppProductCodeRule`, `win32LobAppPowerShellScriptRule`) and remediation run schedules from experiment entries. No Graph calls, so `Tests\Unit` covers it directly. |
-| `GuestAgent.ps1` | Runs PowerShell inside a lab VM through the QEMU guest agent (`Invoke-GuestPowerShell`) and fetches a large text file from it in checked chunks (`Read-GuestPayload`). Dot-sourced by the driver and by `Invoke-LabGuestScript.ps1`; see the guest agent notes under "Timing notes" for why it works the way it does. |
+| `GuestAgent.ps1` | Runs PowerShell inside a lab VM through the QEMU guest agent (`Invoke-GuestPowerShell`), writes a file into it through the agent's file-write call (`Send-GuestFile`) and reads one back in a single file-read call (`Receive-GuestFile`), both checked by SHA-256. Dot-sourced by the driver and by `Invoke-LabGuestScript.ps1`; see the guest agent notes under "Timing notes" for why it works the way it does. |
 | `Fixtures.ps1` | Device-side fixtures the file, registry and MSI rule experiments look at: files with a known version, size and modified date, a `Program Files (x86)`-only file, `HKLM\SOFTWARE\IntuneScriptLab` in both registry views, and an MSI product survey. Run by `Prepare`. |
 | `Invoke-ValidationRound.ps1` | Driver: `Prepare`, `Deploy`, `Trigger`, `Collect`, `Remove`. `Deploy -Name` and `Collect -AppName` take wildcards to keep a round to its own experiments (each app's install status is one report export job of 20-30 seconds, and the service runs them one at a time). |
 | `Win32Content.ps1` | Packages `Win32Install.ps1` with IntuneWinAppUtil.exe and uploads the content to each app. |
@@ -120,8 +120,19 @@ Every action supports `-WhatIf`.
   - A second copy of the detached runner finds the output file held by the first, skips the script
     and writes the done marker at once, so the launch sits behind a started marker.
 - `Collect` runs the device script detached and polls a done marker, so no single guest agent call
-  has to stay open for minutes, and uploads are numbered part files so a chunk written twice
-  replaces itself.
+  has to stay open for minutes.
+- Moving files, measured on VM 125 on 2026-10-06. A guest exec call takes about 6 seconds and its
+  command line fails silently above a few KB, so the kit used to deliver scripts 1,200 base64
+  characters per call and read the payload 100,000 characters per call (179 calls, 25 minutes
+  for one `Collect`). The agent's `file-write` call takes 30,000 characters of text on the
+  host's command line per call, and its `file-read` call returns a file of up to 16 MB in one
+  reply: 507,000 characters in 2 seconds. The device gzips the collect JSON before base64, 13.4 MB
+  of JSON from a month of hourly probe records packed to 380 KB. `-Since` keeps the probe records
+  from a date on and leaves the rest out.
+- The round-7 experiment `REM-INSTALL-MODULE` hangs for its full 60-minute timeout every hourly
+  cycle and holds the remediation runner for everything queued behind it (round 10's seven
+  detections waited 70 minutes for it). Its assignment was removed on 2026-10-06; the policy
+  stays, unassigned, so `Deploy` still skips it and its evidence stands.
 
 ## Adding an experiment
 
diff --git a/Validation/Tests/Unit/Invoke-ValidationRound.Tests.ps1 b/Validation/Tests/Unit/Invoke-ValidationRound.Tests.ps1
index 0313013..6a15e0f 100644
--- a/Validation/Tests/Unit/Invoke-ValidationRound.Tests.ps1
+++ b/Validation/Tests/Unit/Invoke-ValidationRound.Tests.ps1
@@ -280,93 +280,142 @@ Describe 'Invoke-ValidationRound helpers' -Tag 'Unit', 'Validation' -Skip:($PSVe
         }
     }
 
-    Context 'Read-GuestPayload' {
+    Context 'Send-GuestFile' {
+        BeforeEach {
+            # The fake host accepts every file-write; the fake VM answers the join call with the hash
+            # the test put in hash.txt
+            Mock ssh {
+                Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value ($args -join ' ')
+                $global:LASTEXITCODE = 0
+            }
+            Mock Invoke-GuestPowerShell {
+                Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value "guest|$Script"
+                if ($Script -like '*Get-FileHash*') {
+                    (Get-Content -Path (Join-Path $TestDrive 'hash.txt') -Raw).Trim()
+                }
+            }
+            $script:Bytes = [Text.Encoding]::ASCII.GetBytes('y' * 50000)
+            $sha = [Security.Cryptography.SHA256]::Create()
+            $script:BytesHash = [BitConverter]::ToString($sha.ComputeHash($script:Bytes)) -replace '-', ''
+            $sha.Dispose()
+            Set-Content -Path (Join-Path $TestDrive 'hash.txt') -Value $script:BytesHash
+        }
+
+        It 'writes the bytes as 30,000-character base64 parts, joins them on the VM and checks the hash' {
+            Send-GuestFile -RemotePath 'C:\ProgramData\IntuneScriptLab\thing.bin' -Bytes $script:Bytes
+            $calls = @(Get-CallLog)
+            $calls[0] | Should-BeLikeString ("guest|`$null = New-Item -ItemType Directory -Path " +
+                "'C:\ProgramData\IntuneScriptLab' -Force; " +
+                "Remove-Item -Path 'C:\ProgramData\IntuneScriptLab\thing.bin.b64.*'*")
+            $writes = @($calls | Where-Object { $_ -like '*file-write*' })
+            $writes.Count | Should-Be 3
+            $shape = "-o BatchMode=yes pve pvesh create /nodes/`$(hostname)/qemu/125/agent/file-write " +
+                "--file 'C:\ProgramData\IntuneScriptLab\thing.bin.b64.000?' --content '*'"
+            foreach ($write in $writes) { $write | Should-BeLikeString $shape }
+            $parts = $writes | ForEach-Object { [regex]::Match($_, "--content '([^']*)'").Groups[1].Value }
+            @($parts | ForEach-Object Length) | Should-BeCollection @(30000, 30000, 6668)
+            (-join $parts) | Should-Be ([Convert]::ToBase64String($script:Bytes))
+            $join = $calls[-1]
+            $join |
+                Should-BeLikeString "guest|*Get-ChildItem -Path 'C:\ProgramData\IntuneScriptLab\thing.bin.b64.*'*"
+            $join | Should-BeLikeString "*WriteAllBytes('C:\ProgramData\IntuneScriptLab\thing.bin'*"
+            $join |
+                Should-BeLikeString "*Remove-Item -Path '*\thing.bin.b64.*'*Get-FileHash*"
+        }
+
+        It 'refuses a file the VM hashes differently' {
+            Set-Content -Path (Join-Path $TestDrive 'hash.txt') -Value ('0' * 64)
+            { Send-GuestFile -RemotePath 'C:\x\thing.bin' -Bytes $script:Bytes } |
+                Should-Throw -ExceptionMessage ("*thing.bin did not arrive intact: the VM hashes it 000*" +
+                    "local bytes hash $($script:BytesHash)")
+        }
+
+        It 'fails naming the part when the host refuses a file-write' {
+            Mock ssh { $global:LASTEXITCODE = 255; 'no such VM' }
+            { Send-GuestFile -RemotePath 'C:\x\thing.bin' -Bytes $script:Bytes } |
+                Should-Throw -ExceptionMessage "*file-write of C:\x\thing.bin.b64.0000 failed on pve: no such VM*"
+        }
+    }
+
+    Context 'Receive-GuestFile' {
         BeforeAll {
-            $script:Payload = 'QUJDREVGR0hJSktMTU5PUFFSU1RVVg=='   # 32 characters, read 10 at a time
             $sha = [Security.Cryptography.SHA256]::Create()
-            $bytes = $sha.ComputeHash([Text.Encoding]::ASCII.GetBytes($script:Payload))
-            $script:PayloadHash = [BitConverter]::ToString($bytes) -replace '-', ''
+            $digest = $sha.ComputeHash([Text.Encoding]::ASCII.GetBytes('abc'))
+            $script:AbcHash = [BitConverter]::ToString($digest) -replace '-', ''
             $sha.Dispose()
-            $script:PayloadSplat = @{
-                RemotePath = 'C:\ProgramData\IntuneScriptLab\collect.b64'; Size = 32
-                Sha256 = $script:PayloadHash; ChunkSize = 10
-            }
         }
 
-        BeforeEach {
-            Set-Content -Path (Join-Path $TestDrive 'payload.txt') -Value $script:Payload -NoNewline
-            Remove-Item -Path (Join-Path $TestDrive 'fault.txt') -ErrorAction SilentlyContinue
-            # The VM: answers a Substring read from the payload. fault.txt names one offset and what
-            # goes wrong there once ('short') or always ('stale': the chunk at offset 0 instead)
-            Mock Invoke-GuestPowerShell {
-                Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value $Script
-                $payload = Get-Content -Path (Join-Path $TestDrive 'payload.txt') -Raw
-                $null = $Script -match '\.Substring\((\d+), (\d+)\)'
-                $offset, $length = [int]$Matches[1], [int]$Matches[2]
-                $faultFile = Join-Path $TestDrive 'fault.txt'
-                $fault = if (Test-Path -Path $faultFile) { (Get-Content -Path $faultFile -Raw).Trim() }
-                if ($fault -eq "short $offset") { Remove-Item -Path $faultFile; return '' }
-                if ($fault -eq "stale $offset") { return $payload.Substring(0, $length) + "`r`n" }
-                $payload.Substring($offset, $length) + "`r`n"
+        It 'reads the file in one file-read call and returns its text when the hash matches' {
+            Mock ssh {
+                Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value ($args -join ' ')
+                $global:LASTEXITCODE = 0
+                '{', '   "bytes-read" : 3,', '   "content" : "abc"', '}'
             }
+            Receive-GuestFile -RemotePath 'C:\ProgramData\IntuneScriptLab\collect.b64' -Sha256 $script:AbcHash |
+                Should-Be 'abc'
+            @(Get-CallLog)[0] | Should-Be ("-o BatchMode=yes pve pvesh get /nodes/`$(hostname)/qemu/125/agent/" +
+                "file-read " +
+                "--file 'C:\ProgramData\IntuneScriptLab\collect.b64' --output-format json")
         }
 
-        It 'reads the file in chunks, in order, and returns its text when the hash matches' {
-            Read-GuestPayload @script:PayloadSplat | Should-Be $script:Payload
-            $calls = @(Get-CallLog)
-            $calls.Count | Should-Be 4
-            $calls[0] |
-                Should-Be "[IO.File]::ReadAllText('C:\ProgramData\IntuneScriptLab\collect.b64').Substring(0, 10)"
-            $calls[3] | Should-BeLikeString '*.Substring(30, 2)'
+        It 'refuses a reply the agent marked truncated' {
+            Mock ssh { $global:LASTEXITCODE = 0; '{"bytes-read":3,"content":"abc","truncated":true}' }
+            { Receive-GuestFile -RemotePath 'C:\x\big.b64' -Sha256 $script:AbcHash } |
+                Should-Throw -ExceptionMessage '*big.b64 is longer than the 16 MB*'
         }
 
-        It 'asks again for a chunk that comes back short' {
-            Set-Content -Path (Join-Path $TestDrive 'fault.txt') -Value 'short 10'
-            Read-GuestPayload @script:PayloadSplat -WarningAction SilentlyContinue | Should-Be $script:Payload
-            @(Get-CallLog | Where-Object { $_ -like '*.Substring(10, 10)' }).Count | Should-Be 2
+        It 'refuses text whose hash is not the VM''s' {
+            Mock ssh { $global:LASTEXITCODE = 0; '{"bytes-read":3,"content":"abd"}' }
+            { Receive-GuestFile -RemotePath 'C:\x\collect.b64' -Sha256 $script:AbcHash } |
+                Should-Throw -ExceptionMessage ("*did not arrive intact: 3 characters with SHA-256 *" +
+                    "the VM's copy has $($script:AbcHash)")
         }
 
-        It 'refuses a payload whose chunk has the right length and the wrong content' {
-            Set-Content -Path (Join-Path $TestDrive 'fault.txt') -Value 'stale 10'
-            $expected = "*did not arrive intact: 32 characters*the VM's copy has $($script:PayloadHash)*"
-            { Read-GuestPayload @script:PayloadSplat } | Should-Throw -ExceptionMessage $expected
+        It 'fails with the host output when file-read fails' {
+            Mock ssh { $global:LASTEXITCODE = 2; 'file not found' }
+            { Receive-GuestFile -RemotePath 'C:\x\missing.b64' -Sha256 $script:AbcHash } |
+                Should-Throw -ExceptionMessage '*file-read of C:\x\missing.b64 failed on pve: file not found'
+        }
+    }
+
+    Context 'Expand-GzipText' {
+        It 'turns the base64 of gzip of UTF-8 text back into the text' {
+            $text = '{"NonAscii":"Gr' + [char]0xFC + [char]0xDF + 'e"}' + ('x' * 5000)
+            $packed = [System.IO.MemoryStream]::new()
+            $mode = [System.IO.Compression.CompressionMode]::Compress
+            $gzip = [System.IO.Compression.GZipStream]::new($packed, $mode)
+            $bytes = [Text.Encoding]::UTF8.GetBytes($text)
+            $gzip.Write($bytes, 0, $bytes.Length)
+            $gzip.Dispose()
+            $encoded = [Convert]::ToBase64String($packed.ToArray())
+            $encoded.Length | Should-BeLessThan $text.Length
+            Expand-GzipText -Base64 $encoded | Should-Be $text
         }
     }
 
     Context 'Invoke-GuestScriptFile' {
         BeforeEach {
-            # Every guest call is logged with its script; the run call's stdout is what comes back
+            # The delivery is Send-GuestFile's; the run call's stdout is what comes back
+            Mock Send-GuestFile {
+                $encoded = [Convert]::ToBase64String($Bytes)
+                Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value "send|$RemotePath|$encoded"
+            }
             Mock Invoke-GuestPowerShell {
                 Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value $Script
-                if ($Script -like '*WriteAllBytes*') { 'ran' }
+                if ($Script -like "*& 'C:\ProgramData\IntuneScriptLab\*.ps1'") { 'ran' }
             }
         }
 
-        It 'clears old parts, delivers the script as numbered 1,200-character part files and runs it by path' {
+        It 'sends the script with a BOM through Send-GuestFile and runs it by path' {
             $body = 'Write-Output ' + ('x' * 2000)
-            $result = Invoke-GuestScriptFile -Script $body -TimeoutSeconds 60
-            $result | Should-Be 'ran'
-
+            Invoke-GuestScriptFile -Script $body -TimeoutSeconds 60 | Should-Be 'ran'
             $calls = @(Get-CallLog)
-            $calls[0] | Should-BeLikeString "Remove-Item -Path 'C:\ProgramData\IntuneScriptLab\collect.ps1.b64*'*"
-            $chunks = @($calls | Where-Object { $_ -like 'Set-Content*' })
-            $chunks.Count | Should-BeGreaterThan 1
-            $chunkShape = "Set-Content -Path 'C:\ProgramData\IntuneScriptLab\collect.ps1.b64.00??' " +
-                "-Value '*' -NoNewline"
-            foreach ($chunk in $chunks) {
-                $chunk | Should-BeLikeString $chunkShape
-                ([regex]::Match($chunk, "-Value '([^']*)'").Groups[1].Value.Length) | Should-BeLessThanOrEqual 1200
-            }
-            $encoded = -join ($chunks | ForEach-Object { [regex]::Match($_, "-Value '([^']*)'").Groups[1].Value })
-            $bytes = [Convert]::FromBase64String($encoded)
+            $calls[0] | Should-BeLikeString "send|C:\ProgramData\IntuneScriptLab\collect.ps1|*"
+            $bytes = [Convert]::FromBase64String(($calls[0] -split '\|')[2])
             [Convert]::ToHexString($bytes[0..2]) | Should-Be 'EFBBBF'
             [Text.Encoding]::UTF8.GetString($bytes, 3, $bytes.Length - 3) | Should-Be $body
-
-            $calls[-1] | Should-BeLikeString ("*Get-ChildItem -Path " +
-                "'C:\ProgramData\IntuneScriptLab\collect.ps1.b64.*'*")
-            $calls[-1] | Should-BeLikeString "*WriteAllBytes('C:\ProgramData\IntuneScriptLab\collect.ps1'*"
-            $calls[-1] | Should-BeLikeString ('*Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass ' +
-                "-Force; & 'C:\ProgramData\IntuneScriptLab\collect.ps1'")
+            $calls[-1] | Should-Be ('Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; ' +
+                "& 'C:\ProgramData\IntuneScriptLab\collect.ps1'")
         }
 
         It 'starts a detached script behind a started marker, so a launch that runs twice starts it once' {
@@ -391,17 +440,18 @@ Describe 'Invoke-ValidationRound helpers' -Tag 'Unit', 'Validation' -Skip:($PSVe
 
         It 'names the remote file after -RemoteName' {
             $null = Invoke-GuestScriptFile -Script 'x' -RemoteName 'fixtures.ps1'
-            (Get-CallLog)[-1] | Should-BeLikeString "*& 'C:\ProgramData\IntuneScriptLab\fixtures.ps1'"
+            $calls = @(Get-CallLog)
+            $calls[0] | Should-BeLikeString 'send|C:\ProgramData\IntuneScriptLab\fixtures.ps1|*'
+            $calls[-1] | Should-BeLikeString "*& 'C:\ProgramData\IntuneScriptLab\fixtures.ps1'"
         }
 
-        It 'passes the run timeout only to the run call' {
+        It 'passes the run timeout to the run call' {
             Mock Invoke-GuestPowerShell {
                 Add-Content -Path (Join-Path $TestDrive 'calls.log') -Value "$TimeoutSeconds|$Script"
             }
             $null = Invoke-GuestScriptFile -Script 'x' -TimeoutSeconds 777
             $calls = @(Get-CallLog)
-            $calls[-1] | Should-BeLikeString '777|*'
-            @($calls | Where-Object { $_ -like '777|*' }).Count | Should-Be 1
+            $calls[-1] | Should-BeLikeString "777|*& 'C:\ProgramData\IntuneScriptLab\collect.ps1'"
         }
     }
 }