0.26.0: fix what the claims audit found, in code and help

[fadwen]

Summary

Version 0.26.0. A claims audit of the module: every statement the README, the 25 command help pages, the about topic, the generated rule reference, the examples and the changelog make about behaviour was checked against the source and, where it needs no tenant or elevation, by running it. Statements that needed a tenant, SYSTEM or a signed-in lab account were checked against the dev tenant and the lab device. This pull request fixes what did not hold, in code where the code was wrong and in the documentation where the text was, with a regression test for each code fix.

No command changes shape. Every fix restores behaviour the documentation already promised.

Code fixes

Area	Defect	Fix
Test-IntuneDeployedScript, Compare-IntuneDeployedScript, Get-IntuneScriptHealth	-Settings never reached the analysis or the settings comparison. A body-level $settings hashtable overwrote the parameter (variable names are case-insensitive), and $PSBoundParameters was tested inside a nested function, where it is that function's own.	Locals renamed; the check captured before the nested functions are defined.
The same three commands	-Id without -Name selected every policy, because -Name defaults to * and selection was name or id.	-Id alone selects by id.
Repair-IntuneScript, Test-IntuneScript	A folder path was enumerated through ForEach-Object -MemberName, which honours -WhatIf; Repair -Path <folder> -WhatIf returned nothing.	Script-block enumeration.
Repair-IntuneScript, IslEncodingIssue	A BOM-less file that was not UTF-8 was decoded as UTF-8 and written back with every non-ASCII character replaced by U+FFFD.	Invalid UTF-8 is read in the system ANSI code page; the rule reports such a file as ANSI (Information) with the same fix.
Test-IntuneScript	A type declared in a directive earned the assumed-context note and was called a portal default; a settings file's ExcludeRule beat an explicit -IncludeRule; -EnforceSignatureCheck:$false was not explicit.	A directive is a declaration; an explicit include sets the file's exclusions aside; a bound switch is explicit either way.
Should-PassIntuneAnalysis	A pipeline of files was joined into one path.	Every file is analyzed and the failing ones are named.
Export-IntuneFindingSarif	Every rule carried level warning; a finding outside -Root was written as an escaped relative URI under the root; a relative -Path was resolved against the process directory (as was Get-IntuneScriptHealth -MarkdownPath).	Level of the rule's most severe finding; absolute file URI; paths resolved against the PowerShell location.
Runtime harness	A missing script path returned a result with exit code -196608 instead of an error.	Terminating error.
Runtime harness, -Credential	A stored-password task for an account without the "Log on as a batch job" right is not always refused with 0x80070569; on the lab device it sits Ready with 0x00041303 ("has not run yet") and no error, and the launcher waited out the whole timeout.	Five seconds in that state after Start-ScheduledTask is reported as the refusal, with the same hint.
Get-IntuneAgentTimeline	-Id returned every timeline whose lines mentioned the id (a relationship report names two apps); a relationship report was never an outcome.	Timelines filtered by their own id; the report added to the outcomes.
Compare-IntuneDeployedScript	Content was compared without regard to case.	Case-sensitive comparison.
Test-IntuneDeployedScript	A user-context Win32 app assigned to All devices was not flagged.	All devices is a device target.
Get-IntuneScriptHealth	-SkipAnalysis called an unassigned policy Healthy, because the check read a finding.	Read from the assignments.
Rules	IslFilterIssue called -ne/-notIn with an unreported value "never matches"; IslInteractiveCall took a bare -Confirm as silencing; IslOutputIssue took $ErrorActionPreference = 'Stop' as a guard; IslPowerShell7Syntax reported using module <missing> as syntax and listed two parameters that exist on neither host; IslScriptSize called Win32 scripts remediations.	Each corrected; Win32 scripts are named with the assumed limits stated.
Smaller	A message typo; the Duration column dropped days; the workflow template did not split SCRIPT_PATHS in its runtime job; two empty files under docs/; the rule reference replaced literal $PSScriptRoot with <value>.	Fixed.

Documentation fixes

• Graph scopes as the Graph reference lists them: DeviceManagementScripts.Read.All for remediations and platform scripts (two examples omitted it), DeviceManagementConfiguration.Read.All for assignment filters, DeviceManagementApps.Read.All for apps, GroupMember.ReadBasic.All for the member read. Creating an export job is listed as a write, so Get-IntuneScriptHealth names the ReadWrite scopes instead of DeviceManagementManagedDevices.Read.All, in the help and in its warning.
• Result properties (RunAs on every harness result, IntuneError as the stderr tail, SignatureStatus always present), the complete status lists, the events Get-IntuneAgentLog names and its Id rule, what -SkipRegistry leaves out, the ARM64 note on the x64 default, the base requirements Test-IntuneWin32Requirement covers, name matching and NotInTenant semantics, the Attention rules, Applied under -WhatIf, the SARIF rule level, the assignment-filter examples' full output, the file-name inference rules, the settings precedence.
• The manifest description names the whole module. The README's links into the repository are absolute, since the README ships in the package and docs/ and Validation/ do not.
• CLAUDE.md records the parameter-shadowing invariant. Validation/Findings.md records the 2026-09-29 re-check of the stored-password path.

Verification

• Unit and integration suites: 869 pass on PowerShell 7.6 (7 skipped: elevation, lab credential), 812 on Windows PowerShell 5.1. PSScriptAnalyzer and the 115-character gate are clean over every changed file. Help Markdown validated, MAML rebuilt and committed, docs/Rules.md regenerated. Build/Publish-Module.ps1 -WhatIf stages and verifies 0.26.0.
• Dev tenant, app-only session: Test-IntuneDeployedScript over 106 policies in 106 s; Compare-IntuneDeployedScript in 2 s; Get-IntuneScriptHealth over 16 policies in 24 s with the app install export at 11-17 s.
• Lab device (Entra joined, agent enrolled), running the branch module as SYSTEM: -Context System runs in session 0 as NT AUTHORITY\SYSTEM with the system profile; -Credential for an account holding a console session runs interactively in that session (RunAs (Interactive)); the stored-password path for the same account without the batch logon right is refused and reported in 11 s; no scheduled task and no run folder remain afterwards.
• Reporting lag measured against Graph on the lab devices: a remediation's changed result (a forced fix) reached Graph 65 minutes after the run, with the agent's next hourly report batch, and within seconds of that upload; platform script run states 2-8 s after the device's log line; app install states 30-39 s after. An unchanged remediation result is never re-reported, so lastStateUpdateDateTime is the last change, not the last run. The device's report line carries Result 4 for a fix and for a recurrence alike; the timeline help now says so.

After merge, git tag v0.26.0 && git push origin v0.26.0 publishes.