Partial pick of 95ec322: a failed or queued regeneration keeps the previous successful AI overview visible, and a stored ISO mapping stays readable while the retrieval index is unavailable. The Defender device risk-acceptance fix of that commit is not taken here.
policy-evaluation rows map like scanner findings in the Finding Reader and the filtered Result DB batch. The query is built after the Result DB disclosure projection, so the customer value never reaches retrieval or the mapper. The global rule key is the technical setting ID; Work GPO rows carry their current comparison ID. Raw GPO and environment observations stay excluded. Retrieval version unchanged.
Binh