v26.7.10.1209

All changes since the last stable release (v26.3.5.912).

Highlights

• Filter on named Event Data and User Data fields — two new filter properties, Event Data and User Data, let you filter on the structured fields inside an event instead of just its rendered description or XML. Pick Event Data or User Data in a Basic filter row and a field-name box appears: choose a field from the logs you have open (or type one, * wildcards allowed), then match its value. Values are compared by type, so 5 matches 05, a GUID matches in any format, and dates match the event's exact value. Several built-in scenarios now use these field filters out of the box. See Event Data & User Data Filtering below.
• Build provider databases from an offline Windows image — create a provider database from a Windows image instead of the running machine: a mounted volume, an extracted image folder, a .wim/.esd, a Windows install .iso, or a .vhdx/.vhd disk. The image kind is auto-detected from the path, ISOs and virtual disks are mounted read-only and cleaned up automatically, and the read is fully offline — the host registry and host files are never touched. Available from Database Tools → Create (with a Load editions picker for multi-edition images) and from EventDbTool create --offline-image. See Offline Image Databases below.
• Auto-import after Create and Merge — a new When finished choice on the Create and Merge tabs can Import (or Import and enable) the database you just built, so you don't have to switch to the Manage tab to start using it.
• Multiple provider versions in one database — provider databases now key providers by name and content version, so distinct versions of the same provider coexist instead of overwriting each other. Merge keeps the most complete version and prefers the newest OS source, and existing databases upgrade to the new layout automatically the first time they load.
• Native Arm64 support with a single self-contained installer — EventLogExpert now ships as one multi-architecture .msixbundle that runs natively on both x64 and Arm64 (Windows installs the matching build automatically), and it carries its Windows App Runtime inside the package, so there's no separate runtime to install on a clean machine. Existing installs update to it in place.
• Redesigned event table — the log table was rebuilt around a render-isolated store with filtering moved off the UI thread, so large logs scroll, filter, and update more smoothly, with per-tab groups for multiple open logs.
• Logs load newest-first — opening a log reads the newest events first and paints the first screenful immediately, so recent events are on screen right away instead of after a full load.
• Export filtered events to CSV or JSON — export the current filtered event view from the menu. The export respects your active filters and the visible columns in their current order (including the always-on Description column), streams to disk with bounded memory, and shows a cancelable progress banner followed by an Export complete notification with the row count and path. Timestamps use a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection.
• Scenario dashboard when no log is open — closing every log (or starting fresh) now shows an empty-state dashboard that browses the built-in scenarios in a master-detail layout, lets you star favorites for quick access, and offers one-click Launch plus quick-launch buttons for the live Application / System / Security logs or opening a file or folder.
• Built-in scenario picker — apply curated, ready-made filter sets from a new Apply Scenario control in the filter pane. Choose from 217 triage scenarios across 20 groups (system health, security, networking, server roles, common Microsoft products, and more); the list is automatically narrowed to scenarios that match the logs you have open, across both live channels and opened .evtx files. Apply layers a scenario on top of your current filters; Replace swaps them out. Scenarios can color-code their filter rows for at-a-glance multi-filter triage and timelines, and a new date-range quick-pick (last 7 days through 2 years) fills the After/Before fields in UTC.
• Group the event table inline — group by any column except Description (for example Activity ID, Source, or Level) so related events fold under collapsible header rows that show the value and event count. The table becomes a keyboard-navigable tree grid, groups can be sorted independently of the per-event sort, and Select Group (and Ctrl+A) reach events even inside collapsed groups.
• Filter Library — save, organize, and reuse filter sets from a new Filter Library (the bookmarks icon in the filter pane). Browse Saved, Favorites, and Previously Used filters, organize them with tags, rename and favorite entries, and import/export your library as JSON. Apply adds a saved set on top of your current filters; Replace current filters swaps them out. Your existing favorite and saved filters are migrated automatically.
• Open from File Explorer — right-click one or more .evtx files, a folder, or the empty space inside a folder and choose "Open with EventLogExpert". Double-clicking a .evtx still opens it, and selecting several files opens them together in a single window.
• Run Database Tools operations elevated on demand — Create Database and Show Providers can elevate a single operation via a "Run Elevated" button (one UAC prompt) instead of requiring you to run the whole app as administrator. The main app stays open while an elevated helper does the work.
• Database Tools UI is now available from the Tools menu, giving Create/Diff/Merge/Show/Upgrade provider-database operations an in-app tabbed workflow with live logs, safer file picking, and elevation awareness.
• Provider database management moved into Database Tools — a new Manage tab centralizes status, enable/disable, upgrade, restore-from-backup, classification retry, and removal. Changes are staged and applied explicitly so accidental database edits are less likely, and an opt-in selection mode unlocks bulk upgrade and bulk remove with per-row progress.
• Light mode is now available, with an option to follow your Windows theme. The title bar follows it too.
• Reorder event table columns by drag-and-drop. Column widths and order are remembered across sessions.
• International Windows support — events on non-English Windows installs (and exported .evtx files that include a LocaleMetaData folder) now resolve to readable text instead of falling back to placeholders.
• Better text for "no provider" events — when an event has no provider metadata, the app now shows the event's data and a meaningful success/error message instead of placeholders. Channel-only providers resolve correctly, and older events that share IDs are now disambiguated.
• Provider database recovery — imported databases are checked when they load, with clear status indicators in the Manage tab. Old (V3) databases automatically upgrade to the new V4 format; empty or unrecognized files are set aside instead of breaking event resolution. If an upgrade is interrupted, a recovery dialog walks you through finishing it. Newly imported databases stay disabled until you turn them on.
• In-app banners are smoother and smarter — upgrade, recovery, crash, and database-attention banners coordinate with modals more cleanly, swap with less flicker, route database actions directly to the Database Tools modal, and handle priority changes predictably instead of bouncing back to stale selections. "No events found" alerts are still grouped together when you open several logs at once.
• Filter overhaul — filters re-evaluate only when they actually change, run in parallel when there are lots of events, and new events are checked against active filters as they arrive instead of re-filtering every open log. Filter rows have been redesigned around predicate "chips" with clearer validation and Done/Add gating.
• Faster combined view — when multiple logs are open, the Combined view is now built once and updated in place as events stream in, instead of being rebuilt from scratch on every update. Live tailing is dramatically faster and uses less memory.
• New menu bar replaces the older Windows menu bar and simplifies right-click menus across the app.
• Debug Log modal now has filtering, scrolls smoothly through large logs, lets you export the contents, and shows newest entries first as they stream in.
• More reliable live event subscriptions — the underlying watcher is more resilient to exceptions, won't get stuck on stop, and won't leak system handles. The initial backlog drains more cleanly when you open a log.
• Accessibility improvements — skip-to-content link, screen reader announcements (including completion announcements for long-running operations), visible keyboard focus, respect for reduced-motion preferences, page landmarks, proper button roles, correct keyboard tab order on database rows, and visual cues that don't rely on color alone.
• Details pane height is remembered between sessions.
• DbTool now reads MTA files, supports more event types and variant types, and the app correctly identifies more severity levels for broader event coverage.
• Major performance and memory pass — many smaller improvements across the app add up to faster load times, smoother scrolling, and lower memory use, especially with multiple logs open.

Features

• Export the filtered event view to CSV or JSON from the menu — respecting the active filter and the visible, ordered columns — with a cancelable progress banner and an "Export complete" notification; see Event Export below.
• An empty-state scenario dashboard shown whenever no log is open, with a master-detail scenario browser, favorite scenarios that persist across sessions, and quick-launch buttons — see Scenarios below.
• A built-in scenario catalog of 217 curated triage scenarios across 20 groups, surfaced through an Apply Scenario picker in the filter pane that only lists scenarios matching the logs you have open — see Scenarios below.
• A date-range quick-pick (last 7 days through 2 years) that fills the After/Before filter date fields in UTC.
• The saved-filter-set picker gains a Replace button alongside Apply.
• Database Tools is available from the Tools menu, with a tabbed modal and vertical tab strip for Create, Diff, Merge, Show, Upgrade, and Manage provider-database operations.
• Database Tools includes a live log view that streams operation output while long-running work is in progress.
• Database Tools uses an elevation-safe Win32 file picker for choosing database paths and output locations.
• Database tooling caches the elevation check and warns when EventDbTool starts without administrator rights.
• Light mode with a "Follow system" option; the title bar honors the OS theme.
• Drag-and-drop column reordering in the event table; column widths and order are remembered.
• Details pane height is remembered between sessions.
• XML is now always available without flipping a toggle. It's only generated when a filter actually needs it, so there's no performance cost when you don't use it.
• New menu bar with a consistent look, replacing the older Windows menu bar (right-click menus are simpler too).
• Improved keyboard navigation in the event table.
• The "Open by Log Name" picker now mirrors the folder structure you'd see in Event Viewer (MMC).
• Exported .evtx files with a LocaleMetaData folder are now fully supported.
• DbTool can read MTA provider files.
• More events display the correct severity (Information / Warning / Error / Critical / Verbose).
• More event types and variant types are recognized, so more events resolve to readable text.
• The title bar now shows the app name and version before any open log names.
• In-app release notes and Markdown content now render italics.
• Open .evtx files and folders straight from Windows Explorer's right-click menu ("Open with EventLogExpert"), including multi-select and the empty space inside a folder.
• Create Database and Show Providers can run a single operation elevated on demand via a "Run Elevated" button, instead of relaunching the whole app as administrator.
• A new Filter Library (the bookmarks icon in the filter pane) for saving, tagging, favoriting, importing, and exporting filter sets — see Filter Library below.
• The "Manage Databases" Select button is hidden when no databases are imported, so there's nothing to act on by mistake.
• Database Tools, Debug Log, Settings, Release Notes, and the Filter Library share a consistent vertical tab strip with full keyboard support (Up/Down/Home/End).
• Release notes for the current build are cached for in-app display, and pre-release builds auto-enable the pre-release update channel.
• Inline event grouping in the event table: right-click a column header and pick a column from the new Group By submenu ((none) turns it off) to fold related events under collapsible group headers — see Event Grouping below.
• Build a provider database from an offline Windows image — a mounted volume, an extracted folder, a .wim/.esd, a Windows install .iso, or a .vhdx/.vhd disk — from Database Tools → Create or EventDbTool create --offline-image; see Offline Image Databases below.
• A When finished option on the Create and Merge tabs to Import or Import and enable the database you just produced, instead of importing it separately.
• The Create tab's image index field is an editable picker: type an index, or press Load editions to choose an edition by name.
• Show Providers and Create share a single "Include protected providers such as Security (requires elevation)" checkbox, and the Run button elevates on demand (one UAC prompt) when it's needed.
• EventDbTool commands (create, show, diff, merge, upgrade) now return meaningful process exit codes, so scripts can tell success from failure.
• A new Event Data filter property matches a named <EventData> field — using the field names defined by the provider's template (for example TargetUserName, or param5 when the template names fields positionally) — by value; see Event Data & User Data Filtering below.
• A new User Data filter property matches a structured <UserData> field addressed by its path, so deeply nested values are reachable (for example CertGetCertificateChain/CertificateChain/TrustStatus/ErrorStatus/@CERT_TRUST_IS_UNTRUSTED_ROOT, where / walks nested elements and @ selects an attribute).
• The Event Data / User Data field-name box is an editable picker that lists the field names present in the logs you have open; type a name directly, including * wildcards to target a family of fields (for example param* or *SubjectName).
• Several built-in scenarios gained Event Data / User Data field filters — for example CAPI2 certificate-chain trust-status flags and PrintService printer/user fields — so they highlight the right events automatically.

Event Export

• Export the current filtered event view to CSV or JSON from the menu. The export respects the active filter and the visible columns in their current order, so what you export matches what you see.
• The always-on Description column is included in the export (it isn't a toggleable column, so it was easy to miss before), and duplicate column headers are de-duplicated so every column name stays unique.
• Timestamps are written in a sortable yyyy-MM-dd HH:mm:ss format, and CSV values are neutralized against formula injection (including values with leading whitespace before a formula character).
• Exports stream to disk with bounded memory instead of buffering the whole result set, so large logs export without spiking memory. The file is replaced atomically in its folder, with a best-effort fallback when an atomic replace isn't available.
• A non-blocking, cancelable progress banner ("Exporting events…") shows during the streaming write. Canceling shows "Export canceled" and cleans up the partial file; a successful export shows "Export complete" with the row count and full path. Dismissing the save dialog stays silent, a late cancel after the write finishes is a no-op, and a re-entry guard prevents two exports from overlapping ("An export is already in progress.").

Scenarios

• Apply Scenario in the filter pane (shown when logs are open) applies a built-in scenario's filters from a Category + Scenario two-dropdown row that mirrors the Apply Filter Set row; the Category dropdown collapses when only one category matches. Scenarios are curated filter sets that target one or more event-log channels, and the list is automatically narrowed to scenarios whose channels you actually have open — across both live logs and opened .evtx files (matched by channel name) — so you only see scenarios that apply to your data.
• An empty-state scenario dashboard appears whenever no log is open (including after you close every log). It's a master-detail browser: a category sidebar (vertical tabs), a scenario list, and a detail pane that shows the selected scenario's logs and filters with a Launch action. Quick-launch buttons cover the live Application, System, and Security logs and opening a file or folder.
• Favorite any scenario with a star; favorites persist across sessions in the app's database and surface under a pinned Favorites tab in the dashboard.
• Launching a scenario opens its channels and applies its filters in one step. If the channels can't be opened, your previous filter-pane state is restored so nothing is lost.
• The built-in catalog ships 217 scenarios across 20 groups — system health, security, networking, server roles, common Microsoft products, and more. Group headers use curated display names.
• Each scenario can be Applied (merged on top of your current filters) or used to Replace your active filters, mirroring the Apply / Replace choice in the Filter Library.
• Scenarios can attach an optional highlight color per filter row, so a single scenario can color-code several filters at once for triage and timeline views.
• Scenarios can filter on named Event Data and structured User Data fields, not just event IDs and channels — for example the CAPI2 scenarios light up specific certificate-chain trust-status flags, and the PrintService scenarios match on the printer and user fields. See Event Data & User Data Filtering below.
• A reusable date-range quick-pick (last 7 days through 2 years) fills the After / Before date fields in UTC. Selecting a preset only populates the date editor — nothing runs until you press Apply — and it uses the same ValueSelect control as the rest of the app for a consistent look and keyboard navigation.
• The saved-filter-set picker also gains a Replace button next to Apply, so saved sets and scenarios behave the same way.
• Scenario matching only scans while the picker is open (memoized by the active-logs reference and released when it closes), so there's no cost when you're not using it.
• Developer builds only: a dev-only export turns the Basic filter rows currently in the filter pane and Filter Library into scenario-catalog JSON — the inverse of the catalog loader — and self-validates by reloading what it emits. It's compiled out of release builds (DEBUG only, or via the /EnableScenarioAuthoring switch).

Event Grouping

• Group the event table by any column except Description so related events fold under a shared header row. Grouping is most useful for an identifier such as Activity ID, but works for every column in the Group By submenu.
• Turn grouping on from a column header's right-click menu via the Group By submenu; (none) turns it back off. Re-selecting the column that's already grouped is a no-op, so the view doesn't rebuild needlessly.
• Groups are ordered by the grouped value, and events within each group keep the current Order By sort. Each header row shows the column name, the value (or (none) when it's empty), and the event count — for example Activity ID: {guid} (42).
• Group Descending flips the order of the groups themselves between ascending and descending, without changing the per-event Order By direction.
• Expand or collapse a group by clicking its header or chevron, or by pressing Enter while the header is focused. Expand All Groups and Collapse All Groups live on both the group header's right-click menu and the View menu. Collapse state is transient — it isn't persisted and resets when you switch to a different log tab.
• Select Group (on the group header's right-click menu) selects every event in a group, including events hidden by a collapse; Ctrl+A likewise selects events inside collapsed groups.
• When grouped, the table behaves as a keyboard-navigable tree grid — see UI / CSS / Accessibility below.

Event Data & User Data Filtering

• Event Data targets a single named field from an event's <EventData> section. Choose the field, a comparison operator, and a value; the row matches events whose field satisfies the comparison. Legacy or template-less events (whose data isn't exposed as named fields) simply aren't matched by an Event Data row — their values remain visible in the description and XML.
• User Data targets a field inside an event's structured <UserData> section, addressed by a path built from the nested element names (and attributes, shown with a leading @). This reaches values that live several levels deep, such as per-flag certificate-chain error states.
• Both field-name boxes suggest the field names present in the logs you currently have open (de-duplicated), and the value box likewise offers the values observed for the chosen field — changing the field clears the current value, since the available values are field-specific.
• Typed value equality — numeric, boolean, date, and GUID fields are matched by their parsed value rather than their raw text: 5 matches 05, True matches true, a GUID matches in any parseable format, and a date matches the event's exact round-trip value. Text and other field kinds compare as strings.
• Wildcards — a field name or User Data path containing * matches any run of characters, case-insensitively, so one predicate can cover a whole family of fields. Wildcard terms are compiled once, so filtering stays fast on large logs.
• Field filters round-trip cleanly through Basic filter text, the Filter Library, and the scenario catalog (including import/export), and a filter row drops its field name automatically when you switch it to a different property.

Offline Image Databases

• Build a provider database from an offline Windows image instead of the live machine — useful for capturing the providers of an OS version or edition you don't have running. Available in Database Tools → Create (paste or browse to an image in the Source path field) and from the command line via EventDbTool create --offline-image <path>.
• Several image kinds are supported and auto-detected from the path: a mounted volume root or extracted image folder (a directory), a .wim or .esd image file, a Windows install .iso (mounted read-only; the install image inside is used), or a .vhdx/.vhd disk (mounted read-only). Override the detected kind with --image-kind directory|wim|iso|vhdx, or, for a folder, the "Folder is an offline Windows image" checkbox.
• The read is fully offline — providers, message files, and registry hives come from the image, and the host registry and host files are never touched, so the database reflects the image and not the machine you're running on.
• Pick an edition for multi-image .wim/.esd files and ISOs: pass --wim-index N (omit it to list the available editions), or use the in-app Load editions button to fill a picker with each image's name and index.
• Reading an offline image runs through the elevated helper (one UAC prompt; the app stays open and doesn't relaunch). Listing editions is always elevated.
• ISOs and virtual disks are mounted read-only and unmounted automatically when the build finishes. Abandoned mounts left by an interrupted or crashed run are detected and swept up on the next run, and a WIM extract checks for adequate free space first.
• Offline event resolution matches the live path: a dedicated reader reproduces modern (WEVT_TEMPLATE) and legacy message-table providers — message and parameter tables, %%n parameter references, struct templates, and EvtFormatMessage-style escaping — so descriptions resolved from an offline-built database read the same as they do live.
• Databases (and the providers inside them) are stamped with the source OS they came from — build, revision, edition, and display version — shown as an OS stamp on each database row in the Manage tab. The stamp also lets Merge prefer providers from a newer OS source instead of trusting file names.
• The image's registry hives are read by a managed hive parser (no native hive-loading), with a RegLoadKey fallback that recovers hives the source OS left dirty.

Database Tools & Manage Tab

• A new Manage tab in the Database Tools modal is the single place to enable/disable, upgrade, restore, remove, and retry classification on imported provider databases.
• Edits in the Manage tab are staged and only applied when you save changes, so you can review (or back out) toggle changes, restores, and removals in one batch instead of one-at-a-time confirmations.
• Optional selection mode (toggled by a Select trigger) unlocks bulk Upgrade and bulk Remove across multiple databases.
• Multi-select removal of databases lets you take several entries out at once; the confirmation still warns you that affected logs will close and reopen.
• Per-row Upgrade progress is shown directly on each database row while an upgrade (or queued upgrade batch) is running.
• The Restore button respects in-flight upgrade progress, so an import-triggered upgrade can't be undercut by an accidental restore.
• Bulk Upgrade/Remove iterate in visible row order, so confirmation and focus stay predictable; failures stay selected (only succeeded entries are cleared) and the tab only auto-exits selection mode once every operation has succeeded.
• Esc in selection mode exits selection instead of closing the whole dialog.
• The attention banner now opens the Database Tools modal directly when there are databases that need attention.
• While the Database Tools modal is open, the attention banner is suppressed so it doesn't fight with the modal you're already using to act on it.
• The Manage tab is keyboard-friendly: action buttons use the real disabled attribute (so screen readers and keyboard users see the correct state) and the master selection checkbox is scoped so it doesn't leak styles to other tabs.
• Elevation on demand — when Create Database or Show Providers needs administrator access (protected providers such as Security, or reading an offline image) and the app isn't already elevated, the Run button shows a shield and prompts once, running just that operation through a UAC-elevated helper. The app keeps running normally; Merge, Diff, and Upgrade are unaffected.
• A When finished choice on the Create and Merge tabs imports — or imports and enables — the database as soon as the operation succeeds, with the Manage tab refreshing to match.
• The Merge tab's existing-provider choice now reads "Keep — skip providers already in target" / "Overwrite — replace providers already in target" so the two modes are unambiguous, and Merge can auto-import its result like Create.
• Each database row shows an OS stamp (build, edition, and display version) when the database records the OS it was built from, so you can tell at a glance which Windows version a database came from.

Database & Recovery

• New V4 provider database format with improved resolution coverage (merges in publishers that own a given channel).
• Imported databases get a clear status: classified, not yet classified, classification failed (with a retry action), unknown format, has backup, etc.
• Empty or unrecognized provider databases are set aside (quarantined) instead of breaking the resolver.
• Obsolete or unrecognized databases are rejected by EventDbTool commands with a clear message.
• V3 databases automatically upgrade to V4. Newly imported databases start out disabled — turn them on when you're ready.
• If an upgrade is interrupted (power loss, crash, etc.), the app detects the leftover marker file and offers a recovery dialog. The recovery dialog is treated as critical, so it can't be casually dismissed and won't get lost behind other UI.
• Removing a database no longer deletes your own .bak backup files.
• If one entry in a batch import fails, the rest still go through — the failures are listed clearly.
• Toggling pre-release builds in Settings can now kick off a database upgrade right from the confirmation dialog.
• Opening a log waits for database classification to finish first, so resolution doesn't silently use the wrong data.
• A successful import marks database state as changed, so closing the Database Tools modal triggers a clean reload of any open log views.
• Distinct provider versions coexist — provider databases now identify each provider by name plus a content version key, so different versions of the same provider can live side by side in one database instead of the last one winning.
• Existing databases are upgraded to the new multi-version layout automatically the first time this build opens them; the on-disk format stays V4.
• Merge keeps the best version — when the same provider appears more than once, Merge selects the most complete version and prefers the one from the newest OS source (by the recorded OS stamp), with deterministic ordering so repeated merges are stable.
• Merge fails fast on an out-of-date source — merging from a database that still needs an upgrade now stops with a clear message instead of producing a partial result.

Banners & Alerts

• App-wide banner area for upgrade progress, attention items, and recoverable errors.
• The banner cycle is hosted at the modal-chrome level via a shared state service, so opening or closing a modal swaps the banner cleanly without flicker.
• When a higher-priority banner arrives (e.g., an error during an upgrade), it takes selection without bouncing back to a stale lower-priority preference on the next refresh.
• Error banners can include an action button (for example, a Reload button); the action button automatically gets keyboard focus when an error banner appears, so you can press Enter to recover.
• If the app hits an unhandled exception, it now offers in-app recovery via a banner instead of going to a hard failure screen.
• "Empty log" notifications are grouped together when you open several logs at once, instead of stacking up.
• Banner severity (Critical vs. Error) is now consistent across the app.
• Grammar fix: the attention banner reads "1 database needs attention" (and "N databases need attention" for higher counts).

Settings UI

• The Settings modal is now focused on preferences and app-wide options; database management lives in the Database Tools Manage tab.
• Settings has a restructured information architecture with improved accessibility plumbing, a cleaner empty-state when there's nothing to show, and a more descriptive toggle aria-label.
• Recovery dialog wording is pluralized correctly when more than one database needs attention.
• Focus rings in Settings no longer get clipped by surrounding chrome.
• The "Pre-release builds" toggle sits on its own row above the modal action buttons so it can't be confused with them.

Event Resolution

• valueMap and bitMap properties are decoded to their mapped names and flags to match what Windows shows, instead of raw numeric values.
• Event variants are read via pointer against the documented EVT_VARIANT layout with hardened type checks, so more property types resolve correctly.
• Events with no provider metadata now show the event data and a readable success/error message instead of placeholders.
• Channel-only providers (events that only identify a channel, not a publisher) now resolve via the channel's owning publisher.
• Older event messages that share IDs are now disambiguated by their qualifier value.
• Templates that legitimately expect zero properties no longer cause spurious "property mismatch" messages.
• Environment variables in publisher metadata paths are expanded properly; resolution is more reliable for providers that use full raw IDs.
• The "Add log" and "Close all" menu items are only enabled when you actually have logs open. "Security" and "State" are only enabled when running elevated.
• Events on non-English Windows installs, and exported .evtx files that ship a LocaleMetaData folder, now resolve via .mui satellite files instead of placeholders.

Filter Improvements

• Filters are evaluated through a new, more reliable pipeline. Behavior is the same — performance and stability are better.
• Toggling unrelated UI no longer causes the filter pipeline to re-run; it only re-runs when filter state actually changes.
• When there are lots of events, filtering runs in parallel. As new events arrive, only the new ones are checked against active filters instead of re-filtering every open log.
• Filters keep their position in the panel even after edits.
• Drafting a new filter no longer leaves stale placeholder rows behind, including when you collapse a filter group mid-edit.
• Filter text parsing now handles quotes, backslashes, and whitespace consistently in all contexts, including sub-filters and multi-select values.
• Date-range defaults are now consistent across the app.
• The filter spinner reflects only the latest filter run — older, slower runs can no longer overwrite a newer result.
• Redesigned filter row built around predicate chips: each filter shows its predicates as discrete chips, with validation gating that prevents adding or completing a row until the predicate is valid.
• The Done/Add buttons now react reliably to changes anywhere in the row (the underlying state-propagation chain no longer goes stale).
• Keyboard focus is restored to the right chip after edits.
• Exclude predicates have a distinct icon shape (not just a color) so they're easier to tell apart from include predicates at a glance.

Filter Library

• A new Filter Library — opened from the bookmarks icon ("Open Filter Library") in the filter pane header — is the single place to save, organize, and reuse filter sets. It consolidates the old separate "Cached" and "Saved" filter buttons into one Library entry point.
• The library modal has three tabs: Saved (filter sets you've explicitly saved), Favorites (entries you've starred), and Previously Used (filters you've recently applied, tracked automatically).
• Tags organize the library: add and remove tags on entries, rename or delete tags via Manage tags, and narrow the list by clicking tag chips.
• Rename saved entries, mark any entry as a favorite, and create a new set with New saved filter.
• Apply adds a library entry on top of your current filters; Replace current filters swaps your active filters for the saved set instead.
• Import / Export — export your library to a timestamped JSON file (e.g., filter-library-20260610-093000.json) and import it back later or on another machine. Older exports, including the previous SavedFilterGroup format, import through a tolerant fallback, and an import preflight flags name conflicts and duplicates so nothing is silently overwritten.
• Previously Used is capped at 50 entries and pruned oldest-first; favorites are always preserved.
• Your existing favorite and saved filters from the old system are migrated into the library automatically the first time you run this build.
• In the Add-filter menu, the old Cached entry is now labeled Recent.

Performance & Memory

• Server GC is enabled and provider message resolution runs in parallel, so large logs resolve descriptions faster.
• Provider message tables load on demand and are stored compactly, cutting resolver memory for large provider databases.
• System and value-type properties are read without boxing, and events are read in batches of 256 with handles released promptly on a failed read.
• A newly opened log's first screenful is prioritized over bulk background resolution.
• Database Tools log output flushes in batches, and Show Providers output is built in a single pass for smoother long-running operations.
• Combined view rebuild eliminated — when multiple logs are open, the Combined view is maintained in place instead of rebuilt on every event. Live tailing is 92–94% faster with 17–50% lower memory use in benchmarks. Per-log tabs are derived from the Combined view on demand. Filter changes, log loads, and log closes are 22–48% faster too.
• Combined-events sorting uses a merge of pre-sorted per-log lists instead of a full re-sort; default sort is consistent between per-log and combined views.
• Inline grouping builds a virtual row-view over the already group-sorted event list: header and event rows are resolved on demand via a binary search over a prefix-sum (with O(1) group lookup by key) and no per-row materialization, and each event's group key is computed only once while the view is built.
• Reduced string and memory allocations in hot paths: pooled string builders, faster format-token paths, and primitive specializations in logging.
• Provider database serialization uses source-generated JSON for faster reads/writes.
• Compressed JSON now streams directly to and from disk, avoiding large temporary strings and byte arrays.
• First-time provider resolution coalesces concurrent requests; parallel local resolution uses an owned registry key for better isolation.
• Keyword decoding is single-pass and short-circuits when there are no standard keywords to check.
• Native event rendering uses stack buffers for typical sizes and falls back to a pooled buffer for very large events.
• Scrolling to the selected event is now a single indexed pass instead of two searches.
• Copying multiple events to the clipboard reuses one string builder; owning-log parsing is faster.
• Keyword display strings are built only when first read.
• Rotating cache for NTStatus and HResult lookups speeds up repeated decodes.
• Caches are tied to instance lifetime so they release when no longer needed.
• Faster event table loading via batch loading and improved indexing.
• The event table only re-renders when the underlying list actually changes; the status bar only updates on real value changes.
• The diagnostic logger only allocates when something is actually logged, and uses a temp file instead of buffering everything in memory.
• Property-count and property-format paths share their cache; template matching picks a better candidate when multiple are available.
• Recomputing eligible-count in the Manage tab skips the snapshot pass when nothing is selected, so banner and coordinator state changes don't allocate in the common case.
• Event resolution was refactored into focused, single-purpose helpers (template analysis, task/keyword resolution, modern-event matching, description formatting) for faster, more predictable resolution.
• Provider parameter lookups are indexed and the description cache is bounded, so repeated resolution stays fast without growing memory unbounded.
• Resolution short-circuits the supplemental metadata load when an event's message has no %% parameter tokens to expand.
• With multiple logs open, the Combined view pages its on-screen slice through a per-log-position min-heap merge plus a bulk single-log slice, so scrolling and viewport updates touch only the rows in view instead of walking the whole merged list.
• Native event metadata is read with less copying and boxing: cold-path variants are read by pointer instead of marshalling a struct, Guid Event Data values are no longer re-boxed on read, and the wevtapi size-probe is skipped in favor of a pinned, per-thread grow-only buffer.
• The event table reads its display-ready sort context and version from a single snapshot, avoiding repeated reads while rendering.

Reliability

• Fixed a race in the elevated helper's force-kill path so a canceled elevated operation reports its outcome correctly.
• Updated dependencies and mitigated CVE-2025-6965 in the transitive SQLite dependency.
• Database Tools operations were hardened with encrypted-input handling, async database flushing, bounded regex timeouts, partial-database cleanup, safer conditional rendering, ARIA/JS interop detach fixes, and cleaner exception handling.
• Modals no longer fail if first-render JavaScript interop is detached or unavailable.
• Log views now tolerate first-render timing issues instead of crashing while the UI is still attaching.
• Log tab activation is guarded while a log is loading, avoiding races from keyboard or click input during startup.
• Update auto-scans no longer interfere with restart/update options.
• Live event subscriptions release their native handle and wait for in-flight callbacks correctly on shutdown — no more leaked handles or hung threads.
• Exceptions thrown by event handlers are isolated so one bad subscriber can't break others; stop requests during stop are rejected cleanly.
• The initial event backlog is drained outside the watcher's startup lock, so opening a busy log no longer stalls.
• UnauthorizedAccessException messages now include the underlying Win32 reason for easier troubleshooting.
• Opening multiple logs at once is throttled to avoid overwhelming the system, and uses channels for smoother event flow.
• Modal close pipeline has a close-veto path with a critical scope, so critical dialogs (recovery, in-progress operations) won't be dismissed out from under you. Inline alerts dispose asynchronously and cleanly when a modal closes.
• Cross-modal context menu activations correctly detach viewport listeners and restore opener focus.
• Focus and JS-interop helpers now catch TaskCanceledException, JSDisconnectedException, and JSException consistently during teardown, so disconnected browser sessions and rapid modal close/open sequences don't surface as errors.
• The Manage tab cancels in-flight or queued upgrade batches before removal, and only counts a removal as failed once the real cancel/completion event arrives.
• Banner cycle mutations are synchronized, upgrade-progress cancellation faults are isolated to their own row, and OnRemove callbacks are properly awaited.
• The Database Tools elevation helper is hardened against hangs: it won't deadlock if the elevated process can't be killed, and its named-pipe and regex paths handle errors and time-outs cleanly.
• Offline-image builds clean up after themselves: mounted ISOs and virtual disks are released even on failure, and orphaned mounts from a crashed or interrupted run are detected and swept up on the next run via an ownership beacon (the build fails closed if that beacon can't be written).
• A WIM extract estimates required space safely (reparse-point aware) and refuses to start without enough free space rather than failing partway.
• The offline image readers are hardened against malformed input: file access is contained to the image root, registry-hive and WEVT reads guard their bounds against integer overflow, and a template with no usable signature fails closed instead of resolving incorrectly.
• Offline-image reads reject attribute-only canonical paths, guard their sampling caps, skip whitespace-only samples, and decode astral (supplementary-plane) numeric character entities correctly.
• Remaining provider-scan handles are disposed on the cold path.

UI / CSS / Accessibility

• Redesigned alert and prompt dialogs as consistent fixed-width popups.
• Buttons across the app share one component with consistent styling, keyboard support, and focus handling.
• Loading spinners keep animating under "reduce motion," and the rotating caret is centered correctly.
• Log tabs are keyboard-accessible with Tab navigation, button roles, and correct disabled states for screen readers.
• Tab-list keyboard handling now prevents default browser behavior only where needed, keeping focus and scroll behavior predictable.
• The grouped event table is exposed as an ARIA tree grid with full keyboard navigation: ArrowUp / ArrowDown move through group headers and events, ArrowLeft / ArrowRight collapse/expand a header or move between an event and its header, Enter toggles the focused header, and Shift + ArrowUp / ArrowDown extends the selection across groups (including into collapsed ones). The group chevron is marked aria-hidden so it isn't announced twice; flat (ungrouped) tables keep the standard arrow behavior.
• ValueSelect dropdowns keep C# and JavaScript open/close/toggle state in sync, so the visible menu matches the component state.
• .visually-hidden styles are scoped correctly so screen-reader-only content doesn't affect unrelated UI.
• Accessibility infrastructure: visible keyboard focus, respect for reduced-motion settings, page landmarks.
• Accessibility behavior: skip-to-content link, live region announcements, proper button roles, visual cues that don't depend on color alone.
• Screen-reader completion announcements for long-running operations via a shared announcer host (e.g., upgrades, removals, classifications announce when they finish).
• Reusable Checkbox component and a new switch-style boolean component; radio groups were refactored to share centralized ARIA parameters in a common base class for consistent labelling.
• Manage tab "blocked" help text (upgrade-blocked, save-blocked) no longer re-announces on every state flip — only the action labels are described, not the live status spans.
• Database row keyboard order is now natural left-to-right (name → toggle/upgrade → trash) while the trash control stays visually pinned to the left edge.
• A pending-toggle visual indicator (subtle 1px ring) and screen-reader suffix ("pending toggle, unsaved") make staged enable/disable changes obvious.
• CSS cleanup: switched from ID selectors to classes, removed !important overrides and the forced-colors override, and consolidated styling tokens.
• A single generic modal style is used across the app; alert dialogs share the same look.
• Boolean "yes/no" selectors no longer look like green/red traffic lights — enabled now uses the app's positive color, removing the polarity confusion.
• ValueSelect dropdowns: several bug fixes and smoother behavior.
• Removed unused HTML and navigation scaffolding.
• Markdown rendering now supports italics.
• Debug Log modal: filtering, smooth scrolling for large logs, export, and newest-first streaming (with a "busy" announcement for screen readers while loading).
• Removed the redundant "Copy Event" button from the details pane (copy is still available from the right-click menu and keyboard shortcuts).
• Modal footers right-align their buttons consistently across the app.
• Debug Log modal: very long lines no longer cause a horizontal scrollbar — they clip with an ellipsis, and hovering shows the full line as a tooltip (indentation in stack traces is preserved so they still read correctly).
• A shared vertical tab strip now drives the Database Tools, Debug Log, Settings, Release Notes, and Filter Library modals, with WAI-ARIA vertical navigation (ArrowUp/Down/Home/End) and a consistent flex body layout.
• Modals can show an inline validation error in their header (with a dedicated error color token) instead of relying on a separate alert.
• The interrupted-upgrade recovery dialog is now a proper modal, consistent with the rest of the app's dialogs.
• Keyboard navigation no longer scrolls the page unexpectedly — Arrow / Home / End keys on the scenario list, filter pane (the add-filter chevron and filter-list toggle), details-pane toggles, log tab bar, and menu bar now suppress the browser's default page scroll synchronously through a shared JS helper, matching the existing tab-strip behavior.
• Bootstrap Icons updated to 1.13.
• The ValueSelect dropdown gains an editable input mode (used by the Create tab's image-index field): you can type a value directly or pick one from the list, and your in-progress text is preserved if it doesn't parse yet.
• The Database Tools operation result is shown as a plain status word in a steady live region, so screen readers announce the outcome without the chip appearing and disappearing.
• Long options in a ValueSelect dropdown (and its selected value) now truncate with an ellipsis and reveal the full text as a hover tooltip only when they're actually clipped, so a wide field name or value no longer stretches or overflows the control.
• The filter property list is sorted alphabetically for easier scanning.

Bug Fixes

• File picker titles now flow through the Win32 dialog correctly, suggested file names are bounds-checked, and long titles are clamped safely.
• Log-view scroll pinning is re-armed when the view shrinks, so pinned output stays anchored after filtering or resizing.
• Fixed an inverted pin-state guard in DatabaseToolsLogView that could keep the live log from following new output.
• ValueSelect now re-renders immediately after close/open/toggle state changes instead of drifting from the JavaScript state.
• Restored the RestartNowAndUpdate options in update prompts.
• DatabaseToolsLogView now resets its watermark correctly between operations.
• Combined view no longer treats records from different logs as duplicates when they happen to share a record ID.
• Fixed crashes when an event message ends with a %n placeholder or uses 0 as a string terminator.
• Fixed an event variant type mismatch that could break resolution; added a missing variant and a more helpful default.
• Fixed an error when trying to read a log file that had been deleted on disk.
• Fixed temp-file creation failures when working with encrypted logs (the app now uses a file stream directly).
• Fixed a disposal bug in the database-backed resolver and a watcher constructor bug.
• Fixed a dependency injection issue with the diagnostic logger.
• Provider-database failure dialogs only appear when you start a scan manually — no more popups during startup scans.
• Several smaller ValueSelect bugs and rough edges.
• Added a clean failure path when provider-database deserialization returns nothing instead of throwing.
• Added proper cleanup (IDisposable) to several components to prevent leaks, and removed dispose calls that were no longer needed.
• Update checks no longer repeat themselves — once per session.
• Removing a database no longer wildcard-deletes your .bak backup files.
• Empty or unrecognized provider databases no longer crash the resolver — they're flagged and quarantined.
• Removed unused remote-machine support from the event message and registry providers.
• Opening one Live log immediately after another no longer briefly populates and then wipes the new log's table — close-all now clears state before the previous log's watcher finishes draining.
• Bulk-selection cleanup in the Manage tab is scoped to the file names that were actually removed instead of clearing the entire selection set.
• The close-and-reopen warning is restored in the remove-confirmation dialog, and per-file removal failures are surfaced so you can see which ones didn't go through.
• Removals that throw after confirmation are counted as failures (rather than silently dropped) so the UI reflects the real outcome.
• Fixed a Database Tools layout regression (two-column form, path inputs, elevation warning, and the responsive single-column collapse) introduced while extracting the shared vertical tab strip.
• Importing a filter library no longer crashes on duplicate fingerprints, colliding entry IDs, or legacy bare-array exports — conflicts are detected and de-duplicated, and colliding IDs are regenerated instead of failing the import.
• Restoring focus after deleting the only row in a Filter Library tab now lands on the active tab button instead of being lost.
• Turning grouping off restores focus by event identity instead of a stale grouped row index, so the selected event stays put when you ungroup.
• The grouped Log header now shows the log name that matches the group key.