Sentinel 3.4.3

Sentinel 3.4.3

Fixed

• Stop parsing detection evidence as a filesystem path. Reject malformed Windows path hints before installer heuristics and distinguish rule-evaluation failures from policy/dispatch failures in diagnostics. Regression tests exercise quoted System32 evidence through durable detection logging.
• Isolate process/image, file, registry and other ETW work in four bounded FIFO lanes (2,048 events / 4 MiB each). Preserve per-provider ordering, filter unused event IDs before payload copying, scope file events before process lookup, and coalesce only path-less WMI registry-host hint refreshes to once per PID/second. Report filtered/coalesced counts separately from genuine lane loss.
• Coalesce repeated intermittent ETW loss alerts and limit repeated reconciliation requests without declaring missing telemetry healthy.
• Make Sentinel offline-isolation firewall rules idempotent. Repair duplicates only within the six exact owned names/group, refuse foreign collisions, and verify rule scope. Add a mandatory native Windows repeated-apply/duplicate-repair fixture.
• Retry incomplete background file walks after 15 minutes while retaining watchers and skipping already indexed successful files. Surface bounded failed-path examples and exception/HRESULT details; access denial is not file absence, and a bad child directory does not abort sibling enumeration.
• Keep enabled-token-privilege observations Tier2/LogOnly, outside credential-dump/composite authority; correct their explanation.

Validation and limits

• Local cross-build: zero warnings/errors; selected portable tests: 458 passed, eight Windows fixtures skipped; dashboard: 33 passed. See log findings, validation and remaining limits. Windows CI must run the full Framework suite and all eight native endpoint fixtures; local Linux checks cannot substitute for these. No Chrome-scroll cause, zero-loss collection, complete disk access or live KGB RAT interception is claimed. NanoAV remains the separate original .NET module with its existing coexistence-only changes.