Azure · ABMFST · Jul 28, 2026 · Jul 28, 2026
diff --git a/.github/workflows/release-mac.yml b/.github/workflows/release-mac.yml
@@ -11,7 +11,7 @@ name: Release (macOS author)
 #
 # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`;
 # the checkout step below switches to and verifies the supplied immutable mac tag.
-# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.95-author.1`
+# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.96-author.1`
 # The protected main copy of the public packaging guard checks the tagged tree
 # before npm install or electron-builder runs.
 #
@@ -143,7 +143,7 @@ jobs:
           ) > SHA256SUMS-macos-author.txt
           cat SHA256SUMS-macos-author.txt
 
-      # Attach to the existing draft release (e.g. mac-v0.3.95-author.1).
+      # Attach to the existing draft release (e.g. mac-v0.3.96-author.1).
       # `--clobber` overwrites if a re-run uploads the same filename.
       - name: Upload artifacts to draft release
         env:

diff --git a/AGENTS.md b/AGENTS.md
@@ -19,12 +19,12 @@ The following release references describe the current tagged source lines:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.95` | Current Full-edition Windows/Linux tagged source (PR [#102](https://github.com/Azure/ConfigForge/pull/102) merged at `6c593c0`). Its matching GitHub release remains an unpublished draft. |
-| `mac-author-build` | `mac-v0.3.95-author.1` | Current author-only macOS tagged source. Its matching GitHub release remains an unpublished draft. PR [#99](https://github.com/Azure/ConfigForge/pull/99) ports documentation-accuracy corrections; PR [#101](https://github.com/Azure/ConfigForge/pull/101) replaces unreliable native HTML hover titles with FluentUI tooltips on My Baselines status cells. |
+| `main` | `v0.3.96` | Current Full-edition Windows/Linux tagged source (PR [#104](https://github.com/Azure/ConfigForge/pull/104) merged at `b986ab8`). Its matching GitHub release remains an unpublished draft. |
+| `mac-author-build` | `mac-v0.3.96-author.1` | Current author-only macOS tagged source. Its matching GitHub release remains an unpublished draft. PR [#105](https://github.com/Azure/ConfigForge/pull/105) ports the full WS2025 control-preservation and global MOF export fixes. |
 
 On `mac-author-build`, the root package, desktop package, and matching lockfile
-records use `0.3.95-author.1`. This release carries no dependency changes from
-the prior macOS line. The package version on `main` is `0.3.95`; do not copy
+records use `0.3.96-author.1`. This release carries no dependency changes from
+the prior macOS line. The package version on `main` is `0.3.96`; do not copy
 macOS package metadata to `main`.
 
 The prior annotated tag `mac-v0.3.94-author.1` resolves to
@@ -121,15 +121,15 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
 - The macOS tag must resolve to the exact final validated commit on
   `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and
   defaults to `Azure/ConfigForge`.
-- The current macOS Author tagged source `mac-v0.3.95-author.1` expects
+- The current macOS Author tagged source `mac-v0.3.96-author.1` expects
   these asset names. Its matching GitHub release remains an unpublished
   draft; this documentation does not assert asset availability or
   publication:
 
   | Asset | Exact name |
   |---|---|
-  | DMG | `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg` |
-  | Blockmap | `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg.blockmap` |
+  | DMG | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` |
+  | Blockmap | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` |
   | Update metadata | `latest-mac.yml` |
   | CycloneDX SBOM | `sbom-macos-author.cdx.json` |
   | SHA-256 manifest | `SHA256SUMS-macos-author.txt` |
@@ -145,7 +145,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
   gh workflow run "Release (macOS author)" `
     --repo Azure/ConfigForge `
     --ref main `
-    -f release_tag=mac-v0.3.95-author.1
+    -f release_tag=mac-v0.3.96-author.1
   ```
 
 - `--ref main` selects the reviewed workflow definition, not the source to
@@ -454,7 +454,7 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   workflow run
   [#30233283418](https://github.com/Azure/ConfigForge/actions/runs/30233283418),
   but that release remains a draft and unpublished.
-- The current macOS Author tagged source is `mac-v0.3.95-author.1`. Its
+- The current macOS Author tagged source is `mac-v0.3.96-author.1`. Its
   matching GitHub release remains an unpublished draft; use current GitHub
   checks and release metadata as the authority for build and asset status
   rather than recording a merge SHA or workflow run here.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,10 @@
 # Changelog
 
-## Unreleased
+## [0.3.96-author.1] - 2026-07-28
+
+> `mac-v0.3.96-author.1` is the current macOS Author tagged source. Its
+> matching GitHub release remains an unpublished draft. The author-only
+> capability boundary is unchanged.
 
 ### Fixed
 
@@ -18,8 +22,8 @@
 
 ## [0.3.95-author.1] - 2026-07-27
 
-> `mac-v0.3.95-author.1` is the current macOS Author tagged source. Its
-> matching GitHub release remains an unpublished draft. This entry does not
+> `mac-v0.3.95-author.1` is the prior macOS Author tagged source. Its
+> matching GitHub release was an unpublished draft. This entry does not
 > indicate publication or assert asset availability. The author-only
 > capability boundary is unchanged: device deploy, audit, enforce, revert,
 > elevation, health, and audit-results storage remain excluded.

diff --git a/INSTALL.md b/INSTALL.md
@@ -8,11 +8,11 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux Full-edition tagged source is `v0.3.95`. The
-current macOS Author tagged source is `mac-v0.3.95-author.1`. Both matching
+The current Windows/Linux Full-edition tagged source is `v0.3.96`. The
+current macOS Author tagged source is `mac-v0.3.96-author.1`. Both matching
 GitHub releases remain unpublished drafts. The Full-edition package version
-on `main` is `0.3.95`; the macOS Author package version is
-`0.3.95-author.1`.
+on `main` is `0.3.96`; the macOS Author package version is
+`0.3.96-author.1`.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -128,7 +128,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The current macOS Author source tag is `mac-v0.3.95-author.1`. Its matching
+The current macOS Author source tag is `mac-v0.3.96-author.1`. Its matching
 GitHub release remains an unpublished draft and must stay draft-only until a
 maintainer completes validation and approves publication. Users can build the
 tagged source by following the instructions in the

diff --git a/README.md b/README.md
@@ -6,10 +6,10 @@
 
 > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps.
 
-The current Windows/Linux Full-edition tagged source is `v0.3.95`. The
-current macOS Author tagged source is `mac-v0.3.95-author.1`. Both matching
+The current Windows/Linux Full-edition tagged source is `v0.3.96`. The
+current macOS Author tagged source is `mac-v0.3.96-author.1`. Both matching
 GitHub releases remain unpublished drafts. The Full-edition package version
-on `main` is `0.3.95`; the macOS Author package version is `0.3.95-author.1`.
+on `main` is `0.3.96`; the macOS Author package version is `0.3.96-author.1`.
 
 The macOS Author release ports applicable documentation-accuracy corrections
 from `main` PR [#97](https://github.com/Azure/ConfigForge/pull/97) via PR
@@ -180,7 +180,7 @@ is not a universal binary.
 - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting.
 - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.).
 - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS
-  Author line is tagged as `mac-v0.3.95-author.1`; its release is an
+  Author line is tagged as `mac-v0.3.96-author.1`; its release is an
   unpublished draft.
 - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for
   Quick Start, User Guide, Architecture, API Reference, and Operations. The
@@ -208,8 +208,10 @@ is not a universal binary.
 
 | Version | Highlights |
 |---|---|
-| **0.3.95-author.1** (current macOS tagged source; draft unpublished) | Fixes unreliable My Baselines status tooltips by replacing native HTML hover titles with FluentUI tooltips (PR #101), and ports documentation-accuracy corrections from main PR #97 (PR #99). |
-| **0.3.95** (current Windows/Linux tagged source; draft unpublished) | Replaces unreliable native HTML hover titles with FluentUI tooltips on My Baselines status cells (PR #100) and corrects architecture/CI/release-state documentation drift (PR #97). |
+| **0.3.96-author.1** (current macOS tagged source; draft unpublished) | Ports the full 320/321/296 WS2025 control-preservation work and global Machine Configuration MOF export fixes from main PR #104 through PR #105. |
+| **0.3.96** (current Windows/Linux tagged source; draft unpublished) | Preserves every WS2025 control while fixing Registry/CSP contracts and CEL compliance, and hardens Machine Configuration MOF export in PR #104. |
+| **0.3.95-author.1** (prior macOS draft, unpublished) | Fixes unreliable My Baselines status tooltips by replacing native HTML hover titles with FluentUI tooltips (PR #101), and ports documentation-accuracy corrections from main PR #97 (PR #99). |
+| **0.3.95** (prior Windows/Linux draft, unpublished) | Replaces unreliable My Baselines status tooltips with FluentUI tooltips (PR #100) and corrects documentation drift (PR #97). |
 | **0.3.94-author.1** (prior macOS draft, unpublished) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations. |
 | **0.3.94** (prior Windows/Linux tagged source) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89. |
 | **0.3.93-author.2** (prior macOS draft, unpublished) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83; PR #84 prepares the immutable tag. Workflow run #30186678580 verified all five assets. |

diff --git a/SECURITY.md b/SECURITY.md
@@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged release lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.95` | Supported tagged source; release remains a draft |
-| macOS Author edition | `mac-v0.3.95-author.1` | Supported tagged source; release remains a draft |
+| Full edition for Windows and Linux | `v0.3.96` | Supported tagged source; release remains a draft |
+| macOS Author edition | `mac-v0.3.96-author.1` | Supported tagged source; release remains a draft |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope

diff --git a/apps/desktop/PACKAGING.md b/apps/desktop/PACKAGING.md
@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.95-author.1:** the release pipeline
+> **Current through v0.3.96-author.1:** the release pipeline
 > generates a CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and

diff --git a/apps/desktop/build/release-notes-author.md b/apps/desktop/build/release-notes-author.md
@@ -1,47 +1,47 @@
-# ConfigForge Author 0.3.95-author.1 - macOS
+# ConfigForge Author 0.3.96-author.1 - macOS
 
-> **Release state: draft and unpublished.** `mac-v0.3.95-author.1` is the
+> **Release state: draft and unpublished.** `mac-v0.3.96-author.1` is the
 > current macOS Author tagged source. Its matching GitHub release remains an
-> unpublished draft until a maintainer completes validation and approves
-> publication. The expected asset names are listed below; this document does
-> not assert that the assets have already been uploaded or that the release
-> has been published.
-
-This release fixes unreliable My Baselines status tooltips and ports
-documentation-accuracy corrections. It remains an author-only Apple Silicon
-build. It does not add device deployment, device audit, enforcement, revert,
-elevation, OSConfig CLI health, or audit-results storage.
-
-## Fixed: reliable My Baselines status tooltips
-
-- Replace unreliable native HTML `title` hover tooltips with FluentUI
-  `Tooltip` on the baseline name, platform, validation, compliance/Not
-  Audited, and modified-date cells in the My Baselines table.
-- Preserve multiline validation details through a stable
-  `aria-describedby` target instead of relying on OS-rendered native tooltips.
-- Keep the mac compliance cell intentionally non-clickable — it stays a
-  non-interactive `<span>` with the existing gray "not audited" styling, now
-  wrapped only in `Tooltip`. No button, click handler, or route navigation
-  was added.
-- Preserve the accessible ARIA shape: no extra table tab stops are
-  introduced by the tooltip triggers.
-- See PR [#101](https://github.com/Azure/ConfigForge/pull/101), which ports
-  the reviewed main PR [#100](https://github.com/Azure/ConfigForge/pull/100)
-  fix to the mac-specific table layout.
-
-## Documentation accuracy
-
-- Port the applicable documentation-accuracy corrections from main PR
-  [#97](https://github.com/Azure/ConfigForge/pull/97) via PR
-  [#99](https://github.com/Azure/ConfigForge/pull/99), including corrected
-  IPC surface, symbol/path references, and third-party notice licensing.
-- Keep the macOS Author version stream and release references unaffected by
-  the documentation port; no package, version, or workflow files changed in
-  PR #99.
+> unpublished draft until a maintainer verifies the five expected assets and
+> approves publication.
+
+This release preserves the complete Windows Server 2025 baseline catalog and
+hardens Machine Configuration MOF export. It remains an author-only Apple
+Silicon build and does not add device deployment, device audit, enforcement,
+revert, elevation, OSConfig CLI health, or audit-results storage.
+
+## Windows Server 2025 baseline rebuild
+
+- Preserve every shipped control and its ordering:
+  - Member Server: 320 resources
+  - Domain Controller: 321 resources
+  - Workgroup Member: 296 resources
+- Use canonical `REG_*` Registry types and colon-qualified hive paths.
+- Replace five CSP controls with reviewed Registry-provider mappings.
+- Keep five Policy CSP controls on writable `Config` paths instead of
+  read-only `Result` paths.
+- Translate the existing compliance schemas to CEL expressions without
+  weakening ranges or dropping resources.
+- Keep explicit desired values for the two Workgroup zero-valued Registry
+  controls so exported manifests remain remediating.
+
+## Machine Configuration MOF export
+
+- Apply the MOF conversion fix to every baseline exported by ConfigForge, not
+  only the WS2025 catalog.
+- Emit `ModuleName = "Microsoft.OSConfig"` and a portable
+  `ModuleVersion = "0.0.0"` placeholder for package-time version resolution.
+- Emit one shared correlation-group GUID plus canonical `Value`, `ValueName`,
+  and `ValueType` fields.
+- Preserve empty-string desired values through the Microsoft.OSConfig fallback
+  path.
+- Default the public packaging documentation to Audit while
+  Microsoft.OSConfig 1.3.11 retains its upstream remediation serialization
+  defect.
 
 ## Included authoring capabilities
 
-- YAML, JSON, and Visual editing with validation
+- YAML, JSON, MOF, CSV, and Visual editing with validation
 - Microsoft Baselines and local, URL, CSV, JSON, YAML, and XLSX import
 - Pairwise, CIS, and Matrix Diff
 - User-supplied Benchmark Mapping data
@@ -67,35 +67,30 @@ The release targets Apple Silicon ARM64 Macs (M1 or later). It is not an x64
 or universal build and does not support Intel Macs. Builds are unsigned and
 not notarized.
 
-## Validation policy
+## Validation
 
-Release preparation uses these dependency-free local checks:
-
-- Parse and compare package and lockfile JSON.
-- Verify the public-package guard and its Node.js tests.
-- Check documentation references, forbidden files, public registry URLs, and
-  exact screenshot scope.
-- Run Git whitespace and diff-scope checks.
-
-GitHub CI is authoritative for npm-backed lint, Vitest, build, audit, and
-Playwright validation. Publication requires successful CI, a completed
-packaging build, and verification of the five expected assets before the
-draft release is published.
+- Main and mac WS2025 YAML structures are identical.
+- Targeted MOF/catalog tests: 37 passed.
+- Public packaging guard tests: 8 passed.
+- PR #105 passed lint, full Vitest, Playwright Electron smoke, CodeQL, docs,
+  and policy checks.
+- The matching Workgroup baseline applied successfully on Windows Server 2025
+  and audited 296/296 compliant in the exact baseline state.
 
 ## Expected draft release assets
 
 The macOS release workflow uses exactly these expected asset names for
-`mac-v0.3.95-author.1`:
+`mac-v0.3.96-author.1`:
 
-1. `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg`
-2. `ConfigForge-Author-0.3.95-author.1-mac-arm64.dmg.blockmap`
+1. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg`
+2. `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap`
 3. `latest-mac.yml`
 4. `sbom-macos-author.cdx.json`
 5. `SHA256SUMS-macos-author.txt`
 
 ## Contributors
 
-PRs #99 and #101 were contributed by
+PRs #104 and #105 were contributed by
 [@ABMFST](https://github.com/ABMFST) with Copilot collaboration.
 
 ## Reporting issues

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@configforge/desktop",
-  "version": "0.3.95-author.1",
+  "version": "0.3.96-author.1",
   "private": true,
   "description": "ConfigForge \u2014 OSConfig Baseline Editing tool",
   "main": "./dist/electron/main.js",

diff --git a/docs/src/architecture/system-overview.md b/docs/src/architecture/system-overview.md
@@ -1,6 +1,6 @@
 # System overview
 
-ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.95`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.95-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
+ConfigForge is an Electron desktop app for authoring, validating, comparing, and exporting OSConfig manifests (`.osc.yaml`). The Full edition (`v0.3.96`) also supports live deploy/audit/revert operations; the macOS Author edition (`mac-v0.3.96-author.1`) intentionally omits those device-operation namespaces. The renderer uses Electron 42, React 18, Fluent UI v9, and Vite; shared business logic lives in the platform-neutral `@configforge/core` package.
 
 There is no HTTP server, database, queue, or microservice layer in the current app. Renderer code calls the Electron preload bridge (`window.cfs.*`), the main process validates IPC payloads, and pure handlers in `packages/core` own filesystem and CLI operations.