@@ -140,21 +140,24 @@ so it cannot later be presented as host-taken.
 ## Controls
 
 ```text
-envcapture-guard-reports     a control that raises is reported, never fatal
-envcapture-schema            the declared key set, enforced both ways
-envcapture-field-contract    observed/unavailable, with no third state
-envcapture-identity-split    provenance can never become identity
-envcapture-assigned-id       an owner-assigned id cannot be 'unavailable'
-envcapture-drift             provenance moves freely; identity never does
-envcapture-no-measurement    no clock, no resource accounting, by AST
-envcapture-windows-fixture   the schema holds off Linux; the capture path does not
-envcapture-frozen-untouched  this addition moved none of the three frozen digests
-envcapture-ci-provenance     a CI-taken manifest says so and cannot hide it
+envcapture-guard-reports         a control that raises is reported, never fatal
+envcapture-schema                the declared key set, enforced both ways
+envcapture-field-contract        observed/unavailable, with no third state
+envcapture-identity-split        provenance can never become identity
+envcapture-assigned-id           an owner-assigned id cannot be 'unavailable'
+envcapture-drift                 provenance moves freely; identity never does
+envcapture-no-measurement        no clock, no resource accounting, by AST
+envcapture-reason-fits-platform  an 'unavailable' reason names THIS platform
+envcapture-windows-fixture       the schema holds off Linux
+envcapture-frozen-untouched      this addition moved none of the three frozen digests
+envcapture-ci-provenance         a CI-taken manifest says so and cannot hide it
 ```
 
-Twelve mutations of the tool, each declaring in advance which control must catch
-it, and each scored on a `FAIL` line from **that** control rather than on a
-non-zero exit.
+Fifteen mutations, each declaring in advance which control must catch it, and
+each scored on a `FAIL` line from **that** control rather than on a non-zero
+exit. Two of the fifteen mutate the **control file**, not the tool: the guard is
+the durable answer to a defect recorded eight times, so it needs its own
+adversary.
 
 ## Two defects the campaign found, both real
 
@@ -174,11 +177,49 @@ turns any escaping exception into a reported failure for that control and lets
 the run continue, and `envcapture-guard-reports` makes restoring the bare call a
 test failure rather than a story in a session log.
 
-## What is NOT verified
+## What the first Windows CI run found, and what it cost
 
-The Windows capture path. The registry read, `powercfg` and
-`GlobalMemoryStatusEx` branches have never executed. `envcapture-windows-fixture`
-exercises the **schema and the drift rule** on a synthetic non-Linux manifest and
-says so in its own success message; it is not evidence that Windows capture
-works. That stays unverified until a dedicated Windows host exists, which is the
-same gate the first clock waits behind.
+The Windows capture path was described as unverified, and one CI run on
+`windows-latest` (Server 2025) made most of it verified and found two defects.
+
+| field | Windows result |
+|---|---|
+| `host_fingerprint` | observed — the registry `MachineGuid` read works |
+| `os_build`, `kernel` | observed — `Windows 2025Server 10.0.26100 SP0 …` |
+| `memory_bytes` | observed — `GlobalMemoryStatusEx` works |
+| `power_policy` | observed — `powercfg` returns the active scheme |
+| `cpu_model` | observed, but **weak** |
+| `virtualization` | **unavailable, for a Linux reason** |
+
+**`virtualization` reported "systemd-detect-virt absent or unclear and no DMI
+identity under /sys" — on Windows.** That is true of every Windows machine ever
+built, and it reads as though a probe ran when nothing Windows-specific had been
+tried at all. A stated reason naming the wrong operating system is worse than no
+reason. `_virtualization()` is now platform-branched and queries
+`Win32_ComputerSystem` through CIM, and `envcapture-reason-fits-platform`
+enforces the general rule: an `unavailable` reason may only name mechanisms that
+exist on the platform it was produced on. Designing that control immediately
+caught a second instance — `_cpu_model`'s repaired reason named both `/proc/cpuinfo`
+and `Win32_Processor` in one sentence.
+
+**`cpu_model` fell through a dead tool in silence.** `wmic` is gone from recent
+Windows images, so the model name arrived as `platform.processor()`'s
+`AMD64 Family 25 Model 1 Stepping 1, AuthenticAMD` — a family string, not the
+processor's name, and nowhere near the "cpu model exact" the ruling asks for. The
+CIM query now runs first.
+
+**A green run printed a failure.** `control_guard_reports` exercised the guard by
+calling it and then deleting the entry from the failure list, which left a literal
+`FAIL[envcapture-guard-fixture]` in every passing CI log — exactly the string this
+repository's mutation scorer keys on, and the sort of line that teaches readers to
+ignore `FAIL`. The guard is now split into a pure `guard_failure()` that returns
+the message and a `guarded()` that reports it, so the probe asserts on a returned
+string and prints nothing.
+
+## What is still NOT verified
+
+Capture on a **dedicated** Windows host. A hosted runner is not one, and the CIM
+virtualization query added above has never executed anywhere, since this container
+is not Windows. `envcapture-windows-fixture` exercises the schema and drift rule
+on a synthetic manifest and now says exactly that rather than claiming the
+Windows branches are unrun.
@@ -168,6 +168,33 @@ def _windows_machine_guid() -> str | None:
     return str(value) if value else None
 
 
+def _windows_cim(class_name: str, props: tuple[str, ...]) -> dict[str, str] | None:
+    """One CIM query for identity. No shell, no timing, no clock.
+
+    `wmic` is gone from recent Windows images — the first CI run of this tool on
+    windows-latest (Server 2025) fell straight through it — so the model name
+    arrived as `platform.processor()`'s family/model/stepping string instead of
+    the processor's actual name. CIM is the supported replacement.
+    """
+    if os.name != "nt":
+        return None
+    script = "; ".join(
+        [f"$o = Get-CimInstance -ClassName {class_name} | Select-Object -First 1"]
+        + [f"Write-Output ('{prop}=' + $o.{prop})" for prop in props])
+    for exe in ("powershell", "pwsh"):
+        found = _tool([exe, "-NoProfile", "-NonInteractive", "-Command", script])
+        if found is None or found[0] != 0:
+            continue
+        values: dict[str, str] = {}
+        for line in found[1].splitlines():
+            key, _, value = line.partition("=")
+            if key.strip() in props and value.strip():
+                values[key.strip()] = value.strip()
+        if values:
+            return values
+    return None
+
+
 def _os_build() -> dict[str, object]:
     if os.name == "nt":
         release, version, csd, ptype = platform.win32_ver()
@@ -208,14 +235,15 @@ def _cpu_model() -> dict[str, object]:
                 if value.strip():
                     return observed(value.strip())
     if os.name == "nt":
-        found = _tool(["wmic", "cpu", "get", "name"])
-        if found and found[0] == 0:
-            lines = [ln.strip() for ln in found[1].splitlines() if ln.strip()]
-            if len(lines) > 1:
-                return observed(lines[1])
+        cim = _windows_cim("Win32_Processor", ("Name",))
+        if cim and cim.get("Name"):
+            return observed(cim["Name"])
     processor = platform.processor()
     if processor:
         return observed(processor)
+    if os.name == "nt":
+        return unavailable("no Win32_Processor Name through powershell or pwsh, and "
+                           "platform.processor() is empty")
     return unavailable("no model name in /proc/cpuinfo and platform.processor() is empty")
 
 
@@ -270,7 +298,21 @@ class _Status(ctypes.Structure):
 
 
 def _virtualization() -> dict[str, object]:
-    """Exact, or explicitly classified. Never a guessed 'probably bare metal'."""
+    """Exact, or explicitly classified. Never a guessed 'probably bare metal'.
+
+    Platform-branched, because an `unavailable` reason that names the other
+    platform's mechanisms is a false statement about what was tried. The first
+    Windows CI run of this tool reported "systemd-detect-virt absent ... no DMI
+    identity under /sys" on Windows Server 2025, which is true of every Windows
+    machine ever built and told the reader nothing.
+    """
+    if os.name == "nt":
+        cim = _windows_cim("Win32_ComputerSystem", ("Manufacturer", "Model"))
+        if cim:
+            return observed(f"Win32_ComputerSystem Manufacturer={cim.get('Manufacturer', '?')} "
+                            f"Model={cim.get('Model', '?')}")
+        return unavailable("Win32_ComputerSystem is unreadable through powershell and pwsh, "
+                           "so the virtualization boundary is not classified on this host")
     found = _tool(["systemd-detect-virt"])
     if found is not None:
         # Exit 1 with "none" is the tool answering, not failing.
@@ -285,14 +327,14 @@ def _virtualization() -> dict[str, object]:
 
 
 def _power_policy() -> dict[str, object]:
-    governor = _text("/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor")
-    if governor and governor.strip():
-        return observed(f"cpufreq scaling_governor={governor.strip()}")
     if os.name == "nt":
         found = _tool(["powercfg", "/getactivescheme"])
         if found and found[0] == 0 and found[1].strip():
             return observed(found[1].strip())
         return unavailable("powercfg /getactivescheme produced no active scheme")
+    governor = _text("/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor")
+    if governor and governor.strip():
+        return observed(f"cpufreq scaling_governor={governor.strip()}")
     return unavailable(
         "no /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor on this host; CPU "
         "frequency policy is not observable here")
 
@@ -11,6 +11,7 @@
     envcapture-assigned-id       an owner-assigned id cannot be 'unavailable'
     envcapture-drift             provenance moves freely; identity never does
     envcapture-no-measurement    no clock, no resource observation, by AST
+    envcapture-reason-fits-platform  an 'unavailable' reason names THIS platform
     envcapture-windows-fixture   the schema holds off Linux; the capture path does not
     envcapture-frozen-untouched  this addition moved none of the three frozen digests
     envcapture-ci-provenance     a CI-taken manifest says so and cannot hide it
@@ -329,6 +330,61 @@ def control_no_measurement() -> None:
 }
 
 
+# Mechanism names that exist on one platform only. A reason naming the other
+# platform's mechanisms is a false statement about what was tried.
+POSIX_ONLY = ("/sys/", "/proc/", "systemd-detect-virt", "scaling_governor", "cpufreq")
+WINDOWS_ONLY = ("powercfg", "Win32_", "MachineGuid", "GlobalMemoryStatusEx",
+                "powershell", "pwsh")
+
+
+def foreign_mechanisms(reason: str, *, on_windows: bool) -> tuple[str, ...]:
+    """Written once, used twice: on the live manifest and on a synthetic reason."""
+    foreign = POSIX_ONLY if on_windows else WINDOWS_ONLY
+    return tuple(token for token in foreign if token in reason)
+
+
+def control_reason_fits_platform() -> None:
+    """An 'unavailable' reason must describe THIS platform's mechanisms.
+
+    The first Windows CI run of this tool reported `virtualization` unavailable
+    because "systemd-detect-virt absent ... and no DMI identity under /sys" —
+    true of every Windows machine ever built, and silent about the fact that
+    nothing Windows-specific had been tried at all. A stated reason that names
+    the wrong operating system is worse than no reason, because it reads as
+    though a probe ran.
+    """
+    on_windows = os.name == "nt"
+    manifest = _live()
+    problems: list[str] = []
+    for name, field in manifest["identity"].items():  # type: ignore[union-attr]
+        if field.get("status") != ec.UNAVAILABLE:
+            continue
+        found = foreign_mechanisms(str(field.get("reason", "")), on_windows=on_windows)
+        if found:
+            problems.append(f"{name} blames {', '.join(found)}")
+    if problems:
+        fail("envcapture-reason-fits-platform",
+             f"on {'Windows' if on_windows else 'POSIX'}, "
+             + "; ".join(problems))
+        return
+
+    # The scanner must actually catch the defect that prompted it, or its silence
+    # on the live manifest proves nothing.
+    regression = "systemd-detect-virt absent or unclear and no DMI identity under /sys"
+    if not foreign_mechanisms(regression, on_windows=True):
+        fail("envcapture-reason-fits-platform",
+             "the scanner does not catch the exact Windows reason that prompted it")
+        return
+    if foreign_mechanisms(regression, on_windows=False):
+        fail("envcapture-reason-fits-platform",
+             "the scanner calls a POSIX reason foreign on POSIX")
+        return
+    ok("envcapture-reason-fits-platform",
+       f"every unavailable reason on {'Windows' if on_windows else 'POSIX'} names a mechanism "
+       "that exists here, and the Windows virtualization reason that shipped in the first "
+       "version is still caught")
+
+
 def control_windows_fixture() -> None:
     problems = ec.validate(WINDOWS_FIXTURE)
     if problems:
@@ -341,9 +397,11 @@ def control_windows_fixture() -> None:
         fail("envcapture-windows-fixture", "a changed Windows power policy was not drift")
         return
     ok("envcapture-windows-fixture",
-       "the schema and the drift rule hold on a non-Linux manifest. This does NOT exercise the "
-       "Windows capture path: the registry, powercfg and GlobalMemoryStatusEx branches stay "
-       "unrun until a dedicated Windows host exists, and are recorded as unverified")
+       "the schema and the drift rule hold on a non-Linux manifest. This fixture does not run "
+       "the Windows capture path; the CI selftest on windows-latest does, and its first run "
+       "returned the registry fingerprint, powercfg and GlobalMemoryStatusEx but no "
+       "virtualization, which is what added the CIM query. What stays unverified is capture on "
+       "a DEDICATED Windows host, since a hosted runner is not one")
 
 
 def _git(*args: str) -> tuple[int, bytes]:
@@ -423,6 +481,23 @@ def control_ci_provenance() -> None:
        "so it cannot later be presented as taken on a dedicated measurement host")
 
 
+def guard_failure(control: Callable[[], None]) -> str | None:
+    """Run a control; return the message a failure should carry, or None.
+
+    Split from `guarded` so the probe below can exercise it WITHOUT printing a
+    `FAIL[` line. The first version reported through `fail()` and then deleted
+    the entry from the list — which left a literal `FAIL[envcapture-guard-fixture]`
+    in every green CI log, exactly the string this repository's mutation scorer
+    keys on. A green run must not print a failure.
+    """
+    try:
+        control()
+    except Exception as exc:  # the point is that nothing escapes
+        return (f"the control raised {type(exc).__name__}: {exc}. A control that crashes "
+                "before reporting is a traceback, not a finding")
+    return None
+
+
 def guarded(name: str, control: Callable[[], None]) -> None:
     """Report an escaping exception instead of dying of it.
 
@@ -433,11 +508,9 @@ def guarded(name: str, control: Callable[[], None]) -> None:
     `envcapture-identity-split` — the control that owns exactly that defect —
     could say a word.
     """
-    try:
-        control()
-    except Exception as exc:  # the point is that nothing escapes
-        fail(name, f"the control raised {type(exc).__name__}: {exc}. A control that crashes "
-                   "before reporting is a traceback, not a finding")
+    message = guard_failure(control)
+    if message is not None:
+        fail(name, message)
 
 
 def control_guard_reports() -> None:
@@ -446,33 +519,29 @@ def control_guard_reports() -> None:
     A scratchpad campaign that once watched a crash get reported is not a
     regression catcher; restoring the bare call in `run()` has to fail here.
     """
-    marker = "envcapture-guard-fixture"
-    before_fails, before_passes = len(_FAILURES), len(_PASSES)
-
     def always_raises() -> None:
         raise RuntimeError("a control that dies before reporting")
 
     try:
-        guarded(marker, always_raises)
+        message = guard_failure(always_raises)
     except Exception as exc:  # nothing may escape, including from the guard
         fail("envcapture-guard-reports",
-             f"guarded() let {type(exc).__name__} escape, so one crashing control still "
+             f"guard_failure() let {type(exc).__name__} escape, so one crashing control still "
              "kills every control after it")
         return
-    recorded = [d for c, d in _FAILURES[before_fails:] if c == marker]
-    # Take the fixture's own failure back out; it is a probe, not a finding.
-    del _FAILURES[before_fails:]
-    del _PASSES[before_passes:]
-    if not recorded:
-        fail("envcapture-guard-reports", "guarded() swallowed the exception without reporting it")
+    if message is None:
+        fail("envcapture-guard-reports", "a raising control was reported as clean")
         return
-    if "RuntimeError" not in recorded[0]:
+    if "RuntimeError" not in message:
         fail("envcapture-guard-reports",
-             f"guarded() reported without naming the exception type: {recorded[0]!r}")
+             f"the report does not name the exception type: {message!r}")
+        return
+    if guard_failure(lambda: None) is not None:
+        fail("envcapture-guard-reports", "a clean control was reported as a failure")
         return
     ok("envcapture-guard-reports",
-       "a control that raises is reported by name and the run continues, so the mutation that "
-       "once killed the suite before its owning control could speak stays caught")
+       "a control that raises is reported by name and the run continues, a clean one is not, "
+       "and this probe prints no FAIL line of its own on a green run")
 
 
 def run() -> int:
@@ -483,6 +552,7 @@ def run() -> int:
     guarded("envcapture-assigned-id", control_assigned_id)
     guarded("envcapture-drift", control_drift)
     guarded("envcapture-no-measurement", control_no_measurement)
+    guarded("envcapture-reason-fits-platform", control_reason_fits_platform)
     guarded("envcapture-windows-fixture", control_windows_fixture)
     guarded("envcapture-frozen-untouched", control_frozen_untouched)
     guarded("envcapture-ci-provenance", control_ci_provenance)