Permissive Learning Mode 5/6 UI Policy

[lilybarkley-msft]

📖 Description

PR 5 of 6 — stacked on PR4. Adds UI-policy relaxation.

• New ui_limits + ui_violation modules: decode EventID=27 payloads (both rendered XML and <ProcessingErrorData><EventPayload> hex form). Recognizes CONVERT_TO_GUI and UI_OPERATION violations and tracks the JOB_OBJECT_UILIMIT_* Detail bits.
• event_parser:
  • ParsedEvent gains event_data_named (only populated when event_id == 27) and processing_error_payload.
  • ParseAccumulator / ParseResult gain need_ui, ui_event_count, ui_events, ui_operation_flags.
  • consume dispatches EventID=27 to ui_violation::consume_ui_violation.
• config:
  • set_ui_subsystem_enabled flips processContainer.uiPolicy.ui.disable to false.
  • apply_ui_operation_flags ORs observed JOB_OBJECT_UILIMIT_* bits into the appropriate uiPolicy sub-keys (clipboard, system settings, isolation, plus the simple boolean limits).
  • write_detection_summary extended with UI parameters; new UI section in the printed summary.
• stop / log honor the new fields: skip the adjusted-config write only when there's nothing mergeable in any axis, and invoke set_ui_subsystem_enabled / apply_ui_operation_flags when the trace reports UI activity.
• UI-policy schema mapping documented in docs/base-process-container/UIPolicy_Schema.md.

🔗 References

• Base: PR4 (user/lilybarkley/plm-pr4-cap-extraction)
• Next: PR6 — testing artifacts (plm_tester workload binary, tests/configs/plm_configs, run_plm_test.ps1)
• Schema reference: docs/base-process-container/UIPolicy_Schema.md

🔍 Validation

• cargo build -p plm --target x86_64-pc-windows-msvc — clean
• cargo fmt --all -- --check — clean
• cargo clippy -p plm --target x86_64-pc-windows-msvc --all-targets -- -D warnings — clean
• cargo test -p plm --target x86_64-pc-windows-msvc — 126 passed (74 new: rendered + processing-error UI variants, both violation categories, every JOB_OBJECT_UILIMIT_* mask path, mixed-stream integration through parse_events_from_xml, full write_detection_summary UI section, should_skip_adjusted predicate).

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the official build pipeline that signs the binaries; it
runs on merge to main and nightly, and Microsoft reviewers can trigger it
on a PR with /azp run. See docs/pull-requests.md.

Microsoft Reviewers: Open in CodeFlow