sequenceDiagram
    participant UI as Windows Event Log
    participant Plugin as windows-events.plugin
    participant FTS as Full-Text Search Preload
    participant Variant as evt_variant_to_buffer()
    participant AnsiHelper as append_ansi() NEW
    participant BinaryHelper as append_binary()
    participant GuidHelper as append_guid()
    participant SystimeHelper as append_systime()
    participant FiletimeHelper as append_filetime_value()
    participant SidHelper as append_sid()
    participant CP as any_to_utf16(CP_ACP)

    Note over UI,SidHelper: Event Data Variant Flattening Flow

    UI->>Plugin: Event with EvtVarTypeAnsiString payload
    Plugin->>FTS: Preload event data for indexing
    FTS->>Variant: Call evt_variant_to_buffer()

    alt Type is EvtVarTypeAnsiString
        Variant->>Variant: Extract type mask (Type & EVT_VARIANT_TYPE_MASK)
        alt Array variant
            Variant->>AnsiHelper: Process each AnsiStringArr[i]
        else Scalar variant
            Variant->>AnsiHelper: Process AnsiStringVal
        end
        AnsiHelper->>AnsiHelper: Null/empty check
        AnsiHelper->>CP: Convert ANSI to UTF-16 via CP_ACP
        CP-->>AnsiHelper: Wide character buffer
        AnsiHelper->>Variant: Append converted string to output buffer
    else Type is EvtVarTypeBinary
        Variant->>BinaryHelper: Process BinaryVal + size
        BinaryHelper->>BinaryHelper: Validate bounds (size_t overflow check)
        BinaryHelper->>BinaryHelper: Render hex digits
        BinaryHelper->>BinaryHelper: NUL-terminate output
        BinaryHelper-->>Variant: Hex string in buffer
    else Type is EvtVarTypeGuid
        Variant->>GuidHelper: Process GuidVal
        alt Null pointer
            GuidHelper->>GuidHelper: Early return (defensive check)
        else Valid guid
            GuidHelper->>GuidHelper: Append formatted GUID
        end
    else Type is EvtVarTypeSysTime
        Variant->>SystimeHelper: Process SysTimeVal
        alt Null pointer
            SystimeHelper->>SystimeHelper: Early return
        else Valid systime
            SystimeHelper->>SystimeHelper: Format datetime
        end
    else Type is EvtVarTypeFileTime
        Variant->>FiletimeHelper: Process FileTimeVal
        alt Null pointer
            FiletimeHelper->>FiletimeHelper: Early return
        else Valid filetime
            FiletimeHelper->>FiletimeHelper: Convert via FileTimeToSystemTime
            FiletimeHelper->>SystimeHelper: Format as datetime
        end
    else Type is EvtVarTypeSid
        Variant->>SidHelper: Process SidVal
        alt Null pointer
            SidHelper->>SidHelper: Early return
        else Valid SID
            SidHelper->>SidHelper: Append SID string
        end
    else Type is EvtVarTypeBoolean (array)
        Variant->>Variant: Append "true"/"false" per element
    end

    Variant-->>FTS: Flattened event data string
    FTS-->>Plugin: Full-text search indexable content

sequenceDiagram
    participant Client as Web Client
    participant API as REST API
    participant Plugin as Windows Events Plugin
    participant Renderer as Row Renderer
    participant Variant as EVT_VARIANT Accessor
    participant Provider as Provider Metadata Loader
    participant XMLParser as XML Parser
    participant WinAPI as Windows Event API

    Note over Client,WinAPI: Lazy row rendering for data=true queries

    Client->>API: GET /api/v1/data?data=true
    API->>Plugin: Query events for timeframe
    Plugin->>WinAPI: EvtRender(EvtRenderEventValues)
    WinAPI-->>Plugin: WEVT_VARIANT with system fields
    alt Insufficient system fields
        Plugin->>Plugin: Validate property_count >= EvtSystemPropertyIdEND
        Plugin-->>API: Return error
    else Valid system fields
        Plugin->>Variant: wevt_field_get_uint64() for EventRecordId
        Plugin->>Variant: wevt_field_get_string() for ProviderName
        Variant-->>Plugin: Degrade gracefully on type mismatch
        Plugin->>Provider: provider_get(uuid, name)
        Provider->>WinAPI: EvtGetPublisherMetadataProperty()
        alt Zero buffer used or empty metadata
            Provider->>Provider: Skip property loading
            Provider-->>Plugin: Return handle with WEVT_PLATFORM_UNKNOWN
        else Valid metadata
            Provider->>Provider: Validate object array handles
            Provider->>WinAPI: EvtGetObjectArrayProperty() for levels/tasks/opcodes
            alt Null handle or zero items
                Provider->>Provider: Skip array loading, compact list to 0 entries
            else Valid array
                Provider->>Provider: Use checked uint32 accessors for message IDs
                Provider->>Provider: wevt_field_get_string() for names
                Provider->>Provider: Compact only validated entries
            end
            Provider-->>Plugin: Return populated metadata handle
        end
        Plugin-->>API: Return event metadata
    end

    Note over Plugin,XMLParser: Lazy XML/Message on row rendering

    Client->>API: Request row rendering
    API->>Plugin: wevt_lazy_loading_event_and_xml()
    Plugin->>WinAPI: EvtFormatMessage(EvtFormatMessageXml)
    alt Zero buffer used
        Plugin->>Plugin: Treat as formatting failure
    else Valid XML
        WinAPI-->>Plugin: XML string in ops.xml
        Plugin->>XMLParser: buffer_extract_and_print_xml_with_cb()
        XMLParser->>XMLParser: find_string_in_slice() for Event/System nodes
        alt NULL slice or out-of-bounds search
            XMLParser-->>Plugin: Return false without crash
        else Valid nodes found
            XMLParser->>XMLParser: Bounds-check before memchr/strstr
            XMLParser-->>Plugin: Extracted message text
        end
        Note over Plugin: CHANGED: Skip redundant EvtFormatMessageEvent call
        Plugin->>Plugin: Set ops.event to empty
        Plugin->>Plugin: Mark row as rendered
    end

    Note over Variant,WinAPI: FTS variant rendering paths

    Plugin->>Variant: evt_variant_to_buffer() for FTS results
    alt Array branch (EVT_VARIANT_TYPE_ARRAY)
        alt EvtVarTypeAnsiString
            Variant->>Variant: append_ansi() with CP_ACP conversion
        else EvtVarTypeBinary or EvtVarTypeEvtHandle
            Variant->>Variant: CHANGED: Skip unsupported array shapes
        else Other types
            Variant->>Variant: Normal array rendering
        end
    else Scalar branch
        alt EvtVarTypeAnsiString
            Variant->>Variant: append_ansi() with CP_ACP conversion
        else EvtVarTypeBinary or EvtVarTypeEvtHandle
            Variant->>Variant: Direct NUL-terminated write
        else EvtVarTypeFileTime
            Variant->>Variant: append_filetime_value() from ULONGLONG
        else EvtVarTypeSysTime or EvtVarTypeSid
            Variant->>Variant: Render with NULL pointer check
        else EvtVarTypeNull
            Variant->>Variant: Skip rendering
        end
    end
    Variant-->>Plugin: Formatted buffer
    Plugin-->>API: FTS row data
    API-->>Client: Rendered response

sequenceDiagram
    participant UI as HTTP API / UI
    participant Collector as Windows Events Collector
    participant RowRender as Row Renderer (lazy)
    participant EvtQuery as Windows Event Query Engine
    participant EvtVar as EVT_VARIANT Accessor
    participant Provider as Provider Cache
    participant Source as Source Scanner
    participant WinAPI as Windows Event API
    participant XMLParser as XML Parser

    Note over Collector,WinAPI: Core data flow for event row rendering

    UI->>Collector: Request `data=true` rows (plain query)
    Collector->>Collector: Allocate WEVT_VARIANT for system fields
    Collector->>EvtQuery: wEvtRender() - render event values
    EvtQuery->>WinAPI: EvtRender(EvtRenderEventValues)
    WinAPI-->>EvtQuery: Returns EVT_VARIANT array + property_count

    Note over EvtQuery: Validate: bytes_used > 0, property_count sanity<br/>(NEW: reject zero-length buffers, OOB writes)
    EvtQuery-->>Collector: Success with property count

    Collector->>EvtQuery: wevt_get_next_event_one()
    EvtQuery->>EvtVar: Access EvtSystem* fields via checked getters
    Note over EvtVar: NEW: All field accessors check type & reject arrays<br/>(no more fatal_assert on type mismatch)
    EvtVar-->>EvtQuery: System event metadata (id, timestamp, provider, etc.)

    EvtQuery->>Provider: provider_get() with provider UUID + name
    Provider->>WinAPI: EvtOpenPublisherMetadata()
    WinAPI-->>Provider: Metadata handle

    Note over Provider: NEW: handle refcount operations under spinlock<br/>Reject zero BufferUsed, validate array/object property counts
    Provider-->>EvtQuery: Provider metadata handle

    EvtQuery-->>Collector: Structured event struct

    Note over Collector,RowRender: Lazy rendering triggered by FACET_ROW display

    Collector->>RowRender: wevt_lazy_loading_event_and_xml()
    RowRender->>RowRender: Format XML via EvtFormatMessage_Xml_utf8()
    RowRender->>RowRender: CHANGED: Skip EvtFormatMessage_Event_utf8()<br/>Empty the event message buffer instead
    Note over RowRender: Previously did both XML + message per row<br/>Now: XML once, message extracted from RenderingInfo
    RowRender-->>Collector: Rendered row data

    Collector->>XMLParser: buffer_extract_and_print_xml_with_cb()
    XMLParser->>XMLParser: Parse slice-bounded XML
    Note over XMLParser: NEW: All string searches use find_string_in_slice()<br/>with explicit end-pointer bounds, no unbounded strstr()

    alt Array-valued EVT_VARIANT
        Collector->>EvtVar: evt_variant_to_buffer() - array branch
        Note over EvtVar: NEW: Check array base pointer before indexing<br/>(e.g., ev->StringArr, ev->UInt32Arr)
        alt Unsupported array types (Binary, EvtHandle)
            EvtVar->>EvtVar: Skip rendering entirely
        else Supported types
            EvtVar->>EvtVar: Convert each element<br/>NEW: ANSI strings via any_to_utf16(CP_ACP)
        end
    else Scalar EVT_VARIANT
        Collector->>EvtVar: evt_variant_to_buffer() - scalar branch
        Note over EvtVar: NEW: Added FileTime, SysTime, Sid scalar rendering<br/>Previously only handled via array path
    end

    EvtVar-->>Collector: Rendered variant as buffer string
    Collector-->>UI: Rendered row JSON

    Note over Source,WinAPI: Background source scanning (parallel path)

    Source->>Source: wevt_sources_scan()
    Source->>Source: Acquire spinlock (trylock)
    Source->>WinAPI: EvtOpenChannelEnum()
    WinAPI-->>Source: Channel enumeration handle

    loop For each channel
        Source->>WinAPI: EvtGetChannelConfigProperty() - channel type
        Source->>WinAPI: EvtGetChannelConfigProperty() - classic flag
        Source->>WinAPI: EvtGetChannelConfigProperty() - owning publisher
        Source->>WinAPI: EvtGetChannelConfigProperty() - enabled flag
        Source->>WinAPI: EvtGetChannelConfigProperty() - retention/auto backup

        Note over Source,NEW: Each property fetch resets used/count before reuse<br/>CHANGED: Reject zero-length results, validate via checked getters
        Source->>Source: categorize_channel() - build WEVT_SOURCE_TYPE flags
    end

    alt Early exit (channel enum failure)
        Source->>Source: Close log handle if open, unlock spinlock
    else Completion
        Source->>WinAPI: wevt_closelog6()
        Source->>WinAPI: EvtClose(channelEnum)
        Source->>Source: Release lock, cleanup variant
    end

    Note over Source: NEW: Always close log handle before early cleanup<br/>Avoid stale spinlock holder / open handle leaks

    Source-->>Collector: Updated source configuration

sequenceDiagram
    participant Client as Win Event Plugin (UI)
    participant Lazy as Lazy Row Renderer
    participant Render as wEvtRender
    participant Variant as EVT_VARIANT Accessors
    participant Provider as Provider Meta Cache
    participant Source as Source Scanner
    participant XML as XML Parser

    Note over Client,XML: Core flows affected by this PR

    Client->>Lazy: data=true query (row rendering)
    Lazy->>Render: wEvtRender() for XML
    Render->>Variant: wevt_field_get_string() for provider name
    Variant-->>Render: validated string or NULL
    Render-->>Lazy: XML buffer
    Lazy->>XML: buffer_extract_and_print_xml_with_cb()
    XML->>XML: find_string_in_slice() (bounded search)
    XML-->>Lazy: extracted message text
    Note over Lazy: CHANGED: No separate EvtFormatMessage_Event call<br/>Uses XML extraction for message

    alt Provider metadata lookup
        Lazy->>Provider: provider_get() with UUID/name
        Provider->>Provider: wevt_field_get_string_checked() for owning publisher
        Provider->>Provider: provider_detect_platform() - wevt_field_get_uint16_checked()
        Provider->>Provider: provider_load_list() - compact only valid entries
        Note over Provider: wevt_field_get_evt_handle() rejects arrays
        Provider-->>Lazy: PROVIDER_META_HANDLE (or NULL)
    end

    Lazy->>Lazy: wevt_lazy_loading_event_and_xml()
    Note over Lazy: Renders XML once, sets event message to empty

    alt System fields extraction
        Lazy->>Variant: wevt_field_get_uint64() (record ID)
        Lazy->>Variant: wevt_field_get_uint16() (event ID)
        Lazy->>Variant: wevt_field_get_filetime_to_ns() (timestamp)
        Lazy->>Variant: wevt_field_get_sid() (user)
        Lazy->>Variant: wevt_field_get_string_utf8() (message)
        Note over Variant: All use _checked variants that return false on type mismatch
    end

    alt Array variant rendering
        Client->>Variant: evt_variant_to_buffer() with array flag
        Variant->>Variant: Check array base pointer (ev->StringArr, etc.)
        Variant->>Variant: append_ansi() for EvtVarTypeAnsiString (CHANGED: CP_ACP conversion)
        Variant->>Variant: append_binary() - guard oversize & null-terminate
        Note over Variant: Binary/EvtHandle arrays: return without rendering
        Variant-->>Client: formatted buffer
    end

    Source->>Source: wevt_sources_scan()
    Source->>Provider: ndEvtGetChannelConfigProperty() - reset metadata before each call
    Provider-->>Source: channel properties (validated types)
    Source->>Source: categorize_channel() - uses wevt_field_get_bool_checked()/uint32_checked()
    Note over Source: Safe cleanup: close log & unlock even on early exit

    alt Provider handle refcount
        Provider->>Provider: provider_dup() - CHANGED: locked under spinlock
        Provider->>Provider: provider_release() - CHANGED: full lock discipline
        Note over Provider: Handles now use same lock for inc/dec
    end