fix: Word and colour Windows workloads correctly across the UI

CLAUDE.md

@@ -383,9 +383,11 @@ one wire shape, worded per platform in the UI, which is the only layer that
 knows the host's OS. The platform split lives entirely in the agent, as build
 tags (`systemd_linux.go` / `services_windows.go` and the matching `control_`
 and `logs_` pairs); the control plane is OS-blind and needed no changes.
-Windows collection runs PowerShell through `agent/internal/winexec`, and every
-script emits JSON that a build-tag-free parser reads, so the parsers are tested
-on Linux — the agent module has no Windows CI.
+Windows collection runs PowerShell through `agent/internal/winexec`. Every
+script that reports data emits JSON that a build-tag-free parser reads, so
+those parsers are tested on Linux — the agent module has no Windows CI. The
+control verbs and `serviceDisplayName` emit no JSON and have no parser; they
+are exercised only by running the agent on Windows.
 
 **Not gated by licence**: this reads as core fleet management, so v1 ships
 everywhere with no `HasFeature` check. If that changes the check belongs at
@@ -895,7 +897,7 @@ tls: true
 
 ```
 1. SyncKeys(server_id, agent_token, agent_version)
-2. Non-Linux hosts stop here — Windows agents register and heartbeat only
+2. Non-Linux hosts stop here — the key-management steps below are Linux-only; a Windows agent's other work (workflow steps, inventory, OS updates, workloads) runs from the goroutines started above, not from this loop
 3. Diff desired keys against /root/.ssh/authorized_keys; unchanged → no write
 4. Changed → write .tmp, os.Rename() over the real file, chmod 0600
 ```
@@ -1171,9 +1173,11 @@ git push origin main                                    # server + web deploy
 - **Windows agents cover the fleet-management path** — register, heartbeat, run
   steps, report inventory, OS updates through the Windows Update COM API, and
   workloads (services plus containers, with control and logs). They still do no
-  `authorized_keys` management, and no package inventory or CVE matching: the
-  vulnerability feeds this project uses carry no Windows data, so a Windows host
-  correctly reports `unsupported` rather than a clean bill of health.
+  `authorized_keys` management, and no package inventory or CVE matching: a
+  Windows agent never calls `ReportPackages`, so no `server_packages` document
+  exists for it and it reports no package inventory at all — a different,
+  earlier state than the `unsupported` a Linux distribution reaches when its
+  family has no security feed.
 - **Both `server` and `web` scale horizontally** — see "Running more than one server replica" below. `web` holds nothing; `server` holds per-agent state that is routed between replicas over Redis rather than duplicated.
 - **Deletion lives in the control plane** — admin sends the warnings because it knows the billing address; the control plane performs the delete because it is the only service that knows which collections carry `instance_id`. Mirroring that list into admin would drift, and a drift there deletes the wrong rows.
 

agent/internal/winexec/run_windows.go

@@ -19,12 +19,16 @@ func Run(ctx context.Context, script string) (string, error) {
 
 	out, err := cmd.Output()
 	if err != nil {
-		if ee, ok := err.(*exec.ExitError); ok && len(ee.Stderr) > 0 {
-			return "", fmt.Errorf("powershell: %s", strings.TrimSpace(string(ee.Stderr)))
-		}
+		// Checked before the ExitError/stderr branch: CommandContext kills the
+		// process on timeout, and that kill can itself produce an ExitError
+		// carrying stderr text, so a genuine timeout would otherwise surface
+		// as that stderr instead of the "timed out" message callers match on.
 		if ctx.Err() == context.DeadlineExceeded {
 			return "", fmt.Errorf("powershell: timed out")
 		}
+		if ee, ok := err.(*exec.ExitError); ok && len(ee.Stderr) > 0 {
+			return "", fmt.Errorf("powershell: %s", strings.TrimSpace(string(ee.Stderr)))
+		}
 		return "", fmt.Errorf("powershell: %w", err)
 	}
 	return string(out), nil

agent/internal/workloads/services_windows.go

@@ -12,8 +12,16 @@ const servicesTimeout = 60 * time.Second
 
 const servicesScript = `
 $ErrorActionPreference = 'Stop'
-$svcs = Get-CimInstance Win32_Service |
-  Select-Object Name,DisplayName,State,StartMode,PathName,ExitCode
+$svcs = Get-CimInstance Win32_Service | ForEach-Object {
+  [pscustomobject]@{
+    Name = $_.Name
+    DisplayName = $_.DisplayName
+    State = $_.State
+    StartMode = $_.StartMode
+    PathName = $_.PathName
+    ExitCode = $_.ExitCode
+  }
+}
 ConvertTo-Json -InputObject @($svcs) -Depth 3 -Compress
 `
 

agent/internal/workloads/winparse.go

@@ -113,10 +113,15 @@ func parseServices(jsonText, systemRoot string) ([]Workload, error) {
 			continue
 		}
 
-		state := "stopped"
+		// The wire shape is shared with the systemd collector — both report
+		// under kind "unit" — so the state word has to be too, or the UI
+		// (which colours and filters on it, and does so before it knows
+		// which platform sent the row) needs two vocabularies for one kind.
+		// running/stopped/failed become active/inactive/failed to match.
+		state := "inactive"
 		switch {
 		case running:
-			state = "running"
+			state = "active"
 		case failed:
 			state = "failed"
 		}
@@ -189,7 +194,10 @@ func parseEvents(jsonText, serviceName, displayName string, tail int) (string, e
 				continue
 			}
 		}
-		msg := strings.TrimSpace(strings.ReplaceAll(e.M, "\r\n", " "))
+		// Collapse every newline form, not just "\r\n": a message containing a
+		// bare "\n" would otherwise still break the one-line-per-event shape
+		// this renders for the log dialog, and undercount the tail trim above.
+		msg := strings.TrimSpace(strings.NewReplacer("\r\n", " ", "\r", " ", "\n", " ").Replace(e.M))
 		lines = append(lines, e.T+"  "+e.L+"  "+msg)
 	}
 

agent/internal/workloads/winparse_test.go

@@ -59,12 +59,12 @@ func TestParseServicesFilters(t *testing.T) {
 		t.Fatalf("got %d workloads, want 3: %+v", len(got), got)
 	}
 
-	if w := byID["Contoso"]; w.Kind != "unit" || w.Name != "Contoso Broker" || w.State != "running" {
+	if w := byID["Contoso"]; w.Kind != "unit" || w.Name != "Contoso Broker" || w.State != "active" {
 		t.Errorf("Contoso = %+v", w)
 	}
 	// Enabled but not running is exactly the row worth seeing.
-	if byID["Fabrikam"].State != "stopped" {
-		t.Errorf("Fabrikam state = %q, want stopped", byID["Fabrikam"].State)
+	if byID["Fabrikam"].State != "inactive" {
+		t.Errorf("Fabrikam state = %q, want inactive", byID["Fabrikam"].State)
 	}
 	// A non-zero exit code on a stopped service is a crash, not a clean stop.
 	if byID["Crashed"].State != "failed" {
@@ -80,15 +80,15 @@ func TestParseServicesExitCode1077(t *testing.T) {
 	if err != nil {
 		t.Fatalf("parseServices: %v", err)
 	}
-	if len(got) != 1 || got[0].State != "stopped" {
-		t.Fatalf("got %+v, want one stopped workload", got)
+	if len(got) != 1 || got[0].State != "inactive" {
+		t.Fatalf("got %+v, want one inactive workload", got)
 	}
 }
 
 func TestParseServicesSingleObjectAndEmpty(t *testing.T) {
 	one := `{"Name":"Solo","DisplayName":"Solo","State":"Running","StartMode":"Auto","PathName":"C:\\Solo\\s.exe","ExitCode":0}`
 	got, err := parseServices(one, `C:\WINDOWS`)
-	if err != nil || len(got) != 1 {
+	if err != nil || len(got) != 1 || got[0].State != "active" {
 		t.Fatalf("single object: got %+v, err %v", got, err)
 	}
 
@@ -130,6 +130,25 @@ func TestParseEventsFormatsAndOrders(t *testing.T) {
 	}
 }
 
+// A message containing a bare "\n" (no carriage return) must still collapse to
+// one line, or it silently multiplies into several output lines and throws
+// off the tail trim's count.
+func TestParseEventsCollapsesBareLF(t *testing.T) {
+	in := `[{"t":"2026-08-13T10:00:00Z","l":"Error","p":"Contoso","m":"broker died\nstack trace here"}]`
+
+	got, err := parseEvents(in, "Contoso", "Contoso Broker", 500)
+	if err != nil {
+		t.Fatalf("parseEvents: %v", err)
+	}
+	if strings.Count(got, "\n") != 0 {
+		t.Fatalf("parseEvents did not collapse bare LF into one line: %q", got)
+	}
+	want := "2026-08-13T10:00:00Z  Error  broker died stack trace here"
+	if got != want {
+		t.Fatalf("parseEvents =\n%q\nwant\n%q", got, want)
+	}
+}
+
 // Service Control Manager logs every service on the host under one provider, so
 // its rows must be filtered down to the target or the log is somebody else's.
 func TestParseEventsFiltersOtherServicesSCM(t *testing.T) {

web/app/(app)/workloads/page.tsx

@@ -41,7 +41,7 @@ export default function WorkloadsPage() {
         <div className="p-4 sm:p-6 lg:p-8">
             <div className="mb-6">
                 <h1 className="text-2xl font-bold text-text-primary">Workloads</h1>
-                <p className="mt-1 text-sm text-text-secondary">Containers and systemd services across the fleet, as last reported by each agent.</p>
+                <p className="mt-1 text-sm text-text-secondary">Containers and services across the fleet, as last reported by each agent.</p>
             </div>
 
             <Card className="mb-6">

web/components/servers/tabs/MaintenanceTab.tsx

@@ -82,7 +82,7 @@ export function MaintenanceTab({
                                                 <span className="font-mono text-xs text-text-secondary">{u.current_version || "n/a"}</span>
                                             </Td>
                                             <Td label={isWindows ? "KB" : "Available"}>
-                                                <span className="font-mono text-xs text-success">{u.new_version}</span>
+                                                <span className="font-mono text-xs text-success">{u.new_version || "n/a"}</span>
                                             </Td>
                                         </Tr>
                                     ))}

web/components/workloads/WorkloadList.tsx

@@ -94,6 +94,7 @@ export function WorkloadList({ serverId, canControl, isWindows }: { serverId: st
             workload={w}
             canControl={canControl}
             busy={control.isPending}
+            isWindows={isWindows}
             onAction={(action) => control.mutate({ w, action })}
             onLogs={() => setLogTarget(w)}
         />

web/components/workloads/WorkloadRow.tsx

@@ -45,12 +45,14 @@ export function WorkloadRow({
     workload,
     canControl,
     busy,
+    isWindows,
     onAction,
     onLogs,
 }: {
     workload: Workload;
     canControl: boolean;
     busy: boolean;
+    isWindows: boolean;
     onAction: (action: WorkloadAction) => void;
     onLogs: () => void;
 }) {
@@ -66,7 +68,7 @@ export function WorkloadRow({
                     {!!w.restarts && w.restarts > 0 && <Badge variant="warning">{w.restarts} restarts</Badge>}
                 </div>
                 <p className="mt-1 truncate text-xs text-text-secondary">
-                    {w.kind === "container" ? w.image || "no image" : "systemd unit"}
+                    {w.kind === "container" ? w.image || "no image" : isWindows ? "Windows service" : "systemd unit"}
                     {w.ports && w.ports.length > 0 && <span className="ml-2 font-mono">{w.ports.join(" ")}</span>}
                 </p>
             </div>

web/lib/api.ts

@@ -1122,7 +1122,7 @@ export const vulnerabilities = {
 export type WorkloadKind = "container" | "unit";
 export type WorkloadAction = "start" | "stop" | "restart";
 
-/** One container or one systemd unit.
+/** One Docker container, one systemd unit, or one Windows service.
  *
  *  `state` is deliberately not a shared vocabulary across the two kinds:
  *  containers report running/exited/paused/restarting/created, units report