fix(hayabusa): restore scheduled EVTX upload pipeline

docs/runbook.md

@@ -276,6 +276,10 @@ powershell.exe -ExecutionPolicy Bypass -File C:\ProgramData\AWatch-rus\export-up
 3. Проверить результат:
 
 ```bash
+systemctl is-active aw-hayabusa-drop.path
+systemctl is-failed aw-hayabusa-drop.service || true
+aw-hayabusa doctor
+aw-hayabusa inventory
 cat /opt/hayabusa/state/latest-intake.json
 journalctl -u aw-hayabusa-drop.service -n 80 --no-pager
 curl -fsS http://127.0.0.1:5602/api/0/dlp/cases/30
@@ -288,6 +292,27 @@ curl -fsS http://127.0.0.1:5602/api/0/dlp/cases/30
 - в case есть `forensics.hayabusa`;
 - Telegram alert уже уходит в операторский чат.
 
+Production scheduled task на `SHARKON2025`:
+
+- `ActivityWatch Hayabusa Upload`
+- principal `Администратор`, `LogonType=Interactive`, `RunLevel=Highest`
+- период `6` часов, lookback `6` часов
+- нормальный `LastTaskResult=0`
+
+Если `LastTaskResult=3221225794` (`0xC0000142`) и в `C:\ProgramData\AWatch-rus\logs\hayabusa-upload.log` нет новой строки, скрипт не стартовал. На текущем RDP-хосте это воспроизводится даже минимальной SYSTEM-задачей с `powershell.exe`; пересоздать Hayabusa task как interactive/highest от `Администратор`, не от `SYSTEM`.
+
+Если upload прошёл, но сервер не обработал пакет:
+
+```bash
+sudo systemctl reset-failed aw-hayabusa-drop.path aw-hayabusa-drop.service
+sudo systemctl start aw-hayabusa-drop.path
+sudo systemctl start aw-hayabusa-drop.service
+find /opt/activitywatch/aw-rus-ops/drop -maxdepth 1 -type f -ls
+find /opt/hayabusa/inbox/incoming -maxdepth 1 -type f -ls
+```
+
+`drop` и `incoming` после успешной обработки должны быть пустыми; latest intake должен указывать на последний пакет `SHARKON2025`.
+
 ### Hayabusa: manual fallback / production validation end-to-end
 
 Цель: подтвердить один реальный путь

docs/security-analytics-stack-v1.md

@@ -34,15 +34,20 @@ Core outcomes:
   - `.meta.json`
   - optional `.caseid`
 - `ActivityWatch Hayabusa Upload` scheduled task runs every 6 hours
+- on `SHARKON2025` the task runs as interactive/highest `Администратор`; `SYSTEM` PowerShell tasks fail with `0xC0000142` before the script starts
+- sidecar JSON is written as UTF-8 without BOM; server-side readers also tolerate BOM for older files
 
 ### Server side
 
 - `aw-hayabusa-drop.path` watches `/opt/activitywatch/aw-rus-ops/drop`
 - `aw-hayabusa-drop.service` runs `aw-hayabusa-autoprocess`
+- `/opt/activitywatch/aw-rus-ops/drop` is writable by `awops` and processed by root-owned systemd units
 - `aw-hayabusa` performs:
   - accept
   - process-inbox
   - report generation
+- Windows zip entries with backslash separators are normalized during extraction
+- autoprocess drains the incoming queue after accepting a drop package, preventing stale failed-run packages from being linked to a newer drop upload
 - `aw-hayabusa-case-alert` performs:
   - severity scoring from `timeline.jsonl`
   - optional auto-case creation

docs/wiki/Hayabusa-Security-Analytics.md

@@ -5,6 +5,7 @@
 ## Что уже работает
 
 - Windows-хост раз в `6` часов делает `EVTX export + upload`
+- production scheduled task: `ActivityWatch Hayabusa Upload`, principal `Администратор`, `LogonType=Interactive`, `RunLevel=Highest`
 - `AW-server` автоматически подхватывает пакет из `drop`
 - `aw-hayabusa` строит forensic-отчёт
 - `aw-hayabusa-case-alert` считает severity и score
@@ -22,11 +23,16 @@ powershell.exe -ExecutionPolicy Bypass -File C:\ProgramData\AWatch-rus\export-up
 На сервере для проверки:
 
 ```bash
+systemctl is-active aw-hayabusa-drop.path
+systemctl is-failed aw-hayabusa-drop.service || true
+aw-hayabusa inventory
 cat /opt/hayabusa/state/latest-intake.json
 journalctl -u aw-hayabusa-drop.service -n 80 --no-pager
 curl -fsS http://127.0.0.1:5602/api/0/dlp/cases/30
 ```
 
+Ожидаемо: `drop` и `incoming` пустые, `latest-intake.json` имеет `status=ok`, `host=SHARKON2025`, а `LastTaskResult` Windows-задачи равен `0`.
+
 ## Что получает оператор
 
 - `summary.html`

docs/windows-hayabusa-evtx-export.md

@@ -83,6 +83,16 @@ This wrapper:
 - uploads `.meta.json`;
 - uploads the `zip` to the AW-server drop directory.
 
+Scheduled production upload on `SHARKON2025`:
+
+- task: `ActivityWatch Hayabusa Upload`
+- principal: `Администратор`, interactive, highest privileges
+- interval: `6` hours
+- lookback: `6` hours
+- success: `LastTaskResult=0` and a new line in `C:\ProgramData\AWatch-rus\logs\hayabusa-upload.log`
+
+`LastTaskResult=3221225794` (`0xC0000142`) with no new upload log means Task Scheduler failed to start `powershell.exe`; keep this task on the interactive administrator principal for this host.
+
 ## Boundaries
 
 - output stays outside standard AW buckets