From c9adb521c5f8f82bce6508a2ad358f6ae15aec5e Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:25 +0000
Subject: [PATCH 01/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/packaging/macos_rcodesign.go | 27 +++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/orbit/pkg/packaging/macos_rcodesign.go b/orbit/pkg/packaging/macos_rcodesign.go
index 50bc6cab3ab..38bfbb828a5 100644
--- a/orbit/pkg/packaging/macos_rcodesign.go
+++ b/orbit/pkg/packaging/macos_rcodesign.go
@@ -12,12 +12,23 @@ import (
 )
 
 func rSign(pkgPath, cert string) error {
-	pemPath := filepath.Join(os.TempDir(), "cert.pem")
-	defer os.Remove(pemPath)
-	err := os.WriteFile(pemPath, []byte(cert), 0o600)
+	pemFile, err := os.CreateTemp("", "cert-*.pem")
 	if err != nil {
+		return fmt.Errorf("creating cert temp file: %s", err)
+	}
+	pemPath := pemFile.Name()
+	defer os.Remove(pemPath)
+	if err := pemFile.Chmod(0o600); err != nil {
+		pemFile.Close()
+		return fmt.Errorf("setting cert temp file permissions: %s", err)
+	}
+	if _, err := pemFile.WriteString(cert); err != nil {
+		pemFile.Close()
 		return fmt.Errorf("writing cert data: %s", err)
 	}
+	if err := pemFile.Close(); err != nil {
+		return fmt.Errorf("closing cert temp file: %s", err)
+	}
 
 	return retry.Do(func() error {
 		var outBuf bytes.Buffer
@@ -30,8 +41,7 @@ func rSign(pkgPath, cert string) error {
 		cmd.Stdout = &outBuf
 		cmd.Stderr = &outBuf
 		if err := cmd.Run(); err != nil {
-			fmt.Println(outBuf.String())
-			return fmt.Errorf("rcodesign: %w", err)
+			return fmt.Errorf("rcodesign: %w: %s", err, outBuf.String())
 		}
 		return nil
 	}, retry.WithMaxAttempts(3))
@@ -56,8 +66,7 @@ func rNotarizeStaple(pkg, apiKeyID, apiKeyIssuer, apiKeyContent string) error {
 		cmd.Stdout = &outBuf
 		cmd.Stderr = &outBuf
 		if err := cmd.Run(); err != nil {
-			fmt.Println(outBuf.String())
-			return fmt.Errorf("rcodesign notarize: %w", err)
+			return fmt.Errorf("rcodesign notarize: %w: %s", err, outBuf.String())
 		}
 		return nil
 	}, retry.WithMaxAttempts(3))
@@ -72,8 +81,8 @@ func writeAPIKeys(issuer, id, content string) (string, error) {
 	// The underliying tools (rcodesign and Transporter) expect to find a
 	// certificate key in this path.
 	path := filepath.Join(homedir, ".appstoreconnect", "private_keys")
-	if err = secure.MkdirAll(path, 0o600); err != nil {
-		return "", fmt.Errorf("finding home dir: %s", err)
+	if err = secure.MkdirAll(path, 0o700); err != nil {
+		return "", fmt.Errorf("creating private keys dir: %s", err)
 	}
 
 	keyPath := filepath.Join(path, fmt.Sprintf("AuthKey_%s.p8", id))

From 68bfc71dacc8da09bdd91042434dff0965d80e81 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:26 +0000
Subject: [PATCH 02/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/wstep.go | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/server/datastore/mysql/wstep.go b/server/datastore/mysql/wstep.go
index ebcd43468eb..2505618a23f 100644
--- a/server/datastore/mysql/wstep.go
+++ b/server/datastore/mysql/wstep.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/fleetdm/fleet/v4/pkg/certificate"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	microsoft_mdm "github.com/fleetdm/fleet/v4/server/mdm/microsoft"
 )
 
@@ -40,20 +41,22 @@ VALUES
 		crt.NotAfter,
 		certPEM,
 	)
-	return err
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "insert wstep certificate")
+	}
+	return nil
 }
 
 // WSTEPNewSerial allocates and returns a new (increasing) serial number.
 func (ds *Datastore) WSTEPNewSerial(ctx context.Context) (*big.Int, error) {
 	result, err := ds.writer(ctx).ExecContext(ctx, `INSERT INTO wstep_serials () VALUES ();`)
 	if err != nil {
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "insert wstep serial")
 	}
-	lid, err := result.LastInsertId() // TODO: ok if sequential and not random?
+	lid, err := result.LastInsertId() // NOTE: sequential serials are acceptable here as they are not relied upon for unpredictability; certificate issuance authorization is handled separately.
 	if err != nil {
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "get last insert id for wstep serial")
 	}
-	// TODO: check maxSerialNumber?
 	return big.NewInt(lid), nil
 }
 
@@ -65,5 +68,8 @@ UPDATE sha256 = new.sha256;`,
 		deviceUUID,
 		strings.ToUpper(hash), // TODO: confirm if this is necessary
 	)
-	return err
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "associate wstep cert hash")
+	}
+	return nil
 }

From 42bda98ec6eab6814f9ea1dfc929fbc088d3f9fe Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:27 +0000
Subject: [PATCH 03/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/mdm/assets/assets.go | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server/mdm/assets/assets.go b/server/mdm/assets/assets.go
index 4a01778fff2..cf361473221 100644
--- a/server/mdm/assets/assets.go
+++ b/server/mdm/assets/assets.go
@@ -9,6 +9,7 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"log"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
@@ -20,6 +21,7 @@ func CAKeyPair(ctx context.Context, ds fleet.MDMAssetRetriever) (*tls.Certificat
 	return KeyPair(ctx, ds, fleet.MDMAssetCACert, fleet.MDMAssetCAKey)
 }
 
+// >>> OPENFRAME(mdm-ca-decrypt-retriever): fork-specific historical CA cert support for CMS decryption
 // CADecryptRetriever is the subset of fleet.Datastore needed to load the Apple
 // MDM CA private key plus every historical CA certificate for CMS decryption.
 type CADecryptRetriever interface {
@@ -73,12 +75,15 @@ func CACertsAndKeyForDecryption(ctx context.Context, ds CADecryptRetriever) ([]*
 	// Fall back to the keypair leaf if the include-deleted lookup yielded
 	// nothing usable, so behaviour matches the previous single-cert path.
 	if len(certs) == 0 {
+		log.Printf("warn: CACertsAndKeyForDecryption: no historical CA certificates matched the current private key (found %d candidates); falling back to the current leaf certificate only, which may cause decrypt failures for payloads escrowed against a previously rolled-over CA cert", len(historical))
 		certs = append(certs, keyPair.Leaf)
 	}
 
 	return certs, keyPair.PrivateKey, nil
 }
 
+// <<< OPENFRAME(mdm-ca-decrypt-retriever)
+
 func APNSKeyPair(ctx context.Context, ds fleet.MDMAssetRetriever) (*tls.Certificate, string, error) {
 	return KeyPairWithMD5(ctx, ds, fleet.MDMAssetAPNSCert, fleet.MDMAssetAPNSKey)
 }
@@ -136,7 +141,7 @@ func X509Cert(ctx context.Context, ds fleet.MDMAssetRetriever, certName fleet.MD
 
 	block, _ := pem.Decode(assets[certName].Value)
 	if block == nil || block.Type != "CERTIFICATE" {
-		return nil, fmt.Errorf("decoding certificate PEM data: %w", err)
+		return nil, fmt.Errorf("decoding certificate %s PEM data: unexpected block type or missing PEM data", certName)
 	}
 
 	return x509.ParseCertificate(block.Bytes)

From b332fe7e3377bc9e7840f21c81a428cc08c5868d Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:28 +0000
Subject: [PATCH 04/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 .../conditional_access_microsoft_proxy.go         | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/server/service/conditional_access_microsoft_proxy/conditional_access_microsoft_proxy.go b/server/service/conditional_access_microsoft_proxy/conditional_access_microsoft_proxy.go
index 0a64c90349c..0c7f3823aae 100644
--- a/server/service/conditional_access_microsoft_proxy/conditional_access_microsoft_proxy.go
+++ b/server/service/conditional_access_microsoft_proxy/conditional_access_microsoft_proxy.go
@@ -75,7 +75,7 @@ func (p *Proxy) Get(ctx context.Context, tenantID string, secret string) (*GetRe
 	var getResponse GetResponse
 	if err := p.get(
 		"/api/v1/microsoft-compliance-partner/settings",
-		fmt.Sprintf("entraTenantId=%s&fleetServerSecret=%s", tenantID, secret),
+		fmt.Sprintf("entraTenantId=%s&fleetServerSecret=%s", url.QueryEscape(tenantID), url.QueryEscape(secret)),
 		&getResponse,
 	); err != nil {
 		return nil, fmt.Errorf("get integration settings failed: %w", err)
@@ -94,7 +94,7 @@ func (p *Proxy) Delete(ctx context.Context, tenantID string, secret string) (*De
 	var deleteResponse DeleteResponse
 	if err := p.delete(
 		"/api/v1/microsoft-compliance-partner",
-		fmt.Sprintf("entraTenantId=%s&fleetServerSecret=%s", tenantID, secret),
+		fmt.Sprintf("entraTenantId=%s&fleetServerSecret=%s", url.QueryEscape(tenantID), url.QueryEscape(secret)),
 		&deleteResponse,
 	); err != nil {
 		return nil, fmt.Errorf("delete integration failed: %w", err)
@@ -181,7 +181,7 @@ func (p *Proxy) GetMessageStatus(
 	var getMessageStatusResponse GetMessageStatusResponse
 	if err := p.get(
 		"/api/v1/microsoft-compliance-partner/device/message",
-		fmt.Sprintf("entraTenantId=%s&fleetServerSecret=%s&messageId=%s", tenantID, secret, messageID),
+		fmt.Sprintf("entraTenantId=%s&fleetServerSecret=%s&messageId=%s", url.QueryEscape(tenantID), url.QueryEscape(secret), url.QueryEscape(messageID)),
 		&getMessageStatusResponse,
 	); err != nil {
 		return nil, fmt.Errorf("get message status response failed: %w", err)
@@ -194,7 +194,7 @@ func (p *Proxy) post(path string, request interface{}, response interface{}) err
 	if err != nil {
 		return fmt.Errorf("marshal request: %w", err)
 	}
-	postRequest, err := http.NewRequest("POST", p.uri+path, nil)
+	postRequest, err := http.NewRequest("POST", p.uri+path, bytes.NewBuffer(b))
 	if err != nil {
 		return fmt.Errorf("post create request: %w", err)
 	}
@@ -202,7 +202,6 @@ func (p *Proxy) post(path string, request interface{}, response interface{}) err
 		return fmt.Errorf("post set headers: %w", err)
 	}
 	postRequest.Header.Add("Content-Type", "application/json")
-	postRequest.Body = io.NopCloser(bytes.NewBuffer(b))
 	resp, err := p.c.Do(postRequest)
 	if err != nil {
 		return fmt.Errorf("post request: %w", err)
@@ -224,7 +223,7 @@ func (p *Proxy) post(path string, request interface{}, response interface{}) err
 func (p *Proxy) get(path string, query string, response interface{}) error {
 	getURL := p.uri + path
 	if query != "" {
-		getURL += "?" + url.PathEscape(query)
+		getURL += "?" + query
 	}
 	getRequest, err := http.NewRequest("GET", getURL, nil)
 	if err != nil {
@@ -254,7 +253,7 @@ func (p *Proxy) get(path string, query string, response interface{}) error {
 func (p *Proxy) delete(path string, query string, response interface{}) error {
 	deleteURL := p.uri + path
 	if query != "" {
-		deleteURL += "?" + url.PathEscape(query)
+		deleteURL += "?" + query
 	}
 	deleteRequest, err := http.NewRequest("DELETE", deleteURL, nil)
 	if err != nil {
@@ -306,7 +305,7 @@ func (p *Proxy) setHeaders(r *http.Request) error {
 		return fmt.Errorf("get origin: %w", err)
 	}
 	if origin == "" {
-		return fmt.Errorf("missing origin: %w", err)
+		return fmt.Errorf("missing origin: origin getter returned an empty value")
 	}
 	r.Header.Add("MS-API-Key", p.apiKey)
 	r.Header.Add("Origin", origin)

From cd1c5ab720825b5a6e7c4e099180d9e27523c66f Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:29 +0000
Subject: [PATCH 05/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 .../mysql/migrations/tables/migration.go      | 27 ++++++++++++-------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/server/datastore/mysql/migrations/tables/migration.go b/server/datastore/mysql/migrations/tables/migration.go
index b8724086bdf..9d03eb82386 100644
--- a/server/datastore/mysql/migrations/tables/migration.go
+++ b/server/datastore/mysql/migrations/tables/migration.go
@@ -3,6 +3,7 @@ package tables
 import (
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -13,7 +14,6 @@ import (
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/goose"
 	"github.com/jmoiron/sqlx"
-	"github.com/pkg/errors"
 )
 
 var MigrationClient = goose.New("migration_status_tables", goose.MySqlDialect{})
@@ -29,14 +29,20 @@ type migrationStep func(tx *sql.Tx) error
 func basicMigrationStep(statement string, errorMessage string) migrationStep {
 	return func(tx *sql.Tx) error {
 		_, err := tx.Exec(statement)
-		return errors.Wrap(err, errorMessage)
+		if err != nil {
+			return fmt.Errorf("%s: %w", errorMessage, err)
+		}
+		return nil
 	}
 }
 
 func basicMigrationStepWithArgs(statement string, args []any, errorMessage string) migrationStep {
 	return func(tx *sql.Tx) error {
 		_, err := tx.Exec(statement, args...)
-		return errors.Wrap(err, errorMessage)
+		if err != nil {
+			return fmt.Errorf("%s: %w", errorMessage, err)
+		}
+		return nil
 	}
 }
 
@@ -74,9 +80,10 @@ func incrementalMigrationStep(count getTotalCountFn, execute executeWithProgress
 					return
 				case <-ticker.C:
 					current := atomicCurrent.Load()
-					if current == total {
+					switch {
+					case current >= total:
 						_, _ = fmt.Fprint(outputTo, "    Almost done...\n")
-					} else {
+					default:
 						_, _ = fmt.Fprintf(outputTo, "    %d%% complete\n", (100*current)/total)
 					}
 				}
@@ -234,26 +241,26 @@ func updateAppConfigJSON(tx *sql.Tx, fn func(config *fleet.AppConfig) error) err
 		if errors.Is(err, sql.ErrNoRows) {
 			return nil
 		}
-		return errors.Wrap(err, "select app_config_json")
+		return fmt.Errorf("select app_config_json: %w", err)
 	}
 
 	var config fleet.AppConfig
 	if err := json.Unmarshal(raw, &config); err != nil {
-		return errors.Wrap(err, "unmarshal app_config_json")
+		return fmt.Errorf("unmarshal app_config_json: %w", err)
 	}
 
 	if err := fn(&config); err != nil {
-		return errors.Wrap(err, "callback app_config_json")
+		return fmt.Errorf("callback app_config_json: %w", err)
 	}
 
 	b, err := json.Marshal(config)
 	if err != nil {
-		return errors.Wrap(err, "marshal updated app_config_json")
+		return fmt.Errorf("marshal updated app_config_json: %w", err)
 	}
 
 	const updateStmt = `UPDATE app_config_json SET json_value = ? WHERE id = 1`
 	if _, err := tx.Exec(updateStmt, b); err != nil {
-		return errors.Wrap(err, "update app_config_json")
+		return fmt.Errorf("update app_config_json: %w", err)
 	}
 
 	return nil

From 7850c7b5c38dfd3f9e3ceb03e4dd8725f3cfc6de Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:30 +0000
Subject: [PATCH 06/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/mdm/android/service/reconcile_devices.go | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/server/mdm/android/service/reconcile_devices.go b/server/mdm/android/service/reconcile_devices.go
index 18266f7c337..19412312cd6 100644
--- a/server/mdm/android/service/reconcile_devices.go
+++ b/server/mdm/android/service/reconcile_devices.go
@@ -34,6 +34,8 @@ func ReconcileAndroidDevices(ctx context.Context, ds fleet.Datastore, logger *sl
 		if asset, ok := assets[fleet.MDMAssetAndroidFleetServerSecret]; ok && len(asset.Value) > 0 {
 			_ = client.SetAuthenticationSecret(string(asset.Value))
 		}
+	} else {
+		logger.DebugContext(ctx, "failed to get android fleet server secret asset during reconcile", "err", err)
 	}
 
 	devices, err := ds.ListAndroidEnrolledDevicesForReconcile(ctx)
@@ -65,6 +67,7 @@ func ReconcileAndroidDevices(ctx context.Context, ds fleet.Datastore, logger *sl
 
 	checked := 0
 	unenrolled := 0
+	var unenrollErrs []error
 	for _, dev := range devices {
 		if dev == nil || dev.DeviceID == "" {
 			continue
@@ -72,11 +75,10 @@ func ReconcileAndroidDevices(ctx context.Context, ds fleet.Datastore, logger *sl
 		checked++
 		deviceName := fmt.Sprintf("%s/devices/%s", enterprise.Name(), dev.DeviceID)
 		_, ok := deviceNameMap[deviceName]
-		switch {
-		case ok:
+		if ok {
 			// Device exists, no-op.
 			continue
-		case !ok:
+		} else {
 			// BYO unenroll wipes only the work profile; clear host_mdm_actions before flipping host_mdm.enrolled so the post-ack "Wiped"
 			// badge clears.
 			if cerr := clearAndroidBYOWipeRef(ctx, ds, dev.HostID); cerr != nil {
@@ -86,7 +88,9 @@ func ReconcileAndroidDevices(ctx context.Context, ds fleet.Datastore, logger *sl
 			}
 
 			if _, derr := ds.SetAndroidHostUnenrolled(ctx, dev.HostID); derr != nil {
+				wrapped := fmt.Errorf("mark android host %d unenrolled during reconcile: %w", dev.HostID, derr)
 				logger.ErrorContext(ctx, "failed to mark android host unenrolled during reconcile", "host_id", dev.HostID, "err", derr)
+				unenrollErrs = append(unenrollErrs, wrapped)
 				continue
 			}
 			// Emit system activity to mirror Pub/Sub DELETED handling.
@@ -110,5 +114,11 @@ func ReconcileAndroidDevices(ctx context.Context, ds fleet.Datastore, logger *sl
 	}
 
 	logger.DebugContext(ctx, "android reconcile complete", "checked", checked, "unenrolled", unenrolled)
+
+	if len(unenrollErrs) > 0 {
+		return ctxerr.Wrap(ctx, fmt.Errorf("failed to mark %d android host(s) unenrolled during reconcile: %w", len(unenrollErrs), unenrollErrs[0]))
+	}
+
 	return nil
 }
+

From fb6a190f3ac86eed48614ad508a9238bc7f1d3c3 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:31 +0000
Subject: [PATCH 07/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 tools/mdm/apple/loadtest/loadtest.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/mdm/apple/loadtest/loadtest.go b/tools/mdm/apple/loadtest/loadtest.go
index 566a0777754..c89e3159698 100644
--- a/tools/mdm/apple/loadtest/loadtest.go
+++ b/tools/mdm/apple/loadtest/loadtest.go
@@ -160,7 +160,7 @@ func main() {
 	for _, team := range teams {
 		teamProfiles, err := apiClient.ListProfiles(ptr.Uint(team.ID))
 		if err != nil {
-			log.Fatalf("load team %s profiles: ", team.Name)
+			log.Fatalf("load team %s profiles: %s", team.Name, err)
 		}
 		if len(teamProfiles) != len(profiles) {
 			log.Fatalf("invalid number of profiles in team %s: %d", team.Name, len(teamProfiles))
@@ -168,11 +168,11 @@ func main() {
 		// Remove the last profile.
 		lastProfile := teamProfiles[len(teamProfiles)-1]
 		if err := apiClient.DeleteProfile(lastProfile.ProfileID); err != nil {
-			log.Fatalf("delete profile %s for team %s", lastProfile.Identifier, team.Name)
+			log.Fatalf("delete profile %s for team %s: %s", lastProfile.Identifier, team.Name, err)
 		}
 		// Add a new profile.
 		if _, err := apiClient.AddProfile(team.ID, newProfile); err != nil {
-			log.Fatalf("upload new profile for team %s", team.Name)
+			log.Fatalf("upload new profile for team %s: %s", team.Name, err)
 		}
 	}
 	printf("4a. Duration: %s\n", time.Since(start))

From f284e25ccc048798095d9a1f9b77a373a8863251 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:32 +0000
Subject: [PATCH 08/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 ee/orbit/pkg/httpsigproxy/httpsigproxy.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ee/orbit/pkg/httpsigproxy/httpsigproxy.go b/ee/orbit/pkg/httpsigproxy/httpsigproxy.go
index 54af2ff4fd5..c04f5134bb0 100644
--- a/ee/orbit/pkg/httpsigproxy/httpsigproxy.go
+++ b/ee/orbit/pkg/httpsigproxy/httpsigproxy.go
@@ -110,6 +110,7 @@ func NewProxy(
 
 	handler, err := newProxyHandler(targetURL, rootCA, insecure, signer)
 	if err != nil {
+		listener.Close()
 		return nil, fmt.Errorf("make proxy handler: %w", err)
 	}
 
@@ -226,7 +227,7 @@ type signingRoundTripper struct {
 func (s *signingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	// Sign the request before sending
 	if err := s.signer.Sign(req); err != nil {
-		return nil, fmt.Errorf("signing request: %#v", err)
+		return nil, fmt.Errorf("signing request: %w", err)
 	}
 
 	// Remove X-Forwarded-For because we are forwarding from 127.0.0.1,

From 7369c940f8e8455523da49ef7bef1c1e10633795 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:33 +0000
Subject: [PATCH 09/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/service/client_users.go | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/server/service/client_users.go b/server/service/client_users.go
index 0af77fb350a..1902fdcb457 100644
--- a/server/service/client_users.go
+++ b/server/service/client_users.go
@@ -1,7 +1,6 @@
 package service
 
 import (
-	"errors"
 	"fmt"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -71,7 +70,7 @@ func (c *Client) userIdFromEmail(email string) (uint, error) {
 		return 0, err
 	}
 	if len(responseBody.List) != 1 {
-		return 0, errors.New("Expected 1 item translated, got none")
+		return 0, fmt.Errorf("expected 1 item translated for email %q, got %d", email, len(responseBody.List))
 	}
 	return responseBody.List[0].Payload.ID, nil
 }
@@ -92,6 +91,8 @@ func (c *Client) DeleteUser(email string) error {
 func (c *Client) Me() (*fleet.User, error) {
 	verb, path := "GET", "/api/latest/fleet/me"
 	var responseBody getUserResponse
-	err := c.authenticatedRequest(nil, verb, path, &responseBody)
-	return responseBody.User, err
+	if err := c.authenticatedRequest(nil, verb, path, &responseBody); err != nil {
+		return nil, err
+	}
+	return responseBody.User, nil
 }

From c3a1ed91aeaa6680194f58bf5ea53e7c232b15d3 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:34 +0000
Subject: [PATCH 10/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/go-paniclog/paniclog_windows.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/orbit/pkg/go-paniclog/paniclog_windows.go b/orbit/pkg/go-paniclog/paniclog_windows.go
index beddeca2948..775a9dcf734 100644
--- a/orbit/pkg/go-paniclog/paniclog_windows.go
+++ b/orbit/pkg/go-paniclog/paniclog_windows.go
@@ -10,7 +10,7 @@
 package paniclog
 
 import (
-	"errors"
+	"fmt"
 	"os"
 	"syscall"
 )
@@ -57,28 +57,28 @@ func setStdHandle(stdhandle int32, handle syscall.Handle) error {
 func redirectStderr(f *os.File) (UndoFunction, error) {
 	stderrFd, err := getStdHandle(syscall.STD_ERROR_HANDLE)
 	if err != nil {
-		return nil, errors.New("Failed to redirect stderr to file: " + err.Error())
+		return nil, fmt.Errorf("failed to redirect stderr to file: %w", err)
 	}
 
 	// duplicate the handle to match unix behavior
 	fHandle, err := dupFD(f.Fd())
 	if err != nil {
-		return nil, errors.New("Failed to duplicate file: " + err.Error())
+		return nil, fmt.Errorf("failed to duplicate file: %w", err)
 	}
 
 	err = setStdHandle(syscall.STD_ERROR_HANDLE, fHandle)
 	if err != nil {
-		return nil, errors.New("Failed to redirect stderr to file: " + err.Error())
+		return nil, fmt.Errorf("failed to redirect stderr to file: %w", err)
 	}
 
 	undo := func() error {
 		err := setStdHandle(syscall.STD_ERROR_HANDLE, stderrFd)
 		if err != nil {
-			return errors.New("Failed to redirect stderr to file: " + err.Error())
+			return fmt.Errorf("failed to redirect stderr to file: %w", err)
 		}
 		err = syscall.CloseHandle(fHandle)
 		if err != nil {
-			return errors.New("Failed to close STD_ERROR handle: " + err.Error())
+			return fmt.Errorf("failed to close STD_ERROR handle: %w", err)
 		}
 		return nil
 	}

From 1a082dbc91c52a3c625dd1b8f0867499a2c0fbdd Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:35 +0000
Subject: [PATCH 11/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 tools/mdm/migration/jamf/main.go | 34 +++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/tools/mdm/migration/jamf/main.go b/tools/mdm/migration/jamf/main.go
index d3b50a286d1..57506920661 100644
--- a/tools/mdm/migration/jamf/main.go
+++ b/tools/mdm/migration/jamf/main.go
@@ -34,7 +34,7 @@ func main() {
 	}
 
 	http.HandleFunc("/", func(writer http.ResponseWriter, request *http.Request) {
-		body, err := io.ReadAll(request.Body)
+		body, err := io.ReadAll(io.LimitReader(request.Body, 1<<20))
 		if err != nil {
 			log.Printf("ERROR: reading request body: %s\n", err)
 			writer.WriteHeader(http.StatusInternalServerError)
@@ -81,6 +81,9 @@ func main() {
 	server := &http.Server{
 		Addr:              fmt.Sprintf(":%s", *port),
 		ReadHeaderTimeout: 3 * time.Second,
+		ReadTimeout:       10 * time.Second,
+		WriteTimeout:      10 * time.Second,
+		IdleTimeout:       30 * time.Second,
 	}
 	if err := server.ListenAndServe(); err != nil {
 		log.Fatal(err.Error())
@@ -96,7 +99,7 @@ func newJamfClient(username, password, url string) (*jamfClient, error) {
 	client := &jamfClient{url: url}
 	var err error
 	if client.token, err = client.getBearerToken(username, password); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("getting bearer token: %w", err)
 	}
 	return client, nil
 }
@@ -106,13 +109,13 @@ func (j *jamfClient) doWithRequest(req *http.Request) ([]byte, error) {
 
 	resp, err := client.Do(req)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("performing request: %w", err)
 	}
 	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("reading response body: %w", err)
 	}
 
 	if resp.StatusCode > 299 {
@@ -125,35 +128,42 @@ func (j *jamfClient) doWithRequest(req *http.Request) ([]byte, error) {
 func (j *jamfClient) do(method, path string) ([]byte, error) {
 	req, err := http.NewRequest(method, path, nil)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("creating request: %w", err)
 	}
 	req.Header.Add("accept", "application/xml")
 	req.Header.Add("Authorization", "Bearer "+j.token)
-	return j.doWithRequest(req)
+	body, err := j.doWithRequest(req)
+	if err != nil {
+		return nil, fmt.Errorf("sending request: %w", err)
+	}
+	return body, nil
 }
 
 func (j *jamfClient) unmanageDevice(jamfID string) error {
 	_, err := j.do("POST", fmt.Sprintf("%s/JSSResource/computercommands/command/UnmanageDevice/id/%s", *url, jamfID))
-	return err
+	if err != nil {
+		return fmt.Errorf("unmanaging device %s: %w", jamfID, err)
+	}
+	return nil
 }
 
 func (j *jamfClient) getBearerToken(username, password string) (string, error) {
 	req, err := http.NewRequest("POST", fmt.Sprintf("%s/api/v1/auth/token", *url), nil)
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("creating auth token request: %w", err)
 	}
 	req.SetBasicAuth(username, password)
 
 	body, err := j.doWithRequest(req)
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("requesting bearer token: %w", err)
 	}
 
 	var tokenResponse struct {
 		Token string `json:"token"`
 	}
 	if err := json.Unmarshal(body, &tokenResponse); err != nil {
-		return "", err
+		return "", fmt.Errorf("unmarshalling token response: %w", err)
 	}
 
 	return tokenResponse.Token, nil
@@ -162,7 +172,7 @@ func (j *jamfClient) getBearerToken(username, password string) (string, error) {
 func (j *jamfClient) getJamfID(serial string) (string, error) {
 	body, err := j.do("GET", fmt.Sprintf("%s/JSSResource/computers/serialnumber/%s", *url, serial))
 	if err != nil {
-		return "", err
+		return "", fmt.Errorf("getting computer by serial number %s: %w", serial, err)
 	}
 
 	var data struct {
@@ -171,7 +181,7 @@ func (j *jamfClient) getJamfID(serial string) (string, error) {
 	}
 
 	if err := xml.Unmarshal(body, &data); err != nil {
-		return "", err
+		return "", fmt.Errorf("unmarshalling computer XML response: %w", err)
 	}
 
 	return data.ID, nil

From 6ff03fef9049b3d872aa11762fdc24ede2b114c5 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:36 +0000
Subject: [PATCH 12/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/windows/windowsupdate/iupdate.go | 118 +++++++++++----------
 1 file changed, 61 insertions(+), 57 deletions(-)

diff --git a/orbit/pkg/windows/windowsupdate/iupdate.go b/orbit/pkg/windows/windowsupdate/iupdate.go
index df89487f186..f109945f723 100644
--- a/orbit/pkg/windows/windowsupdate/iupdate.go
+++ b/orbit/pkg/windows/windowsupdate/iupdate.go
@@ -2,6 +2,7 @@
 package windowsupdate
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/windows/oleconv"
@@ -99,7 +100,7 @@ func toIUpdatesIdentities(updatesDisp *ole.IDispatch) ([]*IUpdateIdentity, error
 		return nil, err
 	}
 
-	identities := make([]*IUpdateIdentity, count)
+	identities := make([]*IUpdateIdentity, 0, count)
 	for i := 0; i < int(count); i++ {
 		updateDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updatesDisp, "Item", i))
 		if err != nil {
@@ -111,9 +112,11 @@ func toIUpdatesIdentities(updatesDisp *ole.IDispatch) ([]*IUpdateIdentity, error
 			return nil, err
 		}
 		if identityDisp != nil {
-			if identities[i], err = toIUpdateIdentity(identityDisp); err != nil {
+			identity, err := toIUpdateIdentity(identityDisp)
+			if err != nil {
 				return nil, err
 			}
+			identities = append(identities, identity)
 		}
 	}
 	return identities, nil
@@ -126,234 +129,234 @@ func toIUpdate(updateDisp *ole.IDispatch) (*IUpdate, error) {
 	}
 
 	if iUpdate.AutoDownload, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "AutoDownload")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("AutoDownload: %w", err)
 	}
 
 	if iUpdate.AutoSelection, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "AutoSelection")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("AutoSelection: %w", err)
 	}
 
 	if iUpdate.AutoSelectOnWebSites, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "AutoSelectOnWebSites")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("AutoSelectOnWebSites: %w", err)
 	}
 
 	arrDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "BundledUpdates"))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("BundledUpdates: %w", err)
 	}
 
 	if iUpdate.BundledUpdates, err = toIUpdatesIdentities(arrDisp); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("BundledUpdates: %w", err)
 	}
 
 	if iUpdate.BrowseOnly, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "BrowseOnly")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("BrowseOnly: %w", err)
 	}
 
 	if iUpdate.CanRequireSource, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "CanRequireSource")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("CanRequireSource: %w", err)
 	}
 
 	if categoriesDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "Categories")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Categories: %w", err)
 	} else if categoriesDisp != nil {
 		if iUpdate.Categories, err = toICategories(categoriesDisp); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("Categories: %w", err)
 		}
 	}
 
 	if iUpdate.CveIDs, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "CveIDs"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("CveIDs: %w", err)
 	}
 
 	if iUpdate.Deadline, err = oleconv.ToTimeErr(oleutil.GetProperty(updateDisp, "Deadline")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Deadline: %w", err)
 	}
 
 	if iUpdate.DeltaCompressedContentAvailable, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "DeltaCompressedContentAvailable")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("DeltaCompressedContentAvailable: %w", err)
 	}
 
 	if iUpdate.DeltaCompressedContentPreferred, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "DeltaCompressedContentPreferred")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("DeltaCompressedContentPreferred: %w", err)
 	}
 
 	if iUpdate.DeploymentAction, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "DeploymentAction")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("DeploymentAction: %w", err)
 	}
 
 	if iUpdate.Description, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "Description")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Description: %w", err)
 	}
 
 	downloadContentsDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "DownloadContents"))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("DownloadContents: %w", err)
 	}
 	if downloadContentsDisp != nil {
 		if iUpdate.DownloadContents, err = toIUpdateDownloadContents(downloadContentsDisp); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("DownloadContents: %w", err)
 		}
 	}
 
 	if iUpdate.DownloadPriority, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "DownloadPriority")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("DownloadPriority: %w", err)
 	}
 
 	if iUpdate.EulaAccepted, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "EulaAccepted")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("EulaAccepted: %w", err)
 	}
 
 	if iUpdate.EulaText, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "EulaText")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("EulaText: %w", err)
 	}
 
 	if iUpdate.HandlerID, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "HandlerID")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("HandlerID: %w", err)
 	}
 
 	identityDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "Identity"))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Identity: %w", err)
 	}
 	if identityDisp != nil {
 		if iUpdate.Identity, err = toIUpdateIdentity(identityDisp); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("Identity: %w", err)
 		}
 	}
 
 	imageDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "Image"))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Image: %w", err)
 	}
 	if imageDisp != nil {
 		if iUpdate.Image, err = toIImageInformation(imageDisp); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("Image: %w", err)
 		}
 	}
 
 	installationBehaviorDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "InstallationBehavior"))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("InstallationBehavior: %w", err)
 	}
 	if installationBehaviorDisp != nil {
 		if iUpdate.InstallationBehavior, err = toIInstallationBehavior(installationBehaviorDisp); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("InstallationBehavior: %w", err)
 		}
 	}
 
 	if iUpdate.IsBeta, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsBeta")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsBeta: %w", err)
 	}
 
 	if iUpdate.IsDownloaded, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsDownloaded")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsDownloaded: %w", err)
 	}
 
 	if iUpdate.IsHidden, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsHidden")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsHidden: %w", err)
 	}
 
 	if iUpdate.IsInstalled, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsInstalled")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsInstalled: %w", err)
 	}
 
 	if iUpdate.IsMandatory, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsMandatory")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsMandatory: %w", err)
 	}
 
 	if iUpdate.IsPresent, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsPresent")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsPresent: %w", err)
 	}
 
 	if iUpdate.IsUninstallable, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "IsUninstallable")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("IsUninstallable: %w", err)
 	}
 
 	if iUpdate.KBArticleIDs, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "KBArticleIDs"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("KBArticleIDs: %w", err)
 	}
 
 	if iUpdate.Languages, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "Languages"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Languages: %w", err)
 	}
 
 	if iUpdate.LastDeploymentChangeTime, err = oleconv.ToTimeErr(oleutil.GetProperty(updateDisp, "LastDeploymentChangeTime")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("LastDeploymentChangeTime: %w", err)
 	}
 
 	if iUpdate.MaxDownloadSize, err = oleconv.ToInt64Err(oleutil.GetProperty(updateDisp, "MaxDownloadSize")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("MaxDownloadSize: %w", err)
 	}
 
 	if iUpdate.MinDownloadSize, err = oleconv.ToInt64Err(oleutil.GetProperty(updateDisp, "MinDownloadSize")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("MinDownloadSize: %w", err)
 	}
 
 	if iUpdate.MoreInfoUrls, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "MoreInfoUrls"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("MoreInfoUrls: %w", err)
 	}
 
 	if iUpdate.MsrcSeverity, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "MsrcSeverity")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("MsrcSeverity: %w", err)
 	}
 
 	if iUpdate.PerUser, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "PerUser")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("PerUser: %w", err)
 	}
 
 	if iUpdate.RebootRequired, err = oleconv.ToBoolErr(oleutil.GetProperty(updateDisp, "RebootRequired")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("RebootRequired: %w", err)
 	}
 
 	if iUpdate.RecommendedCpuSpeed, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "RecommendedCpuSpeed")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("RecommendedCpuSpeed: %w", err)
 	}
 
 	if iUpdate.RecommendedHardDiskSpace, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "RecommendedHardDiskSpace")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("RecommendedHardDiskSpace: %w", err)
 	}
 
 	if iUpdate.RecommendedMemory, err = oleconv.ToInt32Err(oleutil.GetProperty(updateDisp, "RecommendedMemory")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("RecommendedMemory: %w", err)
 	}
 
 	if iUpdate.ReleaseNotes, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "ReleaseNotes")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("ReleaseNotes: %w", err)
 	}
 
 	if iUpdate.SecurityBulletinIDs, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "SecurityBulletinIDs"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("SecurityBulletinIDs: %w", err)
 	}
 
 	if iUpdate.SupersededUpdateIDs, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "SupersededUpdateIDs"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("SupersededUpdateIDs: %w", err)
 	}
 
 	if iUpdate.SupportUrl, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "SupportUrl")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("SupportUrl: %w", err)
 	}
 
 	if iUpdate.Title, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "Title")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Title: %w", err)
 	}
 
 	uninstallationBehaviorDisp, err := oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "UninstallationBehavior"))
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("UninstallationBehavior: %w", err)
 	}
 	if uninstallationBehaviorDisp != nil {
 		if iUpdate.UninstallationBehavior, err = toIInstallationBehavior(uninstallationBehaviorDisp); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("UninstallationBehavior: %w", err)
 		}
 	}
 
 	if iUpdate.UninstallationNotes, err = oleconv.ToStringErr(oleutil.GetProperty(updateDisp, "UninstallationNotes")); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("UninstallationNotes: %w", err)
 	}
 
 	if iUpdate.UninstallationSteps, err = iStringCollectionToStringArrayErr(oleconv.ToIDispatchErr(oleutil.GetProperty(updateDisp, "UninstallationSteps"))); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("UninstallationSteps: %w", err)
 	}
 
 	return iUpdate, nil
@@ -384,3 +387,4 @@ func (iUpdate *IUpdate) AcceptEula() error {
 	_, err := oleutil.CallMethod(iUpdate.disp, "AcceptEula")
 	return err
 }
+

From 9316a114442e4c4a2956e1c2776746f4d96204e5 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:37 +0000
Subject: [PATCH 13/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/logging/kafkarest.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/logging/kafkarest.go b/server/logging/kafkarest.go
index 10f83b65fad..0ff086a9b5a 100644
--- a/server/logging/kafkarest.go
+++ b/server/logging/kafkarest.go
@@ -79,9 +79,9 @@ func (l *kafkaRESTProducer) Write(ctx context.Context, logs []json.RawMessage) e
 }
 
 func checkResponse(resp *http.Response) (err error) {
+	body, _ := io.ReadAll(resp.Body)
 	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("Error: %d. %s", resp.StatusCode, string(body))
+		return fmt.Errorf("kafka rest unexpected status %d: %s", resp.StatusCode, string(body))
 	}
 
 	return nil

From 19f22d4aba3992c81db89726998d2408134f79fb Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:38 +0000
Subject: [PATCH 14/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/mdm/nanodep/cmd/deptokens/main.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server/mdm/nanodep/cmd/deptokens/main.go b/server/mdm/nanodep/cmd/deptokens/main.go
index a7775f2ecd5..7c5dc3befba 100644
--- a/server/mdm/nanodep/cmd/deptokens/main.go
+++ b/server/mdm/nanodep/cmd/deptokens/main.go
@@ -83,6 +83,9 @@ func encodeEncryptedKeyPEM(key *rsa.PrivateKey, password string) ([]byte, error)
 // decrypting it with password.
 func decodeEncryptedKeyPEM(pemBytes []byte, password string) (*rsa.PrivateKey, error) {
 	block, _ := pem.Decode(pemBytes)
+	if block == nil {
+		return nil, errors.New("failed to decode PEM block containing private key")
+	}
 	if block.Type != "RSA PRIVATE KEY" {
 		return nil, errors.New("PEM type is not RSA PRIVATE KEY")
 	}

From 39ba955e983c4a142d89563eb93b9f612b2f0d02 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:39 +0000
Subject: [PATCH 15/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/cmd/desktop/desktop_linux.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/orbit/cmd/desktop/desktop_linux.go b/orbit/cmd/desktop/desktop_linux.go
index 5ad2febfffd..f0974e41637 100644
--- a/orbit/cmd/desktop/desktop_linux.go
+++ b/orbit/cmd/desktop/desktop_linux.go
@@ -54,7 +54,8 @@ func blockWaitForStopEvent(_ string) error {
 func trayIconExists() bool {
 	conn, err := dbus.SessionBus()
 	if err != nil {
-		log.Error().Err(err)
+		log.Error().Err(err).Msg("trayIconExists: connect to session bus")
+		return false
 	}
 
 	// Get the name we would expect systray to reserve for our tray icon.

From e23f24fa5514cd6a26a1e6897561e3f3a385305c Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:40 +0000
Subject: [PATCH 16/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/mdm/apple/vpp/api.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/mdm/apple/vpp/api.go b/server/mdm/apple/vpp/api.go
index 67152adf6d4..9b555269bd1 100644
--- a/server/mdm/apple/vpp/api.go
+++ b/server/mdm/apple/vpp/api.go
@@ -233,7 +233,7 @@ type DisassociateAssetsRequest = AssociateAssetsRequest
 // cancelled before reaching the device).
 //
 // https://developer.apple.com/documentation/devicemanagement/disassociate_assets
-func DisassociateAssets(token string, params *DisassociateAssetsRequest) (string, error) {
+func DisassociateAssets(ctx context.Context, token string, params *DisassociateAssetsRequest) (string, error) {
 	if err := params.Validate(); err != nil {
 		return "", err
 	}
@@ -243,7 +243,7 @@ func DisassociateAssets(token string, params *DisassociateAssetsRequest) (string
 		return "", fmt.Errorf("encoding params as JSON: %w", err)
 	}
 
-	req, err := http.NewRequest(http.MethodPost, getBaseURL()+"/assets/disassociate", &reqBody)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, getBaseURL()+"/assets/disassociate", &reqBody)
 	if err != nil {
 		return "", fmt.Errorf("creating request to Apple VPP endpoint: %w", err)
 	}

From 4e8ffc5339d1115e60a4288d2f0a720eb15446fa Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:41 +0000
Subject: [PATCH 17/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/table/extension.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orbit/pkg/table/extension.go b/orbit/pkg/table/extension.go
index 04aada736ad..86001131953 100644
--- a/orbit/pkg/table/extension.go
+++ b/orbit/pkg/table/extension.go
@@ -129,7 +129,7 @@ func (r *Runner) Execute() error {
 	r.srv.RegisterPlugin(plugins...)
 
 	if err := r.srv.Run(); err != nil {
-		return err
+		return fmt.Errorf("running extension manager server: %w", err)
 	}
 
 	return nil

From 501eeecbdcca4b98b79197e16e8001c474e5e423 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:42 +0000
Subject: [PATCH 18/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/host_identity_scep.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/datastore/mysql/host_identity_scep.go b/server/datastore/mysql/host_identity_scep.go
index b261a8581cd..1728ba80c84 100644
--- a/server/datastore/mysql/host_identity_scep.go
+++ b/server/datastore/mysql/host_identity_scep.go
@@ -45,7 +45,10 @@ func updateHostIdentityCertHostIDBySerial(ctx context.Context, tx sqlx.ExtContex
 		UPDATE host_identity_scep_certificates
 		SET host_id = ?
 		WHERE serial = ?`, hostID, serialNumber)
-	return err
+	if err != nil {
+		return fmt.Errorf("updating host identity cert host id by serial: %w", err)
+	}
+	return nil
 }
 
 func (ds *Datastore) GetHostIdentityCertByName(ctx context.Context, name string) (*types.HostIdentityCertificate, error) {

From 94758e05c7737cb74996551f5ff598bd179e1bc3 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:43 +0000
Subject: [PATCH 19/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/scheduled_queries.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/datastore/mysql/scheduled_queries.go b/server/datastore/mysql/scheduled_queries.go
index 5223a75e640..0f3a5e46ec3 100644
--- a/server/datastore/mysql/scheduled_queries.go
+++ b/server/datastore/mysql/scheduled_queries.go
@@ -366,7 +366,7 @@ func (ds *Datastore) AsyncBatchSaveHostsScheduledQueryStats(ctx context.Context,
 				var teamID int
 				statTeamID, err := stat.TeamID()
 				if err != nil {
-					return 0, err
+					return 0, ctxerr.Wrap(ctx, err, "parse team id from scheduled query stat pack name")
 				}
 				if statTeamID != nil {
 					teamID = *statTeamID

From bf6a6f3b55575577db45a50846f54f64f8ae8ed3 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:44 +0000
Subject: [PATCH 20/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/platform/mysql/common.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/platform/mysql/common.go b/server/platform/mysql/common.go
index bf7349b9b3f..e048ea8a336 100644
--- a/server/platform/mysql/common.go
+++ b/server/platform/mysql/common.go
@@ -93,7 +93,7 @@ func NewDB(conf *MysqlConfig, opts *DBOptions, otelDriverName string) (*sqlx.DB,
 		var err error
 		db, err = sqlx.Open(driverName, dsn)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to open mysql connection: %w", err)
 		}
 	}
 

From ee2ffe2058b35bf0aa2feea7ac37e9dd3d067d52 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:45 +0000
Subject: [PATCH 21/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 tools/dibble/pkg/seed/enroll_secrets.go | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/tools/dibble/pkg/seed/enroll_secrets.go b/tools/dibble/pkg/seed/enroll_secrets.go
index 42cb562e7cf..3083afae5d8 100644
--- a/tools/dibble/pkg/seed/enroll_secrets.go
+++ b/tools/dibble/pkg/seed/enroll_secrets.go
@@ -16,13 +16,17 @@ import (
 func EnrollSecrets(c Client, log Logger, teams []Team) Result {
 	res := Result{Entity: "enroll-secrets"}
 	for _, t := range teams {
-		secret := randomEnrollSecret()
+		secret, err := randomEnrollSecret()
+		if err != nil {
+			res.Errors = append(res.Errors, fmt.Errorf("generate enroll secret for team=%s (id=%d): %w", t.Name, t.ID, err))
+			continue
+		}
 		body := map[string]any{
 			"secrets": []map[string]string{{"secret": secret}},
 		}
 		// PATCH replaces the team's enroll-secret list with this one. Find
 		// them in the UI under Settings → [team] → Add hosts → Show enroll secret.
-		err := c.Patch(fmt.Sprintf("/api/latest/fleet/fleets/%d/secrets", t.ID), body, nil)
+		err = c.Patch(fmt.Sprintf("/api/latest/fleet/fleets/%d/secrets", t.ID), body, nil)
 		switch {
 		case err == nil:
 			res.Created++
@@ -39,11 +43,10 @@ func EnrollSecrets(c Client, log Logger, teams []Team) Result {
 	return res
 }
 
-func randomEnrollSecret() string {
+func randomEnrollSecret() (string, error) {
 	var b [16]byte
 	if _, err := rand.Read(b[:]); err != nil {
-		// Vanishingly unlikely; fall back to a fixed-but-clearly-fake value.
-		return "dibble-fallback-secret"
+		return "", fmt.Errorf("generate random enroll secret: %w", err)
 	}
-	return "dibble-" + hex.EncodeToString(b[:])
+	return "dibble-" + hex.EncodeToString(b[:]), nil
 }

From e17f5a2237c847bf708097633f727ce29e83fce3 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:46 +0000
Subject: [PATCH 22/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 tools/bump-migration/main.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tools/bump-migration/main.go b/tools/bump-migration/main.go
index 602bdc89cad..8711c7100ad 100644
--- a/tools/bump-migration/main.go
+++ b/tools/bump-migration/main.go
@@ -30,9 +30,8 @@ func main() {
 
 	flag.Parse()
 	if *sourceMigration == "" {
-		log.Println("The --source-migration flag is required.")
 		flag.Usage()
-		return
+		log.Fatal("The --source-migration flag is required.")
 	}
 
 	sourceFilename := filepath.Base(*sourceMigration)

From 8a1352500d11958cedab0bd90f67a42180969bd2 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:47 +0000
Subject: [PATCH 23/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/dataflatten/json.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orbit/pkg/dataflatten/json.go b/orbit/pkg/dataflatten/json.go
index c55176823cd..28238527cd5 100644
--- a/orbit/pkg/dataflatten/json.go
+++ b/orbit/pkg/dataflatten/json.go
@@ -10,7 +10,7 @@ import (
 func JsonFile(file string, opts ...FlattenOpts) ([]Row, error) {
 	rawdata, err := os.ReadFile(file)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("reading json file %s: %w", file, err)
 	}
 	return Json(rawdata, opts...)
 }

From 482ef4f92972a8ed787c8f71b3d2b6b8d53189fe Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:48 +0000
Subject: [PATCH 24/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/dataflatten/jsonl.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orbit/pkg/dataflatten/jsonl.go b/orbit/pkg/dataflatten/jsonl.go
index 44ee33e8591..dc9aca5bb1d 100644
--- a/orbit/pkg/dataflatten/jsonl.go
+++ b/orbit/pkg/dataflatten/jsonl.go
@@ -11,7 +11,7 @@ import (
 func JsonlFile(file string, opts ...FlattenOpts) ([]Row, error) {
 	f, err := os.Open(file)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("opening jsonl file %s: %w", file, err)
 	}
 	defer f.Close()
 	return Jsonl(f, opts...)

From 830b57b513da8046166819e08a833daeeff0effa Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:49 +0000
Subject: [PATCH 25/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/dataflatten/plist.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/orbit/pkg/dataflatten/plist.go b/orbit/pkg/dataflatten/plist.go
index e2bc2ed720b..346e4679966 100644
--- a/orbit/pkg/dataflatten/plist.go
+++ b/orbit/pkg/dataflatten/plist.go
@@ -11,7 +11,7 @@ import (
 func PlistFile(file string, opts ...FlattenOpts) ([]Row, error) {
 	rawdata, err := os.ReadFile(file)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("reading plist file %s: %w", file, err)
 	}
 	return Plist(rawdata, opts...)
 }

From 345a674b15b353dc3d7e53e57ab2248de3e648d0 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:50 +0000
Subject: [PATCH 26/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/mail/invite.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/mail/invite.go b/server/mail/invite.go
index 2a9d8b96078..6b6ce1b9890 100644
--- a/server/mail/invite.go
+++ b/server/mail/invite.go
@@ -2,6 +2,7 @@ package mail
 
 import (
 	"bytes"
+	"fmt"
 	"html/template"
 	"time"
 
@@ -23,12 +24,12 @@ func (i *InviteMailer) Message() ([]byte, error) {
 	i.CurrentYear = time.Now().Year()
 	t, err := server.GetTemplate("server/mail/templates/invite_token.html", "email_template")
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("get invite email template: %w", err)
 	}
 
 	var msg bytes.Buffer
 	if err = t.Execute(&msg, i); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("execute invite email template: %w", err)
 	}
 	return msg.Bytes(), nil
 }

From 8478337b9cb3a96132aefa823a142fbef5249700 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:51 +0000
Subject: [PATCH 27/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/vulnerabilities/customcve/matching_rules.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/vulnerabilities/customcve/matching_rules.go b/server/vulnerabilities/customcve/matching_rules.go
index e0b3c3703f3..276bed3a5cb 100644
--- a/server/vulnerabilities/customcve/matching_rules.go
+++ b/server/vulnerabilities/customcve/matching_rules.go
@@ -98,7 +98,7 @@ func (r CVEMatchingRule) match(ctx context.Context, ds fleet.Datastore) ([]fleet
 	}
 	software, err := ds.ListSoftwareForVulnDetection(ctx, filter)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("listing software for vuln detection (rule %q): %w", r.NameLikeMatch, err)
 	}
 
 	var excludePattern string
@@ -174,7 +174,7 @@ func CheckCustomVulnerabilities(ctx context.Context, ds fleet.Datastore, logger
 		// Return early so DeleteOutOfDateVulnerabilities doesn't run.
 		// Otherwise, without the insert refreshing updated_at, all existing vulns would look stale and be deleted.
 		logger.ErrorContext(ctx, "Error inserting software vulnerabilities", "err", err)
-		return nil, err
+		return nil, fmt.Errorf("inserting software vulnerabilities: %w", err)
 	}
 
 	if err := ds.DeleteOutOfDateVulnerabilities(ctx, fleet.CustomSource, startTime); err != nil {

From 2c13edadedb09c0284923e55558efa90ac87f32a Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:52 +0000
Subject: [PATCH 28/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/packaging/wix/transform.go | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/orbit/pkg/packaging/wix/transform.go b/orbit/pkg/packaging/wix/transform.go
index ec34d0c183d..06fe1f4c80d 100644
--- a/orbit/pkg/packaging/wix/transform.go
+++ b/orbit/pkg/packaging/wix/transform.go
@@ -5,6 +5,7 @@ import (
 	"encoding/xml"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 )
 
@@ -64,13 +65,35 @@ func TransformHeat(path string) error {
 		return fmt.Errorf("marshal xml: %w", err)
 	}
 
+	// Write to a temp file in the same directory first, then rename over the
+	// original. This avoids destroying the original file if the write fails,
+	// and the rename is atomic on the same filesystem.
+	dir := filepath.Dir(path)
+	tmp, err := os.CreateTemp(dir, filepath.Base(path)+".tmp-*")
+	if err != nil {
+		return fmt.Errorf("create temp file: %w", err)
+	}
+	tmpPath := tmp.Name()
+	defer os.Remove(tmpPath)
+
+	if _, err := tmp.Write(contents); err != nil {
+		tmp.Close()
+		return fmt.Errorf("write temp file: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temp file: %w", err)
+	}
+	if err := os.Chmod(tmpPath, 0o600); err != nil {
+		return fmt.Errorf("chmod temp file: %w", err)
+	}
+
 	// Remove first as we encounter permission errors on some Linux configurations.
 	if err := os.Remove(path); err != nil {
 		return fmt.Errorf("remove old file: %w", err)
 	}
 
-	if err := os.WriteFile(path, contents, 0o600); err != nil {
-		return fmt.Errorf("write file: %w", err)
+	if err := os.Rename(tmpPath, path); err != nil {
+		return fmt.Errorf("rename temp file: %w", err)
 	}
 
 	return nil

From d33c79ceccbcd510ed8c6f146024d3aa84c6cf94 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:53 +0000
Subject: [PATCH 29/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/failing/common_store.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/datastore/failing/common_store.go b/server/datastore/failing/common_store.go
index 580aa75e9f2..9e56700400b 100644
--- a/server/datastore/failing/common_store.go
+++ b/server/datastore/failing/common_store.go
@@ -27,9 +27,10 @@ func (c commonFailingStore) Exists(ctx context.Context, iconID string) (bool, er
 }
 
 func (c commonFailingStore) Cleanup(ctx context.Context, usedIconIDs []string, removeCreatedBefore time.Time) (int, error) {
-	return 0, nil
+	return 0, fmt.Errorf("%s store not properly configured", c.Entity)
 }
 
 func (c commonFailingStore) Sign(_ context.Context, _ string, _ time.Duration) (string, error) {
 	return "", fmt.Errorf("%s store not properly configured", c.Entity)
 }
+

From 0da9e46767670679e9cdad1776ab02df112751df Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:54 +0000
Subject: [PATCH 30/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/calendar_events.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/datastore/mysql/calendar_events.go b/server/datastore/mysql/calendar_events.go
index 455e246dde4..048fc7b0f2b 100644
--- a/server/datastore/mysql/calendar_events.go
+++ b/server/datastore/mysql/calendar_events.go
@@ -95,7 +95,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 		}
 		return nil
 	}); err != nil {
-		return nil, ctxerr.Wrap(ctx, err)
+		return nil, ctxerr.Wrap(ctx, err, "create or update calendar event")
 	}
 
 	calendarEvent, err := getCalendarEventByID(ctx, ds.writer(ctx), uint(id)) //nolint:gosec // dismiss G115

From 5a3c3ee847b57d24b1f856321b5d9db654f7b502 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:55 +0000
Subject: [PATCH 31/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/queries.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/server/datastore/mysql/queries.go b/server/datastore/mysql/queries.go
index 9946d067529..e7e057beafd 100644
--- a/server/datastore/mysql/queries.go
+++ b/server/datastore/mysql/queries.go
@@ -333,7 +333,10 @@ func (ds *Datastore) NewQuery(
 		return nil, ctxerr.Wrap(ctx, err, "creating new Query")
 	}
 
-	id, _ := result.LastInsertId()
+	id, err := result.LastInsertId()
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting last insert id for query")
+	}
 	query.ID = uint(id) //nolint:gosec // dismiss G115
 	query.Packs = []fleet.Pack{}
 
@@ -1379,3 +1382,4 @@ func numSavedQueriesDB(ctx context.Context, db sqlx.QueryerContext) (int, error)
 
 	return count, nil
 }
+

From fdd84f3968597162ce4fd9ccad544cbb953a8457 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:56 +0000
Subject: [PATCH 32/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/service/client_hosts.go | 23 +++++------------------
 1 file changed, 5 insertions(+), 18 deletions(-)

diff --git a/server/service/client_hosts.go b/server/service/client_hosts.go
index b1841ebd387..82ead0a2d84 100644
--- a/server/service/client_hosts.go
+++ b/server/service/client_hosts.go
@@ -39,27 +39,15 @@ func (c *Client) translateTransferHostsToIDs(hosts []string, label string, team
 
 	var translatePayloads []fleet.TranslatePayload
 	for _, host := range hosts {
-		translatedPayload, err := encodeTranslatedPayload(fleet.TranslatorTypeHost, host)
-		if err != nil {
-			return nil, 0, 0, err
-		}
-		translatePayloads = append(translatePayloads, translatedPayload)
+		translatePayloads = append(translatePayloads, encodeTranslatedPayload(fleet.TranslatorTypeHost, host))
 	}
 
 	if label != "" {
-		translatedPayload, err := encodeTranslatedPayload(fleet.TranslatorTypeLabel, label)
-		if err != nil {
-			return nil, 0, 0, err
-		}
-		translatePayloads = append(translatePayloads, translatedPayload)
+		translatePayloads = append(translatePayloads, encodeTranslatedPayload(fleet.TranslatorTypeLabel, label))
 	}
 
 	if team != "" {
-		translatedPayload, err := encodeTranslatedPayload(fleet.TranslatorTypeTeam, team)
-		if err != nil {
-			return nil, 0, 0, err
-		}
-		translatePayloads = append(translatePayloads, translatedPayload)
+		translatePayloads = append(translatePayloads, encodeTranslatedPayload(fleet.TranslatorTypeTeam, team))
 	}
 
 	var hostIDs []uint
@@ -89,12 +77,11 @@ func (c *Client) translateTransferHostsToIDs(hosts []string, label string, team
 	return hostIDs, labelID, teamID, nil
 }
 
-func encodeTranslatedPayload(translatorType string, identifier string) (fleet.TranslatePayload, error) {
-	translatedPayload := fleet.TranslatePayload{
+func encodeTranslatedPayload(translatorType string, identifier string) fleet.TranslatePayload {
+	return fleet.TranslatePayload{
 		Type:    translatorType,
 		Payload: fleet.StringIdentifierToIDPayload{Identifier: identifier},
 	}
-	return translatedPayload, nil
 }
 
 func (c *Client) TransferHosts(hosts []string, label string, status, searchQuery string, team string) error {

From 5a46463ea9365b277cfd585aa5bfd1b27e5b0e67 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:57 +0000
Subject: [PATCH 33/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/service/client_software.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/service/client_software.go b/server/service/client_software.go
index ad11d08b9f3..290dba315f4 100644
--- a/server/service/client_software.go
+++ b/server/service/client_software.go
@@ -213,14 +213,14 @@ func (c *Client) UploadIcon(teamID uint, titleID uint, filename string, iconRead
 	writer := multipart.NewWriter(&buf)
 	fileWriter, err := writer.CreateFormFile("icon", filename)
 	if err != nil {
-		return err
+		return fmt.Errorf("create form file: %w", err)
 	}
 	if _, err = io.Copy(fileWriter, iconReader); err != nil {
-		return err
+		return fmt.Errorf("copy icon bytes: %w", err)
 	}
 	// Close the writer before using the buffer
 	if err := writer.Close(); err != nil {
-		return err
+		return fmt.Errorf("close multipart writer: %w", err)
 	}
 
 	return c.putIcon(teamID, titleID, writer, buf)

From b301830092248d24bd22b2256c1c7daddd2d3980 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:58 +0000
Subject: [PATCH 34/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 ee/server/calendar/google_calendar_load.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ee/server/calendar/google_calendar_load.go b/ee/server/calendar/google_calendar_load.go
index 3b7e07ff84e..92e12252676 100644
--- a/ee/server/calendar/google_calendar_load.go
+++ b/ee/server/calendar/google_calendar_load.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -126,7 +125,7 @@ func (lowLevelAPI *GoogleCalendarLoadAPI) CreateEvent(event *calendar.Event) (*c
 }
 
 func (lowLevelAPI *GoogleCalendarLoadAPI) UpdateEvent(event *calendar.Event) (*calendar.Event, error) {
-	return nil, errors.New("GoogleCalendarLoadAPI.UpdateEvent is not implemented")
+	return nil, fmt.Errorf("update event: %w", errNotImplemented)
 }
 
 func (lowLevelAPI *GoogleCalendarLoadAPI) GetEvent(id, _ string) (*calendar.Event, error) {
@@ -249,3 +248,5 @@ func (lowLevelAPI *GoogleCalendarLoadAPI) Watch(eventUUID string, channelID stri
 func (lowLevelAPI *GoogleCalendarLoadAPI) Stop(channelID string, resourceID string) error {
 	return nil
 }
+
+var errNotImplemented = errors.New("GoogleCalendarLoadAPI.UpdateEvent is not implemented")

From 6ce729b215342f25d52763f936f8eef70980d02e Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:55:59 +0000
Subject: [PATCH 35/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/osquery/osquery.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/orbit/pkg/osquery/osquery.go b/orbit/pkg/osquery/osquery.go
index 5e88ce8db71..06f91c11871 100644
--- a/orbit/pkg/osquery/osquery.go
+++ b/orbit/pkg/osquery/osquery.go
@@ -182,6 +182,9 @@ func (r *Runner) Execute() error {
 
 // Runner interrupts the running osquery process.
 func (r *Runner) Interrupt(err error) {
+	if err != nil {
+		log.Info().Err(fmt.Errorf("interrupt osqueryd runner: %w", err)).Msg("osqueryd runner interrupted")
+	}
 	if _, cancel := r.getContextAndCancel(); cancel != nil {
 		cancel()
 	}

From 9fb2260fce8089d4bd9948f10699ce172b37553c Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:56:00 +0000
Subject: [PATCH 36/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 orbit/pkg/packaging/linux_shared.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/orbit/pkg/packaging/linux_shared.go b/orbit/pkg/packaging/linux_shared.go
index 385e034100c..5e4914c303d 100644
--- a/orbit/pkg/packaging/linux_shared.go
+++ b/orbit/pkg/packaging/linux_shared.go
@@ -57,7 +57,7 @@ func buildNFPM(opt Options, pkger nfpm.Packager) (string, error) {
 	}
 
 	if opt.Architecture != ArchAmd64 && opt.Architecture != ArchArm64 {
-		return "", fmt.Errorf("Invalid architecture: %s", opt.Architecture)
+		return "", fmt.Errorf("invalid architecture: %s", opt.Architecture)
 	}
 
 	// Initialize autoupdate metadata
@@ -543,3 +543,4 @@ pkill fleet-desktop || true
 
 	return nil
 }
+

From d7031782b2fa98ceff091873f95731696bcf3c69 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:56:01 +0000
Subject: [PATCH 37/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/maintained_apps.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/datastore/mysql/maintained_apps.go b/server/datastore/mysql/maintained_apps.go
index 5523eebf4b8..266ce088638 100644
--- a/server/datastore/mysql/maintained_apps.go
+++ b/server/datastore/mysql/maintained_apps.go
@@ -40,7 +40,10 @@ ON DUPLICATE KEY UPDATE
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "upsert maintained app")
 		}
-		id, _ := res.LastInsertId()
+		id, err := res.LastInsertId()
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get last insert id for maintained app")
+		}
 		appID = uint(id) //nolint:gosec // dismiss G115
 
 		// For darwin apps, update existing software_titles and software entries

From 7e58ef0106cf8f0e5bee82dac058be1dcd7ba8de Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:56:02 +0000
Subject: [PATCH 38/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 ...60326210603_UpdateSoftwareTitleNamesToFMANames.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/server/datastore/mysql/migrations/tables/20260326210603_UpdateSoftwareTitleNamesToFMANames.go b/server/datastore/mysql/migrations/tables/20260326210603_UpdateSoftwareTitleNamesToFMANames.go
index 430140a3e6a..2221a9d0cf7 100644
--- a/server/datastore/mysql/migrations/tables/20260326210603_UpdateSoftwareTitleNamesToFMANames.go
+++ b/server/datastore/mysql/migrations/tables/20260326210603_UpdateSoftwareTitleNamesToFMANames.go
@@ -1,6 +1,9 @@
 package tables
 
-import "database/sql"
+import (
+	"database/sql"
+	"fmt"
+)
 
 func init() {
 	MigrationClient.AddMigration(Up_20260326210603, Down_20260326210603)
@@ -28,7 +31,7 @@ func Up_20260326210603(tx *sql.Tx) error {
 			AND st.name != fma.name
 	`)
 	if err != nil {
-		return err
+		return fmt.Errorf("updating software_titles names to FMA names: %w", err)
 	}
 
 	// Also update software entries to match their software_titles names.
@@ -43,7 +46,10 @@ func Up_20260326210603(tx *sql.Tx) error {
 			AND s.bundle_identifier != ''
 			AND s.name != fma.name
 	`)
-	return err
+	if err != nil {
+		return fmt.Errorf("updating software names to FMA names: %w", err)
+	}
+	return nil
 }
 
 func Down_20260326210603(tx *sql.Tx) error {

From d626e2728740db745628ddac00bf5102b43ec494 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:56:03 +0000
Subject: [PATCH 39/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/datastore/mysql/operating_systems.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/datastore/mysql/operating_systems.go b/server/datastore/mysql/operating_systems.go
index 2f9cbf30e46..273fb7318f2 100644
--- a/server/datastore/mysql/operating_systems.go
+++ b/server/datastore/mysql/operating_systems.go
@@ -18,7 +18,7 @@ func (ds *Datastore) ListOperatingSystems(ctx context.Context) ([]fleet.Operatin
 func listOperatingSystemsDB(ctx context.Context, tx sqlx.QueryerContext) ([]fleet.OperatingSystem, error) {
 	var os []fleet.OperatingSystem
 	if err := sqlx.SelectContext(ctx, tx, &os, `SELECT id, name, version, arch, kernel_version, platform, display_version, installation_type, os_version_id FROM operating_systems`); err != nil {
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "list operating systems")
 	}
 	return os, nil
 }
@@ -146,7 +146,7 @@ func getOperatingSystemDB(ctx context.Context, tx sqlx.ExtContext, hostOS fleet.
 	var os fleet.OperatingSystem
 	stmt := "SELECT id, name, version, arch, kernel_version, platform, display_version, installation_type, os_version_id FROM operating_systems WHERE name = ? AND version = ? AND arch = ? AND kernel_version = ? AND platform = ? AND display_version = ? AND installation_type = ?"
 	if err := sqlx.GetContext(ctx, tx, &os, stmt, hostOS.Name, hostOS.Version, hostOS.Arch, hostOS.KernelVersion, hostOS.Platform, hostOS.DisplayVersion, hostOS.InstallationType); err != nil {
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "get operating system")
 	}
 	return &os, nil
 }

From fb47bb4d74852557cc5cbc6c92bbea973d16a0ce Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 06:56:04 +0000
Subject: [PATCH 40/40] fix(FLEETMDM-002-2): 62 review findings across 40 files

---
 server/service/apple_mdm_declarations_batched.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/service/apple_mdm_declarations_batched.go b/server/service/apple_mdm_declarations_batched.go
index 288711d6001..58c08d9fb0a 100644
--- a/server/service/apple_mdm_declarations_batched.go
+++ b/server/service/apple_mdm_declarations_batched.go
@@ -44,7 +44,8 @@ func ReconcileAppleDeclarationsBatched(
 
 	cursor, err := ds.GetMDMAppleDeclarationReconcileCursor(ctx)
 	if err != nil {
-		logger.WarnContext(ctx, "failed to read apple MDM declaration reconcile cursor; starting from beginning", "err", err)
+		wrappedErr := fmt.Errorf("reading apple MDM declaration reconcile cursor: %w", err)
+		logger.WarnContext(ctx, "failed to read apple MDM declaration reconcile cursor; starting from beginning", "err", wrappedErr)
 		cursor = ""
 	}