all I know is that I get the correct behavior if I use

CopyAppValue

on my own and plug in the right inputs. osquery loses the user somewhere