@allister don’t know if my long explanation here helps https://github.com/osquery/osquery/issues/7389, but I delved into the code some time ago to describe the current nuanced behavior.