Replace inventory-counting risk with bounded workload scoring and separate confidence

powershell/Get-ServerStorage.ps1

@@ -19,5 +19,29 @@ function Get-SamsaraShares {
                 capacity_gib = $null; free_gib = $null; special = [bool]$_.Special }
         })
     }
-    $Result.limitations += 'Configured SMB shares, including administrative shares. No share contents, ACLs, credentials, sessions or consumers queried. Existence does not establish use.'
+    Invoke-SamsaraRead $Result 'SMB open-file activity' {
+        $openFiles = @(Get-SmbOpenFile -ErrorAction Stop)
+        $observedAt = Get-SamsaraTimestamp
+        foreach ($share in $Result.data) {
+            if ($share.name -match '^(ADMIN|IPC|[A-Z])\$$' -or -not $share.path) { continue }
+            $prefix = $share.path.TrimEnd([char]'\') + '\'
+            $matching = @($openFiles | Where-Object {
+                # Path alone also matches a file opened through C$/D$. Require
+                # Path = share root + ShareRelativePath to distinguish that case.
+                $_.Path -and $_.ShareRelativePath -and
+                ([string]$_.Path).Equals(($prefix + ([string]$_.ShareRelativePath).TrimStart([char]'\')), [StringComparison]::OrdinalIgnoreCase)
+            })
+            $adminAliases = @($Result.data | Where-Object {
+                $_.name -match '^(ADMIN|IPC|[A-Z])\$$' -and ([string]$_.path).TrimEnd([char]'\').Equals($share.path.TrimEnd([char]'\'), [StringComparison]::OrdinalIgnoreCase)
+            })
+            # Only aggregated, path-correlated activity is exported. Never serialize
+            # open-file objects, file names, session identities or user names.
+            $share | Add-Member -NotePropertyName observed_open_files -NotePropertyValue $matching.Count
+            $clients = @($matching | Select-Object -ExpandProperty ClientComputerName -Unique)
+            $share | Add-Member -NotePropertyName observed_client_count -NotePropertyValue $clients.Count
+            $share | Add-Member -NotePropertyName activity_source -NotePropertyValue $(if ($adminAliases.Count) { 'Get-SmbOpenFile (administrative alias ambiguous)' } else { 'Get-SmbOpenFile (share-root-correlated)' })
+            $share | Add-Member -NotePropertyName activity_observed_at -NotePropertyValue $observedAt
+        }
+    }
+    $Result.limitations += 'Configured SMB shares, including administrative shares, and aggregate open-file counts share-root-correlated to business shares. No file contents, open-file paths, session identities, ACLs or credentials are exported. Zero open files does not prove a share unused. Same-root aliases are not individually distinguishable; an administrative same-root alias is marked ambiguous and never confirms business-share use. All business shares remain one workload group.'
 }