Add NT-version-scoped exclusions and a parallel multi-version CI matrix

Exclusions:
- Add MinNtTargetVersion/MaxNtTargetVersion columns to exclusions.csv so a row can apply
  only within an _NT_TARGET_VERSION build-number range (parsed from -NtTargetVersion, e.g.
  22000 from 10.0.22000). Import-SampleExclusions filters this range at load time alongside
  the existing build-number range; blank = unbounded.
- Exclude the samples that fail only when linking against older library sets, with the
  reason taken from the build logs: audio.sysvad (<=22000, KSJACK_DESCRIPTION3);
  network.netadaptercx.netvadapter and network.wlan.wificx (<=22621, NDIS/DDI version);
  powerlimit.plclient/plpolicy (<=22621, POWER_LIMIT_ATTRIBUTES); storage classpnp/storahci
  (<=22621, STOR_ADDRESS_TYPE_NVME, Debug-only) and storage.msdsm (Debug|x64). usb.usbview is
  intentionally NOT excluded: it fails on every version for a known host reason (missing
  .NET 4.7.2/4.8.1 targeting packs).

CI:
- ci.yml and ci-pr.yml: add _NT_TARGET_VERSION as a manual matrix axis (4 newest versions,
  latest-first) so each version x configuration x platform runs on its own parallel runner.
- Build-Samples.ps1 and Join-CsvReports.ps1 now write an easy-to-scan Markdown summary to
  GITHUB_STEP_SUMMARY: each build job shows counts and a failures table with the first error;
  the report job shows per-version totals and a consolidated failures list, plus the
  colour-coded sample x version HTML/CSV overview.

Co-authored-by: Copilot <[email protected]>

6 files changed, 333 insertions, 59 deletions

diff --git a/.github/scripts/Join-CsvReports.ps1 b/.github/scripts/Join-CsvReports.ps1
index 32cd9d63..b3e6cd4f 100644
--- a/.github/scripts/Join-CsvReports.ps1
+++ b/.github/scripts/Join-CsvReports.ps1
@@ -1,35 +1,209 @@
-$logsPath = Join-Path (Get-Location).Path "_logs"
+<#
+.SYNOPSIS
+    Joins the per-job Build-Samples CSV reports (one per _NT_TARGET_VERSION x configuration x
+    platform) into a single overview, and writes an easy-to-scan summary to the GitHub Actions
+    run page ($GITHUB_STEP_SUMMARY).
+
+.DESCRIPTION
+    Each build job uploads a "_logs" folder containing a report named
+        _overview.<ntTag>.<configuration>.<platform>.csv
+    with columns: Sample, <Configuration|Platform>  (one combination per file). This script:
+      * parses the _NT_TARGET_VERSION tag and combination from every report,
+      * collapses each sample's combinations into one status per version,
+      * writes _overview.all.csv / _overview.all.htm (a colour-coded sample x version matrix), and
+      * appends a Markdown summary (per-version totals + a failures table) to $GITHUB_STEP_SUMMARY
+        so failures are obvious from the run page without opening any logs.
+
+    The older 2-part name (_overview.<configuration>.<platform>.csv, no version) is still
+    understood and bucketed under the "latest" column.
+#>
+
+$logsPath       = Join-Path (Get-Location).Path "_logs"
 $reportFileName = '_overview.all'
-$idProperty = 'Sample'
-$results = $null
 
-Get-ChildItem -Path $logsPath -Filter '*.csv' | ForEach-Object {
-    $csv = Import-Csv -Path $_
-    if ($results -eq $null) {
-        $results = $csv
+if (-not (Test-Path $logsPath)) {
+    Write-Warning "No _logs directory found at $logsPath - nothing to report."
+    return
+}
+
+# --- Friendly labels for the known _NT_TARGET_VERSION build tags --------------
+$ntLabel = @{
+    '28000' = 'latest'; '26100' = '24H2'; '22621' = '22H2'; '22000' = '21H2'
+    '20348' = 'Server 2022'; '19041' = '2004'; '18362' = '1903'; '17763' = '1809'
+}
+
+# --- Load every per-job CSV ---------------------------------------------------
+# data[sample][tag][combo] = status
+$data       = @{}
+$allSamples = [System.Collections.Generic.SortedSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+$tagSet     = [System.Collections.Generic.HashSet[string]]::new()
+
+Get-ChildItem -Path $logsPath -Filter '_overview.*.csv' |
+    Where-Object { $_.Name -notlike '_overview.all.*' } |
+    ForEach-Object {
+        # _overview.<tag>.<config>.<platform>  ->  drop _overview; last two are config/platform.
+        $parts = [IO.Path]::GetFileNameWithoutExtension($_.Name).Split('.')
+        $parts = $parts[1..($parts.Count - 1)]          # drop the leading "_overview"
+        if ($parts.Count -ge 3) { $tag = ($parts[0..($parts.Count - 3)] -join '.') }
+        else                    { $tag = 'latest' }
+        [void]$tagSet.Add($tag)
+
+        Import-Csv -Path $_.FullName | ForEach-Object {
+            $sample = $_.Sample
+            if (-not $sample) { return }
+            [void]$allSamples.Add($sample)
+            if (-not $data.ContainsKey($sample)) { $data[$sample] = @{} }
+            if (-not $data[$sample].ContainsKey($tag)) { $data[$sample][$tag] = @{} }
+            foreach ($col in ($_.PSObject.Properties.Name | Where-Object { $_ -ne 'Sample' })) {
+                $data[$sample][$tag][$col] = "$($_.$col)".Trim()
+            }
+        }
     }
-    else {
-        $results = $csv | ForEach-Object {
-            $id = $_.$idProperty
-            $match = $results | Where-Object { $_.$idProperty -eq $id }
-            if ($match) {
-                $properties = $_ | Get-Member -MemberType NoteProperty | Where-Object { $_.Name -ne $idProperty } | Select-Object -ExpandProperty Name
-                $newObject = New-Object PSObject
-                # Add ID property separately to ensure it appears first
-                $newObject | Add-Member -MemberType NoteProperty -Name $idProperty -Value $_.$idProperty
-                foreach ($property in $properties) {
-                    $newObject | Add-Member -MemberType NoteProperty -Name $property -Value $_.$property
-                }
-                foreach ($property in ($match | Get-Member -MemberType NoteProperty | Where-Object { $_.Name -ne $idProperty } | Select-Object -ExpandProperty Name)) {
-                    if ($properties -notcontains $property) {
-                        $newObject | Add-Member -MemberType NoteProperty -Name $property -Value $match.$property
-                    }
-                }
-                $newObject
+
+if ($tagSet.Count -eq 0) {
+    Write-Warning "No per-job '_overview.*.csv' reports were found in $logsPath."
+    return
+}
+
+# Order versions newest-first (numeric tags descending; non-numeric last)
+$tags = $tagSet | Sort-Object @{ Expression = { if ($_ -match '^\d+$') { [int]$_ } else { 0 } }; Descending = $true }, @{ Expression = { $_ } }
+
+function Get-Status {
+    # Collapse one sample/version's combinations into a single status object.
+    param([hashtable]$Combos)
+    $c = @{ Succeeded = 0; Failed = 0; Sporadic = 0; Unsupported = 0; Excluded = 0 }
+    $details = @()
+    if ($Combos) {
+        foreach ($k in ($Combos.Keys | Sort-Object)) {
+            switch ($Combos[$k]) {
+                'Succeeded' { $c.Succeeded++ } 'Failed' { $c.Failed++ } 'Sporadic' { $c.Sporadic++ }
+                'Unsupported' { $c.Unsupported++ } 'Excluded' { $c.Excluded++ }
+            }
+            $details += "$k = $($Combos[$k])"
+        }
+    }
+    $buildable = $c.Succeeded + $c.Failed + $c.Sporadic
+    if (-not $Combos -or $Combos.Count -eq 0) { $label = 'n/a'; $klass = 'na' }
+    elseif ($buildable -eq 0) { $label = '--'; $klass = 'na' }
+    elseif ($c.Failed -eq 0 -and $c.Sporadic -eq 0) { $label = "PASS ($($c.Succeeded)/$buildable)"; $klass = 'pass' }
+    elseif ($c.Failed -eq 0) { $label = "PASS* ($($c.Succeeded + $c.Sporadic)/$buildable)"; $klass = 'flaky' }
+    elseif ($c.Failed -eq $buildable) { $label = "FAIL ($($c.Failed)/$buildable)"; $klass = 'fail' }
+    else { $label = "PARTIAL ($($c.Failed) failed / $buildable)"; $klass = 'partial' }
+    [pscustomobject]@{ Label = $label; Class = $klass; Tooltip = ($details -join ' | '); Counts = $c; Buildable = $buildable }
+}
+
+# --- Build per-version totals + the matrix ------------------------------------
+$totals = @{}; foreach ($t in $tags) { $totals[$t] = [pscustomobject]@{ S = 0; F = 0; O = 0; U = 0; E = 0; pass = 0; flaky = 0; partial = 0; fail = 0; na = 0 } }
+$failuresList = [System.Collections.ArrayList]::new()
+$csvRows = @()
+$bodyRows = New-Object System.Text.StringBuilder
+
+foreach ($sample in $allSamples) {
+    $csvRow = [ordered]@{ Sample = $sample }
+    $cells = ''
+    foreach ($t in $tags) {
+        $combos = $null
+        if ($data[$sample].ContainsKey($t)) { $combos = $data[$sample][$t] }
+        $st = Get-Status -Combos $combos
+        $tt = $totals[$t]
+        $tt.S += $st.Counts.Succeeded; $tt.F += $st.Counts.Failed; $tt.O += $st.Counts.Sporadic
+        $tt.U += $st.Counts.Unsupported; $tt.E += $st.Counts.Excluded
+        switch ($st.Class) { 'pass' { $tt.pass++ } 'flaky' { $tt.flaky++ } 'partial' { $tt.partial++ } 'fail' { $tt.fail++ } 'na' { $tt.na++ } }
+        $csvRow["$t"] = $st.Label
+        $tip = [System.Web.HttpUtility]::HtmlEncode($st.Tooltip)
+        $cells += "<td class='$($st.Class)' title='$tip'>$($st.Label)</td>"
+        if ($combos) {
+            foreach ($k in ($combos.Keys | Sort-Object)) {
+                if ($combos[$k] -eq 'Failed') { [void]$failuresList.Add([pscustomobject]@{ Sample = $sample; Version = $t; Combo = $k }) }
             }
         }
     }
+    $csvRows += [pscustomobject]$csvRow
+    $enc = [System.Web.HttpUtility]::HtmlEncode($sample)
+    [void]$bodyRows.Append("<tr><td class='sample'>$enc</td>$cells</tr>`n")
 }
 
-$results | ConvertTo-Csv | Out-File (Join-Path $logsPath "$reportFileName.csv")
-$results | ConvertTo-Html -Title "Overview" | Out-File (Join-Path $logsPath "$reportFileName.htm")
+Add-Type -AssemblyName System.Web -ErrorAction SilentlyContinue
+
+# --- CSV ----------------------------------------------------------------------
+$csvRows | Export-Csv -Path (Join-Path $logsPath "$reportFileName.csv") -NoTypeInformation
+
+# --- HTML (colour-coded sample x version matrix) ------------------------------
+$generated = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
+$sumHead = "<tr><th>_NT_TARGET_VERSION</th><th>Release</th><th>Pass</th><th>Flaky</th><th>Partial</th><th>Fail</th><th>n/a</th><th>Combos OK</th><th>Sporadic</th><th>Failed</th><th>Excluded</th><th>Pass rate</th></tr>"
+$sumRows = ''
+foreach ($t in $tags) {
+    $x = $totals[$t]; $tot = $x.pass + $x.flaky + $x.partial + $x.fail + $x.na; $elig = $tot - $x.na
+    $rate = if ($elig -gt 0) { '{0:N0}%' -f (100.0 * ($x.pass + $x.flaky) / $elig) } else { 'n/a' }
+    $rel = $ntLabel[$t]; if (-not $rel) { $rel = '' }
+    $sumRows += "<tr><td class='sample'>$t</td><td>$rel</td><td class='pass'>$($x.pass)</td><td class='flaky'>$($x.flaky)</td><td class='partial'>$($x.partial)</td><td class='fail'>$($x.fail)</td><td class='na'>$($x.na)</td><td>$($x.S)</td><td>$($x.O)</td><td>$($x.F)</td><td>$($x.E)</td><td><b>$rate</b></td></tr>`n"
+}
+$matHead = "<tr><th class='sample'>Sample</th>"
+foreach ($t in $tags) { $rel = $ntLabel[$t]; if (-not $rel) { $rel = '' }; $matHead += "<th>$t<br><span class='sub'>$rel</span></th>" }
+$matHead += "</tr>"
+
+$html = @"
+<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"/>
+<title>WDK Driver Samples - Build Overview</title>
+<style>
+ body{font-family:'Segoe UI',Arial,sans-serif;margin:24px;color:#1b1b1b}
+ h1{font-size:22px;margin-bottom:4px}h2{font-size:17px;margin-top:28px}
+ .meta{color:#555;font-size:13px;margin-bottom:8px}
+ table{border-collapse:collapse;margin-top:8px;font-size:13px}
+ th,td{border:1px solid #cfcfcf;padding:5px 9px;text-align:center}
+ th{background:#f0f3f7;position:sticky;top:0}
+ td.sample,th.sample{text-align:left;font-family:Consolas,monospace;white-space:nowrap}
+ .sub{font-weight:normal;color:#666;font-size:11px}
+ .pass{background:#c8e6c9}.flaky{background:#fff59d}.partial{background:#ffcc80}.fail{background:#ef9a9a}.na{background:#eee;color:#888}
+ .legend span{display:inline-block;padding:3px 9px;margin-right:6px;border:1px solid #cfcfcf;border-radius:3px;font-size:12px}
+</style></head><body>
+<h1>WDK Driver Samples &mdash; Build Overview</h1>
+<div class="meta">Generated: $generated &nbsp;|&nbsp; columns are <b>_NT_TARGET_VERSION</b> (library link version); hover a cell for the per-combination breakdown.</div>
+<div class="legend"><span class="pass">PASS</span><span class="flaky">PASS* (retry)</span><span class="partial">PARTIAL</span><span class="fail">FAIL</span><span class="na">-- n/a</span></div>
+<h2>Summary by _NT_TARGET_VERSION</h2>
+<table>$sumHead
+$sumRows</table>
+<h2>Sample &times; _NT_TARGET_VERSION</h2>
+<table>$matHead
+$($bodyRows.ToString())</table>
+</body></html>
+"@
+$html | Out-File -FilePath (Join-Path $logsPath "$reportFileName.htm") -Encoding UTF8
+
+# --- GitHub Actions run summary (Markdown) ------------------------------------
+if ($env:GITHUB_STEP_SUMMARY) {
+    $totalFailed = ($totals.Values | Measure-Object -Property fail -Sum).Sum + ($totals.Values | Measure-Object -Property partial -Sum).Sum
+    $icon = if ($failuresList.Count -gt 0) { ':x:' } else { ':white_check_mark:' }
+
+    $md = [System.Text.StringBuilder]::new()
+    [void]$md.AppendLine("# $icon WDK Driver Samples &mdash; Build Overview")
+    [void]$md.AppendLine()
+    [void]$md.AppendLine("Columns are **_NT_TARGET_VERSION** (the WDK library version drivers link against). Each version was built for Debug/Release x x64/arm64.")
+    [void]$md.AppendLine()
+    [void]$md.AppendLine("## Summary by _NT_TARGET_VERSION")
+    [void]$md.AppendLine("| _NT_TARGET_VERSION | Release | :white_check_mark: Pass | :warning: Flaky | :large_orange_diamond: Partial | :x: Fail | :heavy_minus_sign: n/a | Pass rate |")
+    [void]$md.AppendLine("|---|---|---:|---:|---:|---:|---:|---:|")
+    foreach ($t in $tags) {
+        $x = $totals[$t]; $tot = $x.pass + $x.flaky + $x.partial + $x.fail + $x.na; $elig = $tot - $x.na
+        $rate = if ($elig -gt 0) { '{0:N0}%' -f (100.0 * ($x.pass + $x.flaky) / $elig) } else { 'n/a' }
+        $rel = $ntLabel[$t]; if (-not $rel) { $rel = '' }
+        [void]$md.AppendLine("| ``$t`` | $rel | $($x.pass) | $($x.flaky) | $($x.partial) | $($x.fail) | $($x.na) | **$rate** |")
+    }
+    [void]$md.AppendLine()
+
+    if ($failuresList.Count -gt 0) {
+        [void]$md.AppendLine("## :x: Failures ($($failuresList.Count))")
+        [void]$md.AppendLine("| Sample | _NT_TARGET_VERSION | Config/Platform |")
+        [void]$md.AppendLine("|---|---|---|")
+        foreach ($f in ($failuresList | Sort-Object Sample, Version, Combo)) {
+            [void]$md.AppendLine("| ``$($f.Sample)`` | $($f.Version) | $($f.Combo.Replace('|','/')) |")
+        }
+        [void]$md.AppendLine()
+        [void]$md.AppendLine("> Open the matching **build** job's summary (or the ``logs-*`` artifact) for the exact compiler error.")
+    }
+    else {
+        [void]$md.AppendLine(":tada: **All combinations built successfully.**")
+    }
+
+    $md.ToString() | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+}
diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 6719270e..7983c8dd 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -9,12 +9,19 @@ on:
       - 'LICENSE'
 jobs:
   build:
-    name: Build driver samples
+    name: build ${{ matrix.nt.tag }} ${{ matrix.configuration }} ${{ matrix.platform }}
     strategy:
       fail-fast: false
       matrix:
         configuration: [Debug, Release]
         platform: [x64, arm64]
+        # _NT_TARGET_VERSION = the WDK library version drivers link against (newest first).
+        # Each { version, tag } runs as its own parallel job; trim this list to reduce CI load.
+        nt:
+          - { version: '10.0.28000', tag: '28000' }
+          - { version: '10.0.26100', tag: '26100' }
+          - { version: '10.0.22621', tag: '22621' }
+          - { version: '10.0.22000', tag: '22000' }
     runs-on: windows-2025-vs2026
     steps:
       - name: Check out repository code
@@ -38,13 +45,14 @@ jobs:
         env:
           WDS_Configuration: ${{ matrix.configuration }}
           WDS_Platform: ${{ matrix.platform }}
-          WDS_ReportFileName: _overview.${{ matrix.configuration }}.${{ matrix.platform }}
+          WDS_NtTargetVersion: ${{ matrix.nt.version }}
+          WDS_ReportFileName: _overview.${{ matrix.nt.tag }}.${{ matrix.configuration }}.${{ matrix.platform }}
 
       - name: Archive build logs and overview build reports
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: logs-${{ matrix.configuration }}-${{ matrix.platform }}
+          name: logs-${{ matrix.nt.tag }}-${{ matrix.configuration }}-${{ matrix.platform }}
           path: _logs
   
   report:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca2696d8..022ae4f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,12 +12,19 @@ on:
     - cron: '0 8 * * 6'
 jobs:
   build:
-    name: Build driver samples
+    name: build ${{ matrix.nt.tag }} ${{ matrix.configuration }} ${{ matrix.platform }}
     strategy:
       fail-fast: false
       matrix:
         configuration: [Debug, Release]
         platform: [x64, arm64]
+        # _NT_TARGET_VERSION = the WDK library version drivers link against (newest first).
+        # Each { version, tag } runs as its own parallel job; trim this list to reduce CI load.
+        nt:
+          - { version: '10.0.28000', tag: '28000' }
+          - { version: '10.0.26100', tag: '26100' }
+          - { version: '10.0.22621', tag: '22621' }
+          - { version: '10.0.22000', tag: '22000' }
     runs-on: windows-2025-vs2026
     steps:
       - name: Check out repository code
@@ -33,13 +40,14 @@ jobs:
         env:
           WDS_Configuration: ${{ matrix.configuration }}
           WDS_Platform: ${{ matrix.platform }}
-          WDS_ReportFileName: _overview.${{ matrix.configuration }}.${{ matrix.platform }}
+          WDS_NtTargetVersion: ${{ matrix.nt.version }}
+          WDS_ReportFileName: _overview.${{ matrix.nt.tag }}.${{ matrix.configuration }}.${{ matrix.platform }}
 
       - name: Archive build logs and overview build reports
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: logs-${{ matrix.configuration }}-${{ matrix.platform }}
+          name: logs-${{ matrix.nt.tag }}-${{ matrix.configuration }}-${{ matrix.platform }}
           path: _logs
 
   report:
diff --git a/Build-Samples.ps1 b/Build-Samples.ps1
index 063947b6..c58164b2 100644
--- a/Build-Samples.ps1
+++ b/Build-Samples.ps1
@@ -130,21 +130,26 @@ function Import-SampleExclusions {
           - Configurations: semicolon-separated config|platform patterns (or '*' for all)
           - Reason:         human-readable explanation
 
-        A row is only returned when BOTH of the following match the current build:
-          - its [MinBuild, MaxBuild] range includes the given build number, and
+        A row is only returned when ALL of the following match the current build:
+          - its [MinBuild, MaxBuild] range includes the given build number,
+          - its [MinNtTargetVersion, MaxNtTargetVersion] range includes the current
+            _NT_TARGET_VERSION build number (e.g. 22000 parsed from '10.0.22000'), and
           - its TargetVersions list matches the given TargetVersion. TargetVersions is
             blank/'*' for all versions, or a ';'-separated list of -like patterns
             (e.g. 'Windows8', 'Windows7;Windows8', 'Windows*').
-        Rows outside the build range, or whose TargetVersions does not match, are skipped.
+        Rows outside any range, or whose TargetVersions does not match, are skipped.
+        MinBuild/MaxBuild and MinNtTargetVersion/MaxNtTargetVersion are blank = unbounded.
     .NOTES
-        CSV format:  Path,Configurations,TargetVersions,MinBuild,MaxBuild,Reason
-        Example row: network\wlan\wdi,*,,,27100,"failure introduced in VS17.14"
-        Target-specific: somepath,*|ARM64,Windows8,,,"ARM not supported when targeting Windows 8"
+        CSV format:  Path,Configurations,TargetVersions,MinBuild,MaxBuild,MinNtTargetVersion,MaxNtTargetVersion,Reason
+        Example row:         network\wlan\wdi,*,,,27100,,,"failure introduced in VS17.14"
+        Target-specific:     somepath,*|ARM64,Windows8,,,,,"ARM not supported when targeting Windows 8"
+        NT-version-specific: somepath,*,,,,,22621,"needs an API newer than the 10.0.22621 library"
     #>
     param(
         [string]$CsvPath,
         [int]$BuildNumber,
-        [string]$TargetVersion = 'Windows10'
+        [string]$TargetVersion = 'Windows10',
+        [string]$NtTargetVersion = '10.0.28000'
     )
 
     if (-not (Test-Path $CsvPath)) {
@@ -152,6 +157,10 @@ function Import-SampleExclusions {
         return @()
     }
 
+    # The _NT_TARGET_VERSION param is the friendly build-number form (e.g. '10.0.22000');
+    # take its last dotted component for numeric range comparisons.
+    $ntBuild = [int]($NtTargetVersion -replace '.*\.', '')
+
     $exclusions = [System.Collections.ArrayList]::new()
     Import-Csv $CsvPath | ForEach-Object {
         $pattern  = $_.Path.Trim('\').Replace('\', '.').ToLower()
@@ -160,20 +169,27 @@ function Import-SampleExclusions {
         $targets  = if ([string]::IsNullOrWhiteSpace($_.TargetVersions)) { '*' } else { $_.TargetVersions }
         $minBuild = if ([string]::IsNullOrWhiteSpace($_.MinBuild)) { 0 }     else { [int]$_.MinBuild }
         $maxBuild = if ([string]::IsNullOrWhiteSpace($_.MaxBuild)) { 99999 } else { [int]$_.MaxBuild }
+        # Min/MaxNtTargetVersion columns are optional; blank or missing means "all NT versions".
+        $minNt    = if ([string]::IsNullOrWhiteSpace($_.MinNtTargetVersion)) { 0 }       else { [int]$_.MinNtTargetVersion }
+        $maxNt    = if ([string]::IsNullOrWhiteSpace($_.MaxNtTargetVersion)) { 9999999 } else { [int]$_.MaxNtTargetVersion }
 
-        # TargetVersion is constant for the whole run, so (like the build number) filter here.
+        # TargetVersion and _NT_TARGET_VERSION are constant for the whole run, so (like the
+        # build number) filter these rows out here at load time.
         $targetMatches = $targets.Split(';') | Where-Object { $TargetVersion -like $_.Trim() }
 
         if (-not $targetMatches) {
             Write-Verbose "Exclusion skipped: '$pattern' - target '$TargetVersion' not in '$targets'"
         }
+        elseif ($ntBuild -lt $minNt -or $ntBuild -gt $maxNt) {
+            Write-Verbose "Exclusion skipped: '$pattern' - _NT_TARGET_VERSION $ntBuild outside [$minNt, $maxNt]"
+        }
         elseif ($minBuild -le $BuildNumber -and $BuildNumber -le $maxBuild) {
             [void]$exclusions.Add([PSCustomObject]@{
                 Pattern        = $pattern
                 Configurations = $configs
                 Reason         = $_.Reason
             })
-            Write-Verbose "Exclusion applied: '$pattern' configs='$configs' targets='$targets' reason='$($_.Reason)'"
+            Write-Verbose "Exclusion applied: '$pattern' configs='$configs' targets='$targets' ntRange=[$minNt,$maxNt] reason='$($_.Reason)'"
         }
         else {
             Write-Verbose "Exclusion skipped: '$pattern' - build $BuildNumber outside [$minBuild, $maxBuild]"
@@ -457,7 +473,7 @@ $ntTargetVersionCode = $ntTargetVersionCodes[$NtTargetVersion]
 #  Step 6 - Load Exclusions
 # =============================================================================
 
-$exclusions = Import-SampleExclusions -CsvPath (Join-Path $root 'exclusions.csv') -BuildNumber $buildNumber -TargetVersion $TargetVersion
+$exclusions = Import-SampleExclusions -CsvPath (Join-Path $root 'exclusions.csv') -BuildNumber $buildNumber -TargetVersion $TargetVersion -NtTargetVersion $NtTargetVersion
 
 # =============================================================================
 #  Step 7 - Print Build Plan
@@ -725,3 +741,55 @@ $sortedResults | ConvertTo-Html -Title "WDK Sample Build Overview - TargetVersio
 if (-not $env:BUILD_BUILDID -and [Environment]::UserInteractive) {
     Invoke-Item $reportHtmlPath
 }
+
+# =============================================================================
+#  Step 12 - GitHub Actions job summary (CI only; no-op when run locally)
+# =============================================================================
+# When $GITHUB_STEP_SUMMARY is set, emit an easy-to-scan markdown summary for the run
+# page: a status header, a counts table, and (if any) a table of failures with the first
+# compiler/linker error so problems are obvious without opening the logs.
+if ($env:GITHUB_STEP_SUMMARY) {
+    $icon = if ($buildState.Failed -gt 0) { ':x:' } elseif ($buildState.Sporadic -gt 0) { ':warning:' } else { ':white_check_mark:' }
+    $cfgLabel = "$($Configurations -join ',')|$($Platforms -join ',')"
+
+    $md = [System.Text.StringBuilder]::new()
+    [void]$md.AppendLine("## $icon ``$cfgLabel`` &nbsp;&middot;&nbsp; _NT_TARGET_VERSION ``$NtTargetVersion``")
+    [void]$md.AppendLine()
+    [void]$md.AppendLine("Environment **$($buildEnv.Name)** &middot; WDK build **$buildNumber** &middot; TargetVersion **$TargetVersion** &middot; **$($sampleSet.Count)** samples &middot; $($elapsed.Minutes)m $($elapsed.Seconds)s")
+    [void]$md.AppendLine()
+    [void]$md.AppendLine("| :white_check_mark: Succeeded | :x: Failed | :warning: Sporadic | :heavy_minus_sign: Excluded | :grey_question: Unsupported |")
+    [void]$md.AppendLine("|---:|---:|---:|---:|---:|")
+    [void]$md.AppendLine("| $($buildState.Succeeded) | $($buildState.Failed) | $($buildState.Sporadic) | $($buildState.Excluded) | $($buildState.Unsupported) |")
+    [void]$md.AppendLine()
+
+    if ($buildState.FailSet.Count -gt 0) {
+        [void]$md.AppendLine("<details open><summary><b>:x: $($buildState.FailSet.Count) failed</b></summary>")
+        [void]$md.AppendLine()
+        [void]$md.AppendLine("| Sample | Config/Platform | First error |")
+        [void]$md.AppendLine("|---|---|---|")
+        foreach ($entry in ($buildState.FailSet | Sort-Object)) {
+            if ($entry -match '^(?<name>.*)\s+(?<config>\w+)\|(?<platform>\w+)$') {
+                $fName = $Matches.name; $fConfig = $Matches.config; $fPlatform = $Matches.platform
+                $errLog = Join-Path $LogFilesDirectory "$fName.$fConfig.$fPlatform.0.err"
+                $msg = ''
+                if (Test-Path $errLog) {
+                    $line = Get-Content $errLog | Where-Object { $_ -match ': (error|fatal error) ' } | Select-Object -First 1
+                    if ($line -match ':\s*((?:fatal )?error\s.+?)\s*\[[^\[]*\]\s*$') { $msg = $Matches[1] } else { $msg = $line }
+                }
+                $msg = ("$msg" -replace '\|', '\|').Trim()
+                if ($msg.Length -gt 180) { $msg = $msg.Substring(0, 177) + '...' }
+                [void]$md.AppendLine("| ``$fName`` | $fConfig/$fPlatform | $msg |")
+            }
+        }
+        [void]$md.AppendLine("</details>")
+        [void]$md.AppendLine()
+    }
+
+    if ($buildState.SporadicSet.Count -gt 0) {
+        $sp = ($buildState.SporadicSet | Sort-Object | ForEach-Object { "``$_``" }) -join ', '
+        [void]$md.AppendLine(":warning: **Sporadic** (passed on retry): $sp")
+        [void]$md.AppendLine()
+    }
+
+    $md.ToString() | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+}
diff --git a/Building-Locally.md b/Building-Locally.md
index 6619c3fe..8c11d012 100644
--- a/Building-Locally.md
+++ b/Building-Locally.md
@@ -162,7 +162,7 @@ configuration/platform combinations, an optional WDK build-number range, and an
 set of target versions:
 
 ```
-Path,Configurations,TargetVersions,MinBuild,MaxBuild,Reason
+Path,Configurations,TargetVersions,MinBuild,MaxBuild,MinNtTargetVersion,MaxNtTargetVersion,Reason
 ```
 
 | Column           | Meaning                                                                                  |
@@ -171,16 +171,24 @@ Path,Configurations,TargetVersions,MinBuild,MaxBuild,Reason
 | `Configurations` | `;`-separated `Config\|Platform` patterns, or `*` for all (e.g. `*\|ARM64`, `Debug\|x64`). |
 | `TargetVersions` | `;`-separated `-like` patterns matched against `-TargetVersion`; blank or `*` = all (e.g. `Windows8`, `Windows7;Windows8`, `Windows*`). |
 | `MinBuild`/`MaxBuild` | Inclusive WDK build-number range; blank = unbounded.                                |
+| `MinNtTargetVersion`/`MaxNtTargetVersion` | Inclusive `-NtTargetVersion` build-number range (e.g. `22621` matches `10.0.22621`); blank = unbounded. Use this for samples that fail only when linking against older libraries. |
 | `Reason`         | Human-readable explanation (keep this column last; quote it if it contains commas).      |
 
 A row is applied only when every populated condition matches the current run (path,
-configuration/platform, build-number range, and target version are AND-ed together). Leave
-`TargetVersions` blank to exclude regardless of target version (the default for most rows).
+configuration/platform, WDK build-number range, NT target-version range, and target version
+are AND-ed together). Leave a column blank to ignore that dimension (the default for most rows).
 
 For example, to exclude all ARM platforms only when building for Windows 8:
 
 ```
-somepath,*|ARM64,Windows8,,,"ARM not supported when targeting Windows 8"
+somepath,*|ARM64,Windows8,,,,,"ARM not supported when targeting Windows 8"
+```
+
+Or to exclude a sample (Debug builds only) when linking against the `10.0.22621` library set
+or older, because it uses a newer API:
+
+```
+somepath,Debug|*,,,,,22621,uses an API newer than the 10.0.22621 library
 ```
 
 ---
diff --git a/exclusions.csv b/exclusions.csv
index b3d8a50a..566c685d 100644
--- a/exclusions.csv
+++ b/exclusions.csv
@@ -1,12 +1,20 @@
-Path,Configurations,TargetVersions,MinBuild,MaxBuild,Reason
-audio\acx\samples\audiocodec\driver,*,,,22621,Only NI: error C1083: Cannot open include file: 'acx.h': No such file or directory
-general\dchu\osrfx2_dchu_extension_loose,*|x64,,,22621,Only NI: Only x64: Fails to build
-general\dchu\osrfx2_dchu_extension_tight,*|x64,,,22621,Only NI: Only x64: Fails to build
-network\trans\WFPSampler,Debug|ARM64,,,22621,Only NI: Only ARM: Fails to build on EWDK 22621 with VS 17.1.5 - CallingConvention=StdCall not supported
-prm,*,,,22621,Only NI: Not supported on NI.
-powerlimit\plclient,*,,,22621,Only NI: Not supported on NI.
-powerlimit\plpolicy,*,,,22621,Only NI: Not supported on NI.
-general\pcidrv,*,,26100,,"failure introduced in VS17.14, suppressed until fix"
-serial\serial,*,,26100,,"failure introduced in VS17.14, suppressed until fix"
-network\wlan\wdi,*,,26100,,"failure introduced in VS17.14, suppressed until fix"
-tools\kasan\samples\kasandemo-wdm,*|x64,,26100,,"failure introduced in VS17.14, suppressed until fix"
+Path,Configurations,TargetVersions,MinBuild,MaxBuild,MinNtTargetVersion,MaxNtTargetVersion,Reason
+audio\acx\samples\audiocodec\driver,*,,,22621,,,Only NI: error C1083: Cannot open include file: 'acx.h': No such file or directory
+general\dchu\osrfx2_dchu_extension_loose,*|x64,,,22621,,,Only NI: Only x64: Fails to build
+general\dchu\osrfx2_dchu_extension_tight,*|x64,,,22621,,,Only NI: Only x64: Fails to build
+network\trans\WFPSampler,Debug|ARM64,,,22621,,,Only NI: Only ARM: Fails to build on EWDK 22621 with VS 17.1.5 - CallingConvention=StdCall not supported
+prm,*,,,22621,,,Only NI: Not supported on NI.
+powerlimit\plclient,*,,,22621,,,Only NI: Not supported on NI.
+powerlimit\plpolicy,*,,,22621,,,Only NI: Not supported on NI.
+general\pcidrv,*,,26100,,,,"failure introduced in VS17.14, suppressed until fix"
+serial\serial,*,,26100,,,,"failure introduced in VS17.14, suppressed until fix"
+network\wlan\wdi,*,,26100,,,,"failure introduced in VS17.14, suppressed until fix"
+tools\kasan\samples\kasandemo-wdm,*|x64,,26100,,,,"failure introduced in VS17.14, suppressed until fix"
+audio\sysvad,*,,,,,22000,_NT_TARGET_VERSION: KSJACK_DESCRIPTION3 undeclared; audio jack descriptor v3 was added in 22H2 (10.0.22621)
+network\netadaptercx\netvadapter,*,,,,,22621,_NT_TARGET_VERSION: requests an NDIS/DDI version newer than the linked library (C1189 wrong NDIS or DDI version)
+network\wlan\wificx,*,,,,,22621,_NT_TARGET_VERSION: requests an NDIS/DDI version newer than the linked library (C1189 wrong NDIS or DDI version)
+powerlimit\plclient,*,,,,,22621,_NT_TARGET_VERSION: POWER_LIMIT_ATTRIBUTES not declared in the older library (C2061)
+powerlimit\plpolicy,*,,,,,22621,_NT_TARGET_VERSION: POWER_LIMIT_ATTRIBUTES not declared in the older library (C2061)
+storage\class\classpnp,Debug|*,,,,,22621,_NT_TARGET_VERSION: STOR_ADDRESS_TYPE_NVME undeclared in the older library (C2065); Debug only
+storage\miniports\storahci,Debug|*,,,,,22621,_NT_TARGET_VERSION: STOR_ADDRESS_TYPE_NVME undeclared in the older library (C2065); Debug only
+storage\msdsm,Debug|x64,,,,,22621,_NT_TARGET_VERSION: STOR_ADDRESS_TYPE_NVME undeclared in the older library (C2065); Debug|x64 only