diff --git a/.claude/commands/release.md b/.claude/commands/release.md
index 4243580cb..601686e64 100644
--- a/.claude/commands/release.md
+++ b/.claude/commands/release.md
@@ -121,7 +121,7 @@ Present as a prioritized list — no AUQ needed, just a summary the user can act
 Update the release tracking issue checkboxes:
 
 1. Run `gh issue view {number} --json body` and capture the output. Parse the JSON to extract the `body` field, then write it to `/tmp/release-issue-body.md` using the Write tool (not shell redirection).
-2. Read the file with the Read tool. Each `/release`-managed checkbox in the template has an HTML comment label like `<!-- release:core -->`, `<!-- release:finalize -->`, or `<!-- release:package -->`. To mark a step complete, find the line containing the matching label and change its `- [ ]` to `- [x]`. Use the Edit tool to write the updated body back to the file. In Phase 2 Release readiness, mark `release:core` complete.
+2. Read the file with the Read tool. Each `/release`-managed checkbox in the template has an HTML comment label like `<!-- release:core -->`, `<!-- release:finalize -->`, `<!-- release:package -->`, or `<!-- release:powerbi -->`. To mark a step complete, find the line containing the matching label and change its `- [ ]` to `- [x]`. Use the Edit tool to write the updated body back to the file. In Phase 2 Release readiness, mark `release:core` complete.
 3. Run `gh issue edit {number} --body-file /tmp/release-issue-body.md` to push the updates.
 
 Then present a summary and next action via AskUserQuestion:
@@ -148,14 +148,33 @@ pwsh -Command "./src/scripts/Package-Toolkit.ps1 -Build -CopyFiles"
 
 If it fails, show the error and ask whether to investigate or skip.
 
+### Package Power BI
+
+Power BI packaging reports its own state and saves demo reports with Power BI Desktop, which only runs on Windows.
+
+On Windows, tell the user not to use the mouse or keyboard until it finishes, then run:
+
+```bash
+pwsh -Command "./src/scripts/Package-PowerBI.ps1 -Unattended"
+```
+
+On other platforms, run `pwsh -Command "./src/scripts/Package-PowerBI.ps1 -Status"` and tell the user to run `Package-PowerBI.ps1 -Unattended` on a Windows machine with Power BI Desktop, then say "done".
+
+It takes about an hour (roughly 10 minutes per demo report). If it stops because the reports were built from a test open data URL ("isn't permanent"), rerun it once with `-Build` to rebuild against the main branch; don't use `-Build` otherwise, because it discards reports that are already saved.
+
+Relay its status output verbatim — it says exactly which step is next. If a report can't be saved automatically, relay the failed step and screenshot path, tell the user to run `Package-PowerBI.ps1 -Open` and save that project as PBIX (refresh, Save as PBIX in `release/pbix`, sensitivity "Public"), then say "done" so you can rerun the command to validate and package.
+
+If validation fails, show the reported issues verbatim. Each one names the file and the fix; don't guess at causes.
+
+Do not proceed until all three files exist: PowerBI-kql.zip, PowerBI-storage.zip, and PowerBI-demo.zip.
+
 ### Manual steps reminder
 
 After packaging succeeds, inform the user of remaining manual steps documented in the release checklist issue (include a link):
 
-1. Power BI packaging
-2. Publish release
-3. Publish announcements
+1. Publish release
+2. Publish announcements
 
 ### Final issue update
 
-Update the release tracking issue checkboxes for finalize-phase items using the same label-based process as Release readiness. Mark `release:finalize` and `release:package` complete. Then report completion and wish the user well.
+Update the release tracking issue checkboxes for finalize-phase items using the same label-based process as Release readiness. Mark `release:finalize` and `release:package` complete. Mark `release:powerbi` complete only when all three Power BI files exist. Then report completion and wish the user well.
diff --git a/.github/ISSUE_TEMPLATE/-internal-only--release-checklist.md b/.github/ISSUE_TEMPLATE/-internal-only--release-checklist.md
index 75c7f3599..1ee3e6a61 100644
--- a/.github/ISSUE_TEMPLATE/-internal-only--release-checklist.md
+++ b/.github/ISSUE_TEMPLATE/-internal-only--release-checklist.md
@@ -110,15 +110,18 @@ Status icons:
     > _This step is optional, but can catch issues earlier. You can also add the `-Build` parameter to the publish command in the next step._
   - Ensure all tests pass: `<root>/src/scripts/Test-PowerShell -Unit -Integration`
 - [ ] <!-- release:package --> Package all release files (except Power BI): `<root>/src/scripts/Package-Toolkit.ps1 -Build -CopyFiles` script
-- [ ] Package Power BI files
-  - [ ] Run `Package-Toolkit.ps1 -OpenPBI` script.
-  - [ ] Save and close each Power BI project:
-    - Select the `<root>/release/pbix` folder.
-    - Change the file extension to PBIX.
-    - When prompted, set the sensitivity to "Public".
-    - Manually remove unused queries based on what's documented in Build-PowerBI.ps1 ~line 120.
-    - Verify all pages, switch to the Get started page, and save again.
-  - [ ] Run `Package-Toolkit -ZipPBI` script.
+- [ ] Confirm the data source saved in the Power BI semantic models points at the current demo hub.
+- [ ] Confirm the demo hub is on this release and has current data: `<root>/src/scripts/Deploy-Demo.ps1 -Check`
+  - If it isn't, update it with `Deploy-Demo.ps1` and wait for ingestion before packaging Power BI.
+- [ ] <!-- release:powerbi --> Package Power BI files on Windows: `<root>/src/scripts/Package-PowerBI.ps1 -Unattended`
+  > _Builds, saves demo PBIX files with Power BI Desktop, validates, and packages. Takes about an hour. Don't use the mouse or keyboard while it runs. If it stops because the reports were built from a test open data URL, rerun once with `-Build`._
+  >
+  > _First, sign in to Power BI Desktop and refresh one demo project by hand so the data source credentials are stored and the "Public" sensitivity label is available. The command can't sign in or answer a credential prompt._
+  - If a report can't be saved automatically, the command names the step that failed and saves a screenshot. Save that report by hand, then rerun the command:
+    - Run `Package-PowerBI.ps1 -Open` to open the projects that need to be saved.
+    - Refresh the report, select **File** > **Save as**, keep the `<root>/release/pbix` folder, change the file type to PBIX, and set the sensitivity to "Public".
+    > _Queries are already trimmed and the Get started page is already selected. There is nothing else to change._
+  - [ ] Confirm all 3 files were created: PowerBI-kql.zip, PowerBI-storage.zip, and PowerBI-demo.zip.
 - [ ] Check the docs for broken links:
   - Create a personal fork of the main repo.
   - If you already have one, update it to the latest.
diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index 1702ee02d..7fd648f3b 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -11,6 +11,12 @@ on:
       - 'src/templates/finops-hub/**/timeZones.bicep'
       - 'docs/deploy/finops-hub-latest.json'
       - 'docs/deploy/finops-hub-preview.json'
+      # Power BI report definitions and build scripts are covered by PowerBIReports.Tests.ps1 and Build-PowerBI.Tests.ps1
+      - 'src/power-bi/kql/**'
+      - 'src/power-bi/storage/**'
+      - 'src/power-bi/reports.json'
+      - 'src/scripts/Build-PowerBI.ps1'
+      - 'src/scripts/Package-PowerBI.ps1'
 jobs:
   run_pester_tests:
     name: Pester
diff --git a/docs-mslearn/toolkit/changelog.md b/docs-mslearn/toolkit/changelog.md
index 6ca4dd7c3..ad350f208 100644
--- a/docs-mslearn/toolkit/changelog.md
+++ b/docs-mslearn/toolkit/changelog.md
@@ -3,7 +3,7 @@ title: FinOps toolkit changelog
 description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more.
 author: MSBrett
 ms.author: brettwil
-ms.date: 09/11/2026
+ms.date: 10/14/2026
 ms.topic: reference
 ms.service: finops
 ms.subservice: finops-toolkit
@@ -133,8 +133,13 @@ _Released June 2026_
 - **Changed**
   - Updated report labels and documentation to use current FinOps Framework capability names, including Usage optimization and Governance, policy, and risk ([#2170](https://github.com/microsoft/finops-toolkit/pull/2170)).
 - **Fixed**
+  - Fixed report templates opening with a preconfigured demo data source. Storage and cluster settings are now empty when you open a template.
+  - Fixed storage report refresh errors for exports using earlier FOCUS versions, which don't have the `CapacityReservationId` and `CapacityReservationStatus` columns. They're now added as empty columns, like `AvailabilityZone` already was.
+  - Fixed the managed disks table on the **Virtual machines** page of the [Governance](power-bi/governance.md) report, which showed an error because the report template didn't include the disks data.
   - Fixed Power BI storage report refresh errors caused by ISO 8601 duration `x_SkuTerm` values (like `P3Y`) and empty strings in cost exports ([#2174](https://github.com/microsoft/finops-toolkit/issues/2174)).
   - Paginate Azure Resource Graph queries by subscription to mitigate [payload size limit](help/errors.md#response-payload-size-is-and-has-exceeded-the-limit) errors in the [Governance](power-bi/governance.md) and [Workload optimization](power-bi/workload-optimization.md) reports ([#1768](https://github.com/microsoft/finops-toolkit/issues/1768)). Queries still surface a payload size error (rather than silently returning truncated results) if a single batch of subscriptions exceeds the limit; see [Reduce the batch size](help/errors.md#option-1-reduce-the-batch-size) for the mitigation. As part of this change, the `AdvisorRecommendations` and `AdvisorReservationRecommendations` tables now return complete (non-truncated) results per batch, matching every other batched table; previously these two tables silently dropped rows beyond the payload limit instead of erroring.
+  - Fixed the [Governance](power-bi/governance.md) report template missing the policy definitions query.
+  - Fixed report templates showing tables in the model diagram that the report doesn't use.
 
 ### [FinOps workbooks](workbooks/finops-workbooks-overview.md) v15
 
diff --git a/docs-wiki/Build-and-test.md b/docs-wiki/Build-and-test.md
index 8410afcd9..c151ef9b3 100644
--- a/docs-wiki/Build-and-test.md
+++ b/docs-wiki/Build-and-test.md
@@ -132,16 +132,23 @@ The Build-PowerShell script calls an Invoke-Build task internally.
 
 ### Building Power BI reports
 
-Power BI reports cannot be built automatically. Generating PBIT and PBIX files must be done manually:
-
-1. Open the desired Power BI report.
-2. Save the report as a `.pbix` file using the same name in the `releases` folder.
-3. Remove unnecessary queries.
-4. Remove setup instructions for unnecessary parameters.
-5. Remove unnecessary parameters.
-6. Save the report again.
-7. Copy the first paragraph description from the main page.
-8. Save the report as a `.pbit` file using the copied description and add "To learn more, see https://aka.ms/ftk/<report-name-no-spaces>".
+Run [Build-PowerBI](../src/scripts/README.md#-build-powerbi) to generate the Power BI release artifacts:
+
+```powershell
+cd <root>/src/scripts
+./Build-PowerBI
+```
+
+This generates two things from a single prune, so the template and the demo report can't drift:
+
+- PBIT templates in `release/pbit`, zipped into `PowerBI-kql.zip` and `PowerBI-storage.zip`.
+- PBIP projects for demo reports in `release/pbix`, each containing only the tables, relationships, and queries that report needs.
+
+The tables and queries each report keeps are listed in [src/power-bi/reports.json](../src/power-bi/reports.json). When a report starts using a new table or query, add it there. The build and the `PowerBIReports` lint test fail when a visual or query uses something the report doesn't keep.
+
+Demo projects keep the data source saved in the semantic model. They read open data from the `main` branch, because the release URL resolves to the last published release and doesn't have open data files added during the release being built. Templates always ship with the data source set to null and the release open data URL. Only permanent URLs are accepted, because the URL ships inside the demo reports. To test before the merge to `main`, add `-TestOpenDataUrl` and pass a branch with `-OpenDataUrl`. Reports built that way are not packaged.
+
+Demo PBIX files need Power BI Desktop to load and save them. On Windows, run [Package-PowerBI](../src/scripts/README.md#-package-powerbi) `-Unattended` to save, validate, and package them automatically.
 
 ### Building documentation
 
diff --git a/docs-wiki/Release-process.md b/docs-wiki/Release-process.md
index 55deb704f..0d50fd3e0 100644
--- a/docs-wiki/Release-process.md
+++ b/docs-wiki/Release-process.md
@@ -121,21 +121,28 @@ Once the above requirements have been met, the feature branch can be merged into
 
       > _The documentation site may take 5 minutes to update after the merge is committed. If not updated, look at [GitHub actions](../actions/workflows/pages/pages-build-deployment) to see if there are any failures._
 
-   6. Run `Package-Toolkit -Build -PowerBI` script.
-      - For each Power BI report:
-        1. Save the file as a PBIX file to the release folder.
-        2. Change the sensitivity to **Public**. If the option is disabled, close the file and reopen it.
-           > ⚠️ _Power BI does not remember the sensitivity setting for Power BI projects so this needs to be done for each release. If not done, the report will not open for anyone outside of Microsoft._
-        3. Update the version on the **Get started** tab.
-        4. For the Cost summary and Data ingestion reports, remove the following from the Transform data (query editor):
-           1. Delete both **Recommendations\*** queries.
-           2. Delete the **InstanceSizeFlexibility** query.
-           3. Open the **▶️ START HERE** query in the advanced editor and remove connector settings and generated rows in the table from the separator line to the end.
-        5. For the Cost summary and Rate optimization reports, remove the following from the Transform data (query editor):
-           1. Delete all **Hub\*** queries.
-        6. Save PBIX again in the release folder.
-           > ⚠️ _**DO NOT** save the above changes back to the Power BI project files!_
-        7. Copy the first paragraph from the **Get started** page and export a template (PBIT file) in the release folder. Use the copied text for the description and add "Learn more at https://aka.ms/ftk/{report-name}" as a separate paragraph in the description.
+   6. Package the Power BI files on Windows with Power BI Desktop installed:
+
+      ```powershell
+      cd <root>/src/scripts
+      ./Package-PowerBI -Unattended
+      ```
+
+      > _Builds the templates, saves each demo report as a PBIX file with Power BI Desktop, validates the files, and packages them. Takes about an hour. Don't use the mouse or keyboard while it runs. If it stops because the reports were built from a test open data URL, rerun once with `-Build`._
+      >
+      > _First, sign in to Power BI Desktop and refresh one demo project from `<root>/release/pbix` by hand. That stores the data source credentials and makes the **Public** sensitivity label available. The command can't sign in or answer a credential prompt: a sign-in window stops it right away, and missing credentials fail the refresh._
+      >
+      > ⚠️ _If the sensitivity label isn't **Public**, the report will not open for anyone outside of Microsoft. Validation fails when a demo report has any other label._
+
+      If a report can't be saved automatically, the command names the step that failed and saves a screenshot next to the PBIX file. Save that report by hand, then rerun the command:
+
+      1. Run `./Package-PowerBI -Open` to open the projects that still need to be saved.
+      2. Refresh the report so demo data is loaded.
+      3. Select **File** > **Save as**, keep the `<root>/release/pbix` folder, and change the file type to PBIX.
+      4. Change the sensitivity to **Public**. If the option is disabled, close the file and reopen it.
+         > _Queries are already trimmed and the **Get started** page is already selected. There is nothing else to change._
+
+      Confirm all 3 files were created: PowerBI-kql.zip, PowerBI-storage.zip, and PowerBI-demo.zip.
    7. Tag and publish a [new release](../releases/new):
       1. Create a tag on publish using the "vX.X" format.
       2. Set the **Target** to `main`.
diff --git a/src/power-bi/README.md b/src/power-bi/README.md
index 9cbc3ca4c..f521a01f9 100644
--- a/src/power-bi/README.md
+++ b/src/power-bi/README.md
@@ -17,7 +17,7 @@ Power BI reports use [Tabular Model Definition Language (TMDL)](https://learn.mi
 3. Enable the following features:
    1. Power BI Project (.pbip) save option
    2. Store semantic model using TMDL format
-4. **DO NOT** enable the "Store reports using enhanced metadata format (PBIR)"
+4. The "Store reports using enhanced metadata format (PBIR)" setting no longer applies. PBIR has been generally available and the default report format since September 2026, and Power BI Desktop converts reports to it when saving. Power BI Desktop keeps a backup of the previous format for 30 days under `%USERPROFILE%\Microsoft\Power BI Desktop Store App\TempSaves\Backups`.
 5. Select the **OK** button to save settings
 6. Restart Power BI
 
@@ -65,6 +65,11 @@ Power BI reports in the FinOps toolkit must adhere to the following guidelines:
    2. Queries should all be a the root **FinOps toolkit** folder.
       1. All queries should use the same settings. Do not duplicate properties that can be shared.
 7. All text (including report, page, and column names) should follow the [content guidelines](../../docs-wiki/Coding-guidelines.md#-content-strings-and-microcopy).
+8. The data source saved in the semantic model is the demo hub, which is what demo reports connect to. Update it when the demo hub changes. Templates always ship with it set to null.
+9. Every table and query a report uses must be listed for that report in [reports.json](./reports.json).
+   1. Reports share one semantic model per data source. The release build removes everything a report doesn't list, so an unlisted table shows up as a broken visual or refresh error.
+   2. Prefix a name with `[kql]` or `[storage]` when only one report type uses it.
+   3. The `PowerBIReports` lint test fails when a visual uses a table or column the report doesn't list, or a list entry names something that doesn't exist. It doesn't check which tables a kept query or measure depends on; that check runs in `Build-PowerBI` at release time, so list everything a query references.
 
 > [!NOTE]
 > Remember: These are general rules of thumb for consistency. They are not set in stone. Please propose updates by submitting a PR, starting a discussion, or creating an issue. In general, use your best judgement to make the report as useful as possible. We just want everything to feel consistent and familiar.
diff --git a/src/power-bi/kql/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl b/src/power-bi/kql/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl
index 2dab7934a..5de53c619 100644
--- a/src/power-bi/kql/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl
+++ b/src/power-bi/kql/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl
@@ -380,14 +380,6 @@ table AdvisorReservationRecommendations
 
 		annotation SummarizationSetBy = Automatic
 
-	column 'properties.extendedProperties.Region'
-		dataType: string
-		lineageTag: 68593266-9950-4caf-9522-ccfcbaa5d5e3
-		summarizeBy: none
-		sourceColumn: properties.extendedProperties.Region
-
-		annotation SummarizationSetBy = Automatic
-
 	column 'properties.extendedProperties.commitment'
 		dataType: string
 		lineageTag: e0b87d0c-8c42-4354-b85a-5fc93d4af06a
@@ -469,11 +461,10 @@ table AdvisorReservationRecommendations
 				      ['properties.extendedProperties.DatabaseSize'] = properties.extendedProperties.DatabaseSize,
 				      ['properties.extendedProperties.DatabaseName'] = properties.extendedProperties.DatabaseName,
 				      ['properties.extendedProperties.ServerName'] = properties.extendedProperties.ServerName,
-				      ['properties.extendedProperties.Region'] = properties.extendedProperties.Region,
 				      ['properties.extendedProperties.displaySKU'] = properties.extendedProperties.displaySKU,
 				      ['properties.extendedProperties.displayQty'] = toint(properties.extendedProperties.displayQty),
 				      ['properties.extendedProperties.location'] = properties.extendedProperties.location,
-				      ['properties.extendedProperties.region'] = properties.extendedProperties.region,
+				      ['properties.extendedProperties.region'] = coalesce(tostring(properties.extendedProperties.region), tostring(properties.extendedProperties.Region)),
 				      ['properties.extendedProperties.vmSize'] = properties.extendedProperties.vmSize,
 				      ['properties.extendedProperties.subId'] = properties.extendedProperties.subId,
 				      ['properties.extendedProperties.scope'] = properties.extendedProperties.scope,
@@ -496,7 +487,7 @@ table AdvisorReservationRecommendations
 				  NullHandling =
 				    if Source = null then
 							#table(
-								{ "id", "name", "properties.recommendationTypeId", "properties.shortDescription", "properties.resourceMetadata", "properties.suppressionIds", "properties.impactedField", "properties.impactedValue", "properties.lastUpdated", "properties.category", "properties.metadata", "properties.impact", "properties.shortDescription.problem", "properties.shortDescription.solution", "properties.extendedProperties.ObservationPeriodStartDate", "properties.extendedProperties.ObservationPeriodEndDate", "properties.extendedProperties.reservedResourceType", "properties.extendedProperties.annualSavingsAmount", "properties.extendedProperties.targetResourceCount", "properties.extendedProperties.HasRecommendation", "properties.extendedProperties.savingsCurrency", "properties.extendedProperties.IsInReplication", "properties.extendedProperties.Recommended_DTU", "properties.extendedProperties.Recommended_SKU", "properties.extendedProperties.ResourceGroup", "properties.extendedProperties.lookbackPeriod", "properties.extendedProperties.savingsAmount", "properties.extendedProperties.DatabaseSize", "properties.extendedProperties.DatabaseName", "properties.extendedProperties.ServerName", "properties.extendedProperties.Region", "properties.extendedProperties.displaySKU", "properties.extendedProperties.displayQty", "properties.extendedProperties.location", "properties.extendedProperties.region", "properties.extendedProperties.vmSize", "properties.extendedProperties.subId", "properties.extendedProperties.scope", "properties.extendedProperties.term", "properties.extendedProperties.sku", "properties.extendedProperties.qty", "properties.extendedProperties.commitment", "properties.extendedProperties.currentSku", "properties.extendedProperties.targetSku", "properties.extendedProperties.recommendationMessage", "properties.resourceMetadata.resourceId", "properties.resourceMetadata.singular", "properties.resourceMetadata.plural", "properties.resourceMetadata.action", "properties.resourceMetadata.source", "recommendedActions", "SortOrder" },
+								{ "id", "name", "properties.recommendationTypeId", "properties.shortDescription", "properties.resourceMetadata", "properties.suppressionIds", "properties.impactedField", "properties.impactedValue", "properties.lastUpdated", "properties.category", "properties.metadata", "properties.impact", "properties.shortDescription.problem", "properties.shortDescription.solution", "properties.extendedProperties.ObservationPeriodStartDate", "properties.extendedProperties.ObservationPeriodEndDate", "properties.extendedProperties.reservedResourceType", "properties.extendedProperties.annualSavingsAmount", "properties.extendedProperties.targetResourceCount", "properties.extendedProperties.HasRecommendation", "properties.extendedProperties.savingsCurrency", "properties.extendedProperties.IsInReplication", "properties.extendedProperties.Recommended_DTU", "properties.extendedProperties.Recommended_SKU", "properties.extendedProperties.ResourceGroup", "properties.extendedProperties.lookbackPeriod", "properties.extendedProperties.savingsAmount", "properties.extendedProperties.DatabaseSize", "properties.extendedProperties.DatabaseName", "properties.extendedProperties.ServerName", "properties.extendedProperties.displaySKU", "properties.extendedProperties.displayQty", "properties.extendedProperties.location", "properties.extendedProperties.region", "properties.extendedProperties.vmSize", "properties.extendedProperties.subId", "properties.extendedProperties.scope", "properties.extendedProperties.term", "properties.extendedProperties.sku", "properties.extendedProperties.qty", "properties.extendedProperties.commitment", "properties.extendedProperties.currentSku", "properties.extendedProperties.targetSku", "properties.extendedProperties.recommendationMessage", "properties.resourceMetadata.resourceId", "properties.resourceMetadata.singular", "properties.resourceMetadata.plural", "properties.resourceMetadata.action", "properties.resourceMetadata.source", "recommendedActions", "SortOrder" },
 								{}
 							)
 				    else Source,
diff --git a/src/power-bi/reports.json b/src/power-bi/reports.json
new file mode 100644
index 000000000..de294f101
--- /dev/null
+++ b/src/power-bi/reports.json
@@ -0,0 +1,172 @@
+{
+  "$comment": [
+    "Build settings for each Power BI report, used by src/scripts/Build-PowerBI.ps1.",
+    "description: Template description shown when the PBIT file is opened.",
+    "tables: Tables to keep. Everything else is removed from the template and demo project.",
+    "queries: Parameters, functions, and queries that do not load a table (Power Query expressions) to keep.",
+    "Prefix a name with [kql] or [storage] to keep it for that report type only."
+  ],
+  "reports": {
+    "CostSummary": {
+      "description": "The Cost summary report provides several summaries of your effective (amortized) and billed costs based on the FinOps Open Cost and Usage Specification (FOCUS). Amortization breaks down reservation and savings plan purchases and allocates costs to the resources that received the benefit. Effective costs will not match your invoice.",
+      "tables": ["Costs", "Prices", "PricingUnits"],
+      "queries": [
+        "▶️  START HERE",
+        "Cluster URL",
+        "[storage]Storage URL",
+        "Default Granularity",
+        "Number of Months",
+        "RangeStart",
+        "RangeEnd",
+        "Experimental: Add Missing Prices",
+        "Deprecated: Perform Extra Query Optimizations",
+        "ftk_DatetimeToJulianDate",
+        "ftk_ImpalaToJulianDate",
+        "ftk_Metadata",
+        "ftk_ParseResourceId",
+        "ftk_ParseResourceName",
+        "ftk_ParseResourceType",
+        "ftk_Storage"
+      ]
+    },
+    "DataIngestion": {
+      "description": "The Data ingestion report provides details about the data you've ingested into your FinOps hub storage account.",
+      "tables": ["Costs", "HubScopes", "HubSettings", "Prices", "PricingUnits", "StorageData", "StorageErrors"],
+      "queries": [
+        "▶️  START HERE",
+        "Cluster URL",
+        "Storage URL",
+        "Default Granularity",
+        "Number of Months",
+        "RangeStart",
+        "RangeEnd",
+        "Experimental: Add Missing Prices",
+        "Deprecated: Perform Extra Query Optimizations",
+        "ftk_DatetimeToJulianDate",
+        "ftk_ImpalaToJulianDate",
+        "ftk_Metadata",
+        "ftk_ParseResourceId",
+        "ftk_ParseResourceName",
+        "ftk_ParseResourceType",
+        "ftk_Storage"
+      ]
+    },
+    "Governance": {
+      "description": "The Governance, policy, and risk report summarizes your Microsoft Cloud governance posture. It offers the standard metrics aligned with the Cloud Adoption Framework to facilitate identifying issues, applying recommendations, and resolving compliance gaps.",
+      "tables": [
+        "AdvisorRecommendations",
+        "Compliance calculation",
+        "Costs",
+        "Disks",
+        "ManagementGroups",
+        "NetworkInterfaces",
+        "NetworkSecurityGroups",
+        "PolicyAssignments",
+        "PolicyStates",
+        "Prices",
+        "PricingUnits",
+        "PublicIPAddresses",
+        "Regions",
+        "Resources",
+        "ResourceTypes",
+        "SqlDatabases",
+        "Subscriptions",
+        "VirtualMachines",
+        "VirtualMachinesDisks"
+      ],
+      "queries": [
+        "▶️  START HERE",
+        "Cluster URL",
+        "[storage]Storage URL",
+        "Default Granularity",
+        "Number of Months",
+        "RangeStart",
+        "RangeEnd",
+        "Experimental: Add Missing Prices",
+        "PolicyDefinitions",
+        "Remove Duplicate Resource IDs",
+        "Deprecated: Perform Extra Query Optimizations",
+        "ftk_ARGBatchSize",
+        "ftk_DemoFilter",
+        "ftk_QueryARG",
+        "ftk_DatetimeToJulianDate",
+        "ftk_ImpalaToJulianDate",
+        "ftk_Metadata",
+        "ftk_ParseResourceId",
+        "ftk_ParseResourceName",
+        "ftk_ParseResourceType",
+        "ftk_Storage"
+      ]
+    },
+    "Invoicing": {
+      "description": "The Invoicing and chargeback report provides several summaries of your billed cost to facilitate invoice reconciliation for Microsoft Customer Agreement (MCA) and Enterprise Agreement (EA) accounts or to perform chargeback using effective (amortized) costs.",
+      "tables": ["Costs", "Prices", "PricingUnits"],
+      "queries": [
+        "▶️  START HERE",
+        "Cluster URL",
+        "[storage]Storage URL",
+        "Default Granularity",
+        "Number of Months",
+        "RangeStart",
+        "RangeEnd",
+        "Experimental: Add Missing Prices",
+        "Deprecated: Perform Extra Query Optimizations",
+        "ftk_DatetimeToJulianDate",
+        "ftk_ImpalaToJulianDate",
+        "ftk_Metadata",
+        "ftk_ParseResourceId",
+        "ftk_ParseResourceName",
+        "ftk_ParseResourceType",
+        "ftk_Storage"
+      ]
+    },
+    "RateOptimization": {
+      "description": "The Rate optimization report provides insights into any rate optimization opportunities, like reservations, savings plans, and Azure Hybrid Benefit. This report uses effective cost, which amortizes and breaks reservation and savings plan purchases down and allocates costs out to the resources that received the benefit. Effective cost will not match your invoice.",
+      "tables": ["Costs", "InstanceSizeFlexibility", "Prices", "PricingUnits", "ReservationRecommendations"],
+      "queries": [
+        "▶️  START HERE",
+        "Cluster URL",
+        "[storage]Storage URL",
+        "Default Granularity",
+        "Number of Months",
+        "RangeStart",
+        "RangeEnd",
+        "Experimental: Add Missing Prices",
+        "Deprecated: Perform Extra Query Optimizations",
+        "ftk_DatetimeToJulianDate",
+        "ftk_ImpalaToJulianDate",
+        "ftk_Metadata",
+        "ftk_ParseResourceId",
+        "ftk_ParseResourceName",
+        "ftk_ParseResourceType",
+        "ftk_Storage"
+      ]
+    },
+    "WorkloadOptimization": {
+      "description": "The Usage optimization report provides insights into resource utilization and efficiency opportunities based on historical usage patterns. Use this report to determine if resources can be scaled down or even shut down during off-peak hours to minimize wasteful usage and spending. Also consider cheaper alternatives when available and ensure all workloads have some direct or indirect link to business value to avoid unnecessary usage and costs that don't contribute to the mission.",
+      "tables": ["AdvisorRecommendations", "Costs", "Disks", "Prices", "PricingUnits", "Resources", "Subscriptions"],
+      "queries": [
+        "▶️  START HERE",
+        "Cluster URL",
+        "[storage]Storage URL",
+        "Default Granularity",
+        "Number of Months",
+        "RangeStart",
+        "RangeEnd",
+        "Experimental: Add Missing Prices",
+        "Remove Duplicate Resource IDs",
+        "Deprecated: Perform Extra Query Optimizations",
+        "ftk_ARGBatchSize",
+        "ftk_DemoFilter",
+        "ftk_QueryARG",
+        "ftk_DatetimeToJulianDate",
+        "ftk_ImpalaToJulianDate",
+        "ftk_Metadata",
+        "ftk_ParseResourceId",
+        "ftk_ParseResourceName",
+        "ftk_ParseResourceType",
+        "ftk_Storage"
+      ]
+    }
+  }
+}
diff --git a/src/power-bi/storage/Shared.Dataset/definition/relationships.tmdl b/src/power-bi/storage/Shared.Dataset/definition/relationships.tmdl
index 047210e6a..0d85eb1e3 100644
--- a/src/power-bi/storage/Shared.Dataset/definition/relationships.tmdl
+++ b/src/power-bi/storage/Shared.Dataset/definition/relationships.tmdl
@@ -64,10 +64,6 @@ relationship 2ad9b8bc-59fb-e94c-a36f-1fa66aaa02a8
 	fromColumn: AdvisorRecommendations.'properties.resourceMetadata.resourceId'
 	toColumn: Resources.id
 
-relationship AutoDetected_d442ee36-a039-47be-83cf-fd058a0973d7
-	fromColumn: AdvisorReservationRecommendations.subscriptionId
-	toColumn: Subscriptions.subscriptionId
-
 relationship AutoDetected_19cbab3d-1150-45a4-9258-ca0b47ba687d
 	isActive: false
 	fromColumn: AdvisorRecommendations.subscriptionId
diff --git a/src/power-bi/storage/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl b/src/power-bi/storage/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl
index 2dab7934a..5de53c619 100644
--- a/src/power-bi/storage/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl
+++ b/src/power-bi/storage/Shared.Dataset/definition/tables/AdvisorReservationRecommendations.tmdl
@@ -380,14 +380,6 @@ table AdvisorReservationRecommendations
 
 		annotation SummarizationSetBy = Automatic
 
-	column 'properties.extendedProperties.Region'
-		dataType: string
-		lineageTag: 68593266-9950-4caf-9522-ccfcbaa5d5e3
-		summarizeBy: none
-		sourceColumn: properties.extendedProperties.Region
-
-		annotation SummarizationSetBy = Automatic
-
 	column 'properties.extendedProperties.commitment'
 		dataType: string
 		lineageTag: e0b87d0c-8c42-4354-b85a-5fc93d4af06a
@@ -469,11 +461,10 @@ table AdvisorReservationRecommendations
 				      ['properties.extendedProperties.DatabaseSize'] = properties.extendedProperties.DatabaseSize,
 				      ['properties.extendedProperties.DatabaseName'] = properties.extendedProperties.DatabaseName,
 				      ['properties.extendedProperties.ServerName'] = properties.extendedProperties.ServerName,
-				      ['properties.extendedProperties.Region'] = properties.extendedProperties.Region,
 				      ['properties.extendedProperties.displaySKU'] = properties.extendedProperties.displaySKU,
 				      ['properties.extendedProperties.displayQty'] = toint(properties.extendedProperties.displayQty),
 				      ['properties.extendedProperties.location'] = properties.extendedProperties.location,
-				      ['properties.extendedProperties.region'] = properties.extendedProperties.region,
+				      ['properties.extendedProperties.region'] = coalesce(tostring(properties.extendedProperties.region), tostring(properties.extendedProperties.Region)),
 				      ['properties.extendedProperties.vmSize'] = properties.extendedProperties.vmSize,
 				      ['properties.extendedProperties.subId'] = properties.extendedProperties.subId,
 				      ['properties.extendedProperties.scope'] = properties.extendedProperties.scope,
@@ -496,7 +487,7 @@ table AdvisorReservationRecommendations
 				  NullHandling =
 				    if Source = null then
 							#table(
-								{ "id", "name", "properties.recommendationTypeId", "properties.shortDescription", "properties.resourceMetadata", "properties.suppressionIds", "properties.impactedField", "properties.impactedValue", "properties.lastUpdated", "properties.category", "properties.metadata", "properties.impact", "properties.shortDescription.problem", "properties.shortDescription.solution", "properties.extendedProperties.ObservationPeriodStartDate", "properties.extendedProperties.ObservationPeriodEndDate", "properties.extendedProperties.reservedResourceType", "properties.extendedProperties.annualSavingsAmount", "properties.extendedProperties.targetResourceCount", "properties.extendedProperties.HasRecommendation", "properties.extendedProperties.savingsCurrency", "properties.extendedProperties.IsInReplication", "properties.extendedProperties.Recommended_DTU", "properties.extendedProperties.Recommended_SKU", "properties.extendedProperties.ResourceGroup", "properties.extendedProperties.lookbackPeriod", "properties.extendedProperties.savingsAmount", "properties.extendedProperties.DatabaseSize", "properties.extendedProperties.DatabaseName", "properties.extendedProperties.ServerName", "properties.extendedProperties.Region", "properties.extendedProperties.displaySKU", "properties.extendedProperties.displayQty", "properties.extendedProperties.location", "properties.extendedProperties.region", "properties.extendedProperties.vmSize", "properties.extendedProperties.subId", "properties.extendedProperties.scope", "properties.extendedProperties.term", "properties.extendedProperties.sku", "properties.extendedProperties.qty", "properties.extendedProperties.commitment", "properties.extendedProperties.currentSku", "properties.extendedProperties.targetSku", "properties.extendedProperties.recommendationMessage", "properties.resourceMetadata.resourceId", "properties.resourceMetadata.singular", "properties.resourceMetadata.plural", "properties.resourceMetadata.action", "properties.resourceMetadata.source", "recommendedActions", "SortOrder" },
+								{ "id", "name", "properties.recommendationTypeId", "properties.shortDescription", "properties.resourceMetadata", "properties.suppressionIds", "properties.impactedField", "properties.impactedValue", "properties.lastUpdated", "properties.category", "properties.metadata", "properties.impact", "properties.shortDescription.problem", "properties.shortDescription.solution", "properties.extendedProperties.ObservationPeriodStartDate", "properties.extendedProperties.ObservationPeriodEndDate", "properties.extendedProperties.reservedResourceType", "properties.extendedProperties.annualSavingsAmount", "properties.extendedProperties.targetResourceCount", "properties.extendedProperties.HasRecommendation", "properties.extendedProperties.savingsCurrency", "properties.extendedProperties.IsInReplication", "properties.extendedProperties.Recommended_DTU", "properties.extendedProperties.Recommended_SKU", "properties.extendedProperties.ResourceGroup", "properties.extendedProperties.lookbackPeriod", "properties.extendedProperties.savingsAmount", "properties.extendedProperties.DatabaseSize", "properties.extendedProperties.DatabaseName", "properties.extendedProperties.ServerName", "properties.extendedProperties.displaySKU", "properties.extendedProperties.displayQty", "properties.extendedProperties.location", "properties.extendedProperties.region", "properties.extendedProperties.vmSize", "properties.extendedProperties.subId", "properties.extendedProperties.scope", "properties.extendedProperties.term", "properties.extendedProperties.sku", "properties.extendedProperties.qty", "properties.extendedProperties.commitment", "properties.extendedProperties.currentSku", "properties.extendedProperties.targetSku", "properties.extendedProperties.recommendationMessage", "properties.resourceMetadata.resourceId", "properties.resourceMetadata.singular", "properties.resourceMetadata.plural", "properties.resourceMetadata.action", "properties.resourceMetadata.source", "recommendedActions", "SortOrder" },
 								{}
 							)
 				    else Source,
diff --git a/src/power-bi/storage/Shared.Dataset/definition/tables/Costs.tmdl b/src/power-bi/storage/Shared.Dataset/definition/tables/Costs.tmdl
index 75880048f..be4922bdd 100644
--- a/src/power-bi/storage/Shared.Dataset/definition/tables/Costs.tmdl
+++ b/src/power-bi/storage/Shared.Dataset/definition/tables/Costs.tmdl
@@ -1480,8 +1480,8 @@ table Costs
 					// Fix known bugs and set data types
 					Fixes = Table.TransformColumnTypes(
 						Table.ReplaceValue(Table.ReplaceValue(
-							// Create AvailabilityZone column if missing to support non-Microsoft clouds
-							if Table.HasColumns(Align12, {"AvailabilityZone"}) then Align12 else Table.AddColumn(Align12, "AvailabilityZone", each null),
+							// Create columns the report needs that older FOCUS versions and non-Microsoft clouds don't have
+							List.Accumulate({"AvailabilityZone", "CapacityReservationId", "CapacityReservationStatus"}, Align12, (tbl, col) => if Table.HasColumns(tbl, {col}) then tbl else Table.AddColumn(tbl, col, each null)),
 							// Fix savings plan purchases -- Cost Management fix pending as of Dec 8, 2024
 							each [EffectiveCost], each if [ChargeCategory] = "Purchase" and [CommitmentDiscountId] <> "" and [CommitmentDiscountId] <> null then 0.0 else [EffectiveCost], Replacer.ReplaceValue, {"EffectiveCost"}),
 							// Fix PricingCategory values -- Remove after Oct 1, 2025
diff --git a/src/powershell/Tests/Lint/PowerBIReports.Tests.ps1 b/src/powershell/Tests/Lint/PowerBIReports.Tests.ps1
new file mode 100644
index 000000000..50330e364
--- /dev/null
+++ b/src/powershell/Tests/Lint/PowerBIReports.Tests.ps1
@@ -0,0 +1,83 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    Lint rule: Power BI reports and src/power-bi/reports.json must agree.
+
+    Build-PowerBI removes every table and query that reports.json doesn't list for a report. When a
+    visual reads from a table that isn't listed, the template and demo report ship with a broken
+    visual (for example, the Governance report's "Virtual machines" page lost its disks table this
+    way). Build-PowerBI fails on this too, but it only runs at release time. This test catches it
+    in the pull request that causes it.
+
+    Uses the same helpers as Build-PowerBI and only reads files, so it doesn't need the Analysis
+    Services library.
+#>
+
+BeforeDiscovery {
+    $powerBiDir = Join-Path (Get-Item -Path $PSScriptRoot).Parent.Parent.Parent.FullName 'power-bi'
+    $reportProjects = @(Get-ChildItem $powerBiDir -Recurse -Include '*.kql.pbip', '*.storage.pbip' | ForEach-Object {
+            @{ Name = $_.Name.Split('.')[0]; Type = $_.Name.Split('.')[1]; Folder = $_.DirectoryName; Label = $_.BaseName }
+        })
+}
+
+BeforeAll {
+    $srcDir = (Get-Item -Path $PSScriptRoot).Parent.Parent.Parent.FullName
+    $powerBiDir = Join-Path $srcDir 'power-bi'
+
+    $ast = [System.Management.Automation.Language.Parser]::ParseFile((Join-Path $srcDir 'scripts/Build-PowerBI.ps1'), [ref]$null, [ref]$null)
+    $ast.FindAll({ param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] }, $false) `
+    | ForEach-Object { . ([scriptblock]::Create($_.Extent.Text)) }
+
+    $config = (Get-Content (Join-Path $powerBiDir 'reports.json') -Raw | ConvertFrom-Json -Depth 10).reports
+    $modelNames = @{}
+    foreach ($type in 'kql', 'storage')
+    {
+        $modelNames[$type] = ConvertTo-NameSet (Get-TmdlObjectName (Join-Path $powerBiDir "$type/Shared.Dataset/definition"))
+    }
+}
+
+Describe 'PowerBIReports' {
+    Context '<Label>' -ForEach $reportProjects {
+        BeforeAll {
+            $settings = $config.$Name
+            if ($settings)
+            {
+                $keptTables = Resolve-Allowlist @($settings.tables) $Type
+                $keptQueries = Resolve-Allowlist @($settings.queries) $Type
+                $kept = ConvertTo-NameSet ($keptTables + $keptQueries)
+            }
+        }
+
+        It 'Is listed in reports.json' {
+            $settings | Should -Not -BeNullOrEmpty -Because "Build-PowerBI needs to know which tables and queries the $Name report keeps"
+            $settings.description | Should -Not -BeNullOrEmpty
+        }
+
+        It 'Only has visuals that read from tables reports.json keeps' {
+            $references = Get-ReportEntityReference (Get-Content (Join-Path $Folder "$Name.Report/report.json") -Raw)
+            $broken = @($references `
+                | Where-Object { -not $_.Hidden -and $modelNames[$Type].Contains($_.Entity) -and -not $kept.Contains($_.Entity) } `
+                | ForEach-Object { "'$($_.Page)' page $($_.Source) reads from '$($_.Entity)'" } `
+                | Sort-Object -Unique)
+            $broken | Should -BeNullOrEmpty -Because "reports.json removes these tables from the $Label report. Add them to the $Name tables"
+        }
+    }
+
+    It 'Only lists tables and queries that exist' {
+        $unknown = foreach ($report in $config.PSObject.Properties)
+        {
+            foreach ($entry in @($report.Value.tables) + @($report.Value.queries))
+            {
+                $prefixed = [regex]::Match($entry, '^\[(?<type>[^\]]+)\](?<name>.+)$')
+                $types = if ($prefixed.Success) { @($prefixed.Groups['type'].Value) } else { @('kql', 'storage') }
+                $name = if ($prefixed.Success) { $prefixed.Groups['name'].Value } else { $entry }
+                if (-not @($types | Where-Object { $modelNames[$_] -and $modelNames[$_].Contains($name) }).Count)
+                {
+                    "$($report.Name): $entry"
+                }
+            }
+        }
+        $unknown | Should -BeNullOrEmpty -Because 'entries that match nothing are misspelled or stale'
+    }
+}
diff --git a/src/powershell/Tests/Unit/Build-PowerBI.Tests.ps1 b/src/powershell/Tests/Unit/Build-PowerBI.Tests.ps1
new file mode 100644
index 000000000..900788066
--- /dev/null
+++ b/src/powershell/Tests/Unit/Build-PowerBI.Tests.ps1
@@ -0,0 +1,404 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    Tests the Power BI build helpers in src/scripts/Build-PowerBI.ps1 and the demo report
+    validation in src/scripts/Package-PowerBI.ps1.
+
+    Both scripts run top-level build logic, so dot-sourcing them would start a build. Function
+    definitions are extracted with the PowerShell parser and defined in the test scope instead.
+    None of these tests need the Analysis Services library or Power BI Desktop.
+#>
+
+BeforeAll {
+    $scriptsDir = Join-Path (Get-Item -Path $PSScriptRoot).Parent.Parent.Parent.FullName 'scripts'
+
+    function Import-ScriptFunction([string] $ScriptName)
+    {
+        $path = Join-Path $scriptsDir $ScriptName
+        $ast = [System.Management.Automation.Language.Parser]::ParseFile($path, [ref]$null, [ref]$null)
+        $ast.FindAll({ param($node) $node -is [System.Management.Automation.Language.FunctionDefinitionAst] }, $false) `
+        | ForEach-Object { $_.Extent.Text }
+    }
+
+    Import-ScriptFunction 'Build-PowerBI.ps1' | ForEach-Object { . ([scriptblock]::Create($_)) }
+    Import-ScriptFunction 'Package-PowerBI.ps1' | ForEach-Object { . ([scriptblock]::Create($_)) }
+    $script:Utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+
+    function New-TmdlModel([string] $Root, [hashtable] $Tables, [string[]] $Relationships = @(), [string[]] $Expressions = @())
+    {
+        New-Item "$Root/definition/tables" -ItemType Directory -Force | Out-Null
+        $modelLines = @('model Model', '	culture: en-US', '')
+        foreach ($name in $Tables.Keys)
+        {
+            $declared = if ($name -match '^[A-Za-z_][A-Za-z0-9_]*$') { $name } else { "'$($name.Replace("'", "''"))'" }
+            $lines = @("table $declared") + ($Tables[$name] | ForEach-Object { "`tcolumn $_" })
+            Set-Content "$Root/definition/tables/$name.tmdl" ($lines -join "`n")
+            $modelLines += "ref table $declared"
+        }
+        Set-Content "$Root/definition/model.tmdl" ($modelLines -join "`n")
+        Set-Content "$Root/definition/relationships.tmdl" ($Relationships -join "`n")
+        Set-Content "$Root/definition/expressions.tmdl" ($Expressions -join "`n")
+
+        $nodes = @($Tables.Keys | ForEach-Object { @{ nodeIndex = $_ } })
+        @{ version = '1.1.0'; diagrams = @(@{ name = 'All tables'; nodes = $nodes }) } | ConvertTo-Json -Depth 10 | Set-Content "$Root/diagramLayout.json"
+    }
+
+    function New-TestPbix([string] $Path, [hashtable] $Parts)
+    {
+        Add-Type -AssemblyName System.IO.Compression, System.IO.Compression.FileSystem
+        Remove-Item $Path -Force -ErrorAction SilentlyContinue
+        $zip = [System.IO.Compression.ZipFile]::Open($Path, [System.IO.Compression.ZipArchiveMode]::Create)
+        try
+        {
+            foreach ($name in $Parts.Keys)
+            {
+                $entry = $zip.CreateEntry($name)
+                $stream = $entry.Open()
+                $bytes = $Parts[$name]
+                if ($bytes -is [string]) { $bytes = [System.Text.Encoding]::Unicode.GetBytes($bytes) }
+                $stream.Write($bytes, 0, $bytes.Length)
+                $stream.Dispose()
+            }
+        }
+        finally { $zip.Dispose() }
+    }
+
+    function New-Layout([int] $ActiveSectionIndex = 0, [string] $Text = 'FinOps toolkit v1.2.3')
+    {
+        return @{
+            config   = (@{ activeSectionIndex = $ActiveSectionIndex } | ConvertTo-Json -Compress)
+            sections = @(
+                @{ displayName = 'Get started'; ordinal = 0; visualContainers = @(@{ config = (@{ text = $Text } | ConvertTo-Json -Compress) }) }
+                @{ displayName = 'Summary'; ordinal = 1 }
+            )
+        } | ConvertTo-Json -Depth 10 -Compress
+    }
+}
+
+Describe 'Resolve-Allowlist' {
+    It 'Keeps shared entries and entries for the report type' {
+        $result = Resolve-Allowlist @('Costs', '[storage]Storage URL', '[kql]Cluster URL') 'storage'
+        $result | Should -Be @('Costs', 'Storage URL')
+    }
+
+    It 'Returns an empty array when nothing applies' {
+        $result = Resolve-Allowlist @('[kql]Cluster URL') 'storage'
+        $result.Count | Should -Be 0
+    }
+}
+
+Describe 'ConvertFrom-TmdlDeclaration' {
+    It 'Reads <Expected> from <Text>' -ForEach @(
+        @{ Text = 'Costs'; Expected = 'Costs' }
+        @{ Text = "'Compliance calculation'"; Expected = 'Compliance calculation' }
+        @{ Text = "'It''s quoted' = 1"; Expected = "It's quoted" }
+        @{ Text = 'ftk_Storage = () => 1'; Expected = 'ftk_Storage' }
+    ) {
+        ConvertFrom-TmdlDeclaration $Text | Should -Be $Expected
+    }
+}
+
+Describe 'Get-TmdlReferenceTable' {
+    It 'Reads <Expected> from <Reference>' -ForEach @(
+        @{ Reference = 'Costs.x_ResourceId'; Expected = 'Costs' }
+        @{ Reference = "'Compliance calculation'.Id"; Expected = 'Compliance calculation' }
+        @{ Reference = "NetworkInterfaces.'properties.virtualMachine.id'"; Expected = 'NetworkInterfaces' }
+    ) {
+        Get-TmdlReferenceTable $Reference | Should -Be $Expected
+    }
+}
+
+Describe 'Get-TmdlNameConflict' {
+    It 'Reports columns that only differ by case with line numbers' {
+        New-TmdlModel "$TestDrive/conflict" @{ Recommendations = @('region', 'name', 'Region') }
+        $conflicts = Get-TmdlNameConflict "$TestDrive/conflict/definition"
+        $conflicts | Should -HaveCount 1
+        $conflicts[0].Table | Should -Be 'Recommendations'
+        $conflicts[0].Message | Should -Match 'region, Region'
+        $conflicts[0].Message | Should -Match 'lines 2, 4'
+    }
+
+    It 'Returns nothing for a valid model' {
+        New-TmdlModel "$TestDrive/valid" @{ Costs = @('BilledCost', 'EffectiveCost') }
+        $result = Get-TmdlNameConflict "$TestDrive/valid/definition"
+        $result.Count | Should -Be 0
+    }
+
+    It 'Finds no conflicts in the shipped models' -ForEach @('storage', 'kql') {
+        $root = Join-Path (Get-Item -Path $PSScriptRoot).Parent.Parent.Parent.FullName "power-bi/$_/Shared.Dataset/definition"
+        $result = Get-TmdlNameConflict $root
+        $result.Count | Should -Be 0
+    }
+}
+
+Describe 'Export-PrunedDataset' {
+    BeforeAll {
+        New-TmdlModel "$TestDrive/source" `
+            -Tables @{ Costs = @('SubAccountId'); Subscriptions = @('subscriptionId'); 'Compliance calculation' = @('Id') } `
+            -Relationships @(
+            'relationship r1', "`tfromColumn: Costs.SubAccountId", "`ttoColumn: Subscriptions.subscriptionId", ''
+            'relationship r2', "`tfromColumn: 'Compliance calculation'.Id", "`ttoColumn: Costs.SubAccountId", ''
+        )
+        $result = Export-PrunedDataset "$TestDrive/source" "$TestDrive/pruned" @('Costs', 'Compliance calculation')
+    }
+
+    It 'Removes tables that are not kept' {
+        $result.Dropped | Should -Be @('Subscriptions')
+        Test-Path "$TestDrive/pruned/definition/tables/Subscriptions.tmdl" | Should -BeFalse
+        Test-Path "$TestDrive/pruned/definition/tables/Costs.tmdl" | Should -BeTrue
+    }
+
+    It 'Removes model references to removed tables' {
+        $model = Get-Content "$TestDrive/pruned/definition/model.tmdl" -Raw
+        $model | Should -Not -Match 'ref table Subscriptions'
+        $model | Should -Match "ref table 'Compliance calculation'"
+    }
+
+    It 'Removes relationships to removed tables and keeps the rest' {
+        $result.RemovedRelationships | Should -Be 1
+        $relationships = Get-Content "$TestDrive/pruned/definition/relationships.tmdl" -Raw
+        $relationships | Should -Not -Match 'relationship r1'
+        $relationships | Should -Match 'relationship r2'
+    }
+
+    It 'Removes diagram nodes for removed tables' {
+        $diagram = Get-Content "$TestDrive/pruned/diagramLayout.json" -Raw | ConvertFrom-Json
+        $diagram.diagrams[0].nodes.nodeIndex | Sort-Object | Should -Be @('Compliance calculation', 'Costs')
+    }
+
+    It 'Leaves the source untouched' {
+        Test-Path "$TestDrive/source/definition/tables/Subscriptions.tmdl" | Should -BeTrue
+    }
+}
+
+Describe 'Get-ReportEntityReference' {
+    BeforeAll {
+        $visual = @{
+            name          = 'v1'
+            singleVisual  = @{ visualType = 'tableEx' }
+            prototypeQuery = @{ From = @(@{ Name = 'c'; Entity = 'Costs' }, @{ Name = 'd'; Entity = 'VirtualMachinesDisks' }) }
+            # Formatting selectors aren't queries and must be ignored
+            objects       = @{ dataPoint = @(@{ selector = @{ data = @(@{ scopeId = @{ Column = @{ Expression = @{ SourceRef = @{ Entity = 'UsageDetails' } } } } }) } }) }
+        }
+        $report = @{
+            filters  = (@(@{ filter = @{ From = @(@{ Name = 'x'; Entity = 'CostDetails' }) } }) | ConvertTo-Json -Depth 10 -Compress)
+            sections = @(
+                @{ displayName = 'Virtual machines'; config = '{}'; visualContainers = @(@{ config = ($visual | ConvertTo-Json -Depth 20 -Compress) }) }
+                @{ displayName = 'Hidden'; config = '{"visibility":1}'; filters = '[{"filter":{"From":[{"Name":"a","Entity":"Advisor"}]}}]' }
+            )
+        } | ConvertTo-Json -Depth 10
+        $references = Get-ReportEntityReference $report
+    }
+
+    It 'Finds entities read by visuals, page filters, and report filters' {
+        $references.Entity | Sort-Object -Unique | Should -Be @('Advisor', 'CostDetails', 'Costs', 'VirtualMachinesDisks')
+    }
+
+    It 'Ignores entity references outside of queries' {
+        $references.Entity | Should -Not -Contain 'UsageDetails'
+    }
+
+    It 'Records the page, visual, and hidden state' {
+        $disk = $references | Where-Object Entity -EQ 'VirtualMachinesDisks'
+        $disk.Page | Should -Be 'Virtual machines'
+        $disk.Source | Should -Be 'tableEx visual v1'
+        $disk.Hidden | Should -BeFalse
+        ($references | Where-Object Entity -EQ 'Advisor').Hidden | Should -BeTrue
+    }
+}
+
+Describe 'Remove-ExpressionLiteral' {
+    It 'Removes M strings and comments but keeps quoted identifiers' {
+        $text = Remove-ExpressionLiteral "let a = #`"Storage URL`", b = `"Resources`" // Subscriptions`nin a /* Regions */" 'M'
+        $text | Should -Match '#"Storage URL"'
+        $text | Should -Not -Match 'Resources|Subscriptions|Regions'
+    }
+
+    It 'Removes DAX strings and comments but keeps quoted table names' {
+        $text = Remove-ExpressionLiteral "CALCULATE(SUM('Compliance calculation'[Id]), `"Resources`") -- Disks" 'DAX'
+        $text | Should -Match "'Compliance calculation'"
+        $text | Should -Not -Match 'Resources|Disks'
+    }
+}
+
+Describe 'Get-MissingDependency' {
+    BeforeAll {
+        function New-Model([object[]] $Expressions = @(), [object[]] $Tables = @())
+        {
+            return [PSCustomObject]@{ Model = [PSCustomObject]@{ Expressions = $Expressions; Tables = $Tables } }
+        }
+        function New-Table([string] $Name, [string] $Source, [object[]] $Measures = @(), [string] $SourceType = 'M')
+        {
+            return [PSCustomObject]@{
+                Name          = $Name
+                Partitions    = @([PSCustomObject]@{ SourceType = $SourceType; Source = [PSCustomObject]@{ Expression = $Source } })
+                Measures      = $Measures
+                Columns       = @()
+                RefreshPolicy = $null
+            }
+        }
+    }
+
+    It 'Finds a removed query used by a table' {
+        $db = New-Model -Tables @(New-Table 'Resources' 'let Source = ftk_QueryARG("resources") in Source')
+        $missing = Get-MissingDependency $db @('ftk_QueryARG')
+        $missing | Should -HaveCount 1
+        $missing[0].Owner | Should -Be "table 'Resources'"
+    }
+
+    It 'Finds a removed parameter referenced with a quoted identifier' {
+        $db = New-Model -Expressions @([PSCustomObject]@{ Name = 'ftk_DemoFilter'; Expression = '() => Text.SplitAny(#"Storage URL", "/.")' })
+        (Get-MissingDependency $db @('Storage URL')).Owner | Should -Be "query 'ftk_DemoFilter'"
+    }
+
+    It 'Finds a removed table used by a measure' {
+        $measure = [PSCustomObject]@{ Name = 'Disk count'; Expression = "COUNTROWS(VirtualMachinesDisks) + COUNTROWS('Compliance calculation')" }
+        $db = New-Model -Tables @(New-Table 'Costs' 'Source' -Measures @($measure))
+        (Get-MissingDependency $db @('VirtualMachinesDisks', 'Compliance calculation')).Name | Should -Be @('VirtualMachinesDisks', 'Compliance calculation')
+    }
+
+    It 'Ignores names in strings, comments, record fields, and shadowing variables' {
+        $source = @'
+let
+    // Resources are joined later
+    Label = "Subscriptions",
+    Regions = Table.FromRecords({}),
+    Renamed = Table.SelectColumns(Regions, {"x"}),
+    Field = [Disks]
+in
+    Renamed
+'@
+        $db = New-Model -Tables @(New-Table 'Costs' $source)
+        $result = Get-MissingDependency $db @('Resources', 'Subscriptions', 'Regions', 'Disks')
+        $result.Count | Should -Be 0
+    }
+
+    It 'Ignores measure and column references' {
+        $measure = [PSCustomObject]@{ Name = 'Total'; Expression = 'SUM(Costs[Resources]) + [Disks]' }
+        $db = New-Model -Tables @(New-Table 'Costs' 'Source' -Measures @($measure))
+        $result = Get-MissingDependency $db @('Resources', 'Disks')
+        $result.Count | Should -Be 0
+    }
+}
+
+Describe 'Test-DemoPbix' {
+    BeforeAll {
+        $version = '1.2.3'
+        $report = [PSCustomObject]@{ tables = @('Costs', 'Prices') }
+        $bigModel = New-Object byte[] (1MB + 1)
+        $diagram = @{ diagrams = @(@{ nodes = @(@{ nodeIndex = 'Costs' }, @{ nodeIndex = 'Prices' }) }) } | ConvertTo-Json -Depth 5 -Compress
+
+        function New-ValidParts
+        {
+            return @{
+                'DataModel'     = $bigModel
+                'Report/Layout' = (New-Layout)
+                'Metadata'      = '{}'
+                'Settings'      = '{}'
+                'Version'       = '1.30'
+                'DiagramLayout' = $diagram
+            }
+        }
+    }
+
+    It 'Passes a correctly saved demo report' {
+        New-TestPbix "$TestDrive/valid.pbix" (New-ValidParts)
+        $result = Test-DemoPbix "$TestDrive/valid.pbix" $report
+        $result.Count | Should -Be 0
+    }
+
+    It 'Fails a file that is not a PBIX' {
+        Set-Content "$TestDrive/bad.pbix" 'not a zip'
+        Test-DemoPbix "$TestDrive/bad.pbix" $report | Should -Match "isn't a readable PBIX"
+    }
+
+    It 'Fails a report saved without data' {
+        $parts = New-ValidParts
+        $parts.DataModel = New-Object byte[] 1024
+        New-TestPbix "$TestDrive/empty.pbix" $parts
+        Test-DemoPbix "$TestDrive/empty.pbix" $report | Should -Match 'saved without loading demo data'
+    }
+
+    It 'Fails a report saved on the wrong page' {
+        $parts = New-ValidParts
+        $parts.'Report/Layout' = New-Layout -ActiveSectionIndex 1
+        New-TestPbix "$TestDrive/page.pbix" $parts
+        Test-DemoPbix "$TestDrive/page.pbix" $report | Should -Match "opens on 'Summary'"
+    }
+
+    It 'Fails a report saved from the source project' {
+        $parts = New-ValidParts
+        $parts.'Report/Layout' = New-Layout -Text 'FinOps toolkit v$$ftkver$$'
+        New-TestPbix "$TestDrive/source.pbix" $parts
+        Test-DemoPbix "$TestDrive/source.pbix" $report | Should -Match 'still has version placeholders'
+    }
+
+    It 'Fails a report saved from an older version' {
+        $parts = New-ValidParts
+        $parts.'Report/Layout' = New-Layout -Text 'FinOps toolkit v1.2.2'
+        New-TestPbix "$TestDrive/old.pbix" $parts
+        Test-DemoPbix "$TestDrive/old.pbix" $report | Should -Match "doesn't mention version 1.2.3"
+    }
+
+    It 'Fails a report with tables it does not use' {
+        $parts = New-ValidParts
+        $parts.DiagramLayout = @{ diagrams = @(@{ nodes = @(@{ nodeIndex = 'Costs' }, @{ nodeIndex = 'Resources' }) }) } | ConvertTo-Json -Depth 5 -Compress
+        New-TestPbix "$TestDrive/extra.pbix" $parts
+        Test-DemoPbix "$TestDrive/extra.pbix" $report | Should -Match "1 table the report doesn't use \(Resources\)"
+    }
+
+    It 'Passes a report saved in the enhanced report format' {
+        $parts = New-ValidParts
+        $parts.Remove('Report/Layout')
+        $parts['Report/definition/report.json'] = '{"$schema":"https://developer.microsoft.com/json-schemas/fabric/item/report/definition/report/1.0.0/schema.json"}'
+        $parts['Report/definition/pages/pages.json'] = '{"activePageName":"page1","pageOrder":["page1","page2"]}'
+        $parts['Report/definition/pages/page1/page.json'] = '{"name":"page1","displayName":"Get started"}'
+        $parts['Report/definition/pages/page1/visuals/v1/visual.json'] = '{"name":"v1","text":"FinOps toolkit v1.2.3"}'
+        New-TestPbix "$TestDrive/pbir.pbix" $parts
+        $result = Test-DemoPbix "$TestDrive/pbir.pbix" $report
+        $result.Count | Should -Be 0
+    }
+
+    It 'Fails an enhanced report saved on the wrong page' {
+        $parts = New-ValidParts
+        $parts.Remove('Report/Layout')
+        $parts['Report/definition/report.json'] = '{"name":"report"}'
+        $parts['Report/definition/pages/pages.json'] = '{"activePageName":"page2"}'
+        $parts['Report/definition/pages/page1/page.json'] = '{"name":"page1","displayName":"Get started"}'
+        $parts['Report/definition/pages/page2/page.json'] = '{"name":"page2","displayName":"Summary","text":"FinOps toolkit v1.2.3"}'
+        New-TestPbix "$TestDrive/pbirpage.pbix" $parts
+        Test-DemoPbix "$TestDrive/pbirpage.pbix" $report | Should -Match "opens on 'Summary'"
+    }
+
+    It 'Fails an enhanced report saved from an older build' {
+        $parts = New-ValidParts
+        $parts.Remove('Report/Layout')
+        $parts['Report/definition/report.json'] = '{"name":"report"}'
+        $parts['Report/definition/pages/pages.json'] = '{"activePageName":"page1"}'
+        $parts['Report/definition/pages/page1/page.json'] = '{"name":"page1","displayName":"Get started","text":"FinOps toolkit v1.2.2"}'
+        New-TestPbix "$TestDrive/pbirold.pbix" $parts
+        Test-DemoPbix "$TestDrive/pbirold.pbix" $report | Should -Match "doesn't mention version 1.2.3"
+    }
+
+    It 'Fails a report saved before the latest build' {
+        New-TestPbix "$TestDrive/stale.pbix" (New-ValidParts)
+        (Get-Item "$TestDrive/stale.pbix").LastWriteTime = (Get-Date).AddHours(-2)
+        Test-DemoPbix "$TestDrive/stale.pbix" $report (Get-Date).AddHours(-1) | Should -Match 'was saved before the latest build'
+    }
+
+    It 'Fails a report with the wrong sensitivity label' {
+        $parts = New-ValidParts
+        $parts.'docProps/custom.xml' = [System.Text.Encoding]::UTF8.GetBytes('<Properties><property name="MSIP_Label_abc_Name"><vt:lpwstr>Confidential</vt:lpwstr></property></Properties>')
+        New-TestPbix "$TestDrive/label.pbix" $parts
+        Test-DemoPbix "$TestDrive/label.pbix" $report -Label 'Public' | Should -Match "has the 'Confidential' sensitivity label"
+    }
+
+    It 'Passes a report with the expected sensitivity label' {
+        $parts = New-ValidParts
+        $parts.'docProps/custom.xml' = [System.Text.Encoding]::UTF8.GetBytes('<Properties><property name="MSIP_Label_abc_Name"><vt:lpwstr>Public</vt:lpwstr></property></Properties>')
+        New-TestPbix "$TestDrive/public.pbix" $parts
+        $result = Test-DemoPbix "$TestDrive/public.pbix" $report -Label 'Public'
+        $result.Count | Should -Be 0
+    }
+}
diff --git a/src/scripts/Build-PowerBI.ps1 b/src/scripts/Build-PowerBI.ps1
index f65f33fa3..e1d7bd1ea 100644
--- a/src/scripts/Build-PowerBI.ps1
+++ b/src/scripts/Build-PowerBI.ps1
@@ -3,7 +3,19 @@
 
 <#
     .SYNOPSIS
-    Creates PBIT files for each Power BI project.
+    Builds Power BI release artifacts: PBIT templates and pruned PBIP projects.
+
+    .DESCRIPTION
+    Generates one PBIT template per report and, unless -NoPbip is specified, one self-contained
+    PBIP project per report under the release/pbix folder.
+
+    Each generated PBIP contains only the tables, relationships, and queries that its report
+    needs. That removes the manual "remove unused queries" step when saving demo PBIX files and
+    guarantees the PBIT and the PBIX are built from the same model, because both are rendered
+    from a single prune.
+
+    Tables that no report uses are dropped before the model is loaded, so a broken table that
+    isn't shipped can never block a release.
 
     .PARAMETER Name
     Optional. Name of the report to build. Wildcards supported. Default = * (all).
@@ -14,15 +26,29 @@
     .PARAMETER Storage
     Optional. Indicates if the storage reports should be generated. Default = false (will build all if no types are selected).
 
+    .PARAMETER NoPbip
+    Optional. Skips generating pruned PBIP projects and only builds PBIT files. Default = false.
+
+    .PARAMETER OpenDataUrl
+    Optional. Public folder demo reports read open data from. Must be a permanent location, because demo reports ship with this URL in them. Default = the open data files in the main branch.
+
+    .PARAMETER TestOpenDataUrl
+    Optional. Allows an OpenDataUrl that isn't permanent, like a branch that gets deleted after it merges. Demo reports built this way can't be released. Default = false.
+
     .EXAMPLE
     ./Build-PowerBI
 
-    Generates all PBIT files.
+    Generates all PBIT files and pruned PBIP projects.
 
     .EXAMPLE
     ./Build-PowerBI CostSummary -Storage
 
-    Generates the Cost summary storage PBIT file.
+    Generates the Cost summary storage PBIT file and PBIP project.
+
+    .EXAMPLE
+    ./Build-PowerBI -NoPbip
+
+    Generates PBIT files only.
 
     .LINK
     https://github.com/microsoft/finops-toolkit/blob/dev/src/scripts/README.md#-build-powerbi
@@ -36,67 +62,602 @@ param(
     $KQL,
 
     [switch]
-    $Storage
+    $Storage,
+
+    [switch]
+    $NoPbip,
+
+    [string]
+    $OpenDataUrl = 'https://raw.githubusercontent.com/microsoft/finops-toolkit/main/src/open-data',
+
+    [switch]
+    $TestOpenDataUrl
 )
 
+$ErrorActionPreference = 'Stop'
+
 $srcDir = "$PSScriptRoot/../power-bi"
 $relDir = "$PSScriptRoot/../../release"
-$pbipDir = "$relDir/pbip"
 $pbitDir = "$relDir/pbit"
+$pbixDir = "$relDir/pbix"
 
-$version = & "$PSScriptRoot/Get-Version"
+$version = & "$PSScriptRoot/Get-Version.ps1"
+$buildDate = Get-Date -Format 'yyyy-MM-dd'
+
+# Report types that ship as demo PBIX files in PowerBI-demo.zip
+$demoTypes = @('storage')
 
 if (-not $KQL -and -not $Storage) { $KQL = $Storage = $true }
 
+#region Report metadata
+
+# Tables and queries to keep in each report are defined in src/power-bi/reports.json so the build
+# and the lint tests read the same list. Everything not listed there is removed from the PBIT and
+# the PBIP.
+$reportsConfigPath = "$srcDir/reports.json"
+$reportsConfig = Get-Content $reportsConfigPath -Raw | ConvertFrom-Json -Depth 10
+
+# Demo reports ship to customers, so they read open data over HTTP like the templates do. They
+# can't use the release URL, because it resolves to the last published release, which doesn't have
+# open data files added during the release being built.
+$openDataUrl = $OpenDataUrl.TrimEnd('/')
+$openDataChecked = @{}
+
+# Whatever URL is used here ships inside the demo reports, so it has to outlive the release. A
+# branch URL works while building and breaks for customers as soon as the branch is deleted.
+$permanentOpenDataUrl = $openDataUrl -match '^https://raw\.githubusercontent\.com/microsoft/finops-toolkit/main/' -or $openDataUrl -match '^https://github\.com/microsoft/finops-toolkit/releases/'
+if (-not $permanentOpenDataUrl)
+{
+    if (-not $TestOpenDataUrl)
+    {
+        throw "Demo reports would ship reading open data from $openDataUrl, which isn't permanent. Customers can't refresh them once it's gone. Use the main branch, or pass -TestOpenDataUrl to build reports that can't be released."
+    }
+    Write-Warning "Demo reports will read open data from $openDataUrl. This is a test build. The reports cannot be released, and Package-PowerBI will not package them."
+}
+
+$reportMetadata = @{}
+$reportsConfig.reports.PSObject.Properties `
+| ForEach-Object {
+    $reportMetadata[$_.Name] = @{
+        Intro       = $_.Value.description
+        Tables      = [string[]]@($_.Value.tables)
+        Expressions = [string[]]@($_.Value.queries)
+    }
+}
+
+#endregion Report metadata
+
+#region Helpers
+
+$script:Utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+
+
+function Write-TextFile($Path, [string[]] $Lines)
+{
+    [System.IO.File]::WriteAllText($Path, (($Lines -join "`n") + "`n"), $script:Utf8NoBom)
+}
+
+function Write-UTF16LE($File, $Content, $Json)
+{
+    Write-Verbose "  Writing UTF-16LE file: $(Split-Path $File -Leaf)..."
+    if ($Json) { $Content = [PSCustomObject]$Json | ConvertTo-Json -Depth 5 -Compress }
+    [System.IO.File]::WriteAllBytes($File, [System.Text.Encoding]::Unicode.GetBytes($Content))
+}
+
+<#
+    .SYNOPSIS
+    Reads the name from a TMDL declaration (for example, "column 'Foo Bar' = 1" returns "Foo Bar").
+#>
+function ConvertFrom-TmdlDeclaration([string] $Text)
+{
+    # Names are either 'quoted' (with '' as an escaped quote) or end at whitespace or "="
+    $match = [regex]::Match($Text, "^\s*(?:'(?<quoted>(?:[^']|'')*)'|(?<plain>[^\s=]+))")
+    if (-not $match.Success) { return $null }
+    if ($match.Groups['quoted'].Success) { return $match.Groups['quoted'].Value.Replace("''", "'") }
+    return $match.Groups['plain'].Value
+}
+
+<#
+    .SYNOPSIS
+    Reads the table name from a TMDL column reference (for example, "'My Table'.Col" returns "My Table").
+#>
+function Get-TmdlReferenceTable([string] $Reference)
+{
+    # Table names are either 'quoted' (with '' as an escaped quote) or end at "."
+    $match = [regex]::Match($Reference, "^\s*(?:'(?<quoted>(?:[^']|'')*)'|(?<plain>[^.\s]+))")
+    if (-not $match.Success) { return $null }
+    if ($match.Groups['quoted'].Success) { return $match.Groups['quoted'].Value.Replace("''", "'") }
+    return $match.Groups['plain'].Value
+}
+
+<#
+    .SYNOPSIS
+    Resolves an allowlist, keeping entries that apply to the specified report type.
+#>
+function Resolve-Allowlist([string[]] $Entries, [string] $ReportType)
+{
+    $resolved = New-Object System.Collections.Generic.List[string]
+    foreach ($entry in $Entries)
+    {
+        if ($entry -match '^\[(?<type>[^\]]+)\](?<name>.+)$')
+        {
+            if ($Matches.type -eq $ReportType) { $resolved.Add($Matches.name) }
+        }
+        else
+        {
+            $resolved.Add($entry)
+        }
+    }
+    return , $resolved.ToArray()
+}
+
+function ConvertTo-NameSet([string[]] $Names)
+{
+    return New-Object System.Collections.Generic.HashSet[string]([string[]]$Names, [System.StringComparer]::OrdinalIgnoreCase)
+}
+
+<#
+    .SYNOPSIS
+    Finds names that only differ by case, which Power BI rejects when loading the model.
+
+    .DESCRIPTION
+    Tabular models treat names as case-insensitive, so two columns named "region" and "Region"
+    cannot coexist. Power BI Desktop and the TMDL text format both allow the file to be saved
+    that way, and the failure only shows up when the model is loaded. Detecting it here turns a
+    confusing load failure into a specific message that names the file, table, and lines.
+#>
+function Get-TmdlNameConflict([string] $DefinitionDir)
+{
+    $conflicts = New-Object System.Collections.Generic.List[object]
+
+    function Add-Conflict($List, $Table, $File, [string] $Text, [System.Text.RegularExpressions.MatchCollection] $Declarations)
+    {
+        # Group declarations by case-insensitive name without calling functions per name, which is
+        # slow in PowerShell for models with hundreds of columns
+        $names = New-Object 'System.Collections.Generic.Dictionary[string, System.Collections.Generic.List[System.Text.RegularExpressions.Match]]' ([System.StringComparer]::OrdinalIgnoreCase)
+        foreach ($declaration in $Declarations)
+        {
+            $name = if ($declaration.Groups['quoted'].Success) { $declaration.Groups['quoted'].Value.Replace("''", "'") } else { $declaration.Groups['plain'].Value }
+            if (-not $names.ContainsKey($name)) { $names[$name] = New-Object 'System.Collections.Generic.List[System.Text.RegularExpressions.Match]' }
+            $names[$name].Add($declaration)
+        }
+
+        foreach ($group in $names.Values)
+        {
+            if ($group.Count -lt 2) { continue }
+            $scope = if ($Table) { "table '$Table'" } else { 'the query list' }
+            $conflicting = ($group | ForEach-Object { if ($_.Groups['quoted'].Success) { $_.Groups['quoted'].Value.Replace("''", "'") } else { $_.Groups['plain'].Value } }) -join ', '
+            $lines = ($group | ForEach-Object { [regex]::Matches($Text.Substring(0, $_.Index), "`n").Count + 1 }) -join ', '
+            $List.Add([PSCustomObject]@{
+                    Table   = $Table
+                    File    = $File
+                    Message = "$File`: $scope declares names that only differ by case ($conflicting) on lines $lines. Power BI treats names as case-insensitive, so one of them must be renamed or removed."
+                })
+        }
+    }
+
+    $namePattern = "(?:'(?<quoted>(?:[^']|'')*)'|(?<plain>[^\s=]+))"
+
+    Get-ChildItem "$DefinitionDir/tables" -Filter '*.tmdl' -ErrorAction SilentlyContinue `
+    | ForEach-Object {
+        $file = $_
+        $text = [System.IO.File]::ReadAllText($file.FullName)
+        $tableMatch = [regex]::Match($text, "(?m)^table\s+$namePattern")
+        $tableName = if (-not $tableMatch.Success) { $file.BaseName } elseif ($tableMatch.Groups['quoted'].Success) { $tableMatch.Groups['quoted'].Value.Replace("''", "'") } else { $tableMatch.Groups['plain'].Value }
+
+        # Matching the whole file at once is much faster than reading line by line in PowerShell
+        Add-Conflict $conflicts $tableName $file.Name $text ([regex]::Matches($text, "(?m)^\t(?:column|measure)\s+$namePattern"))
+    }
+
+    $expressionFile = "$DefinitionDir/expressions.tmdl"
+    if (Test-Path $expressionFile)
+    {
+        $text = [System.IO.File]::ReadAllText($expressionFile)
+        Add-Conflict $conflicts $null 'expressions.tmdl' $text ([regex]::Matches($text, "(?m)^expression\s+$namePattern"))
+    }
+
+    return , $conflicts.ToArray()
+}
+
+<#
+    .SYNOPSIS
+    Copies a semantic model, keeping only the specified tables.
+
+    .DESCRIPTION
+    Tables are removed from disk before the model is loaded so that tables no report ships
+    cannot block the build. Relationships that point at a removed table and the matching
+    "ref table" entries in model.tmdl are removed at the same time to keep the model loadable.
+#>
+function Export-PrunedDataset([string] $SourceDir, [string] $TargetDir, [string[]] $KeepTables)
+{
+    $keep = ConvertTo-NameSet $KeepTables
+
+    Remove-Item $TargetDir -Recurse -Force -ErrorAction SilentlyContinue
+    New-Item (Split-Path $TargetDir -Parent) -ItemType Directory -Force | Out-Null
+    Copy-Item $SourceDir $TargetDir -Recurse -Force
+
+    $definitionDir = "$TargetDir/definition"
+    $dropped = New-Object System.Collections.Generic.List[string]
+    $kept = New-Object System.Collections.Generic.List[string]
+
+    # Remove table files that aren't needed
+    Get-ChildItem "$definitionDir/tables" -Filter '*.tmdl' `
+    | ForEach-Object {
+        $file = $_
+        $tableName = $file.BaseName
+        foreach ($line in [System.IO.File]::ReadAllLines($file.FullName))
+        {
+            if ($line -match '^table\s+(?<rest>.+)$') { $tableName = ConvertFrom-TmdlDeclaration $Matches.rest; break }
+        }
+
+        if ($keep.Contains($tableName))
+        {
+            $kept.Add($tableName)
+        }
+        else
+        {
+            Write-Verbose "  Removing table: $tableName"
+            $dropped.Add($tableName)
+            Remove-Item $file.FullName -Force
+        }
+    }
+
+    $droppedSet = ConvertTo-NameSet $dropped
+
+    # Remove "ref table" entries for removed tables
+    $modelFile = "$definitionDir/model.tmdl"
+    $modelLines = [System.IO.File]::ReadAllLines($modelFile)
+    $keptModelLines = $modelLines | Where-Object {
+        if ($_ -notmatch '^ref table\s+(?<rest>.+)$') { return $true }
+        return -not $droppedSet.Contains((ConvertFrom-TmdlDeclaration $Matches.rest))
+    }
+    Write-TextFile $modelFile $keptModelLines
+
+    # Remove relationships that point at a removed table
+    $removedRelationships = 0
+    $relationshipFile = "$definitionDir/relationships.tmdl"
+    if (Test-Path $relationshipFile)
+    {
+        $lines = [System.IO.File]::ReadAllLines($relationshipFile)
+        $starts = @(0..($lines.Count - 1) | Where-Object { $lines[$_] -match '^relationship\s' })
+
+        if ($starts.Count -gt 0)
+        {
+            $output = New-Object System.Collections.Generic.List[string]
+            for ($i = 0; $i -lt $starts[0]; $i++) { $output.Add($lines[$i]) }
+
+            for ($b = 0; $b -lt $starts.Count; $b++)
+            {
+                $start = $starts[$b]
+                $end = if ($b + 1 -lt $starts.Count) { $starts[$b + 1] - 1 } else { $lines.Count - 1 }
+
+                $block = New-Object System.Collections.Generic.List[string]
+                $referencesDropped = $false
+                for ($i = $start; $i -le $end; $i++)
+                {
+                    $block.Add($lines[$i])
+                    if ($lines[$i] -match '^\s*(from|to)Column:\s*(?<ref>.+)$')
+                    {
+                        if ($droppedSet.Contains((Get-TmdlReferenceTable $Matches.ref))) { $referencesDropped = $true }
+                    }
+                }
+
+                if ($referencesDropped)
+                {
+                    $removedRelationships++
+                    continue
+                }
+
+                while ($block.Count -gt 0 -and [string]::IsNullOrWhiteSpace($block[$block.Count - 1])) { $block.RemoveAt($block.Count - 1) }
+                $block | ForEach-Object { $output.Add($_) }
+                $output.Add('')
+            }
+
+            Write-TextFile $relationshipFile $output
+        }
+    }
+
+    # Drop model diagram nodes for removed tables so the diagram matches the model
+    $diagramFile = "$TargetDir/diagramLayout.json"
+    if (Test-Path $diagramFile)
+    {
+        $diagram = Get-Content $diagramFile -Raw | ConvertFrom-Json -Depth 100
+        foreach ($layout in $diagram.diagrams)
+        {
+            $layout.nodes = @($layout.nodes | Where-Object { $keep.Contains($_.nodeIndex) })
+        }
+        $diagram | ConvertTo-Json -Depth 100 | Set-Content $diagramFile -NoNewline
+    }
+
+    return [PSCustomObject]@{
+        Kept                 = $kept.ToArray()
+        Dropped              = $dropped.ToArray()
+        RemovedRelationships = $removedRelationships
+    }
+}
+
+<#
+    .SYNOPSIS
+    Stamps the version into a report and confirms the Get started page is the active page.
+#>
+function Get-ReportLayout([string] $ReportDir, [string] $ReportLabel)
+{
+    $json = (Get-Content "$ReportDir/report.json" -Raw) `
+        -replace '\$\$ftkver\$\$', $version `
+        -replace '\$\$build-date\$\$', $buildDate
+
+    $report = $json | ConvertFrom-Json -Depth 100
+
+    # Pages are stored in an arbitrary order and displayed by ordinal, so the active page index
+    # is an index into the display order, not into the sections array.
+    $displayOrder = @($report.sections | Sort-Object @{ Expression = { if ($null -eq $_.ordinal) { 0 } else { $_.ordinal } } })
+    $expected = [array]::FindIndex($displayOrder, [Predicate[object]] { param($section) $section.displayName -eq 'Get started' })
+
+    if ($expected -lt 0)
+    {
+        Write-Warning "$ReportLabel has no 'Get started' page. Leaving the active page unchanged."
+        return $json
+    }
+
+    $config = $report.config | ConvertFrom-Json -Depth 100
+    if ($config.activeSectionIndex -eq $expected) { return $json }
+
+    Write-Warning "$ReportLabel opens on '$($displayOrder[$config.activeSectionIndex].displayName)'. Resetting to 'Get started'."
+    $config.activeSectionIndex = $expected
+    $report.config = $config | ConvertTo-Json -Depth 100 -Compress
+    return ($report | ConvertTo-Json -Depth 100)
+}
+
+<#
+    .SYNOPSIS
+    Lists the table and query names declared in a TMDL model folder without loading the model.
+#>
+function Get-TmdlObjectName([string] $DefinitionDir)
+{
+    $names = New-Object System.Collections.Generic.List[string]
+
+    Get-ChildItem "$DefinitionDir/tables" -Filter '*.tmdl' -ErrorAction SilentlyContinue `
+    | ForEach-Object {
+        foreach ($line in [System.IO.File]::ReadAllLines($_.FullName))
+        {
+            if ($line -match '^table\s+(?<rest>.+)$') { $names.Add((ConvertFrom-TmdlDeclaration $Matches.rest)); break }
+        }
+    }
+
+    $expressionFile = "$DefinitionDir/expressions.tmdl"
+    if (Test-Path $expressionFile)
+    {
+        foreach ($line in [System.IO.File]::ReadAllLines($expressionFile))
+        {
+            if ($line -match '^expression\s+(?<rest>.+)$') { $names.Add((ConvertFrom-TmdlDeclaration $Matches.rest)) }
+        }
+    }
+
+    return , $names.ToArray()
+}
+
+<#
+    .SYNOPSIS
+    Lists the tables and queries that visuals and filters in a report read from.
+
+    .DESCRIPTION
+    Only "From" clauses are read, because those are what Power BI queries. Other entity references,
+    like conditional formatting selectors, are ignored when the entity doesn't exist.
+#>
+function Get-ReportEntityReference([string] $ReportJson)
+{
+    $references = New-Object System.Collections.Generic.List[object]
+    $report = $ReportJson | ConvertFrom-Json -Depth 100
+
+    function Add-Reference($List, [string] $Json, [string] $Page, [bool] $Hidden, [string] $Source)
+    {
+        if (-not $Json) { return }
+        foreach ($from in [regex]::Matches($Json, '"From"\s*:\s*\[(?<items>[^\]]*)\]'))
+        {
+            foreach ($entity in [regex]::Matches($from.Groups['items'].Value, '"Entity"\s*:\s*"(?<name>(?:[^"\\]|\\.)*)"'))
+            {
+                $List.Add([PSCustomObject]@{
+                        Entity = [regex]::Unescape($entity.Groups['name'].Value)
+                        Page   = $Page
+                        Hidden = $Hidden
+                        Source = $Source
+                    })
+            }
+        }
+    }
+
+    Add-Reference $references $report.filters '(all pages)' $false 'report filters'
+
+    foreach ($section in @($report.sections))
+    {
+        # Configs are JSON strings. Parsing each one is slow, so only the needed values are matched.
+        $hidden = "$($section.config)" -match '"visibility"\s*:\s*1\b'
+        Add-Reference $references $section.filters $section.displayName $hidden 'page filters'
+
+        foreach ($visual in @($section.visualContainers))
+        {
+            $visualType = [regex]::Match("$($visual.config)", '"visualType"\s*:\s*"(?<value>[^"]+)"').Groups['value'].Value
+            $visualName = [regex]::Match("$($visual.config)", '"name"\s*:\s*"(?<value>[^"]+)"').Groups['value'].Value
+            $label = "$visualType visual $visualName".Trim()
+            Add-Reference $references $visual.config $section.displayName $hidden $label
+            Add-Reference $references $visual.filters $section.displayName $hidden $label
+            Add-Reference $references $visual.query $section.displayName $hidden $label
+        }
+    }
+
+    return , $references.ToArray()
+}
+
+<#
+    .SYNOPSIS
+    Removes comments and string literals from Power Query (M) or DAX so names can be matched safely.
+
+    .DESCRIPTION
+    Quoted identifiers are kept: #"Name" in M and 'Name' in DAX.
+#>
+function Remove-ExpressionLiteral([string] $Expression, [ValidateSet('M', 'DAX')] [string] $Language)
+{
+    if (-not $Expression) { return '' }
+
+    $pattern = if ($Language -eq 'M')
+    {
+        '(?<keep>#"(?:[^"]|"")*")|(?<drop>"(?:[^"]|"")*")|(?<drop>//[^\n]*)|(?<drop>/\*.*?\*/)'
+    }
+    else
+    {
+        "(?<keep>'(?:[^']|'')*')|(?<drop>`"(?:[^`"]|`"`")*`")|(?<drop>//[^\n]*)|(?<drop>--[^\n]*)|(?<drop>/\*.*?\*/)"
+    }
+
+    return [regex]::Replace($Expression, $pattern, {
+            param($match)
+            if ($match.Groups['keep'].Success) { return $match.Value }
+            if ($match.Value.StartsWith('"')) { return '""' }
+            return ' '
+        }, [System.Text.RegularExpressions.RegexOptions]::Singleline)
+}
+
+<#
+    .SYNOPSIS
+    Finds references to removed tables or queries in the expressions that remain in a model.
+
+    .DESCRIPTION
+    A query or measure that references something the allowlist removed loads fine but fails on
+    refresh or shows an error in the report. Catching it at build time turns that into a specific
+    message instead of a broken demo report or template.
+#>
+function Get-MissingDependency($Database, [string[]] $RemovedNames)
+{
+    $missing = New-Object System.Collections.Generic.List[object]
+    if (-not $RemovedNames -or $RemovedNames.Count -eq 0) { return , $missing.ToArray() }
+
+    function Test-Reference([string] $Text, [string] $Name, [string] $Language)
+    {
+        if ($Language -eq 'M')
+        {
+            $quoted = '#"' + $Name.Replace('"', '""') + '"'
+            if ($Text.Contains($quoted)) { return $true }
+            if ($Name -notmatch '^[A-Za-z_][A-Za-z0-9_.]*$') { return $false }
+
+            $escaped = [regex]::Escape($Name)
+            # A let variable with the same name shadows the query, so it isn't a reference
+            if ($Text -match "(?<![\w.#\[])$escaped\s*=(?![=>])") { return $false }
+            return $Text -match "(?<![\w.#\[])$escaped(?![\w\]])"
+        }
+
+        $quoted = "'" + $Name.Replace("'", "''") + "'"
+        if ($Text.Contains($quoted)) { return $true }
+        if ($Name -notmatch '^[A-Za-z_][A-Za-z0-9_]*$') { return $false }
+        $escaped = [regex]::Escape($Name)
+        return $Text -match "(?<![\w'\[])$escaped(?![\w'\]])"
+    }
+
+    function Add-Missing($List, [string] $Owner, [string] $Expression, [string] $Language)
+    {
+        $text = Remove-ExpressionLiteral $Expression $Language
+        foreach ($name in $RemovedNames)
+        {
+            if (Test-Reference $text $name $Language)
+            {
+                $List.Add([PSCustomObject]@{ Owner = $Owner; Name = $name; Language = $Language })
+            }
+        }
+    }
+
+    foreach ($expression in @($Database.Model.Expressions))
+    {
+        Add-Missing $missing "query '$($expression.Name)'" $expression.Expression 'M'
+    }
+
+    foreach ($table in @($Database.Model.Tables))
+    {
+        foreach ($partition in @($table.Partitions))
+        {
+            $language = if ("$($partition.SourceType)" -eq 'Calculated') { 'DAX' } else { 'M' }
+            Add-Missing $missing "table '$($table.Name)'" $partition.Source.Expression $language
+        }
+        if ($table.RefreshPolicy -and $table.RefreshPolicy.SourceExpression)
+        {
+            Add-Missing $missing "table '$($table.Name)' refresh policy" $table.RefreshPolicy.SourceExpression 'M'
+        }
+        foreach ($measure in @($table.Measures))
+        {
+            Add-Missing $missing "measure '$($table.Name)'[$($measure.Name)]" $measure.Expression 'DAX'
+        }
+        foreach ($column in @($table.Columns | Where-Object { "$($_.Type)" -eq 'Calculated' }))
+        {
+            Add-Missing $missing "column '$($table.Name)'[$($column.Name)]" $column.Expression 'DAX'
+        }
+    }
+
+    return , $missing.ToArray()
+}
+
+function Assert-NoMissingDependency($Database, [string[]] $RemovedNames, [string] $Label, [string] $ReportName)
+{
+    $dependencies = Get-MissingDependency $Database $RemovedNames
+    if ($dependencies.Count -eq 0) { return }
+
+    $details = ($dependencies | ForEach-Object { "    $($_.Owner) uses '$($_.Name)'" }) -join "`n"
+    $names = ($dependencies | ForEach-Object { "'$($_.Name)'" } | Sort-Object -Unique) -join ', '
+    throw "$Label needs $names, which reports.json removes:`n$details`nAdd the missing names to the $ReportName report in src/power-bi/reports.json, or remove the reference."
+}
+
+#endregion Helpers
+
+#region Setup
+
+& "$PSScriptRoot/New-Directory.ps1" $relDir
+& "$PSScriptRoot/New-Directory.ps1" $pbitDir
+
 # Cleanup
 Write-Verbose "Removing existing ZIP files..."
 if ($KQL)
-{ 
-    Remove-Item "$pbitDir/../PowerBI-kql.zip" -Force -ErrorAction SilentlyContinue
+{
+    Remove-Item "$relDir/PowerBI-kql.zip" -Force -ErrorAction SilentlyContinue
     Remove-Item "$pbitDir/*.kql.pbit" -Force -ErrorAction SilentlyContinue
 }
 if ($Storage)
-{ 
-    Remove-Item "$pbitDir/../PowerBI-storage.zip" -Force -ErrorAction SilentlyContinue
+{
+    Remove-Item "$relDir/PowerBI-storage.zip" -Force -ErrorAction SilentlyContinue
     Remove-Item "$pbitDir/*.storage.pbit" -Force -ErrorAction SilentlyContinue
 }
 
+# Remove generated projects from earlier builds, but never saved PBIX files. Package-PowerBI
+# detects PBIX files saved from an older build and asks for them to be saved again.
+if (Test-Path $pbixDir)
+{
+    $selectedTypes = @(if ($KQL) { 'kql' }) + @(if ($Storage) { 'storage' })
+    Get-ChildItem $pbixDir -Force `
+    | Where-Object { $_.Name -match '^(?<name>[^.]+)\.(?<type>kql|storage)\.(pbip|Report|Dataset)$' -and $selectedTypes -contains $Matches.type -and $Matches.name -like "*$Name*" } `
+    | Remove-Item -Recurse -Force
+
+    # A folder named like a PBIX is left over from an older build and blocks saving one
+    Get-ChildItem $pbixDir -Force -Directory `
+    | Where-Object { $_.Name -match '^(?<name>[^.]+)\.(?<type>kql|storage)\.pbix$' -and $selectedTypes -contains $Matches.type -and $Matches.name -like "*$Name*" } `
+    | ForEach-Object {
+        Write-Warning "Removing $($_.Name), which is a folder where a PBIX file belongs."
+        Remove-Item $_.FullName -Recurse -Force
+    }
+    if ($Name -eq '*' -and $KQL -and $Storage) { Remove-Item "$pbixDir/.manifest.json" -Force -ErrorAction SilentlyContinue }
+}
+
 # Select report types
 $types = @()
 if ($KQL) { $types += "*$Name*.kql.pbip" } # cSpell:ignore PBIP
 if ($Storage) { $types += "*$Name*.storage.pbip" }
 
 # Get reports
-$reports = Get-ChildItem $srcDir -Recurse -Include $types
-Write-Host "Building $($reports.Count) Power BI report template$(if ($reports.Count -ne 1) { 's' })..."
-
-function Write-UTF16LE($File, $Content, $Json)
+$reports = @(Get-ChildItem $srcDir -Recurse -Include $types | Sort-Object FullName)
+if ($reports.Count -eq 0)
 {
-    Write-Verbose "  Writing UTF-16LE file: $($File.Name)..."
-    if ($Json) { $Content = [PSCustomObject]$Json | ConvertTo-Json -Depth 5 -Compress }
-    [System.IO.File]::WriteAllBytes($File, [System.Text.Encoding]::Unicode.GetBytes($Content))
+    throw "No Power BI projects matched '$Name'. Confirm the report name."
 }
+Write-Host "Building $($reports.Count) Power BI report$(if ($reports.Count -ne 1) { 's' })..."
 
 # Setup dependencies
 if (-not (Get-Package Microsoft.AnalysisServices -ErrorAction SilentlyContinue))
 {
-    # $adminCheck = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
-    # $isAdmin = $adminCheck.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
-
-    # Write-Host "The Microsoft.AnalysisServices package is required to build the data model."
-    # if ($isAdmin)
-    # {
-    #     Write-Host "  This window cannot run admin commands."
-    #     Write-Host "  ⚠️ Please run this command in an admin elevated prompt: Install-Package Microsoft.AnalysisServices -ProviderName NuGet"
-    #     return
-    # }
-    # else
-    # {
-    #     Write-Host "  Installing the the Analysis Services package..."
-    #     Install-Package Microsoft.AnalysisServices -Force
-    # }
-
-    Write-Verbose "  Installing the the Analysis Services package..."
+    Write-Verbose "  Installing the Analysis Services package..."
     Write-Verbose "  PRO TIP: Install via an admin prompt to speed up future runs!"
     Install-Package -Name Microsoft.AnalysisServices -ProviderName NuGet -Scope CurrentUser -Force
 }
@@ -105,104 +666,250 @@ $dllPath = "$((Get-Item (Get-Package Microsoft.AnalysisServices).Source).Directo
 Write-Verbose "  Adding type from $dllPath"
 Add-Type -Path $dllPath
 
-# Loop thru reports
-$reports | ForEach-Object {
-    $inputFile = $_
+#endregion Setup
+
+#region Build
+
+$conflictCache = @{}
+$sourceNameCache = @{}
+$manifest = New-Object System.Collections.Generic.List[object]
+$allowlistEntries = New-Object System.Collections.Generic.HashSet[string]
+$allowlistMatches = New-Object System.Collections.Generic.HashSet[string]
+
+foreach ($inputFile in $reports)
+{
     $reportName = $inputFile.Name.Split('.')[0]
+    $reportType = $inputFile.Name.Split('.')[1] # Extract "kql" or "storage" from filename
+    $baseName = "$reportName.$reportType"
     $folder = $inputFile.DirectoryName
     $reportDir = "$folder/$reportName.Report"
     $datasetDir = "$folder/Shared.Dataset"
-    $reportType = $inputFile.Name.Split('.')[1] # Extract "kql" or "storage" from filename
-    Write-Verbose "Processing $($inputFile.Name)..."
 
-    $metadata = @{
-        CostSummary          = @{
-            Intro       = "The Cost summary report provides several summaries of your effective (amortized) and billed costs based on the FinOps Open Cost and Usage Specification (FOCUS). Amortization breaks down reservation and savings plan purchases and allocates costs to the resources that received the benefit. Effective costs will not match your invoice."
-            Tables      = @("Costs", "Prices", "PricingUnits")
-            Expressions = @("▶️  START HERE", "Cluster URL", "[storage]Storage URL", "Default Granularity", "Number of Months", "RangeStart", "RangeEnd", "Experimental: Add Missing Prices", "Deprecated: Perform Extra Query Optimizations", "ftk_DatetimeToJulianDate", "ftk_ImpalaToJulianDate", "ftk_Metadata", "ftk_ParseResourceId", "ftk_ParseResourceName", "ftk_ParseResourceType", "ftk_Storage")
-        }
-        Invoicing            = @{
-            Intro       = "The Invoicing and chargeback report provides several summaries of your billed cost to facilitate invoice reconciliation for Microsoft Customer Agreement (MCA) and Enterprise Agreement (EA) accounts or to perform chargeback using effective (amortized) costs."
-            Tables      = @("Costs", "Prices", "PricingUnits")
-            Expressions = @("▶️  START HERE", "Cluster URL", "[storage]Storage URL", "Default Granularity", "Number of Months", "RangeStart", "RangeEnd", "Experimental: Add Missing Prices", "Deprecated: Perform Extra Query Optimizations", "ftk_DatetimeToJulianDate", "ftk_ImpalaToJulianDate", "ftk_Metadata", "ftk_ParseResourceId", "ftk_ParseResourceName", "ftk_ParseResourceType", "ftk_Storage")
-        }
-        DataIngestion        = @{
-            Intro       = "The Data ingestion report provides details about the data you've ingested into your FinOps hub storage account."
-            Tables      = @("Costs", "HubScopes", "HubSettings", "Prices", "PricingUnits", "StorageData", "StorageErrors")
-            Expressions = @("▶️  START HERE", "Cluster URL", "Storage URL", "Default Granularity", "Number of Months", "RangeStart", "RangeEnd", "Experimental: Add Missing Prices", "Deprecated: Perform Extra Query Optimizations", "ftk_DatetimeToJulianDate", "ftk_ImpalaToJulianDate", "ftk_Metadata", "ftk_ParseResourceId", "ftk_ParseResourceName", "ftk_ParseResourceType", "ftk_Storage")
-        }
-        Governance           = @{
-            Intro       = "The Governance, policy, and risk report summarizes your Microsoft Cloud governance posture. It offers the standard metrics aligned with the Cloud Adoption Framework to facilitate identifying issues, applying recommendations, and resolving compliance gaps."
-            Tables      = @("AdvisorRecommendations", "Compliance calculation", "Costs", "Disks", "ManagementGroups", "NetworkInterfaces", "NetworkSecurityGroups", "PolicyAssignments", "PolicyDefinitions", "PolicyStates", "Prices", "PricingUnits", "PublicIPAddresses", "Regions", "Resources", "ResourceTypes", "SqlDatabases", "Subscriptions", "VirtualMachines")
-            Expressions = @("▶️  START HERE", "Cluster URL", "[storage]Storage URL", "Default Granularity", "Number of Months", "RangeStart", "RangeEnd", "Experimental: Add Missing Prices", "Remove Duplicate Resource IDs", "Deprecated: Perform Extra Query Optimizations", "ftk_ARGBatchSize", "ftk_DemoFilter", "ftk_QueryARG", "ftk_DatetimeToJulianDate", "ftk_ImpalaToJulianDate", "ftk_Metadata", "ftk_ParseResourceId", "ftk_ParseResourceName", "ftk_ParseResourceType", "ftk_Storage")
+    Write-Host "  $baseName..."
+
+    $metadata = $reportMetadata[$reportName]
+    if (-not $metadata) { throw "No build metadata is defined for the '$reportName' report. Add it to src/power-bi/reports.json." }
+
+    $keepTables = Resolve-Allowlist $metadata.Tables $reportType
+    $keepExpressions = Resolve-Allowlist $metadata.Expressions $reportType
+
+    # Fail on name conflicts this report ships; report the rest once per model
+    if (-not $conflictCache.ContainsKey($datasetDir))
+    {
+        $conflictCache[$datasetDir] = Get-TmdlNameConflict "$datasetDir/definition"
+        $conflictCache[$datasetDir] | ForEach-Object { Write-Warning "$($_.Message) It was left out of this build." }
+    }
+    foreach ($conflict in $conflictCache[$datasetDir])
+    {
+        if ($conflict.Table -and -not ($keepTables -contains $conflict.Table)) { continue }
+        throw "$($conflict.Message) The $baseName report needs it, so the build cannot continue."
+    }
+
+    # Prune the model on disk, then load it
+    $stagedDataset = "$pbixDir/$baseName.Dataset"
+    $pruned = Export-PrunedDataset $datasetDir $stagedDataset $keepTables
+    Write-Verbose "  Kept $($pruned.Kept.Count) tables, dropped $($pruned.Dropped.Count), removed $($pruned.RemovedRelationships) relationships"
+
+    $db = [Microsoft.AnalysisServices.Tabular.TmdlSerializer]::DeserializeDatabaseFromFolder("$stagedDataset/definition") # cSpell:ignore TMDL
+
+    # Remove queries this report doesn't use
+    $keepExpressionSet = ConvertTo-NameSet $keepExpressions
+    @($db.Model.Expressions) `
+    | Where-Object { -not $keepExpressionSet.Contains($_.Name) } `
+    | ForEach-Object {
+        Write-Verbose "  Removing query: $($_.Name)"
+        $db.Model.Expressions.Remove($_) | Out-Null
+    }
+
+    if (-not $sourceNameCache.ContainsKey($datasetDir)) { $sourceNameCache[$datasetDir] = Get-TmdlObjectName "$datasetDir/definition" }
+    $sourceNames = $sourceNameCache[$datasetDir]
+    $survivingNames = ConvertTo-NameSet (@($db.Model.Tables | ForEach-Object { $_.Name }) + @($db.Model.Expressions | ForEach-Object { $_.Name }))
+    $removedNames = @($sourceNames | Where-Object { -not $survivingNames.Contains($_) })
+    $isDemo = $demoTypes -contains $reportType
+
+    # Confirm every visual reads from something the model still has
+    $sourceNameSet = ConvertTo-NameSet $sourceNames
+    $brokenVisuals = New-Object System.Collections.Generic.List[string]
+    $entityReferences = Get-ReportEntityReference (Get-Content "$reportDir/report.json" -Raw)
+    $removedReferences = @($entityReferences | Where-Object { -not $survivingNames.Contains($_.Entity) })
+
+    # Stale references to tables that no longer exist anywhere are ignored by Power BI
+    $removedReferences `
+    | Where-Object { -not $sourceNameSet.Contains($_.Entity) } `
+    | Group-Object Entity `
+    | ForEach-Object { Write-Verbose "  $($_.Count) references to '$($_.Name)', which isn't in the model." }
+
+    # Hidden pages can't be seen, so a broken visual there is reported without failing the build
+    $removedReferences `
+    | Where-Object { $sourceNameSet.Contains($_.Entity) -and $_.Hidden } `
+    | Group-Object Page `
+    | ForEach-Object {
+        $entities = ($_.Group.Entity | Sort-Object -Unique | ForEach-Object { "'$_'" }) -join ', '
+        Write-Warning "$baseName hidden '$($_.Name)' page reads from $entities, which reports.json removes. The build continues because the page is hidden."
+    }
+
+    $removedReferences `
+    | Where-Object { $sourceNameSet.Contains($_.Entity) -and -not $_.Hidden } `
+    | Group-Object Entity, Page, Source `
+    | ForEach-Object { $brokenVisuals.Add("    '$($_.Group[0].Page)' page $($_.Group[0].Source) reads from '$($_.Group[0].Entity)'") }
+
+    if ($brokenVisuals.Count -gt 0)
+    {
+        throw "$baseName has visuals that read from tables reports.json removes:`n$($brokenVisuals -join "`n")`nAdd the tables to the $reportName report in src/power-bi/reports.json."
+    }
+
+    # Track allowlist entries that match nothing. These are only reported once every report type
+    # has been built, because most entries only exist in one of the two models by design.
+    $modelNames = ConvertTo-NameSet (@($db.Model.Tables | ForEach-Object { $_.Name }) + @($db.Model.Expressions | ForEach-Object { $_.Name }))
+    foreach ($entry in @($keepTables + $keepExpressions))
+    {
+        $null = $allowlistEntries.Add("$reportName|$entry")
+        if ($modelNames.Contains($entry)) { $null = $allowlistMatches.Add("$reportName|$entry") }
+    }
+
+    # Rebuild the query pane order from what survived
+    $queryOrder = $db.Model.Annotations | Where-Object { $_.Name -eq 'PBI_QueryOrder' } | Select-Object -First 1
+    if ($queryOrder)
+    {
+        $surviving = @($db.Model.Expressions | ForEach-Object { $_.Name }) + @($db.Model.Tables | ForEach-Object { $_.Name })
+        $survivingSet = ConvertTo-NameSet $surviving
+
+        $previous = @()
+        try { $previous = @($queryOrder.Value | ConvertFrom-Json) } catch { Write-Verbose "  Could not read the existing query order; rebuilding it." }
+
+        $ordered = New-Object System.Collections.Generic.List[string]
+        $previous | Where-Object { $survivingSet.Contains($_) } | ForEach-Object { $ordered.Add($_) }
+        $surviving | Where-Object { $ordered -notcontains $_ } | ForEach-Object { $ordered.Add($_) }
+
+        $queryOrder.Value = $ordered | ConvertTo-Json -Depth 1 -Compress -AsArray
+    }
+
+    #region PBIP project
+
+    # Only report types that ship as demo PBIX files need a project to save from
+    if ($isDemo -and -not $NoPbip)
+    {
+        # The demo project keeps the demo data source, so check it before template changes
+        Assert-NoMissingDependency $db $removedNames "The $baseName demo project" $reportName
+
+        # The template is rendered from the same model, so every demo-only change is undone after
+        $demoEdits = New-Object System.Collections.Generic.List[object]
+
+        foreach ($table in @($db.Model.Tables))
+        {
+            foreach ($partition in @($table.Partitions | Where-Object { $_.Source.Expression -match 'releases/latest/download/' }))
+            {
+                $demoEdits.Add([PSCustomObject]@{ Object = $partition.Source; Expression = $partition.Source.Expression })
+                # A demo report that can't read open data is only found when someone refreshes
+                # it, so the URL is checked here, while it's cheap to fix
+                foreach ($match in [regex]::Matches($partition.Source.Expression, 'https://github\.com/microsoft/finops-toolkit/releases/latest/download/(?<file>[^"]+)'))
+                {
+                    $file = $match.Groups['file'].Value
+                    $url = "$openDataUrl/$file"
+                    if (-not $openDataChecked.ContainsKey($url))
+                    {
+                        $response = Invoke-WebRequest $url -Method Head -SkipHttpErrorCheck -ErrorAction SilentlyContinue
+                        $openDataChecked[$url] = $response.StatusCode -eq 200
+                    }
+                    if (-not $openDataChecked[$url])
+                    {
+                        throw "Demo reports read open data from $url, which isn't published yet. Merge to main before packaging Power BI, or pass -OpenDataUrl with a branch that has $file."
+                    }
+                    Write-Verbose "  Demo open data for $($table.Name): $url"
+                }
+
+                $partition.Source.Expression = $partition.Source.Expression -replace 'https://github\.com/microsoft/finops-toolkit/releases/latest/download/', "$openDataUrl/"
+            }
         }
-        RateOptimization     = @{
-            Intro       = "The Rate optimization report provides insights into any rate optimization opportunities, like reservations, savings plans, and Azure Hybrid Benefit. This report uses effective cost, which amortizes and breaks reservation and savings plan purchases down and allocates costs out to the resources that received the benefit. Effective cost will not match your invoice."
-            Tables      = @("Costs", "InstanceSizeFlexibility", "Prices", "PricingUnits", "ReservationRecommendations")
-            Expressions = @("▶️  START HERE", "Cluster URL", "[storage]Storage URL", "Default Granularity", "Number of Months", "RangeStart", "RangeEnd", "Experimental: Add Missing Prices", "Deprecated: Perform Extra Query Optimizations", "ftk_DatetimeToJulianDate", "ftk_ImpalaToJulianDate", "ftk_Metadata", "ftk_ParseResourceId", "ftk_ParseResourceName", "ftk_ParseResourceType", "ftk_Storage")
+
+
+        # Re-serialize the pruned model so the PBIP matches what the PBIT ships
+        Remove-Item "$stagedDataset/definition" -Recurse -Force
+        [Microsoft.AnalysisServices.Tabular.TmdlSerializer]::SerializeDatabaseToFolder($db, "$stagedDataset/definition")
+
+        $platformFile = "$stagedDataset/.platform"
+        if (Test-Path $platformFile)
+        {
+            $platform = Get-Content $platformFile -Raw | ConvertFrom-Json
+            $platform.metadata.displayName = $baseName
+            $platform.config.logicalId = [guid]::NewGuid().ToString()
+            $platform | ConvertTo-Json -Depth 10 | Set-Content $platformFile -NoNewline
         }
-        WorkloadOptimization = @{
-            Intro       = "The Usage optimization report provides insights into resource utilization and efficiency opportunities based on historical usage patterns. Use this report to determine if resources can be scaled down or even shut down during off-peak hours to minimize wasteful usage and spending. Also consider cheaper alternatives when available and ensure all workloads have some direct or indirect link to business value to avoid unnecessary usage and costs that don't contribute to the mission."
-            Tables      = @("AdvisorRecommendations", "Costs", "Disks", "Prices", "PricingUnits", "Resources", "Subscriptions")
-            Expressions = @("▶️  START HERE", "Cluster URL", "[storage]Storage URL", "Default Granularity", "Number of Months", "RangeStart", "RangeEnd", "Experimental: Add Missing Prices", "Remove Duplicate Resource IDs", "Deprecated: Perform Extra Query Optimizations", "ftk_ARGBatchSize", "ftk_DemoFilter", "ftk_QueryARG", "ftk_DatetimeToJulianDate", "ftk_ImpalaToJulianDate", "ftk_Metadata", "ftk_ParseResourceId", "ftk_ParseResourceName", "ftk_ParseResourceType", "ftk_Storage")
+
+        # Report
+        $stagedReport = "$pbixDir/$baseName.Report"
+        Remove-Item $stagedReport -Recurse -Force -ErrorAction SilentlyContinue
+        Copy-Item $reportDir $stagedReport -Recurse -Force
+
+        [System.IO.File]::WriteAllText("$stagedReport/report.json", (Get-ReportLayout $reportDir $baseName), $script:Utf8NoBom)
+
+        @{
+            '$schema'        = 'https://developer.microsoft.com/json-schemas/fabric/item/report/definitionProperties/1.0.0/schema.json'
+            version          = '4.0'
+            datasetReference = @{ byPath = @{ path = "../$baseName.Dataset" } }
+        } | ConvertTo-Json -Depth 10 | Set-Content "$stagedReport/definition.pbir" -NoNewline
+
+        $reportPlatformFile = "$stagedReport/.platform"
+        if (Test-Path $reportPlatformFile)
+        {
+            $reportPlatform = Get-Content $reportPlatformFile -Raw | ConvertFrom-Json
+            $reportPlatform.metadata.displayName = $baseName
+            $reportPlatform.config.logicalId = [guid]::NewGuid().ToString()
+            $reportPlatform | ConvertTo-Json -Depth 10 | Set-Content $reportPlatformFile -NoNewline
         }
-    }[$reportName]
 
-    # Create folder structure
-    $targetFile = "$pbitDir/$($inputFile.Name.Replace('.pbip', ''))"
+        # Project file
+        @{
+            '$schema' = 'https://developer.microsoft.com/json-schemas/fabric/pbip/pbipProperties/1.0.0/schema.json'
+            version   = '1.0'
+            artifacts = @(@{ report = @{ path = "$baseName.Report" } })
+            settings  = @{ enableAutoRecovery = $true }
+        } | ConvertTo-Json -Depth 10 | Set-Content "$pbixDir/$baseName.pbip" -NoNewline
+
+        # Templates ship the public data source and open data URLs, not the demo ones
+        foreach ($edit in $demoEdits) { $edit.Object.Expression = $edit.Expression }
+    }
+
+    #endregion PBIP project
+
+    #region PBIT template
+
+    $targetFile = "$pbitDir/$baseName"
     Remove-Item $targetFile -Recurse -Force -ErrorAction SilentlyContinue
     & "$PSScriptRoot/New-Directory.ps1" $targetFile
     & "$PSScriptRoot/New-Directory.ps1" "$targetFile/Report"
 
-    # DataModelSchema
-    $model = [Microsoft.AnalysisServices.Tabular.TmdlSerializer]::DeserializeDatabaseFromFolder("$datasetDir/definition") # cSpell:ignore TMDL
-    $modelJson = [Microsoft.AnalysisServices.Tabular.JsonSerializer]::SerializeDatabase($model) | ConvertFrom-Json -Depth 100 -AsHashtable
-    $modelJson.name = [guid]::NewGuid()
-    $modelJson.model.expressions `
-    | ForEach-Object {
-        $exp = $_
-        if ($exp.name.EndsWith(' URL'))
+    # Templates ship without a data source so customers supply their own. The PBIP was already
+    # written with the demo values so demo PBIX files can still refresh.
+    foreach ($exp in @($db.Model.Expressions))
+    {
+        if ($exp.Name.EndsWith(' URL'))
         {
-            $exp.expression = $exp.expression -replace '^\\"[^\\"]+\\" meta ', 'null meta '
+            $exp.Expression = $exp.Expression -replace '^"[^"]*" meta ', 'null meta '
         }
-        if ($exp.name -eq 'ftk_DemoFilter')
+        if ($exp.Name -eq 'ftk_DemoFilter')
         {
-            $exp.expression = '() => "" // To filter out subscriptions, replace with: "| where subscriptionId in (''<sub1>'', ''<sub2>'')"'
+            $exp.Expression = '() => "" // To filter out subscriptions, replace with: "| where subscriptionId in (''<sub1>'', ''<sub2>'')"'
         }
     }
-    $modelJson.model.tables = $modelJson.model.tables | Where-Object { $metadata.Tables -contains $_.name -or $metadata.Tables -contains "[$reportType]$($_.name)" }
-    $modelJson.model.relationships `
-    | Where-Object { -not (($metadata.Tables -contains $_.fromTable -or $metadata.Tables -contains "[$reportType]$($_.fromTable)") -and ($metadata.Tables -contains $_.toTable -or $metadata.Tables -contains "[$reportType]$($_.toTable)")) } `
-    | ForEach-Object { Write-Verbose "  Removing relationship: $($_.fromTable) -> $($_.toTable)" }
-    $modelJson.model.relationships = @($modelJson.model.relationships | Where-Object { ($metadata.Tables -contains $_.fromTable -or $metadata.Tables -contains "[$reportType]$($_.fromTable)") -and ($metadata.Tables -contains $_.toTable -or $metadata.Tables -contains "[$reportType]$($_.toTable)") })
-    $modelJson.model.expressions = $modelJson.model.expressions | Where-Object { $metadata.Expressions -contains $_.name -or $metadata.Expressions -contains "[$reportType]$($_.name)" }
-    $modelJson.model.annotations = $modelJson.model.annotations `
-    | ForEach-Object {
-        $ann = $_
-        if ($ann.name -eq 'PBI_QueryOrder')
-        {
-            $ann.value = ($metadata.Expressions + $metadata.Tables) | ConvertTo-Json -Depth 1 -Compress | ConvertTo-Json -Depth 1
-        }
-        return $ann
-    }
+    Assert-NoMissingDependency $db $removedNames "The $baseName template" $reportName
+
+    # DataModelSchema
+    $modelJson = [Microsoft.AnalysisServices.Tabular.JsonSerializer]::SerializeDatabase($db) | ConvertFrom-Json -Depth 100 -AsHashtable
+    $modelJson.name = [guid]::NewGuid()
+
     Write-UTF16LE -File "$targetFile/DataModelSchema" -Content ($modelJson | ConvertTo-Json -Depth 100)
 
-    # DiagramLayout
-    Write-UTF16LE -File "$targetFile/DiagramLayout" -Json (Get-Content "$datasetDir/diagramLayout.json" -Raw | ConvertFrom-Json -Depth 100)
+    # DiagramLayout (from the pruned model so it doesn't reference tables that were removed)
+    Write-UTF16LE -File "$targetFile/DiagramLayout" -Json (Get-Content "$stagedDataset/diagramLayout.json" -Raw | ConvertFrom-Json -Depth 100)
 
     # Report/Layout
-    $reportJson = (Get-Content "$reportDir/report.json" -Raw) `
-        -replace '\$\$ftkver\$\$', $version `
-        -replace '\$\$build-date\$\$', (Get-Date -Format 'yyyy-MM-dd')
-    Write-UTF16LE -File "$targetFile/Report/Layout" -Json ($reportJson | ConvertFrom-Json -Depth 100)
+    Write-UTF16LE -File "$targetFile/Report/Layout" -Json ((Get-ReportLayout $reportDir $baseName) | ConvertFrom-Json -Depth 100)
 
     # Report/StaticResources
     Copy-Item "$reportDir/StaticResources" "$targetFile/Report/StaticResources" -Recurse -Force
 
     # Metadata
-    # TODO: Where does "Version" come from?
-    # TODO: Add all intro paragraphs
-    # TODO: Add Load button guidance
     $desktopVersion = $modelJson.model.annotations | Where-Object { $_.name -eq 'PBIDesktopVersion' } | ForEach-Object { $_.value }
     Write-Verbose "  Desktop version: '$desktopVersion'"
     Write-UTF16LE -File "$targetFile/Metadata" -Json @{
@@ -210,8 +917,7 @@ $reports | ForEach-Object {
         AutoCreatedRelationships = @()
         FileDescription          = "$($metadata.Intro)`n`nTo customize queries or data source settings, select the Edit option in the Load button.`n`nLearn more at https://aka.ms/ftk/pbi/$reportName"
         CreatedFrom              = "Cloud"
-        # TODO: Validate "CreatedFromRelease"
-        CreatedFromRelease       = "20$($desktopVersion -replace '^[^\(]+\(([0-9]{2}\.[0-2][0-9])\)[^\)]+$','$1')"
+        CreatedFromRelease       = "20$($desktopVersion -replace '^[^\(]+\(([0-9]{2}\.[0-2][0-9])\)[^\)]+$', '$1')"
     }
 
     # Settings
@@ -225,13 +931,11 @@ $reports | ForEach-Object {
         QueriesSettings = @{
             TypeDetectionEnabled      = $editorSettings.typeDetectionEnabled
             RelationshipImportEnabled = $editorSettings.relationshipImportEnabled
-            # TODO: Validate "Version"
             Version                   = $desktopVersion.Split(' ')[0]
         }
     }
 
     # Version
-    # TODO: Where the "Version" file content come from?
     Write-UTF16LE -File "$targetFile/Version" -Content "1.30"
 
     # [Content_Types].xml
@@ -252,12 +956,77 @@ $reports | ForEach-Object {
     | Out-File -LiteralPath "$targetFile/[Content_Types].xml" -Encoding utf8
 
     # Create PBIT file
-    Compress-Archive -Path "$targetFile/*" -DestinationPath "$targetFile.pbit"
-
+    Compress-Archive -Path "$targetFile/*" -DestinationPath "$targetFile.pbit" -Force
     Remove-Item $targetFile -Recurse -Force
+
+    #endregion PBIT template
+
+    $manifest.Add([PSCustomObject]@{
+            name        = $reportName
+            type        = $reportType
+            base        = $baseName
+            demo        = $isDemo
+            pbip        = if ($isDemo -and -not $NoPbip) { "$baseName.pbip" } else { $null }
+            pbix        = if ($isDemo) { "$baseName.pbix" } else { $null }
+            pbit        = "$baseName.pbit"
+            tables      = @($db.Model.Tables | ForEach-Object { $_.Name } | Sort-Object)
+            expressions = @($db.Model.Expressions | ForEach-Object { $_.Name } | Sort-Object)
+        })
+
+    # The staged model is only kept when it's part of a demo project
+    if (-not $isDemo -or $NoPbip)
+    {
+        Remove-Item $stagedDataset -Recurse -Force -ErrorAction SilentlyContinue
+    }
 }
 
-# Zip files
+#endregion Build
+
+#region Package
+
 $genAllReports = $Name -eq '*'
-if ($KQL -and $genAllReports) { Compress-Archive -Path "$pbitDir/*.kql.pbit" -DestinationPath "$pbitDir/../PowerBI-kql.zip" }
-if ($Storage -and $genAllReports) { Compress-Archive -Path "$pbitDir/*.storage.pbit" -DestinationPath "$pbitDir/../PowerBI-storage.zip" }
+if ($KQL -and $genAllReports) { Compress-Archive -Path "$pbitDir/*.kql.pbit" -DestinationPath "$relDir/PowerBI-kql.zip" -Force }
+if ($Storage -and $genAllReports) { Compress-Archive -Path "$pbitDir/*.storage.pbit" -DestinationPath "$relDir/PowerBI-storage.zip" -Force }
+
+# Package-PowerBI reads the manifest to know what was built and what needs to be saved. Partial
+# builds don't write one, so a single-report build never looks like a complete release.
+$demoProjects = @($manifest | Where-Object { $_.pbip })
+if (-not $NoPbip -and $genAllReports -and $KQL -and $Storage)
+{
+    & "$PSScriptRoot/New-Directory.ps1" $pbixDir
+    @{
+        version       = $version
+        built         = (Get-Date -Format 'o')
+        openDataUrl   = $openDataUrl
+        releasable    = $permanentOpenDataUrl
+        reports       = $manifest.ToArray()
+    } | ConvertTo-Json -Depth 10 | Set-Content "$pbixDir/.manifest.json"
+}
+elseif (-not $NoPbip -and $demoProjects.Count -gt 0)
+{
+    # A partial build rewrites some projects but not the manifest, so a PBIX saved before the change
+    # would still look newer than `built`. Removing the manifest makes Package-PowerBI rebuild everything.
+    Remove-Item "$pbixDir/.manifest.json" -Force -ErrorAction SilentlyContinue
+}
+
+# Allowlist entries that matched nothing in any model built are stale or misspelled
+if ($KQL -and $Storage -and $Name -eq '*')
+{
+    $allowlistEntries `
+    | Where-Object { -not $allowlistMatches.Contains($_) } `
+    | Sort-Object `
+    | ForEach-Object {
+        $parts = $_.Split('|')
+        Write-Warning "$($parts[0]) lists '$($parts[1])' but no model has a table or query with that name."
+    }
+}
+
+Write-Host "✅ $($reports.Count) PBIT template$(if ($reports.Count -ne 1) { 's' })"
+if ($genAllReports)
+{
+    if ($KQL) { Write-Host "✅ PowerBI-kql.zip" }
+    if ($Storage) { Write-Host "✅ PowerBI-storage.zip" }
+}
+if ($demoProjects.Count -gt 0) { Write-Host "✅ $($demoProjects.Count) demo PBIP project$(if ($demoProjects.Count -ne 1) { 's' }) in release/pbix" }
+
+#endregion Package
diff --git a/src/scripts/Deploy-Demo.ps1 b/src/scripts/Deploy-Demo.ps1
new file mode 100644
index 000000000..0ca3dc8f1
--- /dev/null
+++ b/src/scripts/Deploy-Demo.ps1
@@ -0,0 +1,340 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    .SYNOPSIS
+    Deploys and refreshes the FinOps hub instances that demo Power BI reports are built from.
+
+    .DESCRIPTION
+    Demo reports in PowerBI-demo.zip are saved with data from a demo hub. That hub has to be on
+    the version being released and have data for the current month, or the demo either fails to
+    refresh or ships with stale numbers.
+
+    Deploys two kinds of instances:
+
+    - "ftk-demo" is the current demo hub. It holds 12 months of data and is what demo reports are
+      built from.
+    - "ftk-demo-v{version}" is a versioned instance kept for testing an older release. It holds
+      one month of data, and its Data Explorer cluster is stopped after data is ingested so it
+      costs almost nothing to keep around.
+
+    Run with -Check before a release to confirm the demo hub is current. It reports the hub
+    version and the months of data it holds, and fails when the hub is behind the toolkit version
+    or is missing data for the current month.
+
+    .PARAMETER Version
+    Optional. Deploys the versioned instance for a release (for example, "v15") instead of the current demo hub.
+
+    .PARAMETER Subscription
+    Optional. Name or ID of the subscription to deploy to. Default = "FTK Prod".
+
+    .PARAMETER ResourceGroup
+    Optional. Name of the resource group. Default = the instance name.
+
+    .PARAMETER Location
+    Optional. Azure region to deploy to. Default = "westus".
+
+    .PARAMETER Scope
+    Optional. Resource IDs of the scopes to export cost data for. Default = the subscription being deployed to.
+
+    .PARAMETER Retention
+    Optional. Number of months of data the hub keeps. Default = 12 for the current demo hub, 1 for a versioned instance.
+
+    .PARAMETER Backfill
+    Optional. Number of months of history to load. Backfilling is a one-time task for a new instance, so nothing is backfilled unless this is specified.
+
+    .PARAMETER Check
+    Optional. Reports whether the demo hub is ready for a release without changing anything. Default = false.
+
+    .PARAMETER Stop
+    Optional. Stops the Data Explorer cluster when the deployment finishes. Default = true for versioned instances.
+
+    .PARAMETER Build
+    Optional. Builds the templates before deploying. Default = false.
+
+    .PARAMETER WhatIf
+    Optional. Validates the deployment without making changes. Default = false.
+
+    .EXAMPLE
+    ./Deploy-Demo -Check
+
+    Reports whether the demo hub is on the current version and has data for this month.
+
+    .EXAMPLE
+    ./Deploy-Demo
+
+    Deploys or updates the demo hub. Exports keep running on their own, so nothing is backfilled.
+
+    .EXAMPLE
+    ./Deploy-Demo -Backfill 12
+
+    Deploys the demo hub and loads 12 months of history. Only needed for a new instance.
+
+    .EXAMPLE
+    ./Deploy-Demo -Version v15 -Backfill 1
+
+    Deploys the versioned instance for v15 with one month of data.
+
+    .LINK
+    https://github.com/microsoft/finops-toolkit/blob/dev/src/scripts/README.md#-deploy-demo
+#>
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [string]
+    $Version,
+
+    [string]
+    $Subscription = 'FTK Prod',
+
+    [string]
+    $ResourceGroup,
+
+    [string]
+    $Location = 'westus',
+
+    [string[]]
+    $Scope,
+
+    [int]
+    $Retention,
+
+    [int]
+    $Backfill,
+
+    [switch]
+    $Check,
+
+    [switch]
+    $Stop,
+
+    [switch]
+    $Build
+)
+
+$ErrorActionPreference = 'Stop'
+
+$toolkitVersion = & "$PSScriptRoot/Get-Version.ps1"
+$isVersioned = [bool]$Version
+$name = if ($isVersioned) { "ftk-demo-$($Version.TrimStart('v') -replace '^', 'v')" } else { 'ftk-demo' }
+if (-not $ResourceGroup) { $ResourceGroup = $name }
+if (-not $Retention) { $Retention = if ($isVersioned) { 1 } else { 12 } }
+if (-not $PSBoundParameters.ContainsKey('Stop')) { $Stop = $isVersioned }
+
+#region Helpers
+
+<#
+    .SYNOPSIS
+    Selects the subscription to work in, by name or ID.
+#>
+function Set-DemoSubscription([string] $NameOrId)
+{
+    $context = Get-AzContext
+    if (-not $context)
+    {
+        throw 'Not signed in to Azure. Run Connect-AzAccount, then run this command again.'
+    }
+
+    if ($context.Subscription.Name -eq $NameOrId -or $context.Subscription.Id -eq $NameOrId)
+    {
+        return $context
+    }
+
+    $subscription = Get-AzSubscription -ErrorAction SilentlyContinue | Where-Object { $_.Name -eq $NameOrId -or $_.Id -eq $NameOrId } | Select-Object -First 1
+    if (-not $subscription)
+    {
+        $available = (Get-AzSubscription -ErrorAction SilentlyContinue | ForEach-Object { $_.Name }) -join ', '
+        throw "Subscription '$NameOrId' not found in tenant $($context.Tenant.Id). Available: $available"
+    }
+
+    Write-Host "Using subscription $($subscription.Name) ($($subscription.Id))"
+    return Set-AzContext -SubscriptionObject $subscription
+}
+
+<#
+    .SYNOPSIS
+    Reports the hub version and the months of data an instance holds.
+
+    .DESCRIPTION
+    The version is read from the config container, which every hub writes when it deploys. The
+    months come from the folders in the ingestion container, which are named by month.
+#>
+function Get-DemoState([string] $HubName, [string] $ResourceGroupName)
+{
+    $state = [PSCustomObject]@{
+        Deployed = $false
+        Version  = $null
+        Months   = @()
+        Storage  = $null
+        Cluster  = $null
+    }
+
+    $storage = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName -ErrorAction SilentlyContinue `
+    | Where-Object { $_.StorageAccountName -like "$($HubName -replace '[^a-z0-9]', '')*" -or $_.Tags['cm-resource-parent'] } `
+    | Select-Object -First 1
+    if (-not $storage) { return $state }
+
+    $state.Deployed = $true
+    $state.Storage = $storage.StorageAccountName
+    $state.Cluster = (Get-AzKustoCluster -ResourceGroupName $ResourceGroupName -ErrorAction SilentlyContinue | Select-Object -First 1)
+
+    $context = $storage.Context
+    $settings = Get-AzStorageBlob -Container 'config' -Blob 'settings.json' -Context $context -ErrorAction SilentlyContinue
+    if ($settings)
+    {
+        $file = New-TemporaryFile
+        try
+        {
+            Get-AzStorageBlobContent -Container 'config' -Blob 'settings.json' -Destination $file -Context $context -Force | Out-Null
+            $state.Version = (Get-Content $file -Raw | ConvertFrom-Json).version
+        }
+        finally { Remove-Item $file -Force -ErrorAction SilentlyContinue }
+    }
+
+    # Ingested data is stored in folders named by month, so the folder names are the months of data
+    $months = New-Object System.Collections.Generic.HashSet[string]
+    # Blobs come back 5,000 at a time in name order, so page through all of them: on a hub with a
+    # year of data the newest months can sit past the first page.
+    $token = $null
+    do
+    {
+        $page = @(Get-AzStorageBlob -Container 'ingestion' -Context $context -MaxCount 5000 -ContinuationToken $token -ErrorAction SilentlyContinue)
+        foreach ($blob in $page)
+        {
+            if ($blob.Name -match '(?<month>20\d{2}[-/]?(0[1-9]|1[0-2]))') { $null = $months.Add(($Matches.month -replace '[-/]', '')) }
+        }
+        $token = if ($page.Count -gt 0) { $page[-1].ContinuationToken } else { $null }
+    }
+    while ($null -ne $token)
+    $state.Months = @($months | Sort-Object)
+
+    return $state
+}
+
+#endregion Helpers
+
+#region Check
+
+$context = Set-DemoSubscription $Subscription
+Write-Host ''
+Write-Host "FinOps hub demo instance $name" -ForegroundColor White
+Write-Host "  Subscription  $($context.Subscription.Name)"
+Write-Host "  Resource group $ResourceGroup"
+
+$state = Get-DemoState $name $ResourceGroup
+$thisMonth = (Get-Date).ToString('yyyyMM')
+$lastMonth = (Get-Date).AddMonths(-1).ToString('yyyyMM')
+
+if ($state.Deployed)
+{
+    $hasCurrent = $state.Months -contains $thisMonth -or $state.Months -contains $lastMonth
+    $isCurrentVersion = $state.Version -eq $toolkitVersion
+    Write-Host "  $(if ($isCurrentVersion) { '✅' } else { '⏳' }) Version       $($state.Version ?? 'unknown') (toolkit is $toolkitVersion)"
+    Write-Host "  $(if ($hasCurrent) { '✅' } else { '⏳' }) Data          $($state.Months.Count) month$(if ($state.Months.Count -ne 1) { 's' })$(if ($state.Months) { ": $($state.Months[0]) to $($state.Months[-1])" })"
+    if ($state.Cluster) { Write-Host "  ℹ️ Data Explorer $($state.Cluster.Name) ($($state.Cluster.State))" }
+}
+else
+{
+    Write-Host '  ⏳ Not deployed'
+}
+Write-Host ''
+
+if ($Check)
+{
+    if (-not $state.Deployed) { throw "$name is not deployed. Run ./Deploy-Demo to create it." }
+
+    $problems = New-Object System.Collections.Generic.List[string]
+    if ($state.Version -ne $toolkitVersion) { $problems.Add("is on $($state.Version ?? 'an unknown version') but the toolkit is $toolkitVersion. Demo reports built from it would use an older hub.") }
+    if (-not ($state.Months -contains $thisMonth -or $state.Months -contains $lastMonth)) { $problems.Add("has no data for $thisMonth or $lastMonth, so demo reports would ship with an empty current month.") }
+
+    if ($problems.Count -gt 0)
+    {
+        throw "$name isn't ready for a release. It $($problems -join ' It ')`nRun ./Deploy-Demo to update it."
+    }
+
+    Write-Host "✅ $name is ready to build demo reports from." -ForegroundColor Green
+    return
+}
+
+#endregion Check
+
+#region Deploy
+
+if (-not $Scope) { $Scope = @("/subscriptions/$($context.Subscription.Id)") }
+
+$parameters = @{
+    hubName                           = $name
+    dataExplorerName                  = $name
+    dataExplorerSku                   = if ($isVersioned) { 'Dev(No SLA)_Standard_E2a_v4' } else { 'Standard_E2ads_v5' }
+    enableManagedExports              = $true
+    scopesToMonitor                   = $Scope
+    ingestionRetentionInMonths        = $Retention
+    dataExplorerFinalRetentionInMonths = $Retention
+}
+
+Write-Host "Deploying $name keeping $Retention month$(if ($Retention -ne 1) { 's' }) of data for $($Scope -join ', ')..."
+
+if ($PSCmdlet.ShouldProcess($name, "Deploy FinOps hub to $ResourceGroup"))
+{
+    & "$PSScriptRoot/Deploy-Toolkit.ps1" 'finops-hub' -ResourceGroup $ResourceGroup -Location $Location -Parameters $parameters -Build:$Build -WhatIf:$WhatIfPreference
+}
+
+if ($WhatIfPreference) { return }
+
+#endregion Deploy
+
+#region Backfill
+
+# Managed exports run on their own once the hub is deployed, so history is only loaded when asked
+if (-not $Backfill)
+{
+    Write-Host 'Exports run on their own. Pass -Backfill to load history, which a new instance needs once.'
+}
+else
+{
+    $state = Get-DemoState $name $ResourceGroup
+    if (-not $state.Storage) { throw "Could not find the storage account for $name after deploying." }
+    $storageId = (Get-AzStorageAccount -ResourceGroupName $ResourceGroup -Name $state.Storage).Id
+
+    foreach ($target in $Scope)
+    {
+        $exportName = "$name-focus"
+        Write-Host "Backfilling $Backfill month$(if ($Backfill -ne 1) { 's' }) of FOCUS 1.2 data for $target..."
+
+        if ($PSCmdlet.ShouldProcess($target, "Create and run the $exportName export"))
+        {
+            New-FinOpsCostExport `
+                -Name $exportName `
+                -Scope $target `
+                -Dataset 'FocusCost' `
+                -DatasetVersion '1.2' `
+                -Monthly `
+                -StorageAccountId $storageId `
+                -StorageContainer 'msexports' `
+                -Backfill $Backfill `
+                -Execute `
+                -ErrorAction Stop `
+            | Out-Null
+        }
+    }
+
+    Write-Host 'Exports run. Data takes a while to ingest, so check back before building demo reports:'
+    Write-Host "     ./Deploy-Demo$(if ($isVersioned) { " -Version $Version" }) -Check" -ForegroundColor Cyan
+}
+
+#endregion Backfill
+
+#region Stop
+
+# A versioned instance is only there to open old reports, so its cluster doesn't need to keep
+# running. It can't be stopped here because data is still ingesting when this command finishes.
+if ($Stop -and $state.Cluster)
+{
+    Write-Host ''
+    Write-Host "  Stop $($state.Cluster.Name) once ingestion finishes so this instance costs almost nothing to keep:" -ForegroundColor Yellow
+    Write-Host "     Stop-AzKustoCluster -ResourceGroupName $ResourceGroup -Name $($state.Cluster.Name)" -ForegroundColor Cyan
+}
+
+#endregion Stop
+
+Write-Host ''
+Write-Host "✅ $name deployed" -ForegroundColor Green
diff --git a/src/scripts/Package-PowerBI.ps1 b/src/scripts/Package-PowerBI.ps1
new file mode 100644
index 000000000..e4b0fc1a9
--- /dev/null
+++ b/src/scripts/Package-PowerBI.ps1
@@ -0,0 +1,564 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    .SYNOPSIS
+    Packages the three Power BI release files and reports what's left to do.
+
+    .DESCRIPTION
+    Power BI releases ship three files: PowerBI-kql.zip and PowerBI-storage.zip hold the PBIT
+    templates, and PowerBI-demo.zip holds the demo PBIX files.
+
+    Power BI Desktop has to load and save the PBIX files. On Windows, -Unattended does that
+    automatically with Save-PowerBIProject, so the whole process runs with one command.
+
+    Without -Unattended, this command is resumable: run it, save the projects it opens, then run
+    it again. Either way, it works out which steps are already done, does the next one, and
+    validates the result, so a missed step fails here instead of shipping.
+
+    .PARAMETER Open
+    Optional. Opens the Power BI projects that still need to be saved as PBIX files. Default = false.
+
+    .PARAMETER Unattended
+    Optional. Saves the Power BI projects with Power BI Desktop automatically, then validates and packages them. Windows only. Default = false.
+
+    .PARAMETER Build
+    Optional. Rebuilds the PBIT templates and PBIP projects even if they already exist. Default = false.
+
+    .PARAMETER Status
+    Optional. Reports what's done and what's left without changing anything. Default = false.
+
+    .PARAMETER SensitivityLabel
+    Optional. Sensitivity label demo reports must have, when the tenant has labels. Reports saved without any label pass. Default = "Public".
+
+    .PARAMETER OpenDataUrl
+    Optional. Public folder demo reports read open data from. Passed to Build-PowerBI. Must be a permanent location. Default = the open data files in the main branch.
+
+    .PARAMETER TestOpenDataUrl
+    Optional. Allows an OpenDataUrl that isn't permanent. Demo reports built this way are not packaged. Default = false.
+
+    .EXAMPLE
+    ./Package-PowerBI
+
+    Builds whatever is missing and reports the next step.
+
+    .EXAMPLE
+    ./Package-PowerBI -Unattended
+
+    Builds, saves, validates, and packages all three Power BI release files without any manual steps.
+
+    .EXAMPLE
+    ./Package-PowerBI -Open
+
+    Opens the Power BI projects that still need to be saved as PBIX files.
+
+    .EXAMPLE
+    ./Package-PowerBI -Status
+
+    Reports what's done and what's left.
+
+    .LINK
+    https://github.com/microsoft/finops-toolkit/blob/dev/src/scripts/README.md#-package-powerbi
+#>
+param(
+    [switch] $Open,
+
+    [switch] $Unattended,
+
+    [switch] $Build,
+
+    [switch] $Status,
+
+    [string] $SensitivityLabel = 'Public',
+
+    [string] $OpenDataUrl,
+
+    [switch] $TestOpenDataUrl
+)
+
+$ErrorActionPreference = 'Stop'
+
+$relDir = "$PSScriptRoot/../../release"
+$pbitDir = "$relDir/pbit"
+$pbixDir = "$relDir/pbix"
+$manifestPath = "$pbixDir/.manifest.json"
+
+$version = & "$PSScriptRoot/Get-Version.ps1"
+$buildArgs = @{}
+if ($OpenDataUrl) { $buildArgs.OpenDataUrl = $OpenDataUrl }
+if ($TestOpenDataUrl) { $buildArgs.TestOpenDataUrl = $true }
+
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+
+#region Helpers
+
+function Format-Size([long] $Bytes)
+{
+    if ($Bytes -ge 1GB) { return "{0:N1} GB" -f ($Bytes / 1GB) }
+    if ($Bytes -ge 1MB) { return "{0:N1} MB" -f ($Bytes / 1MB) }
+    return "{0:N0} KB" -f ($Bytes / 1KB)
+}
+
+<#
+    .SYNOPSIS
+    Reads a single entry from a ZIP-based file (PBIX, PBIT) without extracting it.
+#>
+function Get-ArchiveEntry([string] $Path, [string] $EntryName)
+{
+    $archive = [System.IO.Compression.ZipFile]::OpenRead($Path)
+    try
+    {
+        $entry = $archive.Entries | Where-Object { $_.FullName -eq $EntryName } | Select-Object -First 1
+        if (-not $entry) { return $null }
+
+        $stream = $entry.Open()
+        try
+        {
+            $buffer = New-Object System.IO.MemoryStream
+            $stream.CopyTo($buffer)
+            return $buffer.ToArray()
+        }
+        finally { $stream.Dispose() }
+    }
+    finally { $archive.Dispose() }
+}
+
+function Get-ArchiveEntryName([string] $Path)
+{
+    $archive = [System.IO.Compression.ZipFile]::OpenRead($Path)
+    try { return @($archive.Entries | ForEach-Object { $_.FullName }) }
+    finally { $archive.Dispose() }
+}
+
+function Get-ArchiveEntrySize([string] $Path, [string] $EntryName)
+{
+    $archive = [System.IO.Compression.ZipFile]::OpenRead($Path)
+    try
+    {
+        $entry = $archive.Entries | Where-Object { $_.FullName -eq $EntryName } | Select-Object -First 1
+        if (-not $entry) { return -1 }
+        return $entry.Length
+    }
+    finally { $archive.Dispose() }
+}
+
+<#
+    .SYNOPSIS
+    Parses a JSON part from a PBIX file, which Power BI writes as UTF-16LE.
+#>
+function ConvertFrom-PbixText([byte[]] $Bytes)
+{
+    if ($Bytes.Length -ge 2 -and $Bytes[0] -eq 0xFF -and $Bytes[1] -eq 0xFE)
+    {
+        $text = [System.Text.Encoding]::Unicode.GetString($Bytes, 2, $Bytes.Length - 2)
+    }
+    elseif ($Bytes.Length -ge 2 -and $Bytes[1] -eq 0)
+    {
+        $text = [System.Text.Encoding]::Unicode.GetString($Bytes)
+    }
+    else
+    {
+        $text = [System.Text.Encoding]::UTF8.GetString($Bytes)
+        $text = $text.TrimStart([char]0xFEFF)
+    }
+
+    return $text
+}
+
+function ConvertFrom-PbixJson([byte[]] $Bytes)
+{
+    return ConvertFrom-PbixText $Bytes | ConvertFrom-Json -Depth 100
+}
+
+<#
+    .SYNOPSIS
+    Checks a saved demo PBIX for the mistakes that are easy to make when saving by hand.
+
+    .DESCRIPTION
+    Catches a report saved without data, saved from the wrong (unpruned) project, saved on the
+    wrong page, saved with the wrong sensitivity label, or saved before the latest build.
+#>
+function Test-DemoPbix([string] $Path, $Report, [datetime] $BuiltAfter = [datetime]::MinValue, [string] $Label)
+{
+    $issues = New-Object System.Collections.Generic.List[string]
+
+    # A PBIX saved before the latest build doesn't have the latest changes
+    $saved = (Get-Item $Path).LastWriteTimeUtc
+    if ($saved -lt $BuiltAfter.ToUniversalTime())
+    {
+        $issues.Add("was saved before the latest build ($($saved.ToLocalTime().ToString('g')) vs. $($BuiltAfter.ToLocalTime().ToString('g'))). Save it again from release/pbix.")
+    }
+
+    try { $entries = Get-ArchiveEntryName $Path }
+    catch
+    {
+        $issues.Add("isn't a readable PBIX file ($($_.Exception.Message)). Save it again from Power BI Desktop.")
+        return $issues
+    }
+
+    # Power BI Desktop writes the report either as one Report/Layout part or, since the enhanced
+    # report format (PBIR) became the default in September 2026, as files under Report/definition.
+    # Desktop converts a report to PBIR when it saves, so both have to be accepted.
+    $isPbir = $entries -notcontains 'Report/Layout' -and @($entries | Where-Object { $_ -like 'Report/definition/*' }).Count -gt 0
+    $reportPart = if ($isPbir) { 'Report/definition/report.json' } else { 'Report/Layout' }
+
+    $missingParts = @('DataModel', $reportPart, 'Metadata', 'Settings', 'Version') | Where-Object { $entries -notcontains $_ }
+    if ($missingParts)
+    {
+        $missingParts | ForEach-Object { $issues.Add("is missing the $_ part. Save it again from Power BI Desktop.") }
+        return $issues
+    }
+
+    # Labels other than the expected one can block people outside the organization from opening it
+    if ($Label -and $entries -contains 'docProps/custom.xml')
+    {
+        try
+        {
+            $customXml = [System.Text.Encoding]::UTF8.GetString((Get-ArchiveEntry $Path 'docProps/custom.xml'))
+            $labels = @([regex]::Matches($customXml, 'name="MSIP_Label_[^"]+_Name"[^>]*>\s*<vt:lpwstr>(?<name>[^<]*)</vt:lpwstr>') | ForEach-Object { $_.Groups['name'].Value })
+            $wrong = @($labels | Where-Object { $_ -ne $Label })
+            if ($wrong.Count -gt 0)
+            {
+                $issues.Add("has the '$($wrong -join "', '")' sensitivity label. Set it to '$Label' and save again.")
+            }
+        }
+        catch { Write-Verbose "Could not read the sensitivity label from $Path" }
+    }
+
+    # A PBIX saved without loading data has a tiny data model
+    $dataModelSize = Get-ArchiveEntrySize $Path 'DataModel'
+    if ($dataModelSize -lt 1MB)
+    {
+        $issues.Add("has a $(Format-Size $dataModelSize) data model, so it was saved without loading demo data. Refresh the report before saving.")
+    }
+
+    if ($isPbir)
+    {
+        # PBIR keeps one file per page and names the page it opens on, so the pages are read
+        # rather than indexed, and every file is searched for the version the build stamped in
+        $reportText = New-Object System.Text.StringBuilder
+        $pages = @{}
+        foreach ($entry in @($entries | Where-Object { $_ -like 'Report/definition/*' -and $_ -like '*.json' }))
+        {
+            $text = $null
+            try { $text = ConvertFrom-PbixText (Get-ArchiveEntry $Path $entry) }
+            catch { Write-Verbose "Could not read $entry from $Path" }
+            if (-not $text) { continue }
+
+            $null = $reportText.AppendLine($text)
+            if ($entry -match '^Report/definition/pages/(?<page>[^/]+)/page\.json$')
+            {
+                try { $pages[$Matches.page] = ($text | ConvertFrom-Json -Depth 100) } catch { Write-Verbose "Could not parse $entry" }
+            }
+        }
+
+        $activePage = $null
+        try { $activePage = (ConvertFrom-PbixJson (Get-ArchiveEntry $Path 'Report/definition/pages/pages.json')).activePageName }
+        catch { Write-Verbose "Could not read the page list from $Path" }
+
+        if ($activePage)
+        {
+            $active = $pages[$activePage]
+            if ($active -and $active.displayName -ne 'Get started')
+            {
+                $issues.Add("opens on '$($active.displayName)'. Switch to the Get started page and save again.")
+            }
+        }
+
+        $allText = $reportText.ToString()
+        if ($allText -match '\$\$ftkver\$\$|\$\$build-date\$\$')
+        {
+            $issues.Add("still has version placeholders, so it was saved from src/power-bi instead of release/pbix. Open the project from release/pbix and save again.")
+        }
+        elseif ($allText -notmatch [regex]::Escape($version))
+        {
+            $issues.Add("doesn't mention version $version, so it was saved from an older build. Rebuild and save again.")
+        }
+    }
+
+    $layout = $null
+    if (-not $isPbir)
+    {
+        try { $layout = ConvertFrom-PbixJson (Get-ArchiveEntry $Path 'Report/Layout') }
+        catch { $issues.Add("has a Report/Layout part that couldn't be read ($($_.Exception.Message)).") }
+    }
+
+    if ($layout)
+    {
+        # Version placeholders are replaced at build time, so finding one means the PBIX was
+        # saved from the source project instead of the generated project in release/pbix
+        $sections = @($layout.sections)
+        $displayOrder = @($sections | Sort-Object @{ Expression = { if ($null -eq $_.ordinal) { 0 } else { $_.ordinal } } })
+        $expected = [array]::FindIndex($displayOrder, [Predicate[object]] { param($section) $section.displayName -eq 'Get started' })
+
+        $config = $layout.config | ConvertFrom-Json -Depth 100
+        if ($expected -ge 0 -and $config.activeSectionIndex -ne $expected)
+        {
+            $active = if ($config.activeSectionIndex -lt $displayOrder.Count) { $displayOrder[$config.activeSectionIndex].displayName } else { "page $($config.activeSectionIndex)" }
+            $issues.Add("opens on '$active'. Switch to the Get started page and save again.")
+        }
+
+        $layoutText = ($layout | ConvertTo-Json -Depth 100 -Compress)
+        if ($layoutText -match '\$\$ftkver\$\$|\$\$build-date\$\$')
+        {
+            $issues.Add("still has version placeholders, so it was saved from src/power-bi instead of release/pbix. Open the project from release/pbix and save again.")
+        }
+        elseif ($layoutText -notmatch [regex]::Escape($version))
+        {
+            $issues.Add("doesn't mention version $version, so it was saved from an older build. Rebuild and save again.")
+        }
+    }
+
+    # A report saved from the shared project carries every table, not just the ones it needs
+    if ($entries -contains 'DiagramLayout')
+    {
+        try
+        {
+            $diagram = ConvertFrom-PbixJson (Get-ArchiveEntry $Path 'DiagramLayout')
+            $tables = @($diagram.diagrams.nodes | ForEach-Object { $_.nodeIndex } | Where-Object { $_ })
+            $extra = @($tables | Where-Object { $Report.tables -notcontains $_ } | Sort-Object -Unique)
+            if ($extra.Count -gt 0)
+            {
+                $issues.Add("includes $($extra.Count) table$(if ($extra.Count -ne 1) { 's' }) the report doesn't use ($($extra -join ', ')). Open the project from release/pbix and save again.")
+            }
+        }
+        catch { Write-Verbose "Could not read DiagramLayout from $Path" }
+    }
+
+    return $issues
+}
+
+#endregion Helpers
+
+#region State
+
+if ($Build -and -not $Status)
+{
+    Write-Host 'Building Power BI templates and projects...'
+    & "$PSScriptRoot/Build-PowerBI.ps1" @buildArgs
+    Write-Host ''
+}
+
+function Read-Manifest
+{
+    if (-not (Test-Path $manifestPath)) { return $null }
+    return Get-Content $manifestPath -Raw | ConvertFrom-Json
+}
+
+$manifest = Read-Manifest
+
+# Manifests from older builds don't say which reports are demo reports
+$isStale = $manifest -and ($manifest.version -ne $version -or -not @($manifest.reports | Where-Object { $null -ne $_.demo }).Count)
+
+if ((-not $manifest -or $isStale) -and -not $Status -and -not $Build)
+{
+    if ($isStale) { Write-Host "Power BI files were built for $($manifest.version) with an older build script. Rebuilding for $version..." }
+    else { Write-Host 'No Power BI build found. Building...' }
+    & "$PSScriptRoot/Build-PowerBI.ps1" @buildArgs
+    Write-Host ''
+    $manifest = Read-Manifest
+    $isStale = $false
+}
+
+if (-not $manifest)
+{
+    Write-Host '⏳ Power BI templates have not been built.'
+    Write-Host '     Run: ' -NoNewline
+    Write-Host './Package-PowerBI -Build' -ForegroundColor Cyan
+    return
+}
+
+$builtAt = [datetime]$manifest.built
+$demoReports = @($manifest.reports | Where-Object { $_.demo })
+$templateZips = @("$relDir/PowerBI-kql.zip", "$relDir/PowerBI-storage.zip")
+$demoZip = "$relDir/PowerBI-demo.zip"
+
+function Get-SaveState
+{
+    $state = [PSCustomObject]@{ Saved = @(); Missing = @() }
+    foreach ($report in $demoReports)
+    {
+        if (Test-Path "$pbixDir/$($report.pbix)") { $state.Saved += $report } else { $state.Missing += $report }
+    }
+    return $state
+}
+
+$state = Get-SaveState
+
+# A demo package older than the build or any saved report is out of date
+$demoZipCurrent = (Test-Path $demoZip) -and $state.Missing.Count -eq 0 -and (Get-Item $demoZip).LastWriteTimeUtc -ge $builtAt.ToUniversalTime() -and `
+    -not @($state.Saved | Where-Object { (Get-Item "$pbixDir/$($_.pbix)").LastWriteTimeUtc -gt (Get-Item $demoZip).LastWriteTimeUtc }).Count
+
+#endregion State
+
+#region Report status
+
+Write-Host "Power BI release files for $version" -ForegroundColor White
+Write-Host ''
+
+$builtTemplates = @(Get-ChildItem "$pbitDir/*.pbit" -ErrorAction SilentlyContinue)
+$zipsBuilt = @($templateZips | Where-Object { Test-Path $_ })
+Write-Host "  $(if ($builtTemplates.Count -eq $manifest.reports.Count -and $zipsBuilt.Count -eq 2) { '✅' } else { '⏳' }) Templates    $($builtTemplates.Count)/$($manifest.reports.Count) PBIT, $($zipsBuilt.Count)/2 ZIP"
+$staleSaves = @($state.Saved | Where-Object { (Get-Item "$pbixDir/$($_.pbix)").LastWriteTimeUtc -lt $builtAt.ToUniversalTime() })
+$staleNote = if ($staleSaves.Count -gt 0) { ", $($staleSaves.Count) saved before the latest build" } else { '' }
+Write-Host "  $(if ($state.Missing.Count -eq 0 -and $staleSaves.Count -eq 0) { '✅' } else { '⏳' }) Demo reports $($state.Saved.Count)/$($demoReports.Count) PBIX saved$staleNote"
+Write-Host "  $(if ($demoZipCurrent) { '✅' } else { '⏳' }) Demo package $(if ($demoZipCurrent) { Format-Size (Get-Item $demoZip).Length } elseif (Test-Path $demoZip) { 'PowerBI-demo.zip is out of date' } else { 'PowerBI-demo.zip not created' })"
+Write-Host ''
+
+if ($Status) { return }
+
+#endregion Report status
+
+#region Save PBIX files
+
+# Fail before saving (which takes about an hour for all reports) when the build can't be released
+if ($manifest.PSObject.Properties.Name -contains 'releasable' -and -not $manifest.releasable)
+{
+    throw "Demo reports were built reading open data from $($manifest.openDataUrl), which isn't permanent, so they can't be released. Rebuild with ./Package-PowerBI -Build once the open data files are on main."
+}
+
+if ($Unattended)
+{
+    if ($null -ne $IsWindows -and -not $IsWindows)
+    {
+        throw 'Unattended packaging needs Power BI Desktop, which only runs on Windows. Run ./Package-PowerBI -Open to save the projects by hand instead.'
+    }
+
+    # Anything that fails validation is saved again, so rerunning fixes a bad save without cleanup
+    $toSave = @($state.Missing) + @($state.Saved | Where-Object { (Test-DemoPbix "$pbixDir/$($_.pbix)" $_ $builtAt $SensitivityLabel).Count -gt 0 })
+
+    if ($toSave.Count -gt 0)
+    {
+        Write-Host "Saving $($toSave.Count) demo report$(if ($toSave.Count -ne 1) { 's' }) with Power BI Desktop. This takes a while."
+        Write-Host ''
+        Write-Host '  Leave the mouse and keyboard alone while this runs.' -ForegroundColor Yellow
+        Write-Host '  Power BI Desktop can ask you to sign in or for data source credentials, which this' -ForegroundColor Yellow
+        Write-Host '  command cannot answer. It stops and prints "ACTION NEEDED" when that happens, then' -ForegroundColor Yellow
+        Write-Host '  carries on by itself once you are done. Nothing else needs you.' -ForegroundColor Yellow
+        Write-Host ''
+        $failures = New-Object System.Collections.Generic.List[string]
+        foreach ($report in $toSave)
+        {
+            Write-Host "  $($report.base)..."
+            try
+            {
+                $result = & "$PSScriptRoot/Save-PowerBIProject.ps1" -Path "$pbixDir/$($report.pbip)" -Destination "$pbixDir/$($report.pbix)" -SensitivityLabel $SensitivityLabel
+                Write-Host "  ✅ $($report.pbix)  $(Format-Size $result.Size) in $([int]$result.Duration.TotalMinutes) min"
+            }
+            catch
+            {
+                $failures.Add($report.base)
+                Write-Host "  ❌ $($_.Exception.Message)" -ForegroundColor Red
+            }
+        }
+        Write-Host ''
+
+        if ($failures.Count -gt 0)
+        {
+            Write-Host "⏳ $($failures.Count) demo report$(if ($failures.Count -ne 1) { 's' }) couldn't be saved automatically: $($failures -join ', ')"
+            Write-Host '     Save them by hand with: ' -NoNewline
+            Write-Host './Package-PowerBI -Open' -ForegroundColor Cyan
+            throw "Unattended packaging stopped. $($failures.Count) demo report$(if ($failures.Count -ne 1) { 's' }) still need to be saved."
+        }
+
+        $state = Get-SaveState
+
+        # Anything saved is newer than the existing package, so repackage even if the zip looked current before
+        $demoZipCurrent = $false
+    }
+}
+elseif ($state.Missing.Count -gt 0)
+{
+    Write-Host "⏳ $($state.Missing.Count) Power BI project$(if ($state.Missing.Count -ne 1) { 's' }) still $(if ($state.Missing.Count -eq 1) { 'needs' } else { 'need' }) to be saved as PBIX:"
+    $state.Missing | ForEach-Object { Write-Host "     $($_.pbip) → $($_.pbix)" }
+    Write-Host ''
+
+    if (-not $Open)
+    {
+        Write-Host '     To save them automatically (Windows), run: ' -NoNewline
+        Write-Host './Package-PowerBI -Unattended' -ForegroundColor Cyan
+        Write-Host '     To open them and save by hand, run: ' -NoNewline
+        Write-Host './Package-PowerBI -Open' -ForegroundColor Cyan
+        return
+    }
+
+    Write-Host 'For each project that opens:'
+    Write-Host '  1. Refresh the report so demo data is loaded.'
+    Write-Host '  2. Select File > Save as, keep the release/pbix folder, and change the file type to PBIX.'
+    if ($SensitivityLabel) { Write-Host "  3. Set the sensitivity to `"$SensitivityLabel`" when prompted." }
+    Write-Host '  4. Close Power BI Desktop without saving other changes.'
+    Write-Host ''
+    Write-Host 'Queries are already trimmed and the Get started page is already selected, so there is nothing else to change.'
+    Write-Host ''
+
+    if ($null -eq $IsWindows -or $IsWindows)
+    {
+        $state.Missing | ForEach-Object { Invoke-Item "$pbixDir/$($_.pbip)" }
+        Write-Host "Opened $($state.Missing.Count) project$(if ($state.Missing.Count -ne 1) { 's' }) in Power BI Desktop."
+    }
+    else
+    {
+        Write-Warning 'Power BI Desktop only runs on Windows. Open these projects there:'
+        $state.Missing | ForEach-Object { Write-Host "     $((Resolve-Path "$pbixDir/$($_.pbip)").Path)" }
+    }
+
+    Write-Host ''
+    Write-Host '     When they are all saved, run: ' -NoNewline
+    Write-Host './Package-PowerBI' -ForegroundColor Cyan
+    return
+}
+
+#endregion Save PBIX files
+
+#region Validate and package
+
+Write-Host "Checking $($state.Saved.Count) demo report$(if ($state.Saved.Count -ne 1) { 's' })..."
+$failed = 0
+foreach ($report in $state.Saved)
+{
+    $path = "$pbixDir/$($report.pbix)"
+    $issues = Test-DemoPbix $path $report $builtAt $SensitivityLabel
+    if ($issues.Count -eq 0)
+    {
+        Write-Host "  ✅ $($report.pbix)  $(Format-Size (Get-Item $path).Length)"
+    }
+    else
+    {
+        $failed++
+        Write-Host "  ❌ $($report.pbix)" -ForegroundColor Red
+        $issues | ForEach-Object { Write-Host "       $_" -ForegroundColor Red }
+    }
+}
+
+if ($failed -gt 0)
+{
+    Write-Host ''
+    throw "$failed demo report$(if ($failed -ne 1) { 's' }) failed validation. Fix the issues above, save again (or run ./Package-PowerBI -Unattended), and rerun this command."
+}
+
+Write-Host ''
+if ($demoZipCurrent)
+{
+    Write-Host 'PowerBI-demo.zip is already up to date.'
+}
+else
+{
+    Write-Host 'Packaging PowerBI-demo.zip...'
+
+    # PBIX files are already compressed, so the fastest level takes far less time for the same size
+    Remove-Item $demoZip -Force -ErrorAction SilentlyContinue
+    Compress-Archive -Path ($state.Saved | ForEach-Object { "$pbixDir/$($_.pbix)" }) -DestinationPath $demoZip -CompressionLevel Fastest
+}
+
+Write-Host ''
+$missingFiles = @($templateZips + $demoZip | Where-Object { -not (Test-Path $_) })
+if ($missingFiles.Count -gt 0)
+{
+    throw "Power BI release files are incomplete. Missing: $(($missingFiles | ForEach-Object { Split-Path $_ -Leaf }) -join ', '). Rebuild all reports with ./Package-PowerBI -Build."
+}
+
+Write-Host "✅ Power BI release files for $version" -ForegroundColor Green
+@($templateZips + $demoZip) `
+| ForEach-Object { Write-Host "     $(Split-Path $_ -Leaf)  $(Format-Size (Get-Item $_).Length)" }
+
+#endregion Validate and package
diff --git a/src/scripts/Package-Toolkit.ps1 b/src/scripts/Package-Toolkit.ps1
index 80178a440..ca880dc64 100644
--- a/src/scripts/Package-Toolkit.ps1
+++ b/src/scripts/Package-Toolkit.ps1
@@ -18,10 +18,10 @@
     Optional. Indicates whether to copy templates and open data files. Default = false.
 
     .PARAMETER OpenPBI
-    Optional. Indicates that Power BI storage projects should be opened so they can be manually saved as *.storage.pbix files. Default = false.
+    Optional. Opens the generated Power BI projects so they can be saved as *.storage.pbix files. Equivalent to Package-PowerBI -Open. Default = false.
 
     .PARAMETER ZipPBI
-    Optional. Indicates that demo PBIX files should be packaged into PowerBI-demo.zip. Default = false.
+    Optional. Validates the saved PBIX files and packages them into PowerBI-demo.zip. Equivalent to Package-PowerBI. Default = false.
 
     .PARAMETER Preview
     Optional. Indicates that the template(s) should be saved as a preview only. Does not package other files. Default = false.
@@ -44,7 +44,7 @@
     .EXAMPLE
     ./Package-Toolkit -ZipPBI
 
-    Generates the PowerBI-demo.zip file. Must be run after -OpenPBI.
+    Validates the saved PBIX files and generates the PowerBI-demo.zip file. Must be run after -OpenPBI.
 #>
 param(
     [Parameter(Position = 0)][string]$Template = "*",
@@ -88,7 +88,9 @@ function Copy-TemplateFiles()
     if ($Template -eq "*")
     {
         Write-Verbose "Removing existing ZIP files..."
-        Remove-Item "$relDir/*.zip" -Force
+        # Power BI ZIP files are managed by Build-PowerBI and Package-PowerBI. Deleting them here
+        # would throw away the templates that -Build just generated.
+        Remove-Item "$relDir/*.zip" -Force -Exclude 'PowerBI-*.zip'
     }
 
     return Get-ChildItem "$relDir/$Template*" -Directory `
@@ -300,74 +302,20 @@ if ($CopyFiles -or $Build -or $Preview -or -not ($OpenPBI -or $ZipPBI))
     }
 }
 
-# Open or zip Power BI storage reports to generate PowerBI-demo.zip
-$pbip = Get-ChildItem -Path "$PSScriptRoot/../power-bi/storage" -Include "*.pbip" -Recurse
-if (-not ($OpenPBI -or $ZipPBI))
+# Power BI files are packaged by Package-PowerBI, which reports what's left to do
+if ($OpenPBI)
 {
-    Write-Host "⚠️ $($pbip.Count) Power BI projects must be manually saved as *.storage.pbix!"
-    Write-Host '     To open them, run: ' -NoNewline
-    Write-Host './Package-Toolkit -OpenPBI' -ForegroundColor Cyan
+    & "$PSScriptRoot/Package-PowerBI.ps1" -Open
 }
-elseif ($OpenPBI)
+elseif ($ZipPBI)
 {
-    # Create temp pbix folder and remove existing storage/demo reports
-    & "$PSScriptRoot/New-Directory" "$relDir/pbix"
-    Remove-Item -Path "$relDir/pbix/*.storage.pbix" -Recurse -Force -ErrorAction SilentlyContinue
-    Remove-Item -Path "$relDir/pbix/*.demo.pbix" -Recurse -Force -ErrorAction SilentlyContinue
-
-    # Open Power BI projects
-    Write-Host "ℹ️ $($pbip.Count) Power BI projects must be saved as PBIX first... Opening..."
-    $pbip | Invoke-Item
-    Write-Host '     Save as *.storage.pbix then run: ' -NoNewline
-    Write-Host './Package-Toolkit -ZipPBI' -ForegroundColor Cyan
+    & "$PSScriptRoot/Package-PowerBI.ps1"
 }
-elseif ($ZipPBI)
+elseif (-not $Preview)
 {
-    $pbixFiles = Get-ChildItem -Path "$relDir/pbix/*.storage.pbix"
-
-    # TODO: Confirm all files are ready
-    if ($pbip.Count -ne $pbixFiles.Count)
-    {
-        Write-Host "⚠️ Found $($pbip.Count) Power BI projects but $($pbixFiles.Count) *.storage.pbix files. Please confirm all projects are saved as PBIX files first."
-        return
-    }
-
-    # Clean PBIX files
-    Write-Verbose "Processing $($pbixFiles.Count) *.storage.pbix files..."
-    $pbixFiles | ForEach-Object {
-        # Expand PBIX files for cleanup
-        $pbix = $_
-        $pbixDir = $pbix.FullName.Replace('.storage.pbix', '.demo')
-        Write-Verbose "Expanding $pbixDir..."
-        Remove-Item -Path $pbixDir -Recurse -Force -ErrorAction SilentlyContinue
-        Expand-Archive -Path $pbix -DestinationPath $pbixDir
-
-        # Remove _rels, docProps
-        Remove-Item -Path "$pbixDir/_rels" -Recurse -Force -ErrorAction SilentlyContinue
-        Remove-Item -Path "$pbixDir/docProps" -Recurse -Force -ErrorAction SilentlyContinue
-
-        # Remove docProps from Content_Types
-        $contentTypes = [xml](Get-Content "$pbixDir/?Content_Types?.xml" -Raw)
-        $contentTypes.Types.Override | Where-Object {
-            $_.PartName -eq '/docProps/custom.xml' } | ForEach-Object { $contentTypes.Types.RemoveChild($_) | Out-Null
-        }
-        $contentTypes.Save("$pbixDir/[Content_Types].xml") | Out-Null
-
-        # Remove unneeded tables
-        # $diagramLayout = Get-Content "$pbixDir/DiagramLayout" -Raw | ConvertFrom-Json -Depth 100
-        # $diagramLayout.diagrams.nodes | Where-Object { $metadata.Tables -contains $_.nodeIndex }
-        # TODO: Save as UTF-16LE -- $diagramLayout | ConvertTo-Json -Depth 100
-
-        # TODO: Remove tables from data model
-        # pbi-tools extract $pbix
-        # TODO: Remove tables
-        # pbi-tools compile $pbixDir $pbix
-
-        # Zip as PBIX for demo
-        Write-Verbose "Saving demo $pbixDir.pbix..."
-        Remove-Item -Path "$pbixDir.pbix" -Recurse -Force -ErrorAction SilentlyContinue
-        Compress-Archive -Path $pbixDir -DestinationPath "$pbixDir.pbix"
-    }
+    & "$PSScriptRoot/Package-PowerBI.ps1" -Status
+    Write-Host '     To finish on Windows, run: ' -NoNewline
+    Write-Host './Package-PowerBI -Unattended' -ForegroundColor Cyan
 }
 
 Write-Host '...done!'
diff --git a/src/scripts/README.md b/src/scripts/README.md
index 6aeb2c5ad..9ee463d0e 100644
--- a/src/scripts/README.md
+++ b/src/scripts/README.md
@@ -14,6 +14,10 @@ On this page:
 - [🏷️ Get-Version](#️-get-version)
 - [🏷️ Update-Version](#️-update-version)
 - [🚚 Publish-Toolkit](#-publish-toolkit)
+- [🎬 Deploy-Demo](#-deploy-demo)
+- [📊 Build-PowerBI](#-build-powerbi)
+- [📊 Package-PowerBI](#-package-powerbi)
+- [📊 Save-PowerBIProject](#-save-powerbiproject)
 - [📦 Package-Toolkit](#-package-toolkit)
 - [©️ Add-CopyrightHeader](#️-add-copyrightheader)
 - [📁 New-Directory](#-new-directory)
@@ -454,6 +458,182 @@ Examples:
 
 <br>
 
+## 🎬 Deploy-Demo
+
+[Deploy-Demo.ps1](./Deploy-Demo.ps1) deploys and refreshes the FinOps hub instances that demo Power BI reports are built from.
+
+Demo reports in `PowerBI-demo.zip` are saved with data from a demo hub, so that hub has to be on the version being released and have data for the current month. Otherwise the demo either fails to refresh or ships with stale numbers.
+
+Two kinds of instances:
+
+- `ftk-demo` is the current demo hub, with 12 months of data. Demo reports are built from it.
+- `ftk-demo-v{version}` keeps one month of data for testing an older release. Stop its Data Explorer cluster after ingestion and it costs almost nothing to keep.
+
+Run `-Check` before a release. It reports the hub version and months of data, and fails when the hub is behind the toolkit version or has no data for the current month.
+
+| Parameter        | Description                                                                                       |
+| ---------------- | ------------------------------------------------------------------------------------------------- |
+| `‑Version`       | Optional. Deploys the versioned instance for a release (for example, "v15"). Default = the current demo hub. |
+| `‑Subscription`  | Optional. Name or ID of the subscription to deploy to. Default = "FTK Prod".                       |
+| `‑ResourceGroup` | Optional. Name of the resource group. Default = the instance name.                                 |
+| `‑Location`      | Optional. Azure region. Default = "westus".                                                        |
+| `‑Scope`         | Optional. Resource IDs to export cost data for. Default = the subscription being deployed to.      |
+| `‑Retention`     | Optional. Months of data the hub keeps. Default = 12, or 1 for a versioned instance.               |
+| `‑Backfill`      | Optional. Months of history to load. Backfilling is a one-time task for a new instance, so nothing is backfilled unless specified. |
+| `‑Check`         | Optional. Reports whether the demo hub is ready for a release without changing anything.           |
+| `‑Stop`          | Optional. Stops the Data Explorer cluster when finished. Default = true for versioned instances.   |
+| `‑Build`         | Optional. Builds the templates before deploying.                                                   |
+
+Examples:
+
+- Check whether the demo hub is ready for a release.
+
+  ```powershell
+  ./Deploy-Demo -Check
+  ```
+
+- Deploy or update the demo hub. Exports keep running on their own, so nothing is backfilled.
+
+  ```powershell
+  ./Deploy-Demo
+  ```
+
+- Load 12 months of history, which a new instance needs once.
+
+  ```powershell
+  ./Deploy-Demo -Backfill 12
+  ```
+
+- Deploy the versioned instance for v15.
+
+  ```powershell
+  ./Deploy-Demo -Version v15 -Backfill 1
+  ```
+
+<br>
+
+## 📊 Build-PowerBI
+
+[Build-PowerBI.ps1](./Build-PowerBI.ps1) generates the Power BI release artifacts:
+
+- One PBIT template per report in `release/pbit`, zipped into `PowerBI-kql.zip` and `PowerBI-storage.zip`.
+- One PBIP project per demo report (storage reports) in `release/pbix`, containing only the tables, relationships, and queries that report needs.
+
+Both come from a single prune, so the template and the demo report always match. The tables and queries each report keeps are listed in [src/power-bi/reports.json](../power-bi/reports.json). When you add a table or query to a report, add it there too.
+
+Templates ship with the data source parameters set to null. Demo projects keep the data source saved in the semantic model, which points at the demo hub.
+
+Demo reports ship to customers, so they read open data over HTTP like the templates do. They can't use the release URL, because it resolves to the last published release, which doesn't have open data files added during the release being built. `‑OpenDataUrl` sets where they read it from, and defaults to the open data files in the `main` branch. Every URL is checked at build time, so a file that isn't published yet fails here instead of when someone refreshes the demo.
+
+The URL ends up inside the demo reports, so it has to outlive the release. Only the `main` branch and release URLs are accepted. The release process merges to `main` before packaging Power BI, so the default is correct at release time.
+
+To build demo reports before that merge, add `‑TestOpenDataUrl` and pass a branch with `‑OpenDataUrl`. Those reports can't be released: the build warns, records it in the manifest, and `Package-PowerBI` refuses to package them.
+
+
+The build fails, with a message that names the report and what to add to `reports.json`, when:
+
+- A table the report keeps has columns that only differ by case, which Power BI can't load.
+- A visual on a visible page reads from a table the report doesn't keep. Hidden pages only log a warning.
+- A query, table, or measure the report keeps uses a table or query the report doesn't keep.
+
+| Parameter  | Description                                                                                  |
+| ---------- | -------------------------------------------------------------------------------------------- |
+| `‑Name`    | Optional. Name of the report to build. Wildcards supported. Default = \* (all).              |
+| `‑KQL`     | Optional. Builds the KQL reports. Default = false (builds all if no types are selected).     |
+| `‑Storage` | Optional. Builds the storage reports. Default = false (builds all if no types are selected). |
+| `‑NoPbip`  | Optional. Skips generating PBIP projects and only builds PBIT templates. Default = false.    |
+
+Examples:
+
+- Generate all templates and projects.
+
+  ```powershell
+  ./Build-PowerBI
+  ```
+
+- Generate the Cost summary storage template and project.
+
+  ```powershell
+  ./Build-PowerBI CostSummary -Storage
+  ```
+
+<br>
+
+## 📊 Package-PowerBI
+
+[Package-PowerBI.ps1](./Package-PowerBI.ps1) packages the three Power BI release files and reports what's left to do.
+
+On Windows, `-Unattended` does everything with one command: build, save demo PBIX files with Power BI Desktop (using [Save-PowerBIProject](#-save-powerbiproject)), validate, and package. Don't use the mouse or keyboard while it runs. Expect about 10 minutes per report, or an hour for all six. If an earlier test build is still in `release/pbix` (made with `‑TestOpenDataUrl`), it stops and asks for `-Build` once to rebuild against the main branch.
+
+Without `-Unattended`, the command is resumable: run it, save the projects it opens, then run it again. Either way, it works out which steps are already done, does the next one, and validates the result.
+
+Demo reports are saved in whatever report format Power BI Desktop uses. Since September 2026 that's the enhanced report format (PBIR), which Desktop converts reports to when it saves them. Both formats are accepted, but a PBIR demo report needs Power BI Desktop from September 2026 or later to open.
+
+Saved PBIX files are checked for the mistakes that are easy to make by hand — saved without data, saved from the unpruned source project, saved on the wrong page, saved with the wrong sensitivity label, or saved before the latest build — so a missed step fails here instead of shipping. With `-Unattended`, files that fail these checks are saved again automatically.
+
+| Parameter           | Description                                                                                                                        |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
+| `‑Unattended`       | Optional. Saves the projects with Power BI Desktop automatically, then validates and packages them. Windows only. Default = false. |
+| `‑Open`             | Optional. Opens the projects that still need to be saved as PBIX files. Default = false.                                           |
+| `‑Build`            | Optional. Rebuilds the templates and projects even if they already exist. Default = false.                                         |
+| `‑Status`           | Optional. Reports what's done and what's left without changing anything. Default = false.                                          |
+| `‑SensitivityLabel` | Optional. Sensitivity label demo reports must have, if they have one. Default = "Public".                                          |
+
+Examples:
+
+- Build, save, validate, and package everything (Windows).
+
+  ```powershell
+  ./Package-PowerBI -Unattended
+  ```
+
+- Build whatever is missing and report the next step.
+
+  ```powershell
+  ./Package-PowerBI
+  ```
+
+- Open the projects that still need to be saved as PBIX files.
+
+  ```powershell
+  ./Package-PowerBI -Open
+  ```
+
+<br>
+
+## 📊 Save-PowerBIProject
+
+[Save-PowerBIProject.ps1](./Save-PowerBIProject.ps1) opens one Power BI project in Power BI Desktop, refreshes its data, applies the sensitivity label, saves it as a PBIX file, and closes Power BI Desktop. `Package-PowerBI -Unattended` calls it for each demo report, so you usually don't need to run it directly.
+
+Data is refreshed through the Analysis Services engine that Power BI Desktop runs locally, so refresh errors stop the script instead of saving an empty report. When the engine can't refresh (it can't load every connector, like Azure Resource Graph), the refresh is retried with Power BI Desktop's own Refresh button. Saving uses Windows UI Automation. If a step can't be automated, the script stops with a message that names the step and saves a screenshot next to the PBIX file (`*.error.png`). Save that report by hand and rerun `Package-PowerBI`.
+
+Requirements:
+
+- Windows with Power BI Desktop installed and associated with `.pbip` files.
+- An interactive desktop session. Don't use the mouse or keyboard while it runs.
+
+- Sign in to Power BI Desktop, and refresh one demo project by hand once so Power BI Desktop stores the credentials for the demo data source. Nothing here can sign in or answer a credential prompt. A sign-in window stops the script right away, and a missing credential fails the refresh with the error the engine reports.
+
+The sensitivity label is applied only when Power BI Desktop offers one and the control is enabled. Tenants without labels show the button greyed out, which is detected and skipped. A report saved without a label passes validation; a report saved with any label other than the expected one fails.
+
+| Parameter           | Description                                                                                                    |
+| ------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `‑Path`             | Required. Path to the PBIP file to open.                                                                       |
+| `‑Destination`      | Optional. Path of the PBIX file to save. Default = the PBIP path with a .pbix extension.                       |
+| `‑SensitivityLabel` | Optional. Name of the sensitivity label to apply. Default = "Public".                                          |
+| `‑TimeoutMinutes`   | Optional. Maximum number of minutes to wait for Power BI Desktop to open and refresh the report. Default = 30. |
+| `‑SkipRefresh`      | Optional. Saves the report without refreshing data. Default = false.                                           |
+
+Example:
+
+- Refresh the Cost summary demo project and save it as a PBIX file.
+
+  ```powershell
+  ./Save-PowerBIProject ../../release/pbix/CostSummary.storage.pbip
+  ```
+
+<br>
+
 ## 📦 Package-Toolkit
 
 [Package-Toolkit.ps1](./Package-Toolkit.ps1) packages all toolkit templates as ZIP files for release.
@@ -462,7 +642,9 @@ Examples:
 | ----------- | -------------------------------------------------------------------------------------------------------------------------- |
 | `‑Template` | Optional. Name of the template or module to package. Default = \* (all).                                                   |
 | `‑Build`    | Optional. Indicates whether the Build-Toolkit command should be executed first. Default = false.                           |
-| `‑PowerBI`  | Optional. Indicates whether to open Power BI files as part of the packaging process. Default = false.                      |
+| `‑CopyFiles` | Optional. Indicates whether to copy templates and open data files. Default = false.                                       |
+| `‑OpenPBI`  | Optional. Opens the generated Power BI projects to be saved as PBIX files. Same as `Package-PowerBI -Open`. Default = false. |
+| `‑ZipPBI`   | Optional. Validates the saved PBIX files and packages PowerBI-demo.zip. Same as `Package-PowerBI`. Default = false.        |
 | `‑Preview`  | Optional. Indicates that the template(s) should be saved as a preview only. Does not package other files. Default = false. |
 
 Examples:
diff --git a/src/scripts/Save-PowerBIProject.ps1 b/src/scripts/Save-PowerBIProject.ps1
new file mode 100644
index 000000000..63aeb3b40
--- /dev/null
+++ b/src/scripts/Save-PowerBIProject.ps1
@@ -0,0 +1,1069 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+<#
+    .SYNOPSIS
+    Opens a Power BI project in Power BI Desktop, refreshes it, and saves it as a PBIX file.
+
+    .DESCRIPTION
+    Automates the one release step that needs Power BI Desktop: saving demo reports with data.
+
+    1. Opens the project in Power BI Desktop.
+    2. Refreshes the data model through the local Analysis Services engine that Power BI Desktop
+       runs, so refresh errors are reported instead of silently saving an empty report. When the
+       engine can't refresh (it can't load every connector, like Azure Resource Graph), the refresh
+       is retried with Power BI Desktop's own Refresh button.
+    3. Applies the sensitivity label, when Power BI Desktop offers one.
+    4. Saves the report as a PBIX file with Save as.
+    5. Closes Power BI Desktop.
+
+    This uses Windows UI Automation to drive Power BI Desktop, which only runs on Windows. If a step
+    can't be automated, the script stops with a message that says which step failed and saves a
+    screenshot next to the destination file. Save that project by hand and rerun Package-PowerBI.
+
+    Run Package-PowerBI -Unattended instead of calling this directly. It saves every project that
+    still needs to be saved, validates the result, and packages PowerBI-demo.zip.
+
+    .PARAMETER Path
+    Required. Path to the PBIP file to open.
+
+    .PARAMETER Destination
+    Optional. Path of the PBIX file to save. Default = the PBIP path with a .pbix extension.
+
+    .PARAMETER SensitivityLabel
+    Optional. Name of the sensitivity label to apply, when the tenant has labels. Skipped when Power BI Desktop doesn't offer any. Default = "Public".
+
+    .PARAMETER TimeoutMinutes
+    Optional. Maximum number of minutes to wait for Power BI Desktop to open and refresh the report. Default = 30.
+
+    .PARAMETER SkipRefresh
+    Optional. Saves the report without refreshing data. Default = false.
+
+    .EXAMPLE
+    ./Save-PowerBIProject ../../release/pbix/CostSummary.storage.pbip
+
+    Refreshes the Cost summary demo project and saves it as CostSummary.storage.pbix.
+
+    .LINK
+    https://github.com/microsoft/finops-toolkit/blob/dev/src/scripts/README.md#-save-powerbiproject
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true, Position = 0)]
+    [string]
+    $Path,
+
+    [string]
+    $Destination,
+
+    [string]
+    $SensitivityLabel = 'Public',
+
+    [int]
+    $TimeoutMinutes = 30,
+
+    [switch]
+    $SkipRefresh
+)
+
+$ErrorActionPreference = 'Stop'
+
+if ($null -ne $IsWindows -and -not $IsWindows)
+{
+    throw 'Power BI Desktop only runs on Windows. Run this command on Windows or save the project by hand.'
+}
+
+$Path = (Resolve-Path $Path).Path
+if (-not $Destination) { $Destination = [System.IO.Path]::ChangeExtension($Path, '.pbix') }
+$Destination = [System.IO.Path]::GetFullPath($Destination)
+$reportLabel = [System.IO.Path]::GetFileNameWithoutExtension($Path)
+$deadline = (Get-Date).AddMinutes($TimeoutMinutes)
+
+Add-Type -AssemblyName UIAutomationClient, UIAutomationTypes, System.Windows.Forms, System.Drawing, System.IO.Compression.FileSystem
+
+# A type can't be redefined once it's loaded, so a session that already ran this script keeps the
+# methods it had then, and editing this block would have no effect there. Compiling under a name
+# nothing has used yet sidesteps that, so a session never has to be restarted to pick up changes.
+$script:Win32Name = "Win32_$([guid]::NewGuid().ToString('N'))"
+Add-Type -Namespace FinOpsToolkit -Name $script:Win32Name -MemberDefinition @'
+private delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
+[DllImport("user32.dll")] private static extern bool EnumChildWindows(IntPtr parent, EnumProc callback, IntPtr lParam);
+// The callback has to be compiled code. A PowerShell scriptblock passed as the delegate never
+// gets called, so the enumeration lives here and hands back a plain array.
+public static IntPtr[] GetDescendants(IntPtr parent)
+{
+    var found = new System.Collections.Generic.List<IntPtr>();
+    EnumChildWindows(parent, (h, l) => { found.Add(h); return true; }, IntPtr.Zero);
+    return found.ToArray();
+}
+[DllImport("user32.dll")] public static extern IntPtr GetParent(IntPtr hWnd);
+[DllImport("user32.dll", CharSet = CharSet.Unicode)] public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder name, int count);
+[DllImport("user32.dll")] public static extern int GetDlgCtrlID(IntPtr hWnd);
+[DllImport("user32.dll", EntryPoint = "SendMessageW", CharSet = CharSet.Unicode)] public static extern IntPtr SendMessageString(IntPtr hWnd, uint msg, IntPtr wParam, System.Text.StringBuilder lParam);
+[DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr hWnd);
+[DllImport("user32.dll")] public static extern bool SetCursorPos(int x, int y);
+[DllImport("user32.dll")] public static extern void mouse_event(uint flags, uint dx, uint dy, uint data, UIntPtr extra);
+[DllImport("user32.dll", CharSet = CharSet.Unicode)] public static extern IntPtr SendMessageW(IntPtr hWnd, uint msg, IntPtr wParam, string lParam);
+[DllImport("user32.dll")] public static extern IntPtr SendMessage(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam);
+'@
+
+<#
+    .SYNOPSIS
+    Lists every window inside a dialog with its class, control id, and parent.
+
+    .DESCRIPTION
+    The file type list isn't in what UI Automation reports for this dialog, so its own window has
+    to be found to set it. It sits several levels down (the dialog hosts a DirectUI view that hosts
+    the combo boxes), so the whole tree is listed. Leaving it alone makes Power BI Desktop save a
+    project, which looks like a save that worked right up until the PBIX isn't there.
+#>
+function Get-ChildWindow([IntPtr] $Parent)
+{
+    if ($Parent -eq [IntPtr]::Zero) { return , @() }
+
+    $windows = foreach ($handle in $win32::GetDescendants($Parent))
+    {
+        $name = New-Object System.Text.StringBuilder 256
+        $win32::GetClassName($handle, $name, $name.Capacity) | Out-Null
+        [PSCustomObject]@{
+            Handle = $handle
+            Parent = $win32::GetParent($handle)
+            Class  = $name.ToString()
+            Id     = $win32::GetDlgCtrlID($handle)
+        }
+    }
+    return , @($windows)
+}
+
+<#
+    .SYNOPSIS
+    Sets a combo box in a file dialog to the entry matching a pattern.
+#>
+function Set-ComboSelection([IntPtr] $Combo, [string] $Pattern)
+{
+    $count = [int]$win32::SendMessage($Combo, 0x0146, [IntPtr]::Zero, [IntPtr]::Zero) # CB_GETCOUNT
+    for ($i = 0; $i -lt $count; $i++)
+    {
+        $text = New-Object System.Text.StringBuilder 512
+        $win32::SendMessageString($Combo, 0x0148, [IntPtr]$i, $text) | Out-Null # CB_GETLBTEXT
+        if ($text.ToString() -notmatch $Pattern) { continue }
+
+        $win32::SendMessage($Combo, 0x014E, [IntPtr]$i, [IntPtr]::Zero) | Out-Null # CB_SETCURSEL
+
+        # CB_SETCURSEL only moves the highlight. The dialog keeps its own file type and only
+        # follows it (and rewrites the extension in the file name) when the combo's parent hears
+        # CBN_SELENDOK, the notification a click on the list sends. Sending CBN_SELCHANGE, or
+        # sending either one to the dialog itself, changes what's drawn but not what gets saved.
+        $id = $win32::GetDlgCtrlID($Combo)
+        $wParam = [IntPtr](([int64]9 -shl 16) -bor ($id -band 0xFFFF)) # CBN_SELENDOK
+        $parent = $win32::GetParent($Combo)
+        $win32::SendMessage($parent, 0x0111, $wParam, $Combo) | Out-Null # WM_COMMAND
+        return $text.ToString()
+    }
+    return $null
+}
+
+$win32 = "FinOpsToolkit.$script:Win32Name" -as [type]
+
+$uia = [System.Windows.Automation.AutomationElement]
+$tree = [System.Windows.Automation.TreeScope]
+$props = [System.Windows.Automation.AutomationElement]
+$types = [System.Windows.Automation.ControlType]
+
+#region Helpers
+
+function Write-Step([string] $Message)
+{
+    Write-Host "    $Message"
+}
+
+function Wait-Until([scriptblock] $Condition, [string] $Description, [int] $Seconds = 0)
+{
+    $until = if ($Seconds -gt 0) { (Get-Date).AddSeconds($Seconds) } else { $deadline }
+    while ((Get-Date) -lt $until)
+    {
+        $result = & $Condition
+        if ($result) { return $result }
+        Start-Sleep -Milliseconds 500
+    }
+    throw "Timed out waiting for $Description."
+}
+
+function Get-ProcessWindow([int] $ProcessId)
+{
+    $condition = New-Object System.Windows.Automation.PropertyCondition($props::ProcessIdProperty, $ProcessId)
+    return @($uia::RootElement.FindAll($tree::Children, $condition))
+}
+
+function Find-Element($Root, [string] $Name, [System.Windows.Automation.ControlType[]] $ControlTypes, [string] $AutomationId)
+{
+    if (-not $Root) { return $null }
+
+    $conditions = New-Object System.Collections.Generic.List[System.Windows.Automation.Condition]
+    if ($Name) { $conditions.Add((New-Object System.Windows.Automation.PropertyCondition($props::NameProperty, $Name))) }
+    if ($AutomationId) { $conditions.Add((New-Object System.Windows.Automation.PropertyCondition($props::AutomationIdProperty, $AutomationId))) }
+
+    if ($conditions.Count -eq 0) { return $null }
+
+    $condition = if ($conditions.Count -eq 1) { $conditions[0] } else { New-Object System.Windows.Automation.AndCondition($conditions.ToArray()) }
+    foreach ($element in @($Root.FindAll($tree::Descendants, $condition)))
+    {
+        if (-not $ControlTypes -or $ControlTypes -contains $element.Current.ControlType)
+        {
+            if (-not $element.Current.IsOffscreen) { return $element }
+        }
+    }
+    return $null
+}
+
+<#
+    .SYNOPSIS
+    Finds a control in a file dialog by automation id and window class.
+
+    .DESCRIPTION
+    The Windows file dialog reports almost everything as a pane, so control types can't be used to
+    tell its parts apart. Ids aren't unique either: the file name box and the address bar are both
+    1001, and only their window class separates them.
+#>
+function Find-DialogElement($Dialog, [string] $AutomationId, [string] $ClassName)
+{
+    $condition = New-Object System.Windows.Automation.PropertyCondition($props::AutomationIdProperty, $AutomationId)
+    return @($Dialog.FindAll($tree::Descendants, $condition)) `
+    | Where-Object { -not $ClassName -or $_.Current.ClassName -eq $ClassName } `
+    | Select-Object -First 1
+}
+
+function Invoke-Element($Element)
+{
+    $attempts = @(
+        @{ Pattern = [System.Windows.Automation.InvokePattern]::Pattern; Action = { param($p) $p.Invoke() } }
+        @{ Pattern = [System.Windows.Automation.SelectionItemPattern]::Pattern; Action = { param($p) $p.Select() } }
+        @{ Pattern = [System.Windows.Automation.ExpandCollapsePattern]::Pattern; Action = { param($p) $p.Expand() } }
+        @{ Pattern = [System.Windows.Automation.TogglePattern]::Pattern; Action = { param($p) $p.Toggle() } }
+    )
+    foreach ($attempt in $attempts)
+    {
+        $pattern = $null
+        if (-not $Element.TryGetCurrentPattern($attempt.Pattern, [ref]$pattern)) { continue }
+
+        # A control can report a pattern and still refuse it, so the next one is tried instead
+        try { & $attempt.Action $pattern; return }
+        catch { Write-Verbose "  $($attempt.Pattern.ProgrammaticName) failed: $($_.Exception.Message)" }
+    }
+
+    # Some Power BI Desktop controls only respond to a real click
+    $rect = $Element.Current.BoundingRectangle
+    $x = [int]($rect.X + $rect.Width / 2)
+    $y = [int]($rect.Y + $rect.Height / 2)
+    $win32::SetCursorPos($x, $y) | Out-Null
+    $win32::mouse_event(0x0002, 0, 0, 0, [UIntPtr]::Zero) # left down
+    $win32::mouse_event(0x0004, 0, 0, 0, [UIntPtr]::Zero) # left up
+}
+
+function Send-KeyInput($Window, [string] $Keys)
+{
+    $win32::SetForegroundWindow([IntPtr]$Window.Current.NativeWindowHandle) | Out-Null
+    Start-Sleep -Milliseconds 300
+    [System.Windows.Forms.SendKeys]::SendWait($Keys)
+}
+
+<#
+    .SYNOPSIS
+    Writes what a window contains to a file, so a control that moved can be found without guessing.
+#>
+function Save-WindowTree($Window, [string] $Path, [IntPtr] $Handle = [IntPtr]::Zero)
+{
+    try
+    {
+        $lines = New-Object System.Collections.Generic.List[string]
+        $lines.Add("$($Window.Current.Name) [$($Window.Current.ClassName)]")
+        foreach ($element in @($Window.FindAll($tree::Descendants, [System.Windows.Automation.Condition]::TrueCondition)))
+        {
+            $current = $element.Current
+            $lines.Add("  $($current.ControlType.ProgrammaticName -replace '^ControlType\.', '')  name='$($current.Name)'  id='$($current.AutomationId)'  class='$($current.ClassName)'  enabled=$($current.IsEnabled)")
+        }
+        # UI Automation hides some of this dialog, so its real child windows are listed too
+        $lines.Add('')
+        $lines.Add('Child windows:')
+        if ($Handle -eq [IntPtr]::Zero) { $Handle = [IntPtr]$Window.Current.NativeWindowHandle }
+        foreach ($child in (Get-ChildWindow $Handle))
+        {
+            $text = New-Object System.Text.StringBuilder 256
+            $win32::SendMessageString($child.Handle, 0x000D, [IntPtr]$text.Capacity, $text) | Out-Null # WM_GETTEXT
+            $lines.Add("  class='$($child.Class)'  id=$($child.Id)  text='$($text.ToString())'")
+        }
+
+        [System.IO.File]::WriteAllLines($Path, $lines)
+        Write-Host "    Saved what the dialog contains: $Path"
+    }
+    catch { Write-Verbose "Could not write the window tree: $($_.Exception.Message)" }
+}
+
+function Save-Screenshot([string] $Reason)
+{
+    try
+    {
+        $screenshot = [System.IO.Path]::ChangeExtension($Destination, '.error.png')
+        $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds
+        $bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height)
+        $graphics = [System.Drawing.Graphics]::FromImage($bitmap)
+        $graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size)
+        $bitmap.Save($screenshot, [System.Drawing.Imaging.ImageFormat]::Png)
+        $graphics.Dispose()
+        $bitmap.Dispose()
+        Write-Host "    Saved a screenshot of the failure: $screenshot"
+    }
+    catch
+    {
+        Write-Verbose "Could not save a screenshot for '$Reason': $($_.Exception.Message)"
+    }
+}
+
+function Stop-Desktop([System.Diagnostics.Process] $Process)
+{
+    if (-not $Process -or $Process.HasExited) { return }
+
+    Get-CimInstance Win32_Process -Filter "ParentProcessId = $($Process.Id)" -ErrorAction SilentlyContinue `
+    | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+    Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue
+}
+
+function Import-TabularLibrary
+{
+    if ('Microsoft.AnalysisServices.Tabular.Server' -as [type]) { return }
+
+    if (-not (Get-Package Microsoft.AnalysisServices -ErrorAction SilentlyContinue))
+    {
+        Write-Verbose 'Installing the Analysis Services package...'
+        Install-Package -Name Microsoft.AnalysisServices -ProviderName NuGet -Scope CurrentUser -Force | Out-Null
+    }
+    $script:TabularDllPath = "$((Get-Item (Get-Package Microsoft.AnalysisServices).Source).Directory)/lib/net8.0/Microsoft.AnalysisServices.Tabular.dll"
+    Add-Type -Path $script:TabularDllPath
+}
+
+<#
+    .SYNOPSIS
+    Reports Power BI Desktop windows that are waiting for someone to answer them.
+
+    .DESCRIPTION
+    Power BI Desktop asks for data source credentials the first time it reads a source, including
+    anonymous ones like a file on GitHub. Nothing here can answer those, and the refresh just
+    stops until someone does, so each one is named as it appears.
+#>
+<#
+    .SYNOPSIS
+    Runs a TMSL command against the Power BI Desktop engine and reports what it's waiting on.
+
+    .DESCRIPTION
+    Engine commands block until they finish, so they run on their own thread. That leaves this
+    one free to report credential prompts and to give up at the deadline instead of hanging.
+#>
+function Invoke-EngineCommand([string] $Command, [string] $Description, [int] $Port, $MainWindow, $Process, $Database)
+{
+    $worker = [powershell]::Create()
+    $null = $worker.AddScript({
+            param($DllPath, $Port, $Command)
+            Add-Type -Path $DllPath
+            $server = New-Object Microsoft.AnalysisServices.Tabular.Server
+            $server.Connect("Data Source=localhost:$Port")
+            try { return @($server.Execute($Command) | ForEach-Object { $_.Messages } | Where-Object { $_.GetType().Name -eq 'XmlaError' } | ForEach-Object { $_.Description }) }
+            finally { $server.Disconnect() }
+        }).AddArgument($script:TabularDllPath).AddArgument($Port).AddArgument($Command)
+
+    $reported = New-Object System.Collections.Generic.HashSet[string]
+    $handle = $worker.BeginInvoke()
+    $lastProgress = Get-Date
+    try
+    {
+        while (-not $handle.AsyncWaitHandle.WaitOne(2000))
+        {
+            Show-PendingPrompt $MainWindow $Process.Id $reported
+
+            # Power BI Desktop shows a "Refresh now" banner the whole time an engine refresh runs,
+            # because it isn't driving it. Table states don't help either: the refresh is one
+            # transaction, so every table stays NoData until it commits. What the engine process
+            # is consuming is the signal that work is happening.
+            if (((Get-Date) - $lastProgress).TotalSeconds -ge 30)
+            {
+                $lastProgress = Get-Date
+                $engine = Get-Process msmdsrv -ErrorAction SilentlyContinue | Sort-Object WorkingSet64 -Descending | Select-Object -First 1
+                if ($engine)
+                {
+                    $elapsed = [int]((Get-Date) - $started).TotalMinutes
+                    Write-Step "Still loading: engine has used $([int]$engine.CPU)s CPU and $([int]($engine.WorkingSet64 / 1MB)) MB ($elapsed min elapsed)..."
+                }
+            }
+            if ((Get-Date) -ge $deadline)
+            {
+                $worker.Stop()
+                throw "$Description didn't finish within $TimeoutMinutes minutes.$(if ($reported.Count -gt 0) { " It was waiting on: $($reported -join ', ')" })"
+            }
+        }
+
+        $errors = @($worker.EndInvoke($handle))
+        if ($reported.Count -gt 0) { Write-Step "Continuing after $($reported.Count) prompt$(if ($reported.Count -ne 1) { 's' })..." }
+        return , $errors
+    }
+    finally { $worker.Dispose() }
+}
+
+function Show-PendingPrompt($MainWindow, [int] $ProcessId, [System.Collections.Generic.HashSet[string]] $Reported)
+{
+    foreach ($window in @(Get-ProcessWindow $ProcessId))
+    {
+        if ($MainWindow -and $window.Current.NativeWindowHandle -eq $MainWindow.Current.NativeWindowHandle) { continue }
+
+        $name = $window.Current.Name
+        if (-not $name) { continue }
+
+        # Either a known prompt title or any dialog offering to connect or sign in
+        $isPrompt = $name -match "(?i)sign in|sign-in|credential|authenticat|your account|access web content|connect to"
+        if (-not $isPrompt)
+        {
+            $isPrompt = [bool](@('Connect', 'Sign in') | Where-Object { Find-Element $window $_ @($types::Button) } | Select-Object -First 1)
+        }
+        if (-not $isPrompt) { continue }
+
+        if ($Reported.Add($name))
+        {
+            Write-Host ''
+            Write-Host "    ⚠️ ACTION NEEDED: Power BI Desktop is waiting on '$name'." -ForegroundColor Yellow
+            Write-Host '       Answer it in that window. Everything continues on its own afterward.' -ForegroundColor Yellow
+            Write-Host ''
+        }
+    }
+}
+
+<#
+    .SYNOPSIS
+    Refreshes the report with Power BI Desktop's own Refresh button and waits for it to finish.
+
+    .DESCRIPTION
+    Some connectors, like Azure Resource Graph, only load when Power BI Desktop runs the refresh
+    itself. The same refresh sent to the engine fails with "The import ... matches no exports",
+    and the tables that read from them come back empty. Returns the errors it found, if any.
+#>
+function Invoke-DesktopRefresh($MainWindow, $Process, $Database)
+{
+    $button = Wait-Until -Description 'the Refresh button' -Seconds 60 -Condition { Find-Element $MainWindow 'Refresh' @($types::Button, $types::SplitButton, $types::MenuItem) }
+    Invoke-Element $button
+
+    $reported = New-Object System.Collections.Generic.HashSet[string]
+    $lastProgress = Get-Date
+    while ((Get-Date) -lt $deadline)
+    {
+        Start-Sleep -Seconds 10
+        Show-PendingPrompt $MainWindow $Process.Id $reported
+
+        # Tables stay empty until the whole refresh commits, so all of them being ready means done
+        $Database.Refresh($true)
+        $notReady = @($Database.Model.Tables `
+            | Where-Object { @($_.Partitions | Where-Object { $_.State -ne [Microsoft.AnalysisServices.Tabular.ObjectState]::Ready }).Count -gt 0 })
+        if ($notReady.Count -eq 0) { return , @() }
+
+        # Desktop reports a failed refresh in a window, and the tables never become ready
+        foreach ($window in @(Get-ProcessWindow $Process.Id | Where-Object { $_.Current.NativeWindowHandle -ne $MainWindow.Current.NativeWindowHandle }))
+        {
+            $text = @($window.FindAll($tree::Descendants, (New-Object System.Windows.Automation.PropertyCondition($props::ControlTypeProperty, $types::Text))) | ForEach-Object { $_.Current.Name }) -join ' '
+            if ("$($window.Current.Name) $text" -match "(?i)\b(error|failed|couldn't|could not|unable)\b")
+            {
+                return , @("Power BI Desktop showed '$($window.Current.Name)': $text")
+            }
+        }
+
+        if (((Get-Date) - $lastProgress).TotalSeconds -ge 60)
+        {
+            $lastProgress = Get-Date
+            Write-Step "Still refreshing in Power BI Desktop ($([int]((Get-Date) - $started).TotalMinutes) min elapsed)..."
+        }
+    }
+    return , @("Power BI Desktop didn't finish refreshing within $TimeoutMinutes minutes.")
+}
+
+<#
+    .SYNOPSIS
+    Finds the port of the Analysis Services engine that a Power BI Desktop process started.
+#>
+function Get-DesktopEnginePort([int] $ProcessId)
+{
+    $engine = Get-CimInstance Win32_Process -Filter "Name = 'msmdsrv.exe' AND ParentProcessId = $ProcessId" -ErrorAction SilentlyContinue | Select-Object -First 1
+    if (-not $engine)
+    {
+        # Fall back to the newest engine started after this script opened the report
+        $engine = Get-CimInstance Win32_Process -Filter "Name = 'msmdsrv.exe'" -ErrorAction SilentlyContinue `
+        | Where-Object { $_.CreationDate -ge $started } `
+        | Sort-Object CreationDate -Descending `
+        | Select-Object -First 1
+    }
+    if (-not $engine -or $engine.CommandLine -notmatch '-s\s+"(?<dir>[^"]+)"') { return $null }
+
+    $portFile = Join-Path $Matches.dir 'msmdsrv.port.txt'
+    if (-not (Test-Path $portFile)) { return $null }
+
+    # The port file is written as UTF-16LE
+    $port = ([System.IO.File]::ReadAllText($portFile, [System.Text.Encoding]::Unicode) -replace '[^0-9]', '')
+    if ($port) { return [int]$port }
+    return $null
+}
+
+#endregion Helpers
+
+$desktop = $null
+$server = $null
+$started = Get-Date
+$backupPath = "$Destination.bak"
+$completed = $false
+
+try
+{
+    #region Open
+
+    Write-Step "Opening $reportLabel in Power BI Desktop..."
+
+    # Saving as the wrong type writes folders named after the PBIX. Those block the next save, so
+    # anything named after the destination is cleared first. The project itself is named
+    # differently (CostSummary.storage.Report, not CostSummary.storage.pbix.Report) and is kept.
+    $destinationName = [System.IO.Path]::GetFileName($Destination)
+
+    # An existing PBIX is moved aside rather than deleted, so a failed save (for example a refresh
+    # error) doesn't cost the last good file. It's restored on failure and dropped on success. A backup
+    # left by an interrupted run is the last good file when the PBIX is missing, so it's restored first.
+    if ((Test-Path $backupPath -PathType Leaf) -and -not (Test-Path $Destination -PathType Leaf))
+    {
+        Write-Verbose '  Restoring the PBIX left in the backup by an interrupted run.'
+        Move-Item $backupPath $Destination -Force
+    }
+    Remove-Item $backupPath -Force -ErrorAction SilentlyContinue
+    if (Test-Path $Destination -PathType Leaf) { Move-Item $Destination $backupPath -Force }
+
+    Get-ChildItem ([System.IO.Path]::GetDirectoryName($Destination)) -Force -ErrorAction SilentlyContinue `
+    | Where-Object { ($_.Name -eq $destinationName -or $_.Name -like "$destinationName.*") -and $_.FullName -ne $backupPath } `
+    | ForEach-Object {
+        if ($_.PSIsContainer) { Write-Verbose "  Removing $($_.Name), left over from a save that wrote a project instead of a file." }
+        Remove-Item $_.FullName -Recurse -Force -ErrorAction SilentlyContinue
+    }
+    Remove-Item ([System.IO.Path]::ChangeExtension($Destination, '.error.png')) -Force -ErrorAction SilentlyContinue
+    Remove-Item ([System.IO.Path]::ChangeExtension($Destination, '.dialog.txt')) -Force -ErrorAction SilentlyContinue
+
+    $existing = @(Get-Process PBIDesktop -ErrorAction SilentlyContinue | ForEach-Object { $_.Id })
+    Start-Process -FilePath $Path
+
+    # Use the file association so the installed and Microsoft Store versions both work
+    $desktop = Wait-Until -Description 'Power BI Desktop to start' -Seconds 120 -Condition {
+        Get-Process PBIDesktop -ErrorAction SilentlyContinue | Where-Object { $existing -notcontains $_.Id } | Select-Object -First 1
+    }
+
+    $promptedAt = $null
+    $mainWindow = Wait-Until -Description "the $reportLabel report to open" -Condition {
+        $windows = @(Get-ProcessWindow $desktop.Id)
+
+        # Nothing here can sign in, so say so plainly and wait for the person at the keyboard
+        $signIn = @($windows | Where-Object { $_.Current.Name -match "(?i)sign in|sign-in|credential|authenticat|your account" }) | Select-Object -First 1
+        if ($signIn)
+        {
+            if (-not $promptedAt)
+            {
+                $promptedAt = Get-Date
+                Write-Host ''
+                Write-Host "    ⚠️ ACTION NEEDED: Power BI Desktop is asking you to sign in ('$($signIn.Current.Name)')." -ForegroundColor Yellow
+                Write-Host '       Complete the sign-in in that window. Everything continues on its own afterward.' -ForegroundColor Yellow
+                Write-Host ''
+            }
+            return $null
+        }
+
+        if ($promptedAt)
+        {
+            Write-Step "Signed in after $([int]((Get-Date) - $promptedAt).TotalSeconds) seconds. Continuing..."
+            $promptedAt = $null
+        }
+
+        $windows | Where-Object { $_.Current.Name -like "*$reportLabel*" } | Select-Object -First 1
+    }
+
+    #endregion Open
+
+    #region Refresh
+
+    Import-TabularLibrary
+    $port = Wait-Until -Description 'the Power BI Desktop data model to load' -Condition { Get-DesktopEnginePort $desktop.Id }
+
+    $server = New-Object Microsoft.AnalysisServices.Tabular.Server
+    $server.Connect("Data Source=localhost:$port")
+    $database = Wait-Until -Description 'the Power BI Desktop data model to load' -Condition {
+        $server.Refresh($true)
+        $server.Databases | Where-Object { $_.Model -and $_.Model.Tables.Count -gt 0 } | Select-Object -First 1
+    }
+
+    if ($SkipRefresh)
+    {
+        Write-Step 'Skipping data refresh.'
+    }
+    else
+    {
+        Write-Step "Refreshing $($database.Model.Tables.Count) tables..."
+        $refreshStarted = Get-Date
+
+        # Refresh policies only apply in the Power BI service
+        $command = @{ refresh = @{ type = 'full'; applyRefreshPolicy = $false; objects = @(@{ database = $database.Name }) } } | ConvertTo-Json -Depth 5 -Compress
+
+        $errors = Invoke-EngineCommand $command 'Data refresh' $port $mainWindow $desktop $database
+        $refreshedByDesktop = $false
+        if ($errors.Count -gt 0)
+        {
+            # The engine can't load every connector (Azure Resource Graph, for one), so what it
+            # couldn't do is retried the way a person would: with Power BI Desktop's Refresh
+            Write-Step "The engine couldn't refresh the data. Trying Power BI Desktop's own refresh..."
+            $errors = Invoke-DesktopRefresh $mainWindow $desktop $database
+            $refreshedByDesktop = $errors.Count -eq 0
+        }
+        if ($errors.Count -gt 0)
+        {
+            # The engine reports what went wrong but not where, and one failure cancels the whole
+            # transaction. Refreshing each table on its own says which tables are actually broken.
+            Write-Step 'Refresh failed. Checking each table to find the cause...'
+            $broken = New-Object System.Collections.Generic.List[string]
+            foreach ($table in @($database.Model.Tables))
+            {
+                if ((Get-Date) -ge $deadline)
+                {
+                    $broken.Add('(ran out of time before checking every table)')
+                    break
+                }
+
+                $tableCommand = @{ refresh = @{ type = 'full'; applyRefreshPolicy = $false; objects = @(@{ database = $database.Name; table = $table.Name }) } } | ConvertTo-Json -Depth 5 -Compress
+                try
+                {
+                    $tableResults = $server.Execute($tableCommand)
+                    $tableErrors = @($tableResults | ForEach-Object { $_.Messages } | Where-Object { $_.GetType().Name -eq 'XmlaError' } | ForEach-Object { $_.Description })
+                }
+                catch
+                {
+                    $tableErrors = @($_.Exception.GetBaseException().Message)
+                }
+
+                # Errors about a cancelled transaction come from another table, not this one
+                $tableErrors = @($tableErrors | Where-Object { $_ -notmatch 'another operation in the transaction' })
+                if ($tableErrors.Count -gt 0) { $broken.Add("$($table.Name): $(($tableErrors | Select-Object -First 2) -join ' ')") }
+            }
+
+            $detail = if ($broken.Count -gt 0) { "`n  $($broken -join "`n  ")" } else { "`n  $($errors -join "`n  ")" }
+            throw "Data refresh failed:$detail"
+        }
+
+        # A refresh through the engine leaves calculated columns, tables, and relationships stale,
+        # which is what Power BI Desktop's "calculated objects need to be manually refreshed"
+        # banner is about. Recalculating here means the saved report doesn't need that click.
+        # Power BI Desktop's own refresh recalculates as part of it, so only the engine's needs this
+        if (-not $refreshedByDesktop)
+        {
+            Write-Step 'Recalculating calculated columns and tables...'
+            $calculate = @{ refresh = @{ type = 'calculate'; objects = @(@{ database = $database.Name }) } } | ConvertTo-Json -Depth 5 -Compress
+            $calculateErrors = Invoke-EngineCommand $calculate 'Recalculating' $port $mainWindow $desktop
+            if ($calculateErrors.Count -gt 0) { throw "Recalculating failed:`n  $($calculateErrors -join "`n  ")" }
+        }
+
+        $database.Refresh($true)
+        $notReady = @($database.Model.Tables `
+            | Where-Object { @($_.Partitions | Where-Object { $_.State -ne [Microsoft.AnalysisServices.Tabular.ObjectState]::Ready }).Count -gt 0 } `
+            | ForEach-Object { $_.Name })
+        if ($notReady.Count -gt 0)
+        {
+            throw "Data refresh didn't finish for: $($notReady -join ', ')"
+        }
+
+        Write-Step "Refreshed in $([int]((Get-Date) - $refreshStarted).TotalSeconds) seconds."
+    }
+
+    $server.Disconnect()
+    $server = $null
+
+    #endregion Refresh
+
+    #region Sensitivity label
+
+    # The Sensitivity button is only shown when the signed-in account has labels to apply
+    # Tenants without labels still show the button, greyed out, so being there isn't enough
+    $sensitivity = if ($SensitivityLabel) { Find-Element $mainWindow 'Sensitivity' @($types::SplitButton, $types::Button, $types::MenuItem) } else { $null }
+    if ($sensitivity -and -not $sensitivity.Current.IsEnabled)
+    {
+        Write-Step 'Sensitivity labels are turned off here. Skipping.'
+        $sensitivity = $null
+    }
+    elseif (-not $SensitivityLabel)
+    {
+        Write-Step 'No sensitivity label requested. Skipping.'
+    }
+
+    if ($sensitivity)
+    {
+        Write-Step "Applying the '$SensitivityLabel' sensitivity label..."
+        try
+        {
+            Invoke-Element $sensitivity
+            $label = Wait-Until -Description "the '$SensitivityLabel' sensitivity label" -Seconds 15 -Condition {
+                foreach ($window in @($mainWindow) + @(Get-ProcessWindow $desktop.Id))
+                {
+                    $item = Find-Element $window $SensitivityLabel @($types::MenuItem, $types::ListItem, $types::Button, $types::RadioButton, $types::CheckBox)
+                    if ($item) { return $item }
+                }
+            }
+            Invoke-Element $label
+            Start-Sleep -Seconds 1
+        }
+        catch
+        {
+            # Saving is the expensive part, so a label that can't be set doesn't stop it. The
+            # label is checked when the saved file is validated.
+            Write-Warning "Could not apply the '$SensitivityLabel' label to $reportLabel ($($_.Exception.Message)). Set it by hand if validation reports it."
+        }
+    }
+    elseif ($SensitivityLabel)
+    {
+        Write-Step 'No sensitivity labels are available. Skipping.'
+    }
+
+    #endregion Sensitivity label
+
+    #region Save as
+
+    Write-Step "Saving $([System.IO.Path]::GetFileName($Destination))..."
+
+    # File > Save as. Keytips are used when the ribbon isn't exposed to UI Automation.
+    $fileTab = $null
+    try { $fileTab = Wait-Until -Description 'the File menu' -Seconds 120 -Condition { Find-Element $mainWindow 'File' @($types::TabItem, $types::Button, $types::MenuItem) } }
+    catch { Write-Verbose 'The File menu is not exposed to UI Automation. Using keytips.' }
+    if ($fileTab) { Invoke-Element $fileTab } else { Send-KeyInput $mainWindow '%f' }
+
+    $saveAs = Wait-Until -Description 'the Save as option in the File menu' -Seconds 30 -Condition {
+        Find-Element $mainWindow 'Save as' @($types::ListItem, $types::Button, $types::MenuItem, $types::TabItem, $types::Hyperlink)
+    }
+    Invoke-Element $saveAs
+
+    # Newer versions show a "Browse this device" option before the file dialog
+    $dialog = Wait-Until -Description 'the Save as dialog' -Seconds 60 -Condition {
+        # Power BI Desktop has other dialogs of the same class, including Open. Typing a file name
+        # into one of those and pressing its default button does something else entirely, so the
+        # title decides, and a Save control is only used when a dialog has no title to go by.
+        $dialogs = @(Get-ProcessWindow $desktop.Id `
+            | ForEach-Object { $_; @($_.FindAll($tree::Children, [System.Windows.Automation.Condition]::TrueCondition)) } `
+            | Where-Object { $_.Current.ClassName -eq '#32770' })
+
+        $fileDialog = @($dialogs | Where-Object { $_.Current.Name -match '(?i)save' }) | Select-Object -First 1
+        if (-not $fileDialog)
+        {
+            $fileDialog = @($dialogs `
+                | Where-Object { -not $_.Current.Name -or $_.Current.Name -notmatch '(?i)open|import|confirm' } `
+                | Where-Object { Find-Element $_ 'Save' @($types::Button, $types::SplitButton) }) | Select-Object -First 1
+        }
+        if ($fileDialog) { return $fileDialog }
+
+        foreach ($other in $dialogs) { Write-Verbose "  Ignoring the '$($other.Current.Name)' dialog." }
+
+        $browse = Find-Element $mainWindow 'Browse this device' @($types::Button, $types::ListItem, $types::Hyperlink)
+        if ($browse) { Invoke-Element $browse }
+        return $null
+    }
+
+    # The file type decides the format, not the extension typed: with the type left on project, a
+    # name ending in .pbix saves CostSummary.storage.pbix.pbip and its folders instead of a file.
+    function Get-FileTypeValue($Combo)
+    {
+        $pattern = $null
+        if ($Combo.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$pattern)) { return $pattern.Current.Value }
+        $selected = @($Combo.FindAll($tree::Descendants, (New-Object System.Windows.Automation.PropertyCondition($props::ControlTypeProperty, $types::ListItem)))) `
+        | Where-Object { $_.Current.IsOffscreen -eq $false } | Select-Object -First 1
+        return $selected.Current.Name
+    }
+
+    # The dialog element doesn't always carry a window handle, but its file name box does, so the
+    # dialog's window is found by walking up from there.
+    $dialogHandle = [IntPtr]$dialog.Current.NativeWindowHandle
+    if ($dialogHandle -eq [IntPtr]::Zero)
+    {
+        $anchor = Find-DialogElement $dialog '1001' 'Edit'
+        $walk = if ($anchor) { [IntPtr]$anchor.Current.NativeWindowHandle } else { [IntPtr]::Zero }
+        while ($walk -ne [IntPtr]::Zero)
+        {
+            $class = New-Object System.Text.StringBuilder 256
+            $win32::GetClassName($walk, $class, $class.Capacity) | Out-Null
+            if ($class.ToString() -eq '#32770') { $dialogHandle = $walk; break }
+            $walk = $win32::GetParent($walk)
+        }
+        Write-Verbose "  Dialog window: $dialogHandle"
+    }
+
+    $selectedFileType = $null
+    $children = Get-ChildWindow $dialogHandle
+    # The file name box is a combo box too, and its history can mention a .pbix, so only a combo
+    # with no edit box inside it is the file type list
+    $editParents = @($children | Where-Object { $_.Class -eq 'Edit' } | ForEach-Object { $_.Parent })
+    foreach ($combo in @($children | Where-Object { $_.Class -match '(?i)combobox' -and $editParents -notcontains $_.Handle }))
+    {
+        $selectedFileType = Set-ComboSelection $combo.Handle '(?i)pbix'
+        if ($selectedFileType) { break }
+    }
+
+    if ($selectedFileType)
+    {
+        Write-Verbose "  File type: $selectedFileType"
+        Start-Sleep -Milliseconds 500
+    }
+    else
+    {
+        # Saving now writes a project, and the dialog is gone by the time that's noticed, so what
+        # it contains is recorded here, while it's still open
+        Save-WindowTree $dialog ([System.IO.Path]::ChangeExtension($Destination, '.dialog.txt')) $dialogHandle
+        Write-Warning "Could not set the Save as type to PBIX for $reportLabel ($($children.Count) child windows). Power BI Desktop will save a project instead."
+    }
+
+    $fileType = Find-Element $dialog $null @($types::ComboBox) 'FileTypeControlHost'
+    if (-not $fileType) { $fileType = Find-Element $dialog 'Save as type:' @($types::ComboBox) }
+    if (-not $fileType)
+    {
+        Write-Verbose '  No file type list reported by UI Automation.'
+    }
+    else
+    {
+
+    $expand = $null
+    if ($fileType.TryGetCurrentPattern([System.Windows.Automation.ExpandCollapsePattern]::Pattern, [ref]$expand))
+    {
+        try { $expand.Expand() } catch { Write-Verbose "  Could not open the file type list: $($_.Exception.Message)" }
+    }
+    Start-Sleep -Milliseconds 500
+
+    $pbixType = @($fileType.FindAll($tree::Descendants, (New-Object System.Windows.Automation.PropertyCondition($props::ControlTypeProperty, $types::ListItem)))) `
+    | Where-Object { $_.Current.Name -match '(?i)pbix' } `
+    | Select-Object -First 1
+    if ($pbixType) { Invoke-Element $pbixType }
+    elseif ($fileType.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$null))
+    {
+        $value = $null
+        $null = $fileType.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$value)
+        try { $value.SetValue('Power BI files (*.pbix)') } catch { Write-Verbose "  Could not set the file type: $($_.Exception.Message)" }
+    }
+    if ($expand) { try { $expand.Collapse() } catch { Write-Verbose '  File type list already closed.' } }
+    Start-Sleep -Milliseconds 500
+
+    # Saving as the wrong type makes a mess that's hard to recognize later, so stop before that
+    $selectedType = Get-FileTypeValue $fileType
+    Write-Verbose "  File type: $selectedType"
+    if ($selectedType -and $selectedType -notmatch '(?i)pbix')
+    {
+        Save-WindowTree $dialog ([System.IO.Path]::ChangeExtension($Destination, '.dialog.txt')) $dialogHandle
+        throw "The Save as dialog is still set to '$selectedType'. Saving now would write a project, not a PBIX."
+    }
+
+    }
+
+    # The search box and the address bar are editable too, and writing a path into either one
+    # makes the dialog reject it. Candidates are tried in order and the value is read back.
+    $candidates = New-Object System.Collections.Generic.List[object]
+    foreach ($candidate in @(
+            (Find-DialogElement $dialog '1001' 'Edit'),
+            (Find-Element $dialog 'File name:' @($types::Edit)),
+            $(
+                $host_ = Find-Element $dialog $null @($types::ComboBox) 'FileNameControlHost'
+                if ($host_) { Find-Element $host_ $null @($types::Edit) }
+            )
+        ))
+    {
+        if ($candidate) { $candidates.Add($candidate) }
+    }
+
+    @($dialog.FindAll($tree::Descendants, [System.Windows.Automation.Condition]::TrueCondition)) `
+    | Where-Object { $_.Current.IsEnabled -and -not $_.Current.IsOffscreen -and $_.Current.ClassName -eq 'Edit' } `
+    | Where-Object { "$($_.Current.Name) $($_.Current.AutomationId) $($_.Current.ClassName)" -notmatch '(?i)search|address|breadcrumb|toolbar' } `
+    | ForEach-Object { $candidates.Add($_) }
+
+    # Typing just the name avoids the path separators the dialog rejects in a file name, but only
+    # when the dialog is already in the right folder. The address bar says where that is.
+    $destinationFolder = [System.IO.Path]::GetDirectoryName($Destination)
+    $address = @($dialog.FindAll($tree::Descendants, [System.Windows.Automation.Condition]::TrueCondition)) `
+    | Where-Object { $_.Current.Name -match '^Address: (?<path>.+)$' } `
+    | Select-Object -First 1
+
+    $currentFolder = if ($address -and $address.Current.Name -match '^Address: (?<path>.+)$') { $Matches.path.TrimEnd('\') } else { $null }
+    # Full paths only: a folder with the same leaf name (another clone's release/pbix) is a different folder
+    $inDestination = $currentFolder -and $currentFolder -eq $destinationFolder.TrimEnd('\')
+    if (-not $currentFolder) { Write-Verbose '  The Save as dialog does not say what folder it is in. Using the full path.' }
+
+    $fileNameOnly = if ($inDestination) { [System.IO.Path]::GetFileName($Destination) } else { $Destination }
+    Write-Verbose "  Saving as '$fileNameOnly'$(if ($currentFolder) { " (dialog is in $currentFolder)" })"
+    $saveButton = Find-DialogElement $dialog '1' 'Button'
+    if (-not $saveButton) { $saveButton = Find-Element $dialog 'Save' @($types::Button, $types::SplitButton) }
+    if (-not $saveButton)
+    {
+        Save-WindowTree $dialog ([System.IO.Path]::ChangeExtension($Destination, '.dialog.txt')) $dialogHandle
+        throw "Could not find the Save button in the '$($dialog.Current.Name)' dialog [$($dialog.Current.ClassName)]."
+    }
+
+    # Whether a box is the right one can't be read reliably: these are legacy controls exposed as
+    # panes, with no value to read back and a name that doesn't always follow what was typed. The
+    # file appearing on disk is the only answer that matters, so each box is tried until it does.
+    $saved = $false
+    foreach ($candidate in $candidates)
+    {
+        Write-Verbose "  Typing the file name into '$($candidate.Current.Name)' [$($candidate.Current.ClassName)]..."
+
+        $value = $null
+        if ($candidate.TryGetCurrentPattern([System.Windows.Automation.ValuePattern]::Pattern, [ref]$value))
+        {
+            try { $value.SetValue($fileNameOnly) } catch { Write-Verbose "    Could not set it: $($_.Exception.Message)" }
+        }
+        else
+        {
+            # Windows refuses to give a background window focus, so typing can't be used at all.
+            # The text goes straight to the control instead, which needs neither focus nor the
+            # dialog to be in front.
+            $handle = [IntPtr]$candidate.Current.NativeWindowHandle
+            if ($handle -eq [IntPtr]::Zero)
+            {
+                Write-Verbose '    It has no window to write to.'
+                continue
+            }
+
+            $null = $win32::SendMessageW($handle, 0x000C, [IntPtr]::Zero, $fileNameOnly) # WM_SETTEXT
+            Start-Sleep -Milliseconds 300
+        }
+
+        $saveHandle = [IntPtr]$saveButton.Current.NativeWindowHandle
+        if ($saveHandle -ne [IntPtr]::Zero)
+        {
+            $null = $win32::SendMessage($saveHandle, 0x00F5, [IntPtr]::Zero, [IntPtr]::Zero) # BM_CLICK
+        }
+        else
+        {
+            Invoke-Element $saveButton
+        }
+
+        # Give the dialog a moment to either start writing or complain
+        for ($wait = 0; $wait -lt 10; $wait++)
+        {
+            Start-Sleep -Seconds 1
+            if (Test-Path $Destination) { $saved = $true; break }
+        }
+        if ($saved) { break }
+
+        foreach ($window in @(Get-ProcessWindow $desktop.Id | Where-Object { $_.Current.ClassName -eq '#32770' -and -not (Find-DialogElement $_ '1001' 'Edit') }))
+        {
+            $message = (@($window.FindAll($tree::Descendants, (New-Object System.Windows.Automation.PropertyCondition($props::ControlTypeProperty, $types::Text)))) | ForEach-Object { $_.Current.Name }) -join ' '
+            Write-Verbose "    The dialog said: $($window.Current.Name). $message"
+            foreach ($dismiss in 'No', 'Cancel', 'OK')
+            {
+                $button = Find-Element $window $dismiss @($types::Button)
+                if ($button) { Invoke-Element $button; break }
+            }
+        }
+    }
+
+    if (-not $saved)
+    {
+        Save-WindowTree $dialog ([System.IO.Path]::ChangeExtension($Destination, '.dialog.txt')) $dialogHandle
+        throw "Typed the file name into $($candidates.Count) box$(if ($candidates.Count -ne 1) { 'es' }) in the '$($dialog.Current.Name)' dialog and $([System.IO.Path]::GetFileName($Destination)) was never written."
+    }
+
+
+
+    # Wait for the file to be written, answering prompts Power BI Desktop shows while saving
+    Wait-Until -Description "$([System.IO.Path]::GetFileName($Destination)) to be saved" -Seconds 600 -Condition {
+        # Skip the main window and the Save as dialog, which is still closing
+        $prompts = @(Get-ProcessWindow $desktop.Id `
+            | Where-Object { $_.Current.NativeWindowHandle -ne $mainWindow.Current.NativeWindowHandle } `
+            | Where-Object { -not (Find-Element $_ $null @($types::Edit) '1001') })
+        foreach ($window in $prompts)
+        {
+            # Never confirm an error, or the failure would be hidden until the timeout
+            $text = @($window.FindAll($tree::Descendants, (New-Object System.Windows.Automation.PropertyCondition($props::ControlTypeProperty, $types::Text))) | ForEach-Object { $_.Current.Name }) -join ' '
+            if ("$($window.Current.Name) $text" -match "(?i)\b(error|failed|couldn't|could not|unable)\b")
+            {
+                throw "Power BI Desktop showed '$($window.Current.Name)': $text"
+            }
+
+            $label = Find-Element $window $SensitivityLabel @($types::ListItem, $types::RadioButton, $types::Button, $types::MenuItem)
+            if ($label)
+            {
+                Write-Step "Selecting the '$SensitivityLabel' sensitivity label in '$($window.Current.Name)'..."
+                Invoke-Element $label
+            }
+            foreach ($confirm in 'OK', 'Apply', 'Save')
+            {
+                $button = Find-Element $window $confirm @($types::Button)
+                if ($button)
+                {
+                    Write-Step "Selecting $confirm in '$($window.Current.Name)'..."
+                    Invoke-Element $button
+                    break
+                }
+            }
+        }
+
+        if (-not (Test-Path $Destination)) { return $false }
+        $size = (Get-Item $Destination).Length
+        Start-Sleep -Seconds 2
+        if ($size -eq 0 -or $size -ne (Get-Item $Destination).Length) { return $false }
+        try
+        {
+            [System.IO.Compression.ZipFile]::OpenRead($Destination).Dispose()
+            return $true
+        }
+        catch
+        {
+            return $false
+        }
+    } | Out-Null
+
+    #endregion Save as
+
+    #region Close
+
+    $windowPattern = $null
+    if ($mainWindow.TryGetCurrentPattern([System.Windows.Automation.WindowPattern]::Pattern, [ref]$windowPattern)) { $windowPattern.Close() }
+
+    try
+    {
+        Wait-Until -Description 'Power BI Desktop to close' -Seconds 60 -Condition {
+            if ($desktop.HasExited) { return $true }
+            foreach ($window in Get-ProcessWindow $desktop.Id)
+            {
+                $dontSave = Find-Element $window "Don't save" @($types::Button)
+                if ($dontSave) { Invoke-Element $dontSave }
+            }
+            return $false
+        } | Out-Null
+    }
+    catch
+    {
+        Write-Verbose 'Power BI Desktop did not close on its own. Stopping it.'
+    }
+
+    #endregion Close
+
+    $completed = $true
+    Remove-Item $backupPath -Force -ErrorAction SilentlyContinue
+
+    [PSCustomObject]@{
+        Path     = $Destination
+        Size     = (Get-Item $Destination).Length
+        Duration = (Get-Date) - $started
+    }
+}
+catch
+{
+    Save-Screenshot $_.Exception.Message
+    throw "Could not save $reportLabel automatically: $($_.Exception.Message) Save it by hand from Power BI Desktop, then rerun Package-PowerBI."
+}
+finally
+{
+    if ($server) { try { $server.Disconnect() } catch { Write-Verbose 'Engine connection already closed.' } }
+    Stop-Desktop $desktop
+
+    # Restore here rather than in catch so an interrupted run (Ctrl+C) is covered too, and only after
+    # Desktop has closed so it no longer holds the file being replaced
+    if (-not $completed -and (Test-Path $backupPath -PathType Leaf))
+    {
+        Remove-Item $Destination -Force -ErrorAction SilentlyContinue
+        Move-Item $backupPath $Destination -Force
+    }
+}