lalanc01​  Very good questions.

Would you mind following up with some more details:

• Those machines are managed / part of a domain, I assume? And neither AvailableUpdates nor ManagedDevicesOptIn has ever been touched by you?
• Can you definitely say that they have been updated by Microsoft (as opposed to them coming with the new certs from the factory, or having them updated by updating the firmware and applying setup defaults)?
• Do you find any of the relevant Event log entries in their event logs (apart from the one stating that there is nothing to update)?
• Would you mind share a sample Bucket Hash?

For devices that are not managed or have opted into ManagedDevicesOptin, they may have been updated via CFR despite the Bucket hash not yet being High Confidence. After all that is what CFR is about (rolling changes only to a subset of devices). Update via the High Confidence list included in the LCR should (as I understand it) not update devices that were in "Under observation" state, and I assume that hashes that once were High Confidence would not move back to Under Observation, but rather to one of the known blocker categories in case there were any issues.

About your last question, my impression is that they will not succeed to getting all the buckets to High Confidence by June, just by looking at the pace buckets have moved in the last months. But I'd be happy to be proven wrong.

Stats so you can draw your own conclusion: