fix(OSQUERY-002): 3 review findings across 2 files

[flamingo]

Closes 3 review findings across 2 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 92 high	Global constant arrays kNetworkShareIds and kPropertySets declared outside the osquery namespace	osquery/utils/windows/shellitem.cpp:21
2	🟢 90 high	File-scope constant arrays in shellitem.cpp do not use the required kPascalCase naming for one array	osquery/utils/windows/shellitem.cpp:21
3	🟢 90 high	logged_in_users.cpp declares kSessionStates at global (non-osquery) namespace scope	osquery/tables/system/windows/logged_in_users.cpp:26

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 01e7aadc-0204-47ef-b373-fc5dbadf3ab5

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff.

[flamingo]

🦩 🔴 Global constant arrays kNetworkShareIds and kPropertySets declared outside the osquery namespace

Moved kNetworkShareIds and kPropertySets declarations from file/global scope to inside the namespace osquery { ... } block (placed immediately after the opening brace, before guidParse). No other code was altered; all downstream usages (networkShareItem, propertyStore) remain valid since they are already within the same namespace block.

🤖 Prompt for AI agents

In osquery/utils/windows/shellitem.cpp around line 21, review and complete this code-review fix: Global constant arrays kNetworkShareIds and kPropertySets declared outside the osquery namespace.
What the draft fix changed: Moved `kNetworkShareIds` and `kPropertySets` declarations from file/global scope to inside the `namespace osquery { ... }` block (placed immediately after the opening brace, before `guidParse`). No other code was altered; all downstream usages (`networkShareItem`, `propertyStore`) remain valid since they are already within the same namespace block.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 File-scope constant arrays in shellitem.cpp do not use the required kPascalCase naming for one array

Same relocation as above resolves the leaking-into-global-namespace concern; the array names already use kPascalCase, so no renaming was needed—only the scope was corrected by moving both declarations inside namespace osquery.

🤖 Prompt for AI agents

In osquery/utils/windows/shellitem.cpp around line 21, review and complete this code-review fix: File-scope constant arrays in shellitem.cpp do not use the required kPascalCase naming for one array.
What the draft fix changed: Same relocation as above resolves the leaking-into-global-namespace concern; the array names already use kPascalCase, so no renaming was needed—only the scope was corrected by moving both declarations inside `namespace osquery`.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 logged_in_users.cpp declares kSessionStates at global (non-osquery) namespace scope

Moved the kSessionStates const std::map definition from global namespace scope into an anonymous namespace nested inside namespace osquery { namespace tables { ... } }, placed immediately before genLoggedInUsers. This resolves the global-scope pollution flagged in the finding while preserving usage at kSessionStates.at(pSessionInfo[i].State) inside genLoggedInUsers, which still resolves correctly via namespace lookup.

🤖 Prompt for AI agents

In osquery/tables/system/windows/logged_in_users.cpp around line 26, review and complete this code-review fix: logged_in_users.cpp declares kSessionStates at global (non-osquery) namespace scope.
What the draft fix changed: Moved the `kSessionStates` const std::map definition from global namespace scope into an anonymous namespace nested inside `namespace osquery { namespace tables { ... } }`, placed immediately before `genLoggedInUsers`. This resolves the global-scope pollution flagged in the finding while preserving usage at `kSessionStates.at(pSessionInfo[i].State)` inside `genLoggedInUsers`, which still resolves correctly via namespace lookup.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer