@@ -13,8 +13,10 @@ import (
 // Azure rejects longer values with HTTP 400 DisplayNameInvalid.
 const azureDisplayNameMaxLen = 64
 
-// isAllowedDisplayNameChar reports whether r is in Azure's DisplayName allowlist
-// ([A-Za-z0-9-]). Underscores are emitted by the sanitizer, not passed through here.
+// isAllowedDisplayNameChar reports whether r is in Azure's base allowlist
+// [A-Za-z0-9-]. Underscores are handled separately by the caller
+// (SanitizeDisplayName passes '_' through verbatim alongside the chars
+// matched here).
 func isAllowedDisplayNameChar(r rune) bool {
 	return (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '-'
 }
@@ -75,8 +77,10 @@ type DisplayNameFields struct {
 	// "monthly") so the segment stays under 8 chars.
 	Payment string
 
-	// Now is the timestamp baseline. Must be non-zero for production calls.
-	// Tests inject a fixed value for determinism.
+	// Now is the timestamp baseline. Tests inject a fixed value for
+	// determinism; production callers should pass time.Now(). A zero
+	// time.Time is replaced with time.Now() by the builder so the
+	// timestamp segment never emits the placeholder "00010101T000000".
 	Now time.Time
 
 	// randSource is an optional 4-byte source for the random suffix.
@@ -114,7 +118,14 @@ func BuildDisplayName(f DisplayNameFields) string {
 	count := fmt.Sprintf("%dx", f.Count)
 	term := normalizeTerm(f.Term)
 	paymt := normalizePayment(f.Payment)
-	ts := f.Now.UTC().Format("20060102T150405")
+	// Guard against a zero-value Now (which would emit the nonsensical
+	// "00010101T000000"). Tests that want determinism pin Now explicitly;
+	// production callers that forget get a real timestamp, not a placeholder.
+	now := f.Now
+	if now.IsZero() {
+		now = time.Now()
+	}
+	ts := now.UTC().Format("20060102T150405")
 	randHex := generateRandSuffix(f.randSource)
 
 	// Required segments (order matters — never dropped, never reordered).
@@ -124,17 +135,18 @@ func BuildDisplayName(f DisplayNameFields) string {
 	// "keep" order; dropping happens from the right.
 	tail := []string{paymt, ts, randHex}
 
-	// Try full -> drop random -> drop timestamp -> drop payment.
+	// Try full -> drop random -> drop timestamp -> drop payment. Check the
+	// PRE-sanitized length so the cap actually gates segment-dropping; calling
+	// SanitizeDisplayName inside the loop would make the cap vacuously true
+	// (the sanitizer hard-truncates to 64) and short-circuit the drop logic.
+	// Each segment is already allowlist-conformant via normalizeSegment, so we
+	// only need to sanitize once on the exit path as a defensive invariant.
 	for keep := len(tail); keep >= 0; keep-- {
 		segments := append([]string{}, required...)
 		segments = append(segments, tail[:keep]...)
 		candidate := joinNonEmpty(segments, "-")
-		// Defensive sanitization: even though each segment is already
-		// allowlist-conformant, SanitizeDisplayName guarantees the
-		// invariant in one place rather than relying on every caller.
-		candidate = SanitizeDisplayName(candidate)
 		if len(candidate) <= azureDisplayNameMaxLen {
-			return candidate
+			return SanitizeDisplayName(candidate)
 		}
 	}
 
@@ -206,8 +218,11 @@ func joinNonEmpty(parts []string, sep string) string {
 }
 
 // generateRandSuffix returns 8 hex chars from src (test hook) or crypto/rand.
-// If randomness can't be obtained (extremely unlikely on supported platforms),
-// returns an empty string — the builder treats that as a dropped suffix.
+// If src is non-nil but shorter than 4 bytes it is treated as if nil and
+// crypto/rand is used as the fallback; callers that want deterministic output
+// must pass at least 4 bytes. If randomness can't be obtained (extremely
+// unlikely on supported platforms), returns an empty string, which the
+// builder treats as a dropped suffix.
 func generateRandSuffix(src []byte) string {
 	if len(src) >= 4 {
 		return hex.EncodeToString(src[:4])
 
@@ -409,6 +409,87 @@ func TestBuildDisplayName_EmptyPaymentSegmentIsSkipped(t *testing.T) {
 	assert.Contains(t, got, "-1yr-20260522T190000-a1b2c3d4")
 }
 
+// TestBuildDisplayName_DropLoopActuallyDropsTimestamp is a regression guard
+// against a previously-broken progressive-drop loop. The old implementation
+// called SanitizeDisplayName(candidate) INSIDE the loop before the length
+// check, which short-circuited the cap (the sanitizer hard-truncates to 64)
+// and returned a mid-string-truncated full format instead of cleanly dropping
+// the random suffix and timestamp. The fixed loop must produce a string that
+// ends exactly at the payment segment with no partial timestamp bytes.
+//
+// Input: full format = 83 chars, requires dropping both the 8-char random
+// suffix AND the 15-char timestamp; the result must end with "-allup" and
+// contain NO trace of the timestamp digits.
+func TestBuildDisplayName_DropLoopActuallyDropsTimestamp(t *testing.T) {
+	got := BuildDisplayName(DisplayNameFields{
+		Service:      "vm",
+		Region:       "germanywestcentral", // 18 chars
+		ResourceType: "Standard_NV24ads_A10_v5",
+		Count:        1,
+		Term:         "1yr",
+		Payment:      "all-upfront",
+		Now:          fixedTime,
+	}.WithRandSource(fixedRand))
+
+	// With the fixed drop loop, both optional ts and random are dropped
+	// cleanly. The broken loop returned a 64-char mid-truncated value that
+	// happened to include "20260" (start of the timestamp).
+	want := "vm-germanywestcentral-Standard_NV24ads_A10_v5-1x-1yr-allup"
+	assert.Equal(t, want, got)
+	assert.LessOrEqual(t, len(got), 64)
+	// Defensive: any partial timestamp prefix would surface as digits after
+	// "allup-"; the fixed builder must not emit any of them.
+	assert.NotContains(t, got, "allup-20")
+	assert.NotContains(t, got, "20260")
+}
+
+// TestBuildDisplayName_DropLoopActuallyDropsPayment is a second regression
+// guard for the drop loop, this time forcing the loop to drop the payment
+// segment too (keep=0, required-only). The broken loop again would short-
+// circuit at iteration 1 and mid-truncate, leaving partial payment bytes.
+func TestBuildDisplayName_DropLoopActuallyDropsPayment(t *testing.T) {
+	got := BuildDisplayName(DisplayNameFields{
+		Service:      "vm",
+		Region:       "germanywestcentral",
+		ResourceType: strings.Repeat("X", 30), // forces required-only fallback
+		Count:        9999,
+		Term:         "1yr",
+		Payment:      "all-upfront",
+		Now:          fixedTime,
+	}.WithRandSource(fixedRand))
+
+	// With the fixed drop loop, all optional segments drop cleanly and the
+	// result is exactly the required segments joined by dashes.
+	want := "vm-germanywestcentral-" + strings.Repeat("X", 30) + "-9999x-1yr"
+	assert.Equal(t, want, got)
+	assert.LessOrEqual(t, len(got), 64)
+	// No payment fragment anywhere: the broken loop left "...1yr-a" at the
+	// 64-char boundary.
+	assert.NotContains(t, got, "allup")
+	assert.NotContains(t, got, "1yr-a")
+}
+
+// TestBuildDisplayName_ZeroNowReplacedByWallClock guards the zero-time guard:
+// a zero-value Now must not emit the placeholder "00010101T000000" segment.
+// The builder substitutes time.Now() so the timestamp is always meaningful.
+func TestBuildDisplayName_ZeroNowReplacedByWallClock(t *testing.T) {
+	got := BuildDisplayName(DisplayNameFields{
+		Service:      "vm",
+		Region:       "eastus",
+		ResourceType: "Standard_D2a_v4",
+		Count:        1,
+		Term:         "1yr",
+		Payment:      "all-upfront",
+		// Now intentionally left as zero value.
+	}.WithRandSource(fixedRand))
+
+	assert.NotContains(t, got, "00010101T000000",
+		"zero-value Now must be replaced by wall-clock time, not emitted as placeholder")
+	// Sanity: still allowlist-conformant and within length cap.
+	assert.LessOrEqual(t, len(got), 64)
+	assert.Regexp(t, `^[A-Za-z0-9_-]{1,64}$`, got)
+}
+
 func TestBuildDisplayName_TimestampUTC(t *testing.T) {
 	// Even if the caller passes a local-zone time, the builder must
 	// normalize to UTC so identifiers are comparable across hosts.