test(service): block live scheduler mutation under the test guard

The repository test runner rewrites HOME and OPENCODEX_HOME, but Windows Task
Scheduler is machine-global. A partially-faked repair test fell through the
default scheduler runner, replaced the user's real opencodex-proxy task with a
temporary test-home launcher, passed, and then deleted that launcher during
cleanup.

When the explicit test-home guard is armed, allow only read-only /query calls
to the live scheduler runner. Every create, delete, run, end, or change
operation must be injected. Production is inert because only the repository
test preload arms this guard.

The regression drives a valid fresh registration through the default create
path. Before the fix its fake recorder receives /create /tn opencodex-proxy
... /f; after the fix the call is rejected before even the recorder.

Author: luvs01

src/lib/windows-elevation.ts

@@ -2,6 +2,7 @@ import { spawn, type ChildProcess, type SpawnOptions } from "node:child_process"
 import { existsSync } from "node:fs";
 import { isAbsolute, join, relative, resolve as resolvePath, sep } from "node:path";
 import { dlopen, ptr, type Pointer } from "bun:ffi";
+import { isTestHomeGuardArmed } from "./test-home-guard";
 
 type ElevationSpawn = (
   command: string,
@@ -530,6 +531,19 @@ export function startPowerShellCommand(commandScript: string): WindowsElevationE
     };
   }
 
+  // HOME isolation cannot contain UAC children or other machine-global effects. Keep the
+  // final process boundary closed while the real launcher is installed; explicitly injected
+  // launchers remain available to tests that exercise the elevation protocol in memory.
+  if (isTestHomeGuardArmed() && elevationSpawn === spawn) {
+    return {
+      launcherPid: null,
+      completion: Promise.reject(new WindowsElevationError(
+        "launch-failed",
+        "Refusing to launch a live Windows elevation process from an armed test process; inject the elevation launcher instead.",
+      )),
+    };
+  }
+
   let child: ChildProcess;
   try {
     child = elevationSpawn(

src/service.ts

@@ -50,6 +50,7 @@ import { recordOwnedConfigPath } from "./lib/config-ownership";
 import { killWindowsSchedulerWrappers } from "./lib/windows-service-wrappers";
 import { maybeShowStarPrompt } from "./cli/star-prompt";
 import { systemdProperty } from "./service-manager-probe";
+import { isTestHomeGuardArmed } from "./lib/test-home-guard";
 
 const LABEL = "com.opencodex.proxy";
 const TASK = "opencodex-proxy";
@@ -900,6 +901,20 @@ function windowsWscript(): string {
 let querySchtasksForTests: ((args: string[]) => string) | null = null;
 
 function querySchtasks(args: string[]): string {
+  // The repository preload isolates HOME and OPENCODEX_HOME, but Task Scheduler is
+  // machine-global. A partially-faked service test once fell through here and replaced the
+  // user's real `opencodex-proxy` task with a launcher inside its temporary test home; the
+  // test passed and cleanup deleted that launcher. Queries are observation-only, but every
+  // other operation must be injected while the explicit test-home guard is armed.
+  if (
+    isTestHomeGuardArmed()
+    && args[0]?.trim().toLowerCase() !== "/query"
+  ) {
+    throw new Error(
+      "refusing to mutate the machine-global Windows Task Scheduler from an armed test process; "
+      + "inject the scheduler operation instead of calling the live manager.",
+    );
+  }
   if (querySchtasksForTests) return querySchtasksForTests(args);
   return runFile(windowsSchtasks(), args);
 }

tests/service.test.ts

@@ -1034,6 +1034,32 @@ describe("launchd service plist", () => {
 });
 
 describe("service lifecycle cleanup ordering", () => {
+  test("an armed test cannot fall through to a live Task Scheduler mutation", async () => {
+    mkdirSync(TEST_DIR, { recursive: true });
+    const attemptNonce = "test-home-guard-registration";
+    const xmlPath = join(TEST_DIR, "guarded-task.xml");
+    writeFileSync(
+      xmlPath,
+      `\uFEFF${buildWindowsTaskXml(undefined, undefined, attemptNonce)}`,
+      { encoding: "utf16le" },
+    );
+    const observedCalls: string[][] = [];
+    serviceModule.setQuerySchtasksForTests(args => {
+      observedCalls.push([...args]);
+      return "";
+    });
+    try {
+      await expect(registerFreshWindowsSchedulerTask(xmlPath, attemptNonce)).rejects.toThrow(
+        "refusing to mutate the machine-global Windows Task Scheduler from an armed test process",
+      );
+      // The guard runs before even the test recorder. Before this regression fix the recorder
+      // receives `/create /tn opencodex-proxy ... /f`, proving the live runner was reachable.
+      expect(observedCalls).toEqual([]);
+    } finally {
+      serviceModule.setQuerySchtasksForTests(null);
+    }
+  });
+
   test("native service switch treats unknown as installed and requires confirmed absence", () => {
     const calls: string[] = [];
     const statuses: Array<"unknown" | "stopped" | "nonexistent"> = [

tests/windows-elevation-spawn.test.ts

@@ -82,6 +82,16 @@ describe("runWindowsElevated spawn contract", () => {
     return child;
   }
 
+  test("an armed test cannot launch the live Windows elevation boundary", async () => {
+    // The probe is deliberately inert: if the guard regresses, it can only start an
+    // non-RunAs PowerShell executing a fixed exit 0, never UAC or Task Scheduler mutation.
+    const execution = startPowerShellCommand("exit 0");
+    expect(execution.launcherPid).toBeNull();
+    await expect(execution.completion).rejects.toThrow(
+      "Refusing to launch a live Windows elevation process from an armed test process",
+    );
+  });
+
   test("returns exit code 0", async () => {
     fakeChild({ code: 0 });
     await expect(runWindowsElevated("schtasks.exe", ["/query"])).resolves.toBe(0);