@trillboards/edge-sdk 0.2.17 → 0.2.18

package/deploy/windows/e2e/test-headless-principal.ps1

@@ -0,0 +1,632 @@
+<#
+.SYNOPSIS
+  test-headless-principal.ps1 -- proves the Trillboards connector's scheduled
+  task runs with NO interactive session, which is what makes it survive an
+  unattended reboot.
+
+.DESCRIPTION
+  The defect this guards: register-task.ps1 used to register `-AtLogOn` +
+  `-LogonType Interactive`, so sensing only ran while one specific user was
+  interactively logged on. After a Windows Update reboot on a store back-office
+  PC the connector stayed down until somebody signed in -- days, silently, with
+  the machine up and no error surfaced anywhere.
+
+  EVERY assertion here carries a CONTROL that must fail. That is not ceremony:
+  a sibling probe for the "no visible window" property once reported 0 windows
+  for the fix AND for a deliberately broken control, because a hosted runner has
+  no desktop for EnumWindows to walk. It passed on hardware incapable of
+  observing the property. So each arm below states what makes it VACUOUS, and
+  fails loudly instead of passing when the control does not fire.
+
+  WHICH ARM COVERS THE PRODUCT'S OWN PATH. Arm B, and only Arm B: it runs the
+  real register-task.ps1 as the account that owns the install, unelevated, which
+  is exactly what installer.nsi (RequestExecutionLevel user) does. Arm C is a
+  SYNTHETIC differential over the principal, so its registration context is not
+  part of what it measures -- whether a task can run without a session is decided
+  by its principal, not by who wrote it.
+
+  WHO CAN CREATE AN S4U TASK -- the full rule, measured over three runs, because
+  two intermediate readings of it were wrong:
+
+    as the account ITSELF, ELEVATED            works   (Arm A, run 31823057985)
+    as the account itself, UNELEVATED          refused (Arm B, run 31836760844)
+    by an elevated admin FOR ANOTHER account   refused (run 31838558271), and
+                                               refused even when that account is
+                                               itself an Administrators member
+
+  So it is BOTH: the caller must be elevated AND must be the account itself. The
+  cross-user direction needs SeTcbPrivilege, which an elevated admin does not
+  hold, and `Start-Process -Credential` cannot help because it yields a FILTERED
+  token. That is why Arm C reaches its subject through a Password-logon task
+  with RunLevel Highest -- the only vehicle that produces an elevated,
+  session-less process running AS the subject, which can then register S4U for
+  itself the same way the product does.
+
+  Arm A -- SHAPE (uses the real register-task.ps1).
+    Asserts the registered task XML carries a LOGON-FREE trigger (<BootTrigger>
+    or <Repetition>) and a non-interactive <LogonType>. Control: the pre-fix
+    registration (AtLogOn + InteractiveToken) is built inline and the SAME
+    predicate must REJECT it.
+
+  Arm B -- THE UNELEVATED FLOOR (real register-task.ps1, standard NON-admin).
+    Asserts what a standard user actually gets. Headless costs ONE elevation on
+    Windows: S4U performs a batch logon and Task Scheduler grants
+    SeBatchLogonRight only to an administrator CALLER, so a standard user is
+    refused S4U even for itself. This arm pins the floor -- the ladder still
+    lands, the repeating trigger survives, and it completes PROMPTLESSLY -- and
+    asserts the platform rule itself, so a future Windows that allowed
+    unelevated S4U would turn this arm red rather than leave a dead rung.
+
+  Arm C -- RUNTIME, and this is the load-bearing one.
+    A second local account, in Administrators and NEVER logged on, registers the
+    same marker action twice FOR ITSELF -- once with the pre-fix Interactive
+    principal, once with S4U -- and both are started. The principal is the ONLY
+    variable. The subject is an elevated admin because that is the only account
+    Windows lets create an S4U task, and it is the state a real customer is in
+    after accepting the single UAC prompt.
+    The Interactive arm must NOT produce its marker; the S4U arm must.
+    VACUOUS if the bootstrap never runs, if it is not elevated, if the
+    Interactive control also runs, or if the control could not register at all
+    (then "it did not run" would say nothing about logon type).
+
+  Arm D -- THE TASK CAN FIND ITS OWN STATE.
+    The S4U marker records the identity, profile root and session id the task
+    actually ran with, plus a real outbound HTTPS attempt. A headless task that
+    resolved %USERPROFILE% to systemprofile would boot, find no device token and
+    no Gemma model, and fail while looking alive -- worse than the outage. This
+    arm is why the principal is S4U and not SYSTEM.
+
+  Arm F -- NO PROMPT A USER CANNOT MEET. ensure-sensing.ps1 owns the single UAC
+    prompt, and must not show it to a standard user: UAC would demand credentials
+    they cannot supply and -Wait would hang the wizard-close path.
+
+  Arm E -- MIGRATION. Existing installs carry a logon-only task and there is no
+    auto-updater, so ensure-sensing.ps1 repairs the shape in place. Starts from a
+    genuinely pre-fix registration and asserts it becomes headless, then asserts
+    the repair is idempotent (a second run must not re-register).
+
+  WHAT THIS CANNOT PROVE. The UAC prompt itself. A hosted runner has no one to
+  click it, so the admin-capable-but-unelevated path -- the population for whom
+  one click turns 'Interactive + repeat' into 'S4U + boot + repeat' -- is
+  exercised only at its two ENDS: Arm A proves an already-elevated caller gets
+  the headless shape, and Arm F proves a standard user is never asked. The
+  middle, `Start-Process -Verb RunAs` actually being accepted, is unobserved.
+
+  A hosted runner cannot reboot mid-job either, so Task
+  Scheduler actually firing <BootTrigger> or the <Repetition> at boot is
+  asserted STRUCTURALLY (the element is in the registered definition), never
+  observed. Nor is the repetition INTERVAL waited out -- a 5-minute wait per run
+  would buy nothing the structural assertion does not already give. What IS
+  observed at runtime is the property that made every trigger useless before:
+  the task running to completion with its owning user not logged on.
+
+.OUTPUTS  exit 0 = passed; exit 1 = failed (including "failed because vacuous").
+#>
+[CmdletBinding()]
+param(
+  # Skip the arms that need to create a local account (B/C/D). Off by default;
+  # they are the point of this file.
+  [switch]$SkipLocalAccountArms
+)
+$ErrorActionPreference = 'Stop'
+
+$Here    = Split-Path -Parent $MyInvocation.MyCommand.Path   # deploy\windows\e2e
+$Deploy  = (Resolve-Path (Join-Path $Here '..')).Path        # deploy\windows
+
+function Log  ($m) { Write-Host "[headless-principal] $m" }
+function Pass ($m) { Write-Host "PASS - $m" }
+function Die  ($m) { Write-Host "FAIL - $m"; exit 1 }
+
+$TempRoot    = if ($env:RUNNER_TEMP) { $env:RUNNER_TEMP } else { $env:TEMP }
+$ProbeRoot   = Join-Path $TempRoot 'tb-headless-probe'
+$MarkerDir   = Join-Path $ProbeRoot 'markers'
+$RealTask    = 'TrillboardsEdge'
+$ControlTask = 'TbHeadlessProbeControl'
+$FixTask     = 'TbHeadlessProbeFix'
+$ProbeUser   = 'tbheadless'      # standard user  -> Arm B/F (the unelevated floor)
+$AdminUser   = 'tbheadlessadm'   # ADMIN, never logged on -> Arm C/D (post-elevation)
+$ProbePass   = 'Pr0be!Headless#2026'
+
+# ---------------------------------------------------------------- the predicate
+# One definition of "headless", used by BOTH the fix and the control. If this
+# ever gets weakened, the control stops failing and the arm reports vacuous.
+# "Headless" is TWO independent properties and both are required:
+#   1. a trigger that fires with nobody logged on, and
+#   2. a principal that does not need an interactive session.
+# Boot and repetition both satisfy (1). They are not interchangeable in latency
+# -- boot is ~30s, repetition is up to one interval -- but they are
+# interchangeable in the property under test, and only ONE of them is available
+# to a non-admin: Microsoft restricts boot triggers to the Administrators group,
+# and installer.nsi:33 is RequestExecutionLevel user.
+function Test-HeadlessDefinition([string]$Xml) {
+  $hasBootTrigger = $Xml -match '<BootTrigger>'
+  $hasRepetition  = $Xml -match '<Repetition>'
+  $logonType = if ($Xml -match '<LogonType>([^<]+)</LogonType>') { $Matches[1] } else { '' }
+  # InteractiveToken is the one logon type that REQUIRES a live interactive
+  # session. An ABSENT <LogonType> is treated as not-headless on purpose: it is
+  # the shape a service-account principal exports, and this product must not run
+  # as one (see Arm D -- SYSTEM re-roots every homedir-derived path). Fail closed.
+  $nonInteractive = ($logonType -ne '') -and ($logonType -ne 'InteractiveToken')
+  [pscustomobject]@{
+    Headless    = (($hasBootTrigger -or $hasRepetition) -and $nonInteractive)
+    BootTrigger = $hasBootTrigger
+    Repetition  = $hasRepetition
+    LogonType   = $logonType
+  }
+}
+
+function Remove-ProbeTask([string]$Name) {
+  Unregister-ScheduledTask -TaskName $Name -Confirm:$false -ErrorAction SilentlyContinue
+}
+
+function Get-TaskShape([string]$Name) {
+  Test-HeadlessDefinition (Export-ScheduledTask -TaskName $Name)
+}
+
+# Register the PRE-FIX shape (AtLogOn + Interactive) for the CURRENT user. This
+# is the control, and it is also how Arm E manufactures a genuine legacy install.
+function Register-PreFixTask([string]$Name, $Action) {
+  $me = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+  $t = New-ScheduledTaskTrigger -AtLogOn -User $me
+  $p = New-ScheduledTaskPrincipal -UserId $me -LogonType Interactive -RunLevel Limited
+  Remove-ProbeTask $Name
+  Register-ScheduledTask -TaskName $Name -Action $Action -Trigger $t -Principal $p | Out-Null
+}
+
+try {
+  if (Test-Path $ProbeRoot) { Remove-Item -Recurse -Force $ProbeRoot -ErrorAction SilentlyContinue }
+  New-Item -ItemType Directory -Force -Path $MarkerDir | Out-Null
+
+  # =========================================================== ARM A -- SHAPE
+  Log 'Arm A: registered-task shape, via the real register-task.ps1'
+
+  $installDir = Join-Path $ProbeRoot 'install'
+  $bin = Join-Path $installDir 'bin'
+  New-Item -ItemType Directory -Force -Path $bin, (Join-Path $installDir 'logs') | Out-Null
+  foreach ($f in @('trillboards-edge-task.vbs', 'run-connector.ps1', 'register-task.ps1', 'ensure-sensing.ps1', 'trillboards-edge.cmd', 'trillboards-hidden-run.vbs')) {
+    Copy-Item -Force (Join-Path $Deploy $f) (Join-Path $bin $f)
+  }
+
+  Remove-ProbeTask $RealTask
+  & (Join-Path $bin 'register-task.ps1') -InstallDir $installDir | Out-Null
+  $fixShape = Get-TaskShape $RealTask
+  Log ("  fix     -> BootTrigger=$($fixShape.BootTrigger) Repetition=$($fixShape.Repetition) LogonType=$($fixShape.LogonType)")
+
+  $noopAction = New-ScheduledTaskAction -Execute (Join-Path $env:WINDIR 'System32\wscript.exe') -Argument 'noop'
+  Register-PreFixTask $ControlTask $noopAction
+  $ctlShape = Get-TaskShape $ControlTask
+  Log ("  control -> BootTrigger=$($ctlShape.BootTrigger) Repetition=$($ctlShape.Repetition) LogonType=$($ctlShape.LogonType)")
+
+  if ($ctlShape.Headless) {
+    Die "Arm A is VACUOUS: the pre-fix shape (AtLogOn + Interactive) satisfied the headless predicate. The predicate is broken, not the fix."
+  }
+  if (-not $fixShape.Headless) {
+    Die "register-task.ps1 did NOT register a headless task (BootTrigger=$($fixShape.BootTrigger), Repetition=$($fixShape.Repetition), LogonType='$($fixShape.LogonType)')."
+  }
+  $state = (Get-ScheduledTask -TaskName $RealTask).State
+  if ("$state" -eq 'Disabled') { Die "TrillboardsEdge registered Disabled -- it would never fire at boot." }
+  Pass "shape: BootTrigger present, LogonType=$($fixShape.LogonType), state=$state; pre-fix control correctly rejected"
+  Remove-ProbeTask $ControlTask
+
+  # ======================================================== ARM E -- MIGRATION
+  # Before touching accounts, because it only needs the current user.
+  Log 'Arm E: ensure-sensing.ps1 repairs a legacy logon-only registration'
+  Set-Content -LiteralPath (Join-Path $installDir 'trillboards.config.json') -Encoding ASCII -Value '{"cameras":[]}'
+  Remove-ProbeTask $RealTask
+  Register-PreFixTask $RealTask $noopAction
+  $beforeShape = Get-TaskShape $RealTask
+  Log ("  before repair -> BootTrigger=$($beforeShape.BootTrigger) Repetition=$($beforeShape.Repetition) LogonType=$($beforeShape.LogonType)")
+  if ($beforeShape.Headless) {
+    Die 'Arm E is VACUOUS: the manufactured legacy task was already headless, so the repair had nothing to do.'
+  }
+
+  $global:LASTEXITCODE = 0
+  & (Join-Path $bin 'ensure-sensing.ps1') -InstallDir $installDir
+  if ($LASTEXITCODE -ne 0) { Die "ensure-sensing.ps1 exited $LASTEXITCODE while repairing a legacy task." }
+  $afterShape = Get-TaskShape $RealTask
+  Log ("  after repair  -> BootTrigger=$($afterShape.BootTrigger) Repetition=$($afterShape.Repetition) LogonType=$($afterShape.LogonType)")
+  if (-not $afterShape.Headless) {
+    Die "ensure-sensing.ps1 did NOT migrate the legacy task (BootTrigger=$($afterShape.BootTrigger), Repetition=$($afterShape.Repetition), LogonType='$($afterShape.LogonType)'). Existing installs would stay logon-only forever -- there is no auto-updater."
+  }
+
+  # Idempotence: a healthy install must not be re-registered on every wizard
+  # close. Compare the WHOLE exported definition -- a re-registration restamps
+  # <RegistrationInfo><Date>, and starting a task does not change its XML (run
+  # times live in ScheduledTaskInfo, not the definition). Deliberately NOT an
+  # [xml] cast: Export-ScheduledTask returns a string declaring encoding="UTF-16"
+  # with no byte-order mark, and casting that throws "There is no Unicode byte
+  # order mark. Cannot switch to Unicode."
+  $definitionBefore = Export-ScheduledTask -TaskName $RealTask
+  $global:LASTEXITCODE = 0
+  & (Join-Path $bin 'ensure-sensing.ps1') -InstallDir $installDir
+  if ($LASTEXITCODE -ne 0) { Die "ensure-sensing.ps1 exited $LASTEXITCODE on an already-healthy task." }
+  $definitionAfter = Export-ScheduledTask -TaskName $RealTask
+  if ($definitionBefore -ne $definitionAfter) {
+    $d1 = if ($definitionBefore -match '<Date>([^<]+)</Date>') { $Matches[1] } else { 'unknown' }
+    $d2 = if ($definitionAfter -match '<Date>([^<]+)</Date>') { $Matches[1] } else { 'unknown' }
+    Die "ensure-sensing.ps1 re-registered an ALREADY-headless task ($d1 -> $d2). That churns a healthy install and interrupts sensing on every wizard close."
+  }
+  Pass "migration: logon-only -> headless in place, and the repair is idempotent"
+  Remove-ProbeTask $RealTask
+
+  if ($SkipLocalAccountArms) {
+    Log 'Arm B/C/D skipped by request.'
+    exit 0
+  }
+
+  # ------------------------------------------------ a user who is NOT logged on
+  Log "Arm B/C/D: creating standard (non-admin) local user '$ProbeUser'"
+  $secure = ConvertTo-SecureString $ProbePass -AsPlainText -Force
+  # -Admin puts the account in Administrators, which is how it comes to hold
+  # SeBatchLogonRight -- the right S4U needs and the one a standard user cannot
+  # be granted without an elevated caller.
+  function New-ProbeAccount([string]$Name, [switch]$Admin) {
+    Get-LocalUser -Name $Name -ErrorAction SilentlyContinue | Remove-LocalUser -ErrorAction SilentlyContinue
+    New-LocalUser -Name $Name -Password $secure -AccountNeverExpires -PasswordNeverExpires `
+      -UserMayNotChangePassword -Description 'Trillboards headless-principal probe' | Out-Null
+    $groupSid = if ($Admin) { 'S-1-5-32-544' } else { 'S-1-5-32-545' }
+    Add-LocalGroupMember -Group (Get-LocalGroup -SID $groupSid).Name -Member $Name -ErrorAction SilentlyContinue
+  }
+  # Members of Users ONLY. Never Administrators -- Arm B would be meaningless.
+  New-ProbeAccount -Name $ProbeUser
+
+  # Both probe accounts must READ the scripts and WRITE the markers. Everyone
+  # (S-1-1-0) rather than Users, because the Arm C/D account is an admin and is
+  # not necessarily in Users.
+  & icacls.exe $ProbeRoot /grant '*S-1-1-0:(OI)(CI)RX' /T | Out-Null
+  & icacls.exe $MarkerDir /grant '*S-1-1-0:(OI)(CI)M' /T | Out-Null
+
+  $cred = New-Object System.Management.Automation.PSCredential($ProbeUser, $secure)
+  $psExe = Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe'
+
+  # Run something AS the probe user and return the exit code. Everything the
+  # product does, it does as this user.
+  function Invoke-AsProbeUser([string[]]$ScriptArgs, [string]$Tag) {
+    $out = Join-Path $ProbeRoot "$Tag-stdout.txt"
+    $err = Join-Path $ProbeRoot "$Tag-stderr.txt"
+    $p = Start-Process -FilePath $psExe -Credential $cred -LoadUserProfile -WorkingDirectory $bin `
+      -ArgumentList (@('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File') + $ScriptArgs) `
+      -RedirectStandardOutput $out -RedirectStandardError $err -PassThru -Wait
+    foreach ($pair in @(@('stdout', $out), @('stderr', $err))) {
+      if (Test-Path $pair[1]) {
+        $text = (Get-Content -Raw $pair[1])
+        if ($text -and $text.Trim()) { Log "  [$Tag $($pair[0])] $($text.Trim())" }
+      }
+    }
+    return $p.ExitCode
+  }
+
+  # Materialise the profile ONCE so %USERPROFILE% under the task is a real
+  # profile. On a customer machine this is always true: the installing user has
+  # logged on. Without it Arm D would be measuring first-logon profile creation.
+  Log '  materialising the probe user profile'
+  Start-Process -FilePath $env:ComSpec -ArgumentList '/c', 'exit' -Credential $cred -LoadUserProfile `
+    -WorkingDirectory 'C:\' -Wait -ErrorAction Stop
+  $probeProfile = (Get-CimInstance Win32_UserProfile -ErrorAction SilentlyContinue |
+    Where-Object { $_.LocalPath -like "*\$ProbeUser" } | Select-Object -First 1).LocalPath
+  Log "  probe user profile: $probeProfile"
+
+  # Prove the premise of the whole differential: this user has NO session.
+  # `query user` exits 1 and writes to stderr when there are no sessions at all,
+  # which under $ErrorActionPreference='Stop' becomes a NativeCommandError. That
+  # case is the EXPECTED one here, so it must not abort the probe.
+  $sessions = ''
+  try { $sessions = (& query.exe user 2>&1 | Out-String) }
+  catch { $sessions = "query user reported no sessions: $($_.Exception.Message)" }
+  Log "  query user ->`n$sessions"
+  if ($sessions -match [regex]::Escape($ProbeUser)) {
+    Die "Arm C premise broken: '$ProbeUser' HAS an interactive session, so the Interactive control could legitimately run."
+  }
+  Pass "premise: '$ProbeUser' has no interactive session"
+
+  # ============================================== ARM B -- THE UNELEVATED FLOOR
+  # This arm asserts what a standard user actually gets, and it is NOT headless.
+  # Measured here, run 31836760844: S4U is refused to a standard user registering
+  # for ITSELF ("Access is denied") because S4U performs a BATCH logon and Task
+  # Scheduler grants SeBatchLogonRight only when the CALLER is an administrator.
+  # Boot triggers are Administrators-only for the same reason. So headless
+  # operation costs exactly one elevation on Windows -- that is a platform rule,
+  # not something the ladder can code around, and ensure-sensing.ps1 is where the
+  # single UAC prompt lives.
+  #
+  # What MUST hold unelevated: the ladder still lands, the task still exists, it
+  # carries the repeating trigger (strictly better than the pre-fix logon-only
+  # shape -- it revives a connector that died while somebody was logged on), and
+  # the script neither hangs nor throws. A standard user must never be shown a
+  # UAC credential prompt they cannot satisfy, so this must also complete
+  # PROMPTLESSLY -- a hang here would be an install that never finishes.
+  Log 'Arm B: the real register-task.ps1, run by the NON-admin user (unelevated floor)'
+  Remove-ProbeTask $RealTask
+  $armBStart = [DateTime]::UtcNow
+  $armBExit = Invoke-AsProbeUser @(('"' + (Join-Path $bin 'register-task.ps1') + '"'), '-InstallDir', ('"' + $installDir + '"')) 'armB'
+  $armBSeconds = ([DateTime]::UtcNow - $armBStart).TotalSeconds
+  Log ("  exit code: $armBExit  elapsed: {0:N1}s" -f $armBSeconds)
+  if ($armBExit -ne 0) {
+    Die "Arm B: register-task.ps1 exited $armBExit for a standard user. An unelevated install must still produce a working task."
+  }
+  if (-not (Get-ScheduledTask -TaskName $RealTask -ErrorAction SilentlyContinue)) {
+    Die 'Arm B: a standard non-admin user could NOT register the connector task at all. The installer is RequestExecutionLevel user, so this would break every install.'
+  }
+  $armBShape = Get-TaskShape $RealTask
+  Log "  non-admin registration -> BootTrigger=$($armBShape.BootTrigger) Repetition=$($armBShape.Repetition) LogonType=$($armBShape.LogonType)"
+  if (-not $armBShape.Repetition) {
+    Die "Arm B: the unelevated floor lost the repeating trigger (BootTrigger=$($armBShape.BootTrigger), LogonType='$($armBShape.LogonType)'). That is the only start path a standard user can create, and without it this rung is no better than the pre-fix shape."
+  }
+  # Documenting the platform rule as an ASSERTION, so that if a future Windows
+  # build ever does allow unelevated S4U this arm goes red and tells us, instead
+  # of the ladder silently carrying a rung nobody needs any more.
+  if ($armBShape.Headless) {
+    Die "Arm B: an unelevated standard user registered a HEADLESS task. That contradicts the measurement this design is built on (S4U refused unelevated). Re-check whether the elevation prompt in ensure-sensing.ps1 is still needed."
+  }
+  Pass "unelevated floor: standard user gets 'Interactive + repeat' promptlessly in $([Math]::Round($armBSeconds,1))s; headless correctly requires elevation"
+  Remove-ProbeTask $RealTask
+
+  # ======================================= ARM F -- NO PROMPT A USER CANNOT MEET
+  # ensure-sensing.ps1 asks for elevation, and it must NOT ask a standard user:
+  # UAC would show an over-the-shoulder CREDENTIAL prompt they cannot satisfy,
+  # and with -Wait that is an install that hangs on the wizard-close path.
+  # Deliberately runs against the task ARM B just created, which the probe user
+  # OWNS and which is non-headless ('Interactive + repeat') -- exactly the state
+  # that arms the elevation branch. Manufacturing a pre-fix task as the ELEVATED
+  # runner instead would test nothing real: the probe user cannot replace a task
+  # it does not own, so register-task.ps1 would fail on an ownership error
+  # ("Cannot create a file when that file already exists") that no customer hits,
+  # because on a customer machine the task belongs to the installing user.
+  Log 'Arm F: ensure-sensing.ps1 as the NON-admin user must not prompt or hang'
+  $armFStart = [DateTime]::UtcNow
+  $armFExit = Invoke-AsProbeUser @(('"' + (Join-Path $bin 'ensure-sensing.ps1') + '"'), '-InstallDir', ('"' + $installDir + '"')) 'armF'
+  $armFSeconds = ([DateTime]::UtcNow - $armFStart).TotalSeconds
+  Log ("  exit code: $armFExit  elapsed: {0:N1}s" -f $armFSeconds)
+  if ($armFSeconds -gt 60) {
+    Die "Arm F: ensure-sensing.ps1 took $([Math]::Round($armFSeconds,1))s for a standard user -- that is the signature of a UAC prompt waiting for credentials nobody can supply."
+  }
+  if (-not (Get-ScheduledTask -TaskName $RealTask -ErrorAction SilentlyContinue)) {
+    Die 'Arm F: ensure-sensing.ps1 left a standard user with NO task.'
+  }
+  Pass "no unsatisfiable prompt: ensure-sensing.ps1 completed for a standard user in $([Math]::Round($armFSeconds,1))s"
+
+  # The elevation branch is gated on [Environment]::UserInteractive, and the ONLY
+  # caller that can reach it is trillboards-setup.ps1's Resume-BackgroundSensing,
+  # which launches ensure-sensing.ps1 with -NonInteractive, CreateNoWindow and
+  # WindowStyle Hidden. If any of those flipped UserInteractive to False the
+  # prompt would never fire and the fix would reach nobody -- silently, which is
+  # this bug's whole signature. Measured as a DIFFERENTIAL on the -NonInteractive
+  # flag so the answer does not depend on the runner's own baseline: whatever the
+  # baseline is, the flag must not change it.
+  $uiProbe = Join-Path $ProbeRoot 'ui-probe.ps1'
+  Set-Content -LiteralPath $uiProbe -Encoding ASCII -Value @'
+param([string]$OutFile)
+Set-Content -LiteralPath $OutFile -Encoding ASCII -Value "userInteractive=$([Environment]::UserInteractive)"
+'@
+  function Measure-UserInteractive([bool]$NonInteractive) {
+    $out = Join-Path $MarkerDir ("ui-" + $NonInteractive + ".txt")
+    if (Test-Path $out) { Remove-Item -Force $out }
+    $flag = if ($NonInteractive) { ' -NonInteractive' } else { '' }
+    $si = New-Object System.Diagnostics.ProcessStartInfo
+    $si.FileName = $psExe
+    $si.Arguments = ('-NoProfile' + $flag + ' -ExecutionPolicy Bypass -WindowStyle Hidden -File "{0}" -OutFile "{1}"' -f $uiProbe, $out)
+    $si.UseShellExecute = $false
+    $si.CreateNoWindow = $true
+    $si.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
+    $p = [System.Diagnostics.Process]::Start($si)
+    $p.WaitForExit()
+    if (-not (Test-Path $out)) { return 'no-result' }
+    ((Get-Content -LiteralPath $out -Raw).Trim() -split '=', 2)[1]
+  }
+  $uiPlain = Measure-UserInteractive $false
+  $uiNonInt = Measure-UserInteractive $true
+  Log "  UserInteractive: without -NonInteractive = $uiPlain ; with -NonInteractive = $uiNonInt"
+  if ($uiPlain -eq 'no-result' -or $uiNonInt -eq 'no-result') {
+    Die 'Could not measure [Environment]::UserInteractive under the wizard launch flags.'
+  }
+  if ($uiPlain -ne $uiNonInt) {
+    Die "-NonInteractive CHANGES [Environment]::UserInteractive ($uiPlain -> $uiNonInt). trillboards-setup.ps1 launches ensure-sensing.ps1 with that flag, so the elevation branch would be unreachable from the only path that calls it."
+  }
+  Pass "the wizard's launch flags do not gate the elevation branch (-NonInteractive leaves UserInteractive=$uiNonInt)"
+  Remove-ProbeTask $RealTask
+
+  # ========================================================= ARM C -- RUNTIME
+  $markerScript = Join-Path $ProbeRoot 'probe-marker.ps1'
+  Set-Content -LiteralPath $markerScript -Encoding ASCII -Value @'
+param([string]$OutFile)
+$net = 'not-attempted'
+for ($i = 0; $i -lt 3; $i++) {
+  try {
+    $r = Invoke-WebRequest -Uri 'https://api.trillboards.com/health' -UseBasicParsing -TimeoutSec 20
+    $net = "transport-ok:$($r.StatusCode)"; break
+  } catch {
+    # Any HTTP status proves TCP+TLS completed under this token, which is the
+    # thing S4U is suspected of breaking. Only a transport error is a real miss.
+    if ($_.Exception.Response) { $net = "transport-ok:$([int]$_.Exception.Response.StatusCode)"; break }
+    $net = "transport-fail:$($_.Exception.Message)"
+    Start-Sleep -Seconds 3
+  }
+}
+$lines = @(
+  "identity=$([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)",
+  "userProfile=$env:USERPROFILE",
+  "localAppData=$env:LOCALAPPDATA",
+  "sessionId=$((Get-Process -Id $PID).SessionId)",
+  "network=$net"
+)
+Set-Content -LiteralPath $OutFile -Encoding ASCII -Value $lines
+'@
+
+
+  $controlMarker = Join-Path $MarkerDir 'control.txt'
+  $fixMarker     = Join-Path $MarkerDir 'fix.txt'
+
+  # Arm C needs an S4U task owned by somebody who is NOT logged on, and Arm B
+  # just proved a standard user cannot create one. The subject here is therefore
+  # a second local account that IS in Administrators -- which is exactly the
+  # population that gets headless in the field, because they are the ones who
+  # can accept the UAC prompt. Members of Administrators hold SeBatchLogonRight
+  # by default, so no policy has to be touched to reach this state.
+  #
+  # An EARLIER revision granted SeBatchLogonRight with `secedit /configure
+  # /areas USER_RIGHTS` instead. Do not do that: /configure REPLACES the whole
+  # user-rights policy with the contents of the .inf, and `secedit /export`
+  # emits only the explicitly-configured rights, so re-applying it stripped
+  # defaults machine-wide. The visible symptom was the CONTROL arm suddenly
+  # failing to register at all ("Access is denied") on a runner where it had
+  # worked minutes earlier -- i.e. the probe broke the host it was measuring.
+  Log "Arm C/D: creating a local ADMIN user '$AdminUser' who is never logged on"
+  New-ProbeAccount -Name $AdminUser -Admin
+  $adminCred = New-Object System.Management.Automation.PSCredential($AdminUser, (ConvertTo-SecureString $ProbePass -AsPlainText -Force))
+  Start-Process -FilePath $env:ComSpec -ArgumentList '/c', 'exit' -Credential $adminCred -LoadUserProfile `
+    -WorkingDirectory 'C:\' -Wait -ErrorAction Stop
+  if ((& query.exe user 2>&1 | Out-String) -match [regex]::Escape($AdminUser)) {
+    Die "Arm C premise broken: '$AdminUser' HAS an interactive session."
+  }
+
+  # HOW AN S4U TASK CAN BE CREATED AT ALL, measured rather than assumed:
+  #   as the account ITSELF, ELEVATED            -> works (Arm A does exactly this)
+  #   as the account itself, UNELEVATED          -> refused (Arm B, run 31836760844)
+  #   by an elevated admin FOR ANOTHER account   -> refused, even when the target
+  #                                                 is itself an Administrators
+  #                                                 member (run 31838558271)
+  # The cross-user direction needs SeTcbPrivilege, which an elevated admin does
+  # not hold. And `Start-Process -Credential` yields a FILTERED token, so it
+  # cannot produce an elevated process as somebody else either.
+  #
+  # The one remaining vehicle is a task. A Password-logon task runs ELEVATED
+  # (RunLevel Highest) and WITHOUT a session, so it can act as $AdminUser and
+  # register the two arms FOR ITSELF -- which is the only direction Windows
+  # permits, and the same direction the product uses.
+  $registrar = Join-Path $ProbeRoot 'probe-register-arms.ps1'
+  Set-Content -LiteralPath $registrar -Encoding ASCII -Value @'
+param([string]$MarkerScript, [string]$ControlTask, [string]$ControlMarker,
+      [string]$FixTask, [string]$FixMarker, [string]$ResultFile)
+$me = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+$elevated = (New-Object System.Security.Principal.WindowsPrincipal(
+  [System.Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole(
+  [System.Security.Principal.WindowsBuiltInRole]::Administrator)
+$psExe = Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe'
+function Register-Arm([string]$Name, [string]$LogonType, [string]$Marker) {
+  try {
+    $a = New-ScheduledTaskAction -Execute $psExe -Argument ('-NoProfile -ExecutionPolicy Bypass -File "' + $MarkerScript + '" -OutFile "' + $Marker + '"')
+    $t = New-ScheduledTaskTrigger -AtStartup
+    $p = New-ScheduledTaskPrincipal -UserId $me -LogonType $LogonType -RunLevel Limited
+    $s = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
+    Unregister-ScheduledTask -TaskName $Name -Confirm:$false -ErrorAction SilentlyContinue
+    Register-ScheduledTask -TaskName $Name -Action $a -Trigger $t -Principal $p -Settings $s -ErrorAction Stop | Out-Null
+    return 'registered'
+  } catch {
+    return "REFUSED:$($_.Exception.Message)"
+  }
+}
+$lines = @(
+  "identity=$me",
+  "elevated=$elevated",
+  "control=$(Register-Arm $ControlTask 'Interactive' $ControlMarker)",
+  "fix=$(Register-Arm $FixTask 'S4U' $FixMarker)"
+)
+Set-Content -LiteralPath $ResultFile -Encoding ASCII -Value $lines
+'@
+  & icacls.exe $registrar /grant '*S-1-1-0:RX' | Out-Null
+
+  $resultFile = Join-Path $MarkerDir 'registrar.txt'
+  $bootstrapTask = 'TbHeadlessProbeBootstrap'
+  Log "Arm C: bootstrapping an ELEVATED, session-less process as '$AdminUser' to register both arms for itself"
+  Remove-ProbeTask $bootstrapTask
+  $bootArgs = ('-NoProfile -ExecutionPolicy Bypass -File "{0}" -MarkerScript "{1}" -ControlTask {2} -ControlMarker "{3}" -FixTask {4} -FixMarker "{5}" -ResultFile "{6}"' -f
+    $registrar, $markerScript, $ControlTask, $controlMarker, $FixTask, $fixMarker, $resultFile)
+  Register-ScheduledTask -TaskName $bootstrapTask `
+    -Action (New-ScheduledTaskAction -Execute $psExe -Argument $bootArgs) `
+    -Trigger (New-ScheduledTaskTrigger -AtStartup) `
+    -User $AdminUser -Password $ProbePass -RunLevel Highest | Out-Null
+  Start-ScheduledTask -TaskName $bootstrapTask
+  $bootDeadline = [DateTime]::UtcNow.AddSeconds(90)
+  while (([DateTime]::UtcNow -lt $bootDeadline) -and -not (Test-Path $resultFile)) { Start-Sleep -Seconds 3 }
+  Remove-ProbeTask $bootstrapTask
+
+  if (-not (Test-Path $resultFile)) {
+    Die 'Arm C is VACUOUS: the Password-logon bootstrap task never ran, so no S4U task could be created and nothing below can be concluded.'
+  }
+  $reg = @{}
+  foreach ($line in (Get-Content -LiteralPath $resultFile)) {
+    $kv = $line -split '=', 2
+    if ($kv.Count -eq 2) { $reg[$kv[0]] = $kv[1] }
+  }
+  # The bootstrap running at all is itself a result: a non-interactive principal
+  # executed with nobody logged on. Arm C then isolates S4U specifically.
+  Log "  bootstrap ran as: $($reg['identity'])  elevated=$($reg['elevated'])"
+  Log "  control registration: $($reg['control'])"
+  Log "  fix     registration: $($reg['fix'])"
+  if ($reg['elevated'] -ne 'True') {
+    Die "Arm C is VACUOUS: the bootstrap was not elevated ($($reg['elevated'])), and S4U cannot be registered without elevation, so a refusal below would say nothing about the principal."
+  }
+
+  if ($reg['control'] -notmatch 'registered$') {
+    Die "Arm C is VACUOUS: the Interactive control could not be registered at all ($($reg['control'])), so 'the control did not run' would say nothing about logon type."
+  }
+  if ($reg['fix'] -notmatch 'registered$') {
+    Die "Arm C: S4U was refused to an ELEVATED account registering for ITSELF ($($reg['fix'])) -- the one direction Windows is supposed to permit, and the one register-task.ps1 uses. The runtime differential cannot be established on this host, so nothing below it would mean anything. Do NOT weaken this into a pass."
+  }
+
+  foreach ($n in @($ControlTask, $FixTask)) {
+    try { Start-ScheduledTask -TaskName $n -ErrorAction Stop; Log "  started $n" }
+    catch { Log "  Start-ScheduledTask $n threw: $($_.Exception.Message)" }
+  }
+
+  # Poll both. The fix should land in seconds; give the control the SAME full
+  # budget so "it did not run" cannot be confused with "it was slow".
+  $deadline = [DateTime]::UtcNow.AddSeconds(90)
+  while ([DateTime]::UtcNow -lt $deadline) {
+    if ((Test-Path $fixMarker) -and (Test-Path $controlMarker)) { break }
+    Start-Sleep -Seconds 3
+  }
+  $controlRan = Test-Path $controlMarker
+  $fixRan     = Test-Path $fixMarker
+
+  foreach ($n in @($ControlTask, $FixTask)) {
+    $info = Get-ScheduledTaskInfo -TaskName $n -ErrorAction SilentlyContinue
+    if ($info) { Log ("  {0}: LastTaskResult=0x{1:X} LastRunTime={2}" -f $n, $info.LastTaskResult, $info.LastRunTime) }
+  }
+  Log "  control marker present: $controlRan"
+  Log "  fix     marker present: $fixRan"
+
+  if ($controlRan) {
+    Die 'Arm C is VACUOUS: the Interactive-principal task RAN for a user with no interactive session. This host cannot observe the property, so a green fix arm would prove nothing.'
+  }
+  if (-not $fixRan) {
+    Die 'The S4U task did NOT run for a user with no interactive session -- the headless principal does not work here.'
+  }
+  Pass 'runtime: S4U ran with nobody logged on; the pre-fix Interactive principal did NOT (same action, same user, same trigger)'
+
+  # ============================================================ ARM D -- STATE
+  $marker = @{}
+  foreach ($line in (Get-Content -LiteralPath $fixMarker)) {
+    $kv = $line -split '=', 2
+    if ($kv.Count -eq 2) { $marker[$kv[0]] = $kv[1] }
+  }
+  Log '  S4U task reported:'
+  foreach ($k in $marker.Keys) { Log "    $k = $($marker[$k])" }
+
+  if ($marker['identity'] -notmatch [regex]::Escape($AdminUser)) {
+    Die "Arm D: the S4U task ran as '$($marker['identity'])', not as '$AdminUser'."
+  }
+  if ([string]::IsNullOrWhiteSpace($marker['userProfile']) -or $marker['userProfile'] -match 'systemprofile') {
+    Die "Arm D: USERPROFILE under the headless task is '$($marker['userProfile'])'. The connector resolves its device identity, data dir and the ~2.4 GB Gemma model through this root; systemprofile means it would start and then find nothing."
+  }
+  if ($marker['userProfile'] -notmatch [regex]::Escape($AdminUser)) {
+    Die "Arm D: USERPROFILE '$($marker['userProfile'])' is not the owning user's profile."
+  }
+  if ($marker['network'] -notmatch '^transport-ok') {
+    Die "Arm D: outbound HTTPS under the S4U token did not complete: $($marker['network']). S4U grants no NETWORK credentials; this asserts that plain outbound TLS is unaffected."
+  }
+  Pass "state: USERPROFILE=$($marker['userProfile']) (not systemprofile), sessionId=$($marker['sessionId']), outbound HTTPS $($marker['network'])"
+
+  Write-Host ''
+  Write-Host 'headless-principal E2E PASSED'
+  exit 0
+}
+finally {
+  foreach ($n in @($RealTask, $ControlTask, $FixTask, 'TbHeadlessProbeBootstrap')) { Remove-ProbeTask $n }
+  foreach ($account in @($ProbeUser, $AdminUser)) {
+    Get-LocalUser -Name $account -ErrorAction SilentlyContinue | Remove-LocalUser -ErrorAction SilentlyContinue
+    Get-CimInstance Win32_UserProfile -ErrorAction SilentlyContinue |
+      Where-Object { $_.LocalPath -like "*\$account" } |
+      Remove-CimInstance -ErrorAction SilentlyContinue
+  }
+}