ever-works-node 0.2.1 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ever-works-node",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Ever Works Node - headless execution node (CLI + long-running service): fleet enrollment, heartbeat and capability reporting",
   "author": {
     "name": "Ever Co. LTD",

package/packaging/README.md

@@ -51,6 +51,10 @@ longest expected job.
 `systemctl reload` is wired to `ever-works-node pause` — a drain, not a
 restart.
 
+Logs go to the journal (`StandardOutput=journal`), which journald already
+rotates and bounds (`SystemMaxUse=` in `journald.conf`), so the unit needs
+nothing of its own.
+
 ## Windows
 
 Enroll first, **as the account the node will run as**, then install from an
@@ -194,6 +198,21 @@ acceptable there only because `Stop-ScheduledTask` terminates the task
 outright and delivers no console event for `cmd.exe` to swallow — that branch
 never drained.
 
+Both logs **rotate past 10 MB** (one policy, `Get-NodeLogRotationPolicy`). The
+service rotates them with NSSM's own `AppRotateFiles` / `AppRotateOnline` /
+`AppRotateBytes` — at start and online while it runs. NSSM never deletes a
+rotated file, so the service install also registers `<Name>-LogPrune`, a
+small `SYSTEM` scheduled task that runs daily at 04:30 and at boot and keeps
+the newest five rotated generations of each log (NSSM's `node-<timestamp>.log`
+names and this installer's own); `uninstall-service.ps1` removes it with the
+service. The task cannot rotate while the node runs (`cmd.exe` holds
+the file open without delete sharing, and truncating under its write offset
+would leave a hole), so it rotates when the task STARTS — at boot and on every
+restart-on-failure — as a first action that runs to completion before the
+node action, renaming a full log to `<name>.<yyyyMMddTHHmmss>` and keeping
+the newest five. Re-run the installer to add rotation to a machine
+installed before it existed.
+
 Without `-ServicePassword` the task falls back to an **S4U** logon, which is
 minted without the account's password and therefore never unlocks its DPAPI
 master key: Windows Credential Manager reads fail there exactly as they do

package/packaging/windows/install-service.logic.ps1

@@ -462,6 +462,35 @@ function Test-PathUnder {
     secret; the step is FLAGGED RequiresPassword and the plan stays safe to
     print and to assert on.
 #>
+<#
+.SYNOPSIS
+    How big node.log / node.err.log may grow before they are rotated, and
+    how many rotated generations the scheduled-task branch keeps.
+
+.DESCRIPTION
+    Self-build slice AP. Both mechanisms used to append to the same two
+    files forever: the NSSM service had no AppRotate* settings at all, and
+    the scheduled task redirected through cmd.exe with nothing ever
+    trimming the target. On a node that runs for months that is the log
+    eating the very disk the workspace floor guards.
+
+    One policy, read by both branches, so the two cannot drift: 10 MB per
+    file. The service rotates with NSSM's own AppRotateFiles /
+    AppRotateOnline / AppRotateBytes (online, while running); NSSM never
+    deletes a rotated file, so the service branch also registers a daily
+    prune task that keeps the newest Keep generations (New-LogPruneScript).
+    The scheduled task rotates when it STARTS (boot, and every
+    restart-on-failure) and keeps the newest Keep generations - see
+    New-ScheduledTaskRotationActionSpec for why it cannot rotate while
+    running.
+#>
+function Get-NodeLogRotationPolicy {
+    return [pscustomobject]@{
+        Bytes = 10485760
+        Keep  = 5
+    }
+}
+
 function New-ServiceConfigurationPlan {
     param(
         [Parameter(Mandatory = $true)][string] $Name,
@@ -503,6 +532,14 @@ function New-ServiceConfigurationPlan {
 
     & $addNssm @('set', $Name, 'AppStdout', (Join-Path $StateDir 'node.log')) 'redirect stdout'
     & $addNssm @('set', $Name, 'AppStderr', (Join-Path $StateDir 'node.err.log')) 'redirect stderr'
+    # Self-build slice AP: rotate both logs - when the service starts, and
+    # ONLINE while it runs - past the shared size policy. Re-applied on every
+    # run like every other setting, so re-running the installer converges a
+    # service installed before rotation existed.
+    $rotation = Get-NodeLogRotationPolicy
+    & $addNssm @('set', $Name, 'AppRotateFiles', '1') 'rotate the logs when the service starts'
+    & $addNssm @('set', $Name, 'AppRotateOnline', '1') 'rotate the logs while the service runs'
+    & $addNssm @('set', $Name, 'AppRotateBytes', [string]$rotation.Bytes) "rotate a log once it passes $($rotation.Bytes) bytes"
     & $addNssm @('set', $Name, 'AppStopMethodConsole', '900000') 'give the drain 15 minutes'
     & $addNssm @('set', $Name, 'AppExit', 'Default', 'Restart') 'restart on exit'
     & $addNssm @('set', $Name, 'AppRestartDelay', '10000') 'back off 10s between restarts'
@@ -685,6 +722,172 @@ function New-ScheduledTaskActionSpec {
     }
 }
 
+<#
+.SYNOPSIS
+    The PowerShell that rotates node.log / node.err.log, as text.
+
+.DESCRIPTION
+    Self-build slice AP. A log at or past RotateBytes is renamed to
+    <name>.<yyyyMMddTHHmmss> - a timestamp, like NSSM's own rotated names -
+    and only the newest Keep rotated generations of that log are kept. A missing log, a locked log or any
+    other failure is swallowed and the script exits 0: a rotation problem
+    must never stop the node from starting.
+
+    Paths are embedded as single-quoted literals with every quote doubled,
+    which is PowerShell's only escape inside single quotes - no expansion of
+    $, backtick or anything else can happen to them.
+#>
+function New-LogRotationScript {
+    param(
+        [Parameter(Mandatory = $true)][string[]] $LogPaths,
+        [Parameter(Mandatory = $true)][long] $RotateBytes,
+        [Parameter(Mandatory = $true)][int] $Keep
+    )
+    $quoted = @($LogPaths | ForEach-Object { "'" + ($_ -replace "'", "''") + "'" }) -join ', '
+    $lines = @(
+        '$ErrorActionPreference = ''Stop''',
+        "foreach (`$log in @($quoted)) {",
+        '    try {',
+        '        $item = Get-Item -LiteralPath $log -ErrorAction SilentlyContinue',
+        "        if (`$null -eq `$item -or `$item.Length -lt $RotateBytes) { continue }",
+        '        $stamp = (Get-Date).ToString(''yyyyMMddTHHmmss'')',
+        '        Move-Item -LiteralPath $log -Destination ($log + ''.'' + $stamp) -Force'
+    ) + (Get-LogPruneScriptLines -Keep $Keep) + @(
+        '    }',
+        '    catch { }',
+        '}',
+        'exit 0'
+    )
+    return ($lines -join "`r`n")
+}
+
+<#
+.SYNOPSIS
+    The lines that delete all but the newest Keep rotated generations of
+    the log in $log, as script text for the generated scripts.
+
+.DESCRIPTION
+    Self-build slice AP (review). Matches BOTH naming schemes a rotated log
+    can have in the state directory, and nothing else:
+
+      * <leaf>.<yyyyMMddTHHmmss>              - this installer's task branch
+                                               (node.log.20261008T034500);
+      * <base>-<yyyyMMddTHHmmss>[.fff]<ext>   - NSSM's own AppRotate names
+                                               (node-20261008T034500.123.log,
+                                               node.err-20261008T034500.123.log).
+
+    Ordered by the timestamp IN THE NAME, newest first, not by
+    LastWriteTime: a rename keeps the file's old modification time, so the
+    generation just rotated would otherwise sort as the oldest and be the
+    one deleted. The live log itself never matches either pattern.
+#>
+function Get-LogPruneScriptLines {
+    param([Parameter(Mandatory = $true)][int] $Keep)
+    return @(
+        '        $leaf = Split-Path -Leaf $log',
+        '        $base = [IO.Path]::GetFileNameWithoutExtension($leaf)',
+        '        $ext = [IO.Path]::GetExtension($leaf)',
+        '        $pattern = ''^(?:'' + [regex]::Escape($leaf) + ''\.\d{8}T\d{6}|'' + [regex]::Escape($base) + ''-\d{8}T\d{6}(?:\.\d{3})?'' + [regex]::Escape($ext) + '')$''',
+        '        $rotated = @(Get-ChildItem -LiteralPath (Split-Path -Parent $log) -File | Where-Object { $_.Name -match $pattern } | Sort-Object { [regex]::Match($_.Name, ''\d{8}T\d{6}'').Value } -Descending)',
+        "        if (`$rotated.Count -gt $Keep) { `$rotated | Select-Object -Skip $Keep | Remove-Item -Force }"
+    )
+}
+
+<#
+.SYNOPSIS
+    The PowerShell that ONLY prunes old rotated generations of the logs
+    (it never rotates the live file), as text.
+
+.DESCRIPTION
+    Self-build slice AP (review). NSSM's AppRotate* settings rotate the
+    service's logs but never delete a rotated generation, so on a node that
+    runs for months they accumulate without bound - the disk the workspace
+    floor guards. The service branch therefore also registers a small
+    scheduled task (New-ScheduledTaskPruneActionSpec) that runs this daily
+    and at boot, keeping the newest Keep generations of each log, the same
+    number the scheduled-task branch keeps. Every failure is swallowed and
+    the script exits 0.
+#>
+function New-LogPruneScript {
+    param(
+        [Parameter(Mandatory = $true)][string[]] $LogPaths,
+        [Parameter(Mandatory = $true)][int] $Keep
+    )
+    $quoted = @($LogPaths | ForEach-Object { "'" + ($_ -replace "'", "''") + "'" }) -join ', '
+    $lines = @(
+        '$ErrorActionPreference = ''Stop''',
+        "foreach (`$log in @($quoted)) {",
+        '    try {'
+    ) + (Get-LogPruneScriptLines -Keep $Keep) + @(
+        '    }',
+        '    catch { }',
+        '}',
+        'exit 0'
+    )
+    return ($lines -join "`r`n")
+}
+
+<#
+.SYNOPSIS
+    The service branch's log-prune task action (self-build slice AP review).
+
+.DESCRIPTION
+    Same encoding as New-ScheduledTaskRotationActionSpec: -EncodedCommand,
+    so no path or quote in the script survives a second round of
+    command-line parsing.
+#>
+function New-ScheduledTaskPruneActionSpec {
+    param(
+        [Parameter(Mandatory = $true)][string] $PowerShellExe,
+        [Parameter(Mandatory = $true)][string[]] $LogPaths,
+        [Parameter(Mandatory = $true)][int] $Keep
+    )
+    $script = New-LogPruneScript -LogPaths $LogPaths -Keep $Keep
+    $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($script))
+    return [pscustomobject]@{
+        Execute  = $PowerShellExe
+        Argument = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encoded"
+        Script   = $script
+    }
+}
+
+<#
+.SYNOPSIS
+    The scheduled task's FIRST action: rotate the logs, then let the node
+    action start.
+
+.DESCRIPTION
+    Self-build slice AP. The task branch writes through cmd.exe's >> (see
+    New-ScheduledTaskActionSpec), and a file cmd.exe holds open can be
+    neither renamed (no FILE_SHARE_DELETE) nor safely truncated (cmd keeps
+    its own write offset and would leave a hole of NULs). So this branch
+    rotates when the task STARTS - at boot and on every restart-on-failure -
+    as a separate action that runs to completion before the node action:
+    the Task Scheduler runs a task's actions one after another, in order.
+    Between starts the log still grows; NSSM's online rotation is one more
+    reason the service stays the recommended shape.
+
+    -EncodedCommand (base64 of the UTF-16LE script) rather than -Command so
+    no path, quote or $ in the script has to survive a second round of
+    command-line parsing. Windows PowerShell 5.1 is assumed and is in-box on
+    every supported Windows.
+#>
+function New-ScheduledTaskRotationActionSpec {
+    param(
+        [Parameter(Mandatory = $true)][string] $PowerShellExe,
+        [Parameter(Mandatory = $true)][string[]] $LogPaths,
+        [Parameter(Mandatory = $true)][long] $RotateBytes,
+        [Parameter(Mandatory = $true)][int] $Keep
+    )
+    $script = New-LogRotationScript -LogPaths $LogPaths -RotateBytes $RotateBytes -Keep $Keep
+    $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($script))
+    return [pscustomobject]@{
+        Execute  = $PowerShellExe
+        Argument = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encoded"
+        Script   = $script
+    }
+}
+
 # --- Preflight ------------------------------------------------------------
 
 function New-PreflightFinding {

package/packaging/windows/install-service.ps1

@@ -825,6 +825,35 @@ if ($mechanism -eq 'service') {
         throw "$reason The service '$Name' was created by this run and has been removed again, so this machine is as it was found. A wrong -ServicePassword shows up here as SCM error 1069."
     }
 
+    # Self-build slice AP (review): NSSM rotates the logs but never deletes a
+    # rotated generation. A small SYSTEM task prunes them, daily and at boot,
+    # to the same number the scheduled-task branch keeps. Registered with
+    # -Force so a re-run converges it. A failure here WARNS rather than
+    # undoing the service: rotation still bounds each file, and an operator
+    # can re-run the installer once the cause is fixed.
+    $pruneTaskName = "$Name-LogPrune"
+    $pruneKeep = (Get-NodeLogRotationPolicy).Keep
+    $pruneSpec = New-ScheduledTaskPruneActionSpec `
+        -PowerShellExe (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') `
+        -LogPaths @($stdoutLog, $stderrLog) `
+        -Keep $pruneKeep
+    if ($commitChanges) {
+        try {
+            $pruneAction = New-ScheduledTaskAction -Execute $pruneSpec.Execute -Argument $pruneSpec.Argument -WorkingDirectory $stateDir
+            $pruneTriggers = @((New-ScheduledTaskTrigger -Daily -At '04:30'), (New-ScheduledTaskTrigger -AtStartup))
+            $prunePrincipal = New-ScheduledTaskPrincipal -UserId 'NT AUTHORITY\SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+            $pruneSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 10)
+            Register-ScheduledTask -TaskName $pruneTaskName -Action $pruneAction -Trigger $pruneTriggers -Principal $prunePrincipal -Settings $pruneSettings -Force | Out-Null
+            Write-Host "Registered scheduled task '$pruneTaskName' (keeps the newest $pruneKeep rotated generations of each log)."
+        }
+        catch {
+            Write-Warning "Could not register the log-prune task '$pruneTaskName': $($_.Exception.Message). NSSM still rotates the logs, but rotated generations will accumulate until the installer is re-run."
+        }
+    }
+    else {
+        Write-Host "  Register-ScheduledTask -TaskName $pruneTaskName -Action <powershell -EncodedCommand: keep the newest $pruneKeep rotated logs> -Trigger <daily 04:30, atStartup> -Principal SYSTEM -Force"
+    }
+
     Write-Host "  Application:   $nodeExe"
     Write-Host "  AppParameters: $argumentLine"
     Write-Host "  RunAs:         $($identity.ServiceLogonName)"
@@ -854,7 +883,18 @@ else {
         -StdoutPath $stdoutLog `
         -StderrPath $stderrLog
 
-    $action = New-ScheduledTaskAction -Execute $actionSpec.Execute -Argument $actionSpec.Argument -WorkingDirectory $stateDir
+    # Self-build slice AP: the logs rotate first, as their own action - see
+    # New-ScheduledTaskRotationActionSpec for why this branch cannot rotate
+    # while the node runs.
+    $rotationPolicy = Get-NodeLogRotationPolicy
+    $rotationSpec = New-ScheduledTaskRotationActionSpec `
+        -PowerShellExe (Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe') `
+        -LogPaths @($stdoutLog, $stderrLog) `
+        -RotateBytes $rotationPolicy.Bytes `
+        -Keep $rotationPolicy.Keep
+    $rotationAction = New-ScheduledTaskAction -Execute $rotationSpec.Execute -Argument $rotationSpec.Argument -WorkingDirectory $stateDir
+    $nodeAction = New-ScheduledTaskAction -Execute $actionSpec.Execute -Argument $actionSpec.Argument -WorkingDirectory $stateDir
+    $action = @($rotationAction, $nodeAction)
     $trigger = New-ScheduledTaskTrigger -AtStartup
     $settings = New-ScheduledTaskSettingsSet `
         -AllowStartIfOnBatteries `
@@ -924,6 +964,7 @@ else {
         Write-Host "  Start-ScheduledTask -TaskName $Name"
     }
 
+    Write-Host "  Rotate:     $($rotationSpec.Execute) -EncodedCommand <logs past $($rotationPolicy.Bytes) bytes, keep $($rotationPolicy.Keep)>"
     Write-Host "  Execute:    $($actionSpec.Execute)"
     Write-Host "  Argument:   $($actionSpec.Argument)"
     Write-Host "  RunAs:      $($identity.TaskUserId) (LogonType $($taskPlan.LogonType))"
@@ -931,7 +972,7 @@ else {
 }
 
 Write-Host ''
-Write-Host "Logs: $stdoutLog and $stderrLog"
+Write-Host "Logs: $stdoutLog and $stderrLog (rotated past $((Get-NodeLogRotationPolicy).Bytes) bytes)"
 Write-Host 'Operating:'
 Write-Host '  drain (finish in-flight work, take no more):  ever-works-node pause'
 Write-Host '  take work again:                              ever-works-node resume'

package/packaging/windows/test-install-service-logic.ps1

@@ -452,6 +452,23 @@ foreach ($required in @('Application', 'AppParameters', 'AppDirectory', 'Start',
 # command-line argument, which process-creation telemetry records.
 Assert-False ($planSettings -contains 'ObjectName') 'the password must not reach nssm as an ObjectName argument'
 
+# Self-build slice AP: both logs rotate - at start AND online - past the
+# shared policy, on a fresh install and on a re-run over an old service.
+$rotationPolicy = Get-NodeLogRotationPolicy
+Assert-Equal $rotationPolicy.Bytes 10485760 'the rotation threshold is 10 MB'
+foreach ($case in @(
+        @{ Label = 'fresh install'; Plan = $freshPlan },
+        @{ Label = 're-run over an existing service'; Plan = $existingPlan }
+    )) {
+    $rotateSettings = @{}
+    foreach ($step in @($case.Plan | Where-Object { $_.Kind -eq 'nssm' -and $_.Arguments[0] -eq 'set' -and $_.Arguments[2] -like 'AppRotate*' })) {
+        $rotateSettings[$step.Arguments[2]] = $step.Arguments[3]
+    }
+    Assert-Equal $rotateSettings['AppRotateFiles'] '1' "$($case.Label) must rotate the logs at service start"
+    Assert-Equal $rotateSettings['AppRotateOnline'] '1' "$($case.Label) must rotate the logs while the service runs"
+    Assert-Equal $rotateSettings['AppRotateBytes'] '10485760' "$($case.Label) must rotate past the shared size policy"
+}
+
 # --- Redaction ------------------------------------------------------------
 
 $renderedSecret = Format-ServicePlanStep -NssmPath 'C:\nssm.exe' -Step $identityStep
@@ -538,6 +555,102 @@ $spacedLogSpec = New-ScheduledTaskActionSpec `
     -StderrPath 'C:\log dir\node.err.log'
 Assert-True ($spacedLogSpec.Argument -like '*>> "C:\log dir\node.log"*') 'a spaced log path must be quoted for cmd.exe'
 
+# --- Scheduled-task log rotation (self-build slice AP) ---------------------
+
+$rotationSpec = New-ScheduledTaskRotationActionSpec `
+    -PowerShellExe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' `
+    -LogPaths @('C:\ProgramData\ever-works-node\node.log', "C:\it's here\node.err.log") `
+    -RotateBytes 10485760 `
+    -Keep 5
+Assert-Equal $rotationSpec.Execute 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' 'the rotation action runs Windows PowerShell'
+Assert-True ($rotationSpec.Argument.StartsWith('-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ')) 'the rotation script travels encoded, never as a re-parsed command line'
+$encodedScript = $rotationSpec.Argument.Substring($rotationSpec.Argument.LastIndexOf(' ') + 1)
+$decodedScript = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($encodedScript))
+Assert-Equal $decodedScript $rotationSpec.Script 'the encoded command must decode to exactly the reviewed script'
+Assert-True ($decodedScript.Contains("'C:\ProgramData\ever-works-node\node.log'")) 'stdout log must be rotated'
+Assert-True ($decodedScript.Contains("'C:\it''s here\node.err.log'")) 'a quote in a log path must be doubled inside its single-quoted literal'
+Assert-True ($decodedScript.Contains('-lt 10485760')) 'the threshold must be the policy bytes'
+Assert-True ($decodedScript.TrimEnd().EndsWith('exit 0')) 'a rotation problem must never stop the node action'
+$parseErrors = $null
+[void][Management.Automation.Language.Parser]::ParseInput($decodedScript, [ref]$null, [ref]$parseErrors)
+Assert-Equal @($parseErrors).Count 0 'the generated rotation script must parse under Windows PowerShell'
+
+# Run the generated script for real, against a scratch directory under TEMP
+# (the only thing in this file that touches a disk, and it removes it).
+$rotationDir = Join-Path ([IO.Path]::GetTempPath()) ('ew-rotation-test-' + [Guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $rotationDir | Out-Null
+try {
+    $bigLog = Join-Path $rotationDir 'node.log'
+    $smallLog = Join-Path $rotationDir 'node.err.log'
+    Set-Content -LiteralPath $bigLog -Value ('x' * 64) -Encoding Ascii
+    Set-Content -LiteralPath $smallLog -Value 'x' -Encoding Ascii
+    foreach ($stamp in @('20260101T000000', '20260102T000000', '20260103T000000')) {
+        Set-Content -LiteralPath (Join-Path $rotationDir "node.log.$stamp") -Value 'old' -Encoding Ascii
+    }
+    Set-Content -LiteralPath (Join-Path $rotationDir 'node.log.keep-me') -Value 'not a rotation' -Encoding Ascii
+    $smallScript = New-LogRotationScript -LogPaths @($bigLog, $smallLog, (Join-Path $rotationDir 'missing.log')) -RotateBytes 32 -Keep 2
+    $psExe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+    $encodedSmall = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($smallScript))
+    & $psExe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encodedSmall
+    Assert-Equal $LASTEXITCODE 0 'the rotation script must exit 0'
+    Assert-False (Test-Path -LiteralPath $bigLog) 'a log past the threshold must be rotated away'
+    Assert-True (Test-Path -LiteralPath $smallLog) 'a log under the threshold must be left alone'
+    $rotatedNames = @(Get-ChildItem -LiteralPath $rotationDir -File | Where-Object { $_.Name -match '^node\.log\.\d{8}T\d{6}$' } | ForEach-Object { $_.Name })
+    Assert-Equal $rotatedNames.Count 2 'only the newest Keep rotated generations survive'
+    Assert-False ($rotatedNames -contains 'node.log.20260101T000000') 'the oldest generation is the one dropped'
+    Assert-True (Test-Path -LiteralPath (Join-Path $rotationDir 'node.log.keep-me')) 'a file that is not a rotation must never be touched'
+}
+finally {
+    Remove-Item -LiteralPath $rotationDir -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+# --- NSSM log retention (self-build slice AP, review) ----------------------
+
+# NSSM rotates but never deletes a rotated generation, so the service branch
+# registers a prune task. Its script must keep the newest Keep generations of
+# EACH log under BOTH naming schemes, and touch nothing else.
+$pruneSpec = New-ScheduledTaskPruneActionSpec `
+    -PowerShellExe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' `
+    -LogPaths @('C:\ProgramData\ever-works-node\node.log', 'C:\ProgramData\ever-works-node\node.err.log') `
+    -Keep 5
+Assert-True ($pruneSpec.Argument.StartsWith('-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ')) 'the prune script travels encoded'
+$decodedPrune = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($pruneSpec.Argument.Substring($pruneSpec.Argument.LastIndexOf(' ') + 1)))
+Assert-Equal $decodedPrune $pruneSpec.Script 'the encoded prune command must decode to exactly the reviewed script'
+Assert-False ($decodedPrune.Contains('Move-Item')) 'the prune script must never rotate the live log - NSSM owns that'
+Assert-True ($decodedPrune.TrimEnd().EndsWith('exit 0')) 'a prune problem must never surface as a task failure'
+$pruneParseErrors = $null
+[void][Management.Automation.Language.Parser]::ParseInput($decodedPrune, [ref]$null, [ref]$pruneParseErrors)
+Assert-Equal @($pruneParseErrors).Count 0 'the generated prune script must parse under Windows PowerShell'
+
+$pruneDir = Join-Path ([IO.Path]::GetTempPath()) ('ew-prune-test-' + [Guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $pruneDir | Out-Null
+try {
+    $liveLog = Join-Path $pruneDir 'node.log'
+    $liveErr = Join-Path $pruneDir 'node.err.log'
+    Set-Content -LiteralPath $liveLog -Value 'live' -Encoding Ascii
+    Set-Content -LiteralPath $liveErr -Value 'live' -Encoding Ascii
+    # NSSM's own names, written NEWEST FIRST so modification time disagrees
+    # with the timestamp in the name: the name must win.
+    foreach ($stamp in @('20260104T000000.400', '20260103T000000.300', '20260102T000000.200', '20260101T000000.100')) {
+        Set-Content -LiteralPath (Join-Path $pruneDir "node-$stamp.log") -Value 'old' -Encoding Ascii
+        Set-Content -LiteralPath (Join-Path $pruneDir "node.err-$stamp.log") -Value 'old' -Encoding Ascii
+    }
+    Set-Content -LiteralPath (Join-Path $pruneDir 'node-notes.log') -Value 'not a rotation' -Encoding Ascii
+    $smallPrune = New-LogPruneScript -LogPaths @($liveLog, $liveErr) -Keep 2
+    $psExe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+    & $psExe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ([Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($smallPrune)))
+    Assert-Equal $LASTEXITCODE 0 'the prune script must exit 0'
+    $left = @(Get-ChildItem -LiteralPath $pruneDir -File | ForEach-Object { $_.Name } | Sort-Object)
+    Assert-True ($left -contains 'node.log') 'the live stdout log is never pruned'
+    Assert-True ($left -contains 'node.err.log') 'the live stderr log is never pruned'
+    Assert-True ($left -contains 'node-notes.log') 'a file that is not a rotation must never be touched'
+    Assert-Equal (@($left | Where-Object { $_ -match '^node-\d{8}T' }) -join ',') 'node-20260103T000000.300.log,node-20260104T000000.400.log' 'NSSM stdout generations: the newest two BY NAME survive'
+    Assert-Equal (@($left | Where-Object { $_ -match '^node\.err-\d{8}T' }) -join ',') 'node.err-20260103T000000.300.log,node.err-20260104T000000.400.log' 'NSSM stderr generations: the newest two survive, counted per log'
+}
+finally {
+    Remove-Item -LiteralPath $pruneDir -Recurse -Force -ErrorAction SilentlyContinue
+}
+
 # --- Preflight ------------------------------------------------------------
 
 Assert-Equal (Invoke-Preflight).Count 0 'a fully healthy service install must produce no findings at all'

package/packaging/windows/uninstall-service.ps1

@@ -58,6 +58,15 @@ if ($null -ne $task) {
     $removed = $true
 }
 
+# Self-build slice AP (review): the service branch's log-prune task. It is
+# this installer's own artefact and means nothing without the service.
+$pruneTaskName = "$Name-LogPrune"
+$pruneTask = Get-ScheduledTask -TaskName $pruneTaskName -ErrorAction SilentlyContinue
+if ($null -ne $pruneTask) {
+    Unregister-ScheduledTask -TaskName $pruneTaskName -Confirm:$false
+    Write-Host "Removed scheduled task '$pruneTaskName'."
+}
+
 if (-not $removed) {
     Write-Host "Nothing named '$Name' is registered on this machine."
 }