mcp-pacemaker 2.0.2 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-pacemaker",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "Keeps your MCP servers alive across editor restarts, reboots, and token expiry — pluggable auth, cross-platform auto-start, one-command setup. Zero-dependency bridge; a small CLI for setup.",
   "type": "module",
   "bin": {
@@ -12,15 +12,21 @@
     "autostart/",
     "supervisor/",
     "tools/windows-security-helper/",
+    "tools/windows-process-lifetime/",
+    "tools/windows-legacy/",
+    "tools/windows-task-channel/",
+    "tools/account-upgrade/",
     "examples/",
     "ui/dist/",
     "README.md",
     "CHANGELOG.md",
     "SECURITY.md",
     "docs/shared-sessions.md",
+    "docs/account-upgrades.md",
     "LICENSE",
     "THIRD_PARTY_NOTICES.txt",
-    "CONTRIBUTING.md"
+    "CONTRIBUTING.md",
+    "docs/execution-context.md"
   ],
   "engines": {
     "node": ">=20"
@@ -56,14 +62,15 @@
     "compat:clean": "node tools/compatibility/prepare.mjs --clean",
     "test:compat": "node --test --test-concurrency=1 test/compat/gates.test.mjs test/compat/cli-api.test.mjs",
     "test:compat:browser": "node --test --test-concurrency=1 test/compat/browser.test.mjs",
-    "test": "node --test test/bridge.test.mjs test/bridge-controls.test.mjs test/kill-tree.test.mjs test/keepalive.test.mjs test/auth-token.test.mjs test/cold-start.test.mjs test/crash-report.test.mjs test/resume.test.mjs test/config-checks.test.mjs test/config-reload.test.mjs test/health.test.mjs test/cli.test.mjs test/logs.test.mjs test/prewarm.test.mjs test/pooling-batch-scheduler.test.mjs test/pooling-batch-api.test.mjs test/pooling-batch-store.test.mjs test/pooling-batches.test.mjs test/pooling-stage-publication.test.mjs test/pooling-batch-startup.test.mjs test/pooling-postcommit-recovery.test.mjs test/pooling-config.test.mjs test/pooling-writer.test.mjs test/pooling-api.test.mjs test/pooling-deadlines.test.mjs test/pooling-queue-budget.test.mjs test/windows-security-helper.test.mjs test/windows-batch-security.test.mjs test/tui.test.mjs test/warm-pool.test.mjs test/server-metrics.test.mjs test/admission.test.mjs test/shared-sessions.test.mjs test/shared-http.test.mjs test/cross-host.test.mjs test/suite-integrity.test.mjs test/consumer-package.test.mjs test/notices.test.mjs test/notices-runtime.test.mjs test/npm-publication.test.mjs test/npm-publication-proof.test.mjs test/update-check.test.mjs test/service-lifecycle.test.mjs test/service-supervisor.test.mjs test/npm-publication-gates.test.mjs test/npm-publication-matrix.test.mjs test/publication-scanners-advisories.test.mjs test/publication-scanners.test.mjs test/service-replacement.test.mjs test/consumer-environment.test.mjs test/npm-publication-external.test.mjs test/npm-publication-peer.test.mjs test/publication-scanners-diagnostics.test.mjs test/publication-scanners-publication.test.mjs test/publication-scanners-paths.test.mjs test/npm-publication-local-enforcement.test.mjs test/publication-scanners-admission.test.mjs",
+    "test": "node --test --test-concurrency=4 test/bridge.test.mjs test/bridge-controls.test.mjs test/kill-tree.test.mjs test/keepalive.test.mjs test/auth-token.test.mjs test/cold-start.test.mjs test/crash-report.test.mjs test/resume.test.mjs test/config-checks.test.mjs test/config-reload.test.mjs test/health.test.mjs test/cli.test.mjs test/logs.test.mjs test/prewarm.test.mjs test/pooling-batch-scheduler.test.mjs test/pooling-batch-api.test.mjs test/pooling-batch-store.test.mjs test/pooling-batches.test.mjs test/pooling-stage-publication.test.mjs test/pooling-batch-startup.test.mjs test/pooling-postcommit-recovery.test.mjs test/pooling-config.test.mjs test/pooling-writer.test.mjs test/pooling-api.test.mjs test/pooling-deadlines.test.mjs test/pooling-queue-budget.test.mjs test/windows-security-helper.test.mjs test/windows-batch-security.test.mjs test/tui.test.mjs test/warm-pool.test.mjs test/server-metrics.test.mjs test/admission.test.mjs test/shared-sessions.test.mjs test/shared-http.test.mjs test/cross-host.test.mjs test/suite-integrity.test.mjs test/consumer-package.test.mjs test/notices.test.mjs test/notices-runtime.test.mjs test/npm-publication.test.mjs test/npm-publication-proof.test.mjs test/update-check.test.mjs test/service-lifecycle.test.mjs test/service-supervisor.test.mjs test/npm-publication-gates.test.mjs test/npm-publication-matrix.test.mjs test/publication-scanners-advisories.test.mjs test/publication-scanners.test.mjs test/service-replacement.test.mjs test/consumer-environment.test.mjs test/npm-publication-external.test.mjs test/npm-publication-peer.test.mjs test/publication-scanners-diagnostics.test.mjs test/publication-scanners-publication.test.mjs test/publication-scanners-paths.test.mjs test/npm-publication-local-enforcement.test.mjs test/publication-scanners-admission.test.mjs test/windows-process-lifetime.test.mjs test/windows-lifetime-startup.test.mjs test/managed-upgrade.test.mjs test/windows-lifetime-identity.test.mjs test/windows-legacy-process.test.mjs test/legacy-upgrade.test.mjs test/legacy-task-security.test.mjs test/windows-task-channel.test.mjs test/task-controller.test.mjs test/account-task-adapter.test.mjs test/account-upgrade.test.mjs test/account-rollback-launch.test.mjs test/account-recovery.test.mjs test/runtime-context.test.mjs test/ci-contracts.test.mjs",
     "notices:check": "node tools/third-party-notices/check.mjs",
     "publication:source-gates": "node tools/npm-publication/source-gates.mjs",
     "publication:artifact-gates": "node tools/npm-publication/artifact-gates.mjs",
     "service:replacement:check": "node tools/service-replacement/check.mjs",
     "publication:external-gates": "node tools/npm-publication/external-gates.mjs",
     "publication:local-gate": "node tools/npm-publication/local-windows.mjs",
-    "publication:verify-local": "node tools/npm-publication/verify-local.mjs"
+    "publication:verify-local": "node tools/npm-publication/verify-local.mjs",
+    "test:contract": "node tools/ci/run-tests.mjs"
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
@@ -72,6 +79,6 @@
     "picocolors": "^1.1.1",
     "react": "^19.2.7",
     "semver": "^7.7.3",
-    "smol-toml": "^1.8.0"
+    "smol-toml": "^1.9.0"
   }
 }

package/supervisor/supervise.mjs

@@ -1,34 +1,38 @@
 import { fork } from 'node:child_process';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { homedir } from 'node:os';
 import { dirname, resolve, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
 import { servicePaths, assertDurableRoot } from '../bin/service-control.mjs';
+import { requireUserRuntimeContext } from '../bin/runtime-context.mjs';
 
 const { values } = parseArgs({
-  options: { port: { type: 'string', default: '8791' }, config: { type: 'string' } },
+  options: { port: { type: 'string', default: '8791' }, config: { type: 'string' }, cwd: { type: 'string' } },
 });
-const port = Number(values.port);
+let port = Number(values.port);
 const root = realpathSync(resolve(dirname(fileURLToPath(import.meta.url)), '..'));
 const config = resolve(values.config || join(homedir(), '.mcp-pacemaker', 'servers.json'));
-const paths = servicePaths(config, port);
+let paths = port === 0 && process.connected && process.env.MCP_PACEMAKER_MANAGED_INSTANCE
+  ? undefined : servicePaths(config, port);
 assertDurableRoot(root);
 if (Number(process.versions.node.split('.')[0]) < 20) throw new Error('Node.js >=20 is required.');
 
-if (existsSync(paths.hold)) {
+if (paths && existsSync(paths.hold)) {
   console.log(`Service :${port} is held stopped. Use the matching CLI start --port ${port} to resume deliberately.`);
 } else {
   await supervise();
 }
 
 async function supervise() {
+  await requireUserRuntimeContext();
   const identity = {
-    protocol: 1, root, config, port, socket: paths.socket, pid: process.pid, execPath: process.execPath,
+    protocol: 1, root, config, port, socket: paths?.socket, pid: process.pid, execPath: process.execPath,
     id: randomUUID(), token: randomBytes(32).toString('hex'),
     version: JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')).version,
+    upgradeProtocol: 1, managedInstance: process.env.MCP_PACEMAKER_MANAGED_INSTANCE,
   };
   let child;
   let childExit;
@@ -37,6 +41,14 @@ async function supervise() {
   let stopRequested = false;
   let holdRequested = false;
   const clients = new Set();
+  const pending = new Map();
+  let readiness;
+  const failStartup = process.env.MCP_PACEMAKER_UPGRADE_PENDING === '1';
+  let initialStartup = failStartup;
+  let pendingStart = failStartup || Boolean(paths && existsSync(paths.admissionHold));
+  let quiescedInstanceId;
+  let stopAuthorization;
+  const lifetimes = [];
   const server = createServer((socket) => {
     clients.add(socket);
     socket.on('close', () => clients.delete(socket));
@@ -55,12 +67,47 @@ async function supervise() {
       catch { socket.destroy(); return; }
       if (request.id !== identity.id ||
           request.token !== identity.token ||
-          request.action !== 'stop') {
+          !['stop', 'inspect', 'quiesce', 'activate', 'resume'].includes(request.action)) {
         socket.destroy();
         return;
       }
+      if (request.action !== 'stop') {
+        if (request.action === 'quiesce') {
+          pendingStart = true;
+          writeFileSync(paths.admissionHold, JSON.stringify({ id: identity.id, root, config, port }) + '\n',
+            { mode: 0o600, flush: true });
+        }
+        bridgeRequest(request).then((result) => {
+          if (result.ok &&
+              result.instanceId === readiness?.instanceId) {
+            if (request.action === 'quiesce' &&
+                result.held) quiescedInstanceId = result.instanceId;
+            if (['activate', 'resume'].includes(request.action)) {
+              if (existsSync(paths.admissionHold)) unlinkSync(paths.admissionHold);
+              pendingStart = false;
+              initialStartup = false;
+              quiescedInstanceId = undefined;
+            }
+          }
+          socket.end(JSON.stringify({ ...result, id: identity.id }) + '\n');
+        }, (error) => socket.end(JSON.stringify({ id: identity.id, ok: false, error: error.message }) + '\n'));
+        return;
+      }
+      if (request.quiescedInstanceId !== undefined) {
+        const heldGeneration = !child ||
+          readiness?.instanceId === quiescedInstanceId ||
+          readiness?.held === true;
+        if (!pendingStart ||
+            request.quiescedInstanceId !== quiescedInstanceId ||
+            !heldGeneration) {
+          socket.end(JSON.stringify({ id: identity.id, stopped: false }) + '\n');
+          return;
+        }
+        stopAuthorization = request.quiescedInstanceId;
+      }
       stop().then(() => {
-        socket.end(JSON.stringify({ id: identity.id, stopped: true, autostartHeld: true }) + '\n');
+        socket.end(JSON.stringify({ id: identity.id, stopped: true, autostartHeld: true,
+          ...(stopAuthorization ? { quiescedInstanceId: stopAuthorization } : {}) }) + '\n');
       }, (error) => {
         console.error(error.message);
         socket.end(JSON.stringify({ id: identity.id, stopped: false }) + '\n');
@@ -69,14 +116,11 @@ async function supervise() {
   });
 
   mkdirSync(dirname(config), { recursive: true, mode: 0o700 });
-  await new Promise((resolveListen, reject) => {
-    server.once('error', reject);
-    server.listen(paths.socket, resolveListen);
-  });
+  if (paths) await listen();
   server.on('error', (error) => { console.error(error.message); process.exitCode = 1; });
   try {
-    writeFileSync(paths.record, JSON.stringify(identity) + '\n', { mode: 0o600 });
-    if (existsSync(paths.hold)) {
+    if (paths) writeFileSync(paths.record, JSON.stringify(identity) + '\n', { mode: 0o600 });
+    if (paths && existsSync(paths.hold)) {
       server.close();
       return;
     }
@@ -87,23 +131,152 @@ async function supervise() {
   }
   process.on('SIGINT', onSignal);
   process.on('SIGTERM', onSignal);
+  process.on('message', (message) => { if (message === 'stop') onSignal(); });
+  process.on('disconnect', onSignal);
+
+  function listen() {
+    return new Promise((resolveListen, reject) => {
+      server.once('error', reject);
+      server.listen(paths.socket, resolveListen);
+    });
+  }
+
+  function bridgeRequest(request) {
+    if (!child?.connected ||
+        !readiness) return Promise.reject(new Error('Bridge has no verified managed readiness.'));
+    const requestId = randomUUID();
+    const requestedChild = child;
+    return new Promise((resolveRequest, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(requestId);
+        reject(new Error('Bridge admission result is uncertain; recovery required.'));
+      }, 11000);
+      pending.set(requestId, (message) => {
+        clearTimeout(timer);
+        if (requestedChild !== child) {
+          reject(new Error('Bridge generation changed during admission; hold remains in effect.'));
+          return;
+        }
+        resolveRequest(message);
+      });
+      child.send({
+        type: 'upgrade-control', requestId, action: request.action, timeoutMs: 8000,
+        expectedAuthority: request.expectedAuthority, expectedSessionState: request.expectedSessionState,
+      });
+    });
+  }
+
+  function observeLifetime(identity) {
+    return (async () => {
+      const { observeWindowsProcessLifetime } = await import('../bin/windows-process-lifetime.mjs');
+      return observeWindowsProcessLifetime(identity);
+    })();
+  }
 
   function launch() {
     if (stopRequested ||
-        existsSync(paths.hold)) {
+        (paths && existsSync(paths.hold))) {
       server.close();
       return;
     }
-    child = fork(join(root, 'supervisor', 'bridge-child.mjs'), ['--port', String(port), '--config', config], {
+    let completeLifetime;
+    let failLifetime;
+    let lifetimeArmed;
+    if (process.platform === 'win32') {
+      const requiredLifetime = new Promise((resolveLifetime, rejectLifetime) => {
+        completeLifetime = resolveLifetime;
+        failLifetime = rejectLifetime;
+      });
+      const proof = requiredLifetime.then(observer => observer.done);
+      proof.catch(() => {});
+      lifetimes.push(proof);
+    }
+    const armLifetime = identity => {
+      lifetimeArmed = observeLifetime(identity);
+      if (completeLifetime) lifetimeArmed.then(completeLifetime, failLifetime);
+      return lifetimeArmed;
+    };
+    readiness = undefined;
+    const launched = fork(join(root, 'supervisor', 'bridge-child.mjs'), [
+      '--port', String(port), '--config', config, ...(values.cwd ? ['--cwd', values.cwd] : []),
+    ], {
       execPath: process.execPath, execArgv: [], stdio: ['ignore', 'inherit', 'inherit', 'ipc'], windowsHide: true,
+      env: { ...process.env, MCP_PACEMAKER_UPGRADE_PENDING: pendingStart ? '1' : '0' },
+    });
+    child = launched;
+    launched.on('message', async (message) => {
+      if (message?.type === 'upgrade-lifetime') {
+        if (lifetimeArmed) return;
+        armLifetime(message.lifetime);
+        lifetimeArmed.then(() => {
+          if (launched.connected) launched.send('upgrade-lifetime-observed');
+        }, error => {
+          console.error(error.message);
+          onSignal();
+        });
+        return;
+      }
+      if (message?.type === 'upgrade-result') {
+        pending.get(message.requestId)?.(message);
+        pending.delete(message.requestId);
+      }
+      if (message?.type !== 'upgrade-ready') return;
+      try {
+        if (process.platform === 'win32' &&
+            !lifetimeArmed &&
+            message.lifetime) armLifetime(message.lifetime);
+        if (process.platform === 'win32' &&
+            !lifetimeArmed) throw new Error('Windows backend lacks verified process containment observation.');
+        if (lifetimeArmed) await lifetimeArmed;
+        if (stopRequested ||
+            launched !== child) return;
+        if (message.protocol !== 1 ||
+            message.version !== identity.version ||
+            !Number.isInteger(message.port) ||
+            message.port < 1 ||
+            (port !== 0 && port !== message.port)) throw new Error('Bridge readiness identity mismatch.');
+        if (port === 0) {
+          port = message.port;
+          paths = servicePaths(config, port);
+          identity.port = port;
+          identity.socket = paths.socket;
+          await listen();
+        }
+        readiness = message;
+        identity.instanceId = message.instanceId;
+        writeFileSync(paths.record, JSON.stringify(identity) + '\n', { mode: 0o600 });
+        if (process.connected) process.send({ ...message, type: 'supervisor-ready', supervisorId: identity.id });
+      } catch (error) {
+        console.error(error.message);
+        await stop(false);
+      }
     });
     childExit = new Promise((resolveExit, reject) => {
-      child.once('error', reject);
-      child.once('exit', (code) => {
+      launched.once('error', error => {
+        failLifetime?.(error);
+        reject(error);
+      });
+      launched.once('exit', (code) => {
         child = undefined;
         resolveExit();
+        if (process.platform === 'win32' &&
+            !lifetimeArmed) {
+          failLifetime(new Error('Current Windows bridge exited without lifetime ownership proof. Older unsupported protocols require separately verified shutdown; no completed receipt is available.'));
+          if (!stopRequested) {
+            process.exitCode = 1;
+            server.close();
+            if (process.connected) process.disconnect();
+          }
+          return;
+        }
         if (stopRequested) return;
-        if (code === 3) server.close();
+        if (code === 3 ||
+            initialStartup) {
+          process.exitCode = code || 1;
+          stop(false).then(() => {
+            if (process.connected) process.disconnect();
+          }, error => { console.error(error.message); process.exitCode = 1; });
+        }
         else retry = setTimeout(launch, 2000);
       });
     });
@@ -125,29 +298,42 @@ async function supervise() {
     stopRequested = true;
     clearTimeout(retry);
     stopping = (async () => {
-      if (child) {
-        if (child.connected) {
-          try {
-            await new Promise((resolveSend, reject) => child.send('stop', (error) => error ? reject(error) : resolveSend()));
-          } catch (error) {
-            if (error.code !== 'ERR_IPC_CHANNEL_CLOSED' &&
-                error.code !== 'EPIPE') throw error;
-          }
-        }
-        let timeout;
-        try {
-          await Promise.race([
-            childExit,
-            new Promise((_, reject) => {
-              timeout = setTimeout(() => reject(new Error('Bridge did not exit; do not replace its root. No force-kill attempted.')), 10000);
-            }),
-          ]);
-        } finally {
-          clearTimeout(timeout);
-        }
+      let timeout;
+      try {
+        await Promise.race([
+          (async () => {
+            if (child?.connected) {
+              try {
+                await new Promise((resolveSend, reject) => child.send('stop', error => error ? reject(error) : resolveSend()));
+              } catch (error) {
+                if (error.code !== 'ERR_IPC_CHANNEL_CLOSED' &&
+                    error.code !== 'EPIPE') throw error;
+              }
+            }
+            const [, ...receipts] = await Promise.all([childExit, ...lifetimes]);
+            for (const receipt of receipts) {
+              if (receipt?.verified !== true ||
+                  receipt.ownerExited !== true ||
+                  receipt.activeProcesses !== 0) throw new Error('Windows descendant teardown was not verified; retain the installation.');
+            }
+          })(),
+          new Promise((_, reject) => {
+            timeout = setTimeout(() => reject(new Error('Bridge did not exit; do not replace its root. No force-kill attempted.')), 10000);
+          }),
+        ]);
+      } finally {
+        clearTimeout(timeout);
       }
       if (holdRequested) {
-        writeFileSync(paths.hold, JSON.stringify({ id: identity.id, root, config, port, stopped: true }) + '\n', { mode: 0o600 });
+        writeFileSync(paths.hold, JSON.stringify({ id: identity.id, root, config, port, stopped: true,
+          ...(stopAuthorization ? { quiescedInstanceId: stopAuthorization } : {}) }) + '\n', { mode: 0o600, flush: true });
+      }
+      if (process.connected) {
+        await new Promise((resolveSent, reject) => {
+          process.send({ type: 'supervisor-stopped', id: identity.id, stopped: true },
+            error => error ? reject(error) : resolveSent());
+        });
+        process.disconnect();
       }
       server.close();
       process.removeListener('SIGINT', onSignal);

package/tools/account-upgrade/qualify-two-account.ps1

@@ -0,0 +1,66 @@
+<#
+.SYNOPSIS
+Runs an explicitly authorized two-account Windows upgrade qualification.
+.DESCRIPTION
+Requires an existing elevated controller, existing logged-on target account and
+existing target task. Does not create accounts, request elevation, change ACLs or
+install toolchains. Without Execute it runs only the product's read-only plan.
+.PARAMETER TrustedRoot
+Existing protected, target-readable controller package directory.
+.PARAMETER NodePath
+Existing trusted Node executable.
+.PARAMETER TargetSid
+Canonical SID of the different existing target account.
+.PARAMETER TaskPath
+Exact existing per-user task.
+.PARAMETER Version
+Exact target version approved for this qualification.
+.PARAMETER ControllerRoot
+Existing protected operation-store parent, readable/traversable by the target.
+.PARAMETER Registry
+Explicit approved registry; use an owned registry for fixture qualification.
+.PARAMETER Execute
+Runs the interactive product transaction after its read-only plan succeeds.
+.OUTPUTS
+Product plan and operation results. This script does not attest readiness by itself.
+.EXAMPLE
+.\qualify-two-account.ps1 -TrustedRoot C:\ExistingProtectedTools\Pacemaker -NodePath C:\ExistingNode\node.exe -TargetSid S-1-5-21-1-2-3-1001 -TaskPath \OwnedPacemakerTask -Version 2.1.0 -ControllerRoot C:\ExistingProtectedOperations -Registry https://approved.example.test/npm/
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string]$TrustedRoot,
+    [Parameter(Mandatory)][string]$NodePath,
+    [Parameter(Mandatory)][string]$TargetSid,
+    [Parameter(Mandatory)][string]$TaskPath,
+    [Parameter(Mandatory)][string]$Version,
+    [Parameter(Mandatory)][string]$ControllerRoot,
+    [Parameter(Mandatory)][string]$Registry,
+    [switch]$Execute
+)
+$ErrorActionPreference = 'Stop'
+if (-not $IsWindows) { throw 'Windows qualification only.' }
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if ($identity.User.Value -ceq $TargetSid -or
+    -not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Use an already-elevated different controller account. This script never elevates.'
+}
+foreach ($path in @($TrustedRoot, $ControllerRoot)) {
+    if (-not (Test-Path -LiteralPath $path -PathType Container)) { throw 'Required existing protected directory is absent.' }
+}
+if (-not (Test-Path -LiteralPath $NodePath -PathType Leaf)) { throw 'Required existing Node executable is absent.' }
+$cli = Join-Path $TrustedRoot 'bin\cli.mjs'
+$arguments = @(
+    $cli, '--user', $TargetSid, '--task', $TaskPath, 'upgrade', '--to', $Version,
+    '--controller-root', $ControllerRoot, '--registry', $Registry
+)
+& $NodePath @arguments --plan
+if ($LASTEXITCODE -ne 0) { throw 'Read-only account/task/path/session eligibility did not pass.' }
+if (-not $Execute) {
+    Write-Output 'Plan only. Actual two-account task mutation, original-account runtime and rollback remain NOT RUN.'
+    return
+}
+if ([Console]::IsInputRedirected) { throw 'Interactive confirmation is required; no unattended approval fallback.' }
+& $NodePath @arguments
+if ($LASTEXITCODE -ne 0) { throw 'Operation did not complete. Preserve both journals; do not force cleanup or replay calls.' }
+Write-Output 'Inspect recorded worker/backend SID, session, version, task full-SD continuity, protected state and cleanup receipts before accepting qualification.'