{
  "summary": "User-scope environment writes followed by End/Run of the existing scheduled task cannot be treated as a reliable environment refresh. Require the actual task principal/configuration and positive evidence from the new daemon process for both diagnostic variables. Quiescence must remain extension-owned; suspend status alone does not establish saved continuity or absence of hosted sessions. Concrete findings were sent to Main and StageKitAuthor; no commands were executed and no files changed.",
  "files": [
    {
      "path": "crates/spt-daemon/src/service.rs:24-27,257-272",
      "description": "Windows scheduled task is treated as boot-only: CLI start/stop never control it; start uses detached spawning and stop uses IPC."
    },
    {
      "path": "installer/install.ps1:196-217",
      "description": "Current installer intends interactive at-logon daemon start. This is not evidence of the existing ENLYZEAM session0 daemon run --detached task configuration."
    },
    {
      "path": "crates/spt/src/cli.rs:8051-8177,24463-24533",
      "description": "Hosted-session stop guard, endpoint caller refusal unaffected by --force, environment markers plus hosted ancestry, and durable stop-inhibit creation."
    },
    {
      "path": "crates/spt/src/cli.rs:652-692,7652-7738,7855-7915",
      "description": "Endpoint suspend/shutdown/stop contracts and implementations; shutdown adds confirmed hosted subtree teardown, while suspend routes a rest-state transition."
    },
    {
      "path": "crates/spt-daemon/src/resting.rs:350-371,416-444",
      "description": "Suspend arms a deferred per-endpoint echo gate, persists the rest edge and cascades shells; command success is not final-save completion proof."
    },
    {
      "path": "crates/spt-daemon/src/daemon.rs:781-841",
      "description": "Explicit start clears standing operator-stop inhibit; stop requests IPC shutdown. Direct task action daemon run does not call start_daemon."
    },
    {
      "path": "crates/spt/src/cli.rs:8694-8739",
      "description": "SPT_RC_HITCH_DIAG=1 switches status into diagnostic mode; ordinary status otherwise obtains live broker identity via IPC."
    },
    {
      "path": "crates/spt-daemon/src/stderrlog.rs:33-49",
      "description": "Canonical log is SPT_HOME/logs/daemon.stderr.log."
    },
    {
      "path": "crates/spt-store/src/perch.rs:24-55",
      "description": "SPT_HOME override, otherwise LOCALAPPDATA/spt-core on Windows; operator and task profile/home must match."
    }
  ],
  "architecture": "Task Scheduler owns the existing task's saved action and logon principal; the CLI deliberately does not control that task on Windows. Each daemon process has its own inherited environment. Endpoint lifecycle and continuity are separate from daemon/task lifecycle, and their owners must establish quiescence before an external human operator performs any resident restart.",
  "report": "## Environment conclusions\n\n1. Do not claim `[Environment]::SetEnvironmentVariable(name,value,'User')` followed by `schtasks /End` and `/Run` reliably refreshes the existing task action environment. Microsoft documents environment-variable caching at Taskeng.exe launch for ExecAction Path, Arguments and WorkingDirectory. That documentation specifically addresses action-property expansion, not a universal promise about every task-child environment; combined with ordinary process environment inheritance and no End/Run refresh guarantee, it requires a fail-closed verification gate rather than a blanket claim of success or failure.\n   - https://learn.microsoft.com/en-us/windows/win32/taskschd/execaction\n   - https://learn.microsoft.com/en-us/windows/win32/procthread/environment-variables\n2. `/Run` uses the program location, account and credentials saved in the task. Setting `$env:SPT_RC_HITCH_DIAG` in the operator shell affects children directly launched from that shell; it is not an explicit environment handoff to Task Scheduler. Reading User values back proves registry persistence for that user, not receipt by daemon48932 or its successor.\n   - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-run\n3. User environment must belong to the task's actual principal. Session0 does not identify that principal as SYSTEM. Microsoft CreateEnvironmentBlock requires a user token for user-specific variables and notes that profile-dependent variables require the profile to be loaded. Query real configuration and ownership instead of inferring from session ID or installer intent.\n   - https://learn.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-createenvironmentblock\n   - https://learn.microsoft.com/en-us/windows/win32/taskschd/principal-logontype\n4. A new daemon PID, successful task Run, refreshed registry values, or a new diagnostic START record alone does not prove BOTH required variables. Require an actual target-process environment observation (operator Process Explorer Environment view if authorized/accessible, recording only these two values) or producer evidence explicitly reporting equivalent startup configuration. No current searched source establishes a START field reporting SPT_NET_DIAG_SYMBOL_DIR; the supplied release producer must establish that contract. A CLI diagnostic response is especially insufficient: cli.rs:8715 itself switches mode based on the querying CLI's environment.\n5. If inheritance cannot be established, stop the staging attempt at explicit operator handoff. Do not silently change task action, write Machine environment, kill task engines, restart the Schedule service, reboot, or replace task launch with interactive launch. An explicit same-user shell launch with process variables can provide a different handoff architecture, but changes the session/launch context and is NOT an equivalent approved substitute for this existing session0 task. It needs a separately authorized operator plan.\n\n## Task and daemon stop semantics\n\n- Windows CLI `spt daemon stop` is graceful IPC, not `schtasks /End`; `spt daemon start` is detached spawning, not `/Run` (service.rs). `daemon` remains an alias for `node` in current cli.rs:423-426.\n- `/End` stops instances of the program started by the task; do not assume it reaches a detached daemon descendant or performs graceful SPT shutdown. No `/End` belongs ahead of extension-owned continuity save/quiescence.\n  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-end\n- Stop's exit success is not independently confirmed process-exit evidence: daemon.rs:829-831 requests IPC stop and returns. Bound subsequent verification of the captured old PID plus creation time, task state and daemon identity. PID identity matters because of reuse.\n- `cmd_daemon_stop` creates a durable operator-stop inhibit before teardown. Explicit `start_daemon` clears it. The supplied existing task's `daemon run --detached` action does not take that explicit-start route. Therefore stop→task Run must not be represented as an exact substitute for stop→CLI start concerning inhibit state. Hand this difference to the operator; do not modify task action or manually delete inhibit as an unapproved convenience.\n- Exact underlying task command forms are `schtasks.exe /End /TN 'spt-core daemon'` and `schtasks.exe /Run /TN 'spt-core daemon'`. They are mutating operator-only primitives, not a recommended blind restart chain. The kit must wrap every subprocess in its established deadline/retained-process mechanism and check native exit codes; no commands were run in this investigation.\n\n## Quiescence and caller authority\n\n- Source-backed verbs: `spt endpoint suspend ball-b`, `spt endpoint suspend engine-room`; `spt endpoint shutdown <id>` is the graceful teardown path; `spt endpoint stop <id>` is escalation without final context save.\n- Suspend invokes rest-state transition, an asynchronous echo gate and shell cascade. A suspended label or successful command alone does not prove continuity was saved or broker PTY sessions are gone. Shutdown adds hosted descendant reap and confirmation; nevertheless the assignment requires extension ownership, so the kit should request extension-confirmed saved continuity/quiescence, not take over endpoint lifecycle automatically. Leave the five already-suspended endpoints untouched.\n- Plain daemon stop refuses hosted live sessions unless human `--force`; the conservative kit should never use force to paper over incomplete quiescence. Separate endpoint-caller denial is unconditionally first: OWL_SESSION_ID, SPT_AGENT_ID, SPT_ENDPOINT_ID or detected hosted ancestry causes refusal even with force, before inhibit creation. Human must use an independent terminal not descended from an agent session. Do not evade the guard by stripping agent identity.\n- Isolated-agent rehearsal is not permission for resident actions. Its isolation and owned-process cleanup cannot be transplanted into resident restart commands. Read-only collector identity scrubbing is not a lifecycle authorization mechanism.\n\n## Read-only facts Main should obtain\n\nThe provided daemon PID/session/action facts remain ground truth. Missing task details should be queried without changing them:\n\n- `schtasks.exe /Query /TN 'spt-core daemon' /XML`: action Command/Arguments/WorkingDirectory, principal UserId/LogonType/RunLevel, triggers, MultipleInstancesPolicy, RestartOnFailure, AllowHardTerminate and relevant settings.\n- `schtasks.exe /Query /TN 'spt-core daemon' /V /FO LIST`: task operational state and last result; localized labels make XML better for authoritative configuration.\n- `Get-CimInstance Win32_Process -Filter 'ProcessId=48932 OR ProcessId=49172' | Select-Object ProcessId,ParentProcessId,SessionId,CreationDate,ExecutablePath,CommandLine`; read-only GetOwner/GetOwnerSid for ownership, and the parent executable to identify actual launch chain.\n- Actual task profile/SPT_HOME, whether principal SID matches the user whose User environment is being staged, task-engine process identity/creation time where observable, and whether process-environment evidence is accessible to the human operator.\n- Capture all above through bounded read-only remote-query infrastructure; these are PS5.1-compatible payloads but bare external commands have no added wall-clock timeout by themselves.\n\n## Scope and evidence\n\nOnly repository reads/searches and primary Microsoft documentation reads were performed. No resident or isolated processes were launched, stopped or changed; no remote query, tests, builds, lint, format, validation commands or writes were performed. Current source establishes intended contracts, not proof that every guard exists identically in the supplied installed spt0.70.0. Actual release identity and diagnostic producer evidence remain Main's integration responsibility."
}