From 3333faaa03a31aff1c84b6542f5ee509d5fbee5b Mon Sep 17 00:00:00 2001
From: igneum-labs <337424239+igneum-labs@users.noreply.github.com>
Date: Thu, 8 Oct 2026 10:01:25 +0000
Subject: [PATCH] installer-stop-check rule 6: the /Create pattern matches the
 installer's own line (the schtasks command is built in a variable); self-test
 green on the tree, known-failed on the shape without the detach

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 tools/ci/installer-stop-check.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/ci/installer-stop-check.sh b/tools/ci/installer-stop-check.sh
index 7a8d6129c..33f8c91bf 100755
--- a/tools/ci/installer-stop-check.sh
+++ b/tools/ci/installer-stop-check.sh
@@ -34,7 +34,7 @@ check() {   # <iss file> <ps1 file>  -> prints each broken rule, returns 1 when
   # rule 6 (PC 2, 0.3.24 take 2, 8 October 2026, 09:24Z): an installer started by the app's job runner is the engine's child and
   # dies with the job's tree when the stop step quits the engine; under a job (IGNEUM_JOB_ID) it must re-run itself detached
   # (a copy through a one-shot scheduled task, /IGDETACHED=1) and exit before the marker and the stop step
-  if ! grep -q "GetEnv('IGNEUM_JOB_ID')" "$iss" || ! grep -q "IGDETACHED" "$iss" || ! grep -q "schtasks.exe', '/Create" "$iss" || ! grep -q "schtasks.exe', '/Run" "$iss"; then echo "rule 6: the installer does not detach itself from the app's job tree (IGNEUM_JOB_ID, a scheduled-task relaunch with /IGDETACHED=1)"; bad=1; fi
+  if ! grep -q "GetEnv('IGNEUM_JOB_ID')" "$iss" || ! grep -q "IGDETACHED" "$iss" || ! grep -q "'/Create /F /SC ONCE" "$iss" || ! grep -q "Exec('schtasks.exe', '/Run" "$iss"; then echo "rule 6: the installer does not detach itself from the app's job tree (IGNEUM_JOB_ID, a scheduled-task relaunch with /IGDETACHED=1)"; bad=1; fi
   local init
   init="$(sed -n '/^function InitializeSetup/,/^end;/p' "$iss")"
   if ! grep -q "UnderAppJob" <<<"$init" || ! grep -q "RelaunchDetached" <<<"$init"; then echo "rule 6: InitializeSetup does not run the detach before anything else"; bad=1; fi
@@ -63,7 +63,7 @@ ISS
   if check "$t/old.iss" "$t/old.ps1" >/dev/null; then echo "self-test: tonight's shape passed, it must fail"; exit 1; fi
   if ! check packaging/windows/Igneum-Miner.iss packaging/windows/stop-igneum.ps1 >/dev/null; then echo "self-test: the tree's own files fail"; check packaging/windows/Igneum-Miner.iss packaging/windows/stop-igneum.ps1 || true; exit 1; fi
   # the job-tree shape (0.3.24 take 2): an installer with no detach path; known-failed first on release-0.3.25 9b93e649's .iss
-  grep -v "IGNEUM_JOB_ID\|IGDETACHED\|schtasks.exe', '/Create\|schtasks.exe', '/Run\|UnderAppJob\|RelaunchDetached\|RemoveDetachTask" packaging/windows/Igneum-Miner.iss > "$t/tree.iss"
+  grep -v "IGNEUM_JOB_ID\|IGDETACHED\|/Create /F /SC ONCE\|schtasks.exe', '/Run\|UnderAppJob\|RelaunchDetached\|RemoveDetachTask" packaging/windows/Igneum-Miner.iss > "$t/tree.iss"
   tree_out="$(check "$t/tree.iss" packaging/windows/stop-igneum.ps1 2>/dev/null || true)"
   if ! grep -q "rule 6" <<<"$tree_out"; then echo "self-test: the job-tree shape passed, it must fail rule 6"; exit 1; fi
   echo "installer-stop self-test: tonight's shape is caught, the tree's files pass"