The one elevated step copies igneum-app.exe and its runtime DLLs into %ProgramData%\Igneum\helper with inheritance cut
(Administrators and SYSTEM full, Users read and execute, owner Administrators) and registers the task against that copy;
the per-user install under LOCALAPPDATA is never what the scheduler runs elevated. The helper's reregister refreshes
the copy only when the signed update manifest names the installed exe's sha256 (platforms.windows.engine_sha256,
publish-manifest.sh --win-engine); anything else is refused with its reason in helper.log. rights.ps1 and
register-power-task.ps1 are no longer read from user-writable folders: every elevated script travels inline through
-EncodedCommand. quit and remove carry a sequence like every verb and pass the rising-sequence guard; a stale line
re-added to the file is skipped. The window host declares asInvoker. The prove host's lease is the lesser of the
grant and the free reading (the V6-07 sub-lane's 12 GB row).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
295711ba29