fix(node): register the service-mode task with Register-ScheduledTask -LogonType S4U

schtasks.exe has no flag naming the logon type directly -- it only infers
S4U vs Interactive from whether /rp is present, and both readings broke
live on a blank-password account: /rp "" fails schtasks' own credential
validation, and omitting /rp registers "Interactive only", which never
launches the process at boot or on demand despite installing cleanly.

Register-ScheduledTask -LogonType S4U names the logon type explicitly, no
inference. Confirmed live: install, manual start, and unattended boot-time
start all now work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 21 insertions, 7 deletions

diff --git a/packaging/win/service.ps1 b/packaging/win/service.ps1
index 936c060..29a02fe 100644
--- a/packaging/win/service.ps1
+++ b/packaging/win/service.ps1
@@ -10,13 +10,24 @@
     any of it.
 
     The middle ground, and what this script sets up: a Scheduled Task that runs
-    AS THIS USER at system boot, without needing them to sign in first.
-    `schtasks /create ... /ru <user> /rp ""` with no `/it` registers an S4U
-    (Service For User) logon -- no password stored anywhere, and unlike
+    AS THIS USER at system boot, without needing them to sign in first -- an
+    S4U (Service For User) logon: no password stored anywhere, and unlike
     LocalSystem it loads this account's own profile, so %LOCALAPPDATA%\meshbay\
     keeps working with zero changes. The cost: S4U carries no network
-    credential (no reaching a domain share as this user), which the node never
-    needed -- everything it touches is local disk plus outbound internet.
+    credential (no reaching a domain share as this user), which the node
+    never needed -- everything it touches is local disk plus outbound
+    internet.
+
+    Install uses Register-ScheduledTask with -LogonType S4U, not
+    `schtasks /create`: schtasks only infers the logon type from whether /rp
+    is present, and both readings were tried and broke on this exact machine's
+    blank-password account (common on a personal PC) -- `/rp ""` fails
+    credential validation ("the user name or password is incorrect", even
+    though nothing is wrong), and omitting /rp registers "Interactive only"
+    instead of S4U, which never runs at boot and doesn't launch anything even
+    run on demand while signed in (both confirmed live, 2026-09-05).
+    -LogonType S4U is explicit, no inference. remove/status/run/end have no
+    such ambiguity and stay on schtasks.exe.
 
     Mirrors meshbay_node.platform.service_install/_remove/_status/_run/_end --
     same TASK_NAME, same flags -- so the CLI and the installer agree on what
@@ -57,8 +68,11 @@ switch ($Action) {
     "install" {
         if (-not (Test-Path $node)) { throw "meshbay-node.exe not found at $node" }
         $user = Get-CurrentUser
-        & schtasks /create /tn $TASK_NAME /tr "`"$node`"" /sc onstart /ru $user /rp "" /rl limited /f
-        if ($LASTEXITCODE -ne 0) { throw "schtasks /create failed (exit $LASTEXITCODE)" }
+        $action = New-ScheduledTaskAction -Execute $node
+        $trigger = New-ScheduledTaskTrigger -AtStartup
+        $principal = New-ScheduledTaskPrincipal -UserId $user -LogonType S4U -RunLevel Limited
+        Register-ScheduledTask -TaskName $TASK_NAME -Action $action -Trigger $trigger `
+            -Principal $principal -Force -ErrorAction Stop | Out-Null
         Write-Host "service: installed ($user, runs at boot)"
     }
     "remove" {