fix(probe): walk Windows service definition chains (Task Scheduler + WinSW) for ownership

src/integrations/native/ownership-preflight.ts

@@ -78,6 +78,25 @@ function claimNamesDifferentHome(
   return false;
 }
 
+/**
+ * Map a service-manager claim backend to the `ServiceInstallState.backend`
+ * value it corresponds to. `scheduler` (Task Scheduler) and `winsw` (native)
+ * are the two Windows manager backends; launchd/systemd claims have no Windows
+ * backend and can never mismatch a v2 state file.
+ */
+function claimBackendToStateBackend(backend: ServiceManagerClaim["backend"]): "scheduler" | "native" | null {
+  if (backend === "scheduler") return "scheduler";
+  if (backend === "winsw") return "native";
+  return null;
+}
+
+/** True when the recorded state backend disagrees with the manager claim. Legacy v1 means scheduler. */
+function claimBackendMismatchesState(claim: ServiceManagerClaim, state: { backend?: "scheduler" | "native" }): boolean {
+  const expected = claimBackendToStateBackend(claim.backend);
+  if (expected === null) return false;
+  return (state.backend ?? "scheduler") !== expected;
+}
+
 export interface OwnershipDeps extends ProbeDeps {
   /**
    * Which state paths to consult. Injectable because the default set includes
@@ -125,7 +144,14 @@ export function inspectNativeCodexOwnership(deps: OwnershipDeps = {}): Ownership
     };
   }
 
-  const manager = inspectServiceManagerInstallation(deps);
+  // The manager assets live under the effective OPENCODEX_HOME. Production
+  // callers do not inject ProbeDeps.configDir, so derive it from the same
+  // current-home snapshot used for ownership comparison rather than silently
+  // falling back to <homedir>/.opencodex.
+  const manager = inspectServiceManagerInstallation({
+    ...deps,
+    configDir: deps.configDir ?? current.opencodexHome,
+  });
   if (manager.kind === "unknown") {
     return { ownership: "unknown", reason: manager.reason };
   }
@@ -146,6 +172,17 @@ export function inspectNativeCodexOwnership(deps: OwnershipDeps = {}): Ownership
         reason: `${disagreeing.backend} is installed from ${disagreeing.definitionPath}, which names different homes than the recorded service state`,
       };
     }
+    // A manager backend that disagrees with the recorded state (e.g. state says
+    // native/WinSW but a scheduler task is found) is an interrupted backend
+    // switch: it does not prove which manager owns the installation. v1 state
+    // predates the field and is scheduler by contract.
+    const stateBackendMismatch = valid.find(state => manager.claims.some(claim => claimBackendMismatchesState(claim, state.state)));
+    if (stateBackendMismatch) {
+      return {
+        ownership: "unknown",
+        reason: `the service state records backend ${stateBackendMismatch.state.backend ?? "scheduler"} but ${manager.claims[0]?.backend ?? "a service manager"} is installed`,
+      };
+    }
     // Definition agrees. Valid state agreeing with it is ownership; no state at
     // all beside an installed definition is not, because the definition is the
     // claim and nothing here recorded making it.
@@ -162,4 +199,4 @@ export function inspectNativeCodexOwnership(deps: OwnershipDeps = {}): Ownership
   return valid.length === 0
     ? { ownership: "owned", reason: "no service state and no service manager claim" }
     : { ownership: "owned", reason: "the recorded service state names these homes" };
-}
+}