fix(service): drop wait keyed on schtasks /end failure

Owner review: lidge-jun#764 is an /end that succeeds while the wrapper respawns, so waiting only when /end errors cannot catch it. Keep orphan/PID cleanup and the immediate live-proxy refuse-success guard; restart-window verification stays on the separate stop-verification path.

Author: Wibias

src/service.ts

@@ -1494,8 +1494,6 @@ async function installWindowsNative(): Promise<void> {
   writeServiceInstallState("native");
 }
 function startWindows(): void { schtasks(["/run", "/tn", TASK]); }
-/** Batch wrapper cooldown after a failed child exit (`ping -n 6` ≈ 5s). */
-export const WINDOWS_SCHEDULER_WRAPPER_RESTART_MS = 6500;
 
 export function isWindowsSchedulerEndBenign(error: unknown): boolean {
   const detail = schtasksErrorDetail(error).toLowerCase();
@@ -1504,13 +1502,19 @@ export function isWindowsSchedulerEndBenign(error: unknown): boolean {
     || detail.includes("0x41330");
 }
 
-/** End the scheduler task; false when `/end` failed for a reason other than "not running". */
-export function stopWindows(): boolean {
+/**
+ * End the scheduler task. "Already stopped" is success; other `/end` failures are
+ * swallowed so callers can still run tracked-proxy + live-proxy cleanup.
+ *
+ * Do not key a restart-window wait on `/end` failure: the #764 case is an `/end`
+ * that *succeeds* while the wrapper survives and respawns. That verification lives
+ * on the stop-verification path (poll across the restart window), not here.
+ */
+export function stopWindows(): void {
   try {
     schtasks(["/end", "/tn", TASK]);
-    return true;
   } catch (error) {
-    return isWindowsSchedulerEndBenign(error);
+    if (isWindowsSchedulerEndBenign(error)) return;
   }
 }
 function statusWindows(): string { try { return schtasks(["/query", "/tn", TASK]); } catch { return ""; } }
@@ -2030,19 +2034,17 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       ops.start();
       console.log("✅ service started.");
       break;
-    case "stop":
+    case "stop": {
       assertServiceEnvironmentMatchesInstall();
       // Only stop what is actually installed. The unguarded call ran a real `launchctl unload`
       // (and its Windows/Linux twins) even with nothing installed.
-      let schedulerEndOk = true;
       if (ops.status() !== null || isServiceInstalled()) {
-        if (process.platform === "win32" && backend === "scheduler") schedulerEndOk = stopWindows();
-        else ops.stop();
+        ops.stop();
       }
       await stopTrackedProxyForServiceCommand();
-      if (process.platform === "win32" && backend === "scheduler" && !schedulerEndOk) {
-        await Bun.sleep(WINDOWS_SCHEDULER_WRAPPER_RESTART_MS);
-      }
+      // Refuse success while a proxy still answers. Restart-window polling for the
+      // succeed-then-respawn scheduler case is owned by the separate stop-verification
+      // work; this keeps the immediate-survivor guard for orphan/PID cleanup paths.
       if (await findLiveProxy({ timeoutMs: 1500 })) {
         console.error("❌ Service stop did not terminate the proxy — it is still running. Check `ocx service status` and the service log.");
         process.exit(1);
@@ -2058,6 +2060,7 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
         else if (!grok.ok) console.error(`⚠️  ${grok.message}`);
       }
       break;
+    }
     case "status": {
       if (process.platform === "win32" && backend === "scheduler") {
         console.log(await inspectWindowsSchedulerServiceStatus());

tests/proxy-liveness.test.ts

@@ -140,6 +140,7 @@ describe("findLiveProxy", () => {
   test("a runtime record whose healthz reports a different pid is rejected", async () => {
     const live = await findLiveProxy({
       readPidFn: () => 1111,
+      verifyPidFn: () => null,
       readRuntimeFn: () => ({ port: 58195 }),
       configFn: () => ({ port: 58195 }),
       fetchFn: (async () => healthz({ ...OURS, pid: 9999 })) as typeof fetch,

tests/service.test.ts

@@ -672,12 +672,14 @@ describe("service lifecycle cleanup ordering", () => {
   });
 
 
-  test("Windows scheduler stop waits through wrapper restart when schtasks /end fails", async () => {
+  test("Windows scheduler stop does not wait on schtasks /end failure", async () => {
     const service = await readText("src/service.ts");
     const stopCase = service.slice(service.indexOf('case "stop":'), service.indexOf('case "status":'));
-    expect(stopCase).toContain("schedulerEndOk = stopWindows()");
-    expect(stopCase).toContain("WINDOWS_SCHEDULER_WRAPPER_RESTART_MS");
-    expect(stopCase).toContain("await Bun.sleep(WINDOWS_SCHEDULER_WRAPPER_RESTART_MS)");
+    // #764 is an /end that succeeds while the wrapper respawns; waiting only when
+    // /end errors cannot catch that path. Restart-window polling lives elsewhere.
+    expect(stopCase).not.toContain("WINDOWS_SCHEDULER_WRAPPER_RESTART_MS");
+    expect(stopCase).not.toContain("schedulerEndOk");
+    expect(stopCase).not.toContain("await Bun.sleep(");
   });
 
   test("tracked proxy cleanup verifies health-reported pids before stopProxy", async () => {