diff --git a/src/lib/windows-elevation.ts b/src/lib/windows-elevation.ts
index b2d02b8123..171545276c 100644
--- a/src/lib/windows-elevation.ts
+++ b/src/lib/windows-elevation.ts
@@ -250,6 +250,21 @@ export const OCX_ELEVATED_PROTOCOL_FAILED = 13;
 /** Windows ERROR_CANCELLED — reserved for UAC denial; never emitted by the elevated script. */
 export const OCX_ELEVATED_UAC_CANCELLED = 1223;
 
+/**
+ * The elevated process could not read a staged payload (#4692).
+ *
+ * `hardenSecretPath` grants the staging account and strips inheritance, so a split-token
+ * elevation of the same user reads the file and an elevation answered with a DIFFERENT
+ * administrator's credentials does not. The elevated side cannot explain that itself: it
+ * runs hidden, so its stderr goes nowhere and only the exit code survives the boundary.
+ * Without a code of its own the operator would be told "exit code 1" for a cause that
+ * names its own remedy — the same undiagnosable failure this change set exists to remove.
+ *
+ * Deliberately outside OCX_ELEVATED_PROTOCOL_CODES: that list is the create-and-run
+ * transaction's alphabet, and this code belongs to the registration path.
+ */
+export const OCX_ELEVATED_STAGING_UNREADABLE = 14;
+
 export const OCX_ELEVATED_PROTOCOL_CODES = [
   OCX_ELEVATED_SUCCESS,
   OCX_ELEVATED_CREATE_FAILED,
@@ -645,36 +660,83 @@ export function runWindowsElevated(file: string, args: string[]): Promise<number
 }
 
 /**
- * Register one scheduled-task definition without exposing a mutable XML pathname to
- * the elevated process. The XML bytes are fixed in the encoded PowerShell command
- * before UAC; Register-ScheduledTask receives that string directly after elevation.
+ * A task definition staged for the elevated process.
+ *
+ * The bytes live in a freshly created, ACL-hardened private directory, and the digest is
+ * taken over exactly those bytes by the caller that validated them. The elevated script
+ * reads the file once, hashes what it read, and refuses unless the digest matches, so a
+ * pathname is no longer a promise about content — it is a claim the receiver checks.
+ */
+export interface StagedWindowsTaskXml {
+  /** Path inside the caller's hardened staging directory. */
+  readonly path: string;
+  /** Lowercase hex SHA-256 of the staged bytes (UTF-16LE, no BOM). */
+  readonly sha256: string;
+}
+
+/**
+ * Read a staged payload, prove it is the one that was validated, and decode it.
+ *
+ * One read: the bytes that are hashed are the same array that is decoded and registered.
+ * Hashing a path and then reopening it would reintroduce the swap window this check
+ * exists to close.
+ */
+const READ_STAGED_TASK_XML = "function Read-OcxStagedTaskXml([string]$path, [string]$expectedHash) {"
+  // An unreadable payload is a diagnosable condition, not a generic throw: a hidden
+  // elevated process has nowhere to print, so the cause has to ride the exit code.
+  + " try { $bytes = [IO.File]::ReadAllBytes($path) }"
+  + " catch [System.UnauthorizedAccessException] { exit " + OCX_ELEVATED_STAGING_UNREADABLE + " }"
+  + " catch [System.Security.SecurityException] { exit " + OCX_ELEVATED_STAGING_UNREADABLE + " };"
+  + " $sha = [Security.Cryptography.SHA256]::Create();"
+  + " try { $actual = [BitConverter]::ToString($sha.ComputeHash($bytes)).Replace('-', '').ToLowerInvariant() } finally { $sha.Dispose() };"
+  + " if ($actual -cne $expectedHash) { throw 'Task Scheduler staged payload failed its integrity check.' };"
+  + " return [Text.Encoding]::Unicode.GetString($bytes) }";
+
+/**
+ * Register one scheduled-task definition from staged, digest-verified bytes.
+ *
+ * The payloads used to be embedded as base64(utf16le) inside an inner PowerShell script
+ * that was itself base64(utf16le)-encoded into `-EncodedCommand`. Two layers of base64
+ * over UTF-16 cost about 14.2 command-line characters per XML character, and a
+ * replacement carries two payloads, so a ~2 KB task definition pushed the outer command
+ * past the Windows limit and the spawn failed with ENAMETOOLONG before UAC ever
+ * appeared (#4692). On a host where the trigger scope exports as an account name the
+ * re-register path runs on every repair, so repair could never succeed.
+ *
+ * The command now carries two paths and two 64-character digests, so its length no
+ * longer depends on the size of the XML at all.
+ *
+ * The original design goal was "immutable bytes, never a caller-writable pathname".
+ * That goal is kept by different means rather than abandoned: the staging directory is
+ * private and ACL-hardened, the files are created exclusively so nothing can be waiting
+ * at the path, and the digest makes a same-account swap during the UAC prompt fail
+ * closed instead of registering something else. An ACL alone could not do that last
+ * part, because a process running as the same user has the same SID.
+ *
+ * The replacement precondition is unchanged: the elevated process still re-queries the
+ * live registration and compares it to the captured predecessor before passing -Force.
  */
 export function runWindowsElevatedScheduledTaskRegistration(
   taskName: string,
-  xml: string,
+  xml: StagedWindowsTaskXml,
   replace = false,
-  expectedExistingXml?: string,
+  expectedExisting?: StagedWindowsTaskXml,
 ): Promise<number> {
-  if (replace && !expectedExistingXml?.trim()) {
+  if (replace && !expectedExisting) {
     throw new Error("Elevated Task Scheduler replacement requires a captured existing definition.");
   }
-  const xmlBase64 = Buffer.from(xml, "utf16le").toString("base64");
-  const expectedExistingBase64 = expectedExistingXml === undefined
-    ? null
-    : Buffer.from(expectedExistingXml, "utf16le").toString("base64");
   const powerShellPath = windowsPowerShell();
   const powerShellDirectory = powerShellPath.replace(/[\\/][^\\/]+$/, "");
   const scheduledTasksModule = `${powerShellDirectory}\\Modules\\ScheduledTasks\\ScheduledTasks.psd1`;
   const inner = [
     `$taskName = ${psSingleQuote(taskName)}`,
-    `$xmlBase64 = ${psSingleQuote(xmlBase64)}`,
-    "$xml = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($xmlBase64))",
+    READ_STAGED_TASK_XML,
+    `$xml = Read-OcxStagedTaskXml ${psSingleQuote(xml.path)} ${psSingleQuote(xml.sha256)}`,
     `$module = Microsoft.PowerShell.Core\\Import-Module -Name ${psSingleQuote(scheduledTasksModule)} -PassThru -Force -ErrorAction Stop`,
     "$registerTask = $module.ExportedCommands['Register-ScheduledTask']",
     "if ($null -eq $registerTask) { throw 'Trusted ScheduledTasks module does not export Register-ScheduledTask.' }",
     ...(replace ? [
-      `$expectedBase64 = ${psSingleQuote(expectedExistingBase64!)}`,
-      "$expectedXml = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($expectedBase64))",
+      `$expectedXml = Read-OcxStagedTaskXml ${psSingleQuote(expectedExisting!.path)} ${psSingleQuote(expectedExisting!.sha256)}`,
       `$schtasks = ${psSingleQuote(resolveTrustedWindowsSchtasksExe())}`,
       "$currentXml = & $schtasks /query /tn $taskName /xml 2>$null | Out-String",
       "if ($LASTEXITCODE -ne 0) { throw 'Task Scheduler replacement precondition could not be read.' }",
diff --git a/src/service.ts b/src/service.ts
index 92cedd7e22..149b1ae02c 100644
--- a/src/service.ts
+++ b/src/service.ts
@@ -19,7 +19,7 @@ export { decodeSchtasksOutput, setQuerySchtasksForTests, formatWindowsSchedulerS
 export type { WindowsSchedulerXmlState } from "./service/windows-taskxml";
 export { buildWindowsServiceScript, buildWindowsSchtasksCreateArgs, buildWindowsSchtasksCreateArgsForXml, buildWindowsLauncherVbs, buildWindowsTaskXml, buildWindowsTaskXmlDocument, windowsTaskRegistrationOwnedByAttempt, windowsTaskRegistrationHealthy, readWindowsSchedulerXmlState } from "./service/windows-taskxml";
 export type { WindowsSchedulerRegistrationStageDeps, FreshWindowsSchedulerRegistrationDeps, RemoveNativeWindowsServiceDeps } from "./service/windows-ops";
-export { windowsListenPort, winswListenPort, writeServiceDefinitionFile, definitionCarriesCredential, stageWindowsSchedulerRegistrationXml, registerFreshWindowsSchedulerTask, removeNativeWindowsServiceForScheduler, assertWindowsNativeServiceAccountSupported, isWindowsSchedulerEndBenign, stopWindows, stopWindowsChecked, classifyWindowsServiceStop } from "./service/windows-ops";
+export { windowsListenPort, winswListenPort, writeServiceDefinitionFile, definitionCarriesCredential, stageWindowsSchedulerRegistrationXml, stageElevatedSchedulerRegistration, describeElevatedRegistrationFailure, registerFreshWindowsSchedulerTask, removeNativeWindowsServiceForScheduler, assertWindowsNativeServiceAccountSupported, isWindowsSchedulerEndBenign, stopWindows, stopWindowsChecked, classifyWindowsServiceStop } from "./service/windows-ops";
 export type { ServiceRepairVerb, RepairServiceDeps } from "./service/repair";
 export { repairService } from "./service/repair";
 export type { ServiceInstallPreparationDeps, FreshWindowsSchedulerInstallDeps, ServiceStopOutcome, ServiceUninstallOutcome } from "./service/orchestration";
diff --git a/src/service/windows-ops.ts b/src/service/windows-ops.ts
index 64e3d48373..703e942061 100644
--- a/src/service/windows-ops.ts
+++ b/src/service/windows-ops.ts
@@ -1,4 +1,5 @@
-import { chmodSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, lstatSync, readFileSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { win32 } from "node:path";
 import { winswXmlPath } from "../lib/winsw";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
@@ -9,7 +10,7 @@ import { existsSync, mkdirSync, mkdtempSync, rmdirSync, unlinkSync } from "node:
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { getConfigDir } from "../config";
-import { runWindowsElevatedScheduledTaskRegistration, WindowsSchtasksError } from "../lib/windows-elevation";
+import { OCX_ELEVATED_STAGING_UNREADABLE, runWindowsElevatedScheduledTaskRegistration, WindowsSchtasksError, type StagedWindowsTaskXml } from "../lib/windows-elevation";
 import { defaultWinswEntry, installWinswService, statusWinswRaw, uninstallWinswService, WINSW_SERVICE_ID, type WinswStatus } from "../lib/winsw";
 import { forgetEphemeralSecretDir, forgetEphemeralSecretPath, hardenSecretDir } from "../lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
@@ -165,6 +166,197 @@ function cleanupWindowsSchedulerStage(
   if (cleanupError) throw cleanupError;
 }
 
+/** A staged payload set for one elevated registration, plus the way to remove it. */
+export interface StagedElevatedSchedulerRegistration {
+  readonly xml: StagedWindowsTaskXml;
+  readonly expectedExisting?: StagedWindowsTaskXml;
+  /** Remove every staged artifact. Idempotent, so a second call after success is a no-op. */
+  cleanup(): void;
+}
+
+export interface ElevatedSchedulerStagingDeps {
+  createStageDir?: () => string;
+  hardenDir?: (path: string) => void;
+  writePayload?: (path: string, bytes: Buffer) => void;
+  hardenPath?: (path: string) => void;
+  inspect?: (path: string) => { isSymbolicLink(): boolean; isFile(): boolean; isDirectory(): boolean };
+  removeStageDir?: (path: string) => void;
+}
+
+/**
+ * Stage the captured definitions an elevated registration needs, as files rather than
+ * as command-line payloads (#4692).
+ *
+ * A file that an administrator process will read is itself a privilege-escalation
+ * surface, so three properties have to hold together and none of them is sufficient
+ * alone:
+ *
+ * - **Access.** The directory is created fresh by `mkdtemp`, then ACL-hardened before
+ *   anything is written into it, so another local account cannot read or replace the
+ *   payload while the UAC prompt is open. Hardening the directory first is what makes
+ *   the file private from the moment it exists.
+ * - **No reparse point.** Each artifact is inspected with `lstat` and rejected unless it
+ *   is what it claims to be. `wx` already refuses to create over an existing name, which
+ *   is the atomic step here — there is no replace path to race, because every path is
+ *   inside a directory that did not exist a moment ago. The explicit check is what keeps
+ *   that guarantee from depending on a reading of `O_EXCL` semantics.
+ * - **Tamper evidence.** The digest is taken over the exact bytes written, and the
+ *   elevated script recomputes it over the bytes it reads. An ACL cannot cover this:
+ *   a process running as the same user has the same SID and can rewrite the file, so
+ *   the digest is the only thing that makes such a swap fail closed rather than
+ *   silently register a different task definition.
+ *
+ * Payloads are UTF-16LE with no BOM, and the elevated process decodes them straight into
+ * `Register-ScheduledTask`. What is hashed is therefore exactly what is registered, with
+ * no trimming step in between that the two sides could disagree about.
+ */
+export function stageElevatedSchedulerRegistration(
+  xml: string,
+  expectedExistingXml?: string,
+  deps: ElevatedSchedulerStagingDeps = {},
+): StagedElevatedSchedulerRegistration {
+  const createStageDir = deps.createStageDir
+    ?? (() => mkdtempSync(join(tmpdir(), WINDOWS_SCHEDULER_STAGE_PREFIX)));
+  const hardenDir = deps.hardenDir ?? ((path: string) => { hardenSecretDir(path, { required: true }); });
+  const writePayload = deps.writePayload ?? ((path: string, bytes: Buffer) => {
+    writeFileSync(path, bytes, { flag: "wx", mode: 0o600 });
+  });
+  const hardenPath = deps.hardenPath ?? ((path: string) => { hardenSecretPath(path, { required: true }); });
+  const inspect = deps.inspect ?? ((path: string) => lstatSync(path));
+  const removeStageDir = deps.removeStageDir ?? ((path: string) => { rmdirSync(path); });
+
+  const stageDir = createStageDir();
+  const files: string[] = [];
+  const cleanup = (): void => {
+    let failure: unknown;
+    for (const file of files.splice(0)) {
+      try {
+        unlinkSync(file);
+        forgetEphemeralSecretPath(file);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") forgetEphemeralSecretPath(file);
+        else if (failure === undefined) failure = error;
+      }
+    }
+    try {
+      removeStageDir(stageDir);
+      forgetEphemeralSecretDir(stageDir);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException | undefined)?.code === "ENOENT") forgetEphemeralSecretDir(stageDir);
+      else if (failure) throw new AggregateError([failure, error], "Elevated Task Scheduler staging cleanup failed.");
+      else failure = error;
+    }
+    if (failure) throw failure;
+  };
+
+  try {
+    try { chmodSync(stageDir, 0o700); } catch { /* required Windows ACL is authoritative */ }
+    const dirStats = inspect(stageDir);
+    if (dirStats.isSymbolicLink() || !dirStats.isDirectory()) {
+      throw new Error(`Refusing to stage an elevated Task Scheduler payload under a redirected path: ${stageDir}`);
+    }
+    hardenDir(stageDir);
+    const stage = (name: string, value: string): StagedWindowsTaskXml => {
+      const path = join(stageDir, name);
+      const bytes = Buffer.from(value, "utf16le");
+      writePayload(path, bytes);
+      files.push(path);
+      const stats = inspect(path);
+      if (stats.isSymbolicLink() || !stats.isFile()) {
+        throw new Error(`Refusing to stage an elevated Task Scheduler payload through a redirected path: ${path}`);
+      }
+      hardenPath(path);
+      return { path, sha256: createHash("sha256").update(bytes).digest("hex") };
+    };
+    return {
+      xml: stage("register.xml", xml),
+      ...(expectedExistingXml === undefined
+        ? {}
+        : { expectedExisting: stage("expected.xml", expectedExistingXml) }),
+      cleanup,
+    };
+  } catch (error) {
+    try {
+      cleanup();
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        "Elevated Task Scheduler staging failed and could not be cleaned up.",
+      );
+    }
+    throw error;
+  }
+}
+
+/**
+ * Turn an elevated registration exit code into something an operator can act on.
+ *
+ * The elevated process runs hidden, so nothing it writes survives; only the exit code
+ * crosses back. That makes an unexplained code the whole user-facing error, which is
+ * exactly what made the ENAMETOOLONG in #4692 expensive to diagnose. Staging introduces
+ * one new failure of its own — the payload is readable only by the account that created
+ * it, so an elevation answered with a different administrator's credentials cannot open
+ * it — and that one gets named along with its remedy rather than surfacing as a number.
+ */
+export function describeElevatedRegistrationFailure(
+  failureLabel: string,
+  exitCode: number,
+  stageDir: string,
+): string {
+  if (exitCode === OCX_ELEVATED_STAGING_UNREADABLE) {
+    return `${failureLabel}: the elevated process could not read the staged task definition in `
+      + `${stageDir}. That directory is readable only by the account that staged it, so this `
+      + "happens when the UAC prompt was answered with a different administrator account. "
+      + "Approve the prompt as the signed-in user, or run the command again from a session "
+      + "already elevated as that user.";
+  }
+  return `${failureLabel} with exit code ${exitCode}.`;
+}
+
+/**
+ * Stage, elevate, and clean up — on every exit, including UAC cancellation and a
+ * synchronous spawn failure.
+ *
+ * A cleanup failure never replaces the registration failure it followed: an operator
+ * told only that a temp directory could not be removed would have no idea the task was
+ * never registered.
+ */
+async function runStagedElevatedSchedulerRegistration(
+  taskName: string,
+  xml: string,
+  replace: boolean,
+  expectedExistingXml: string | undefined,
+  failureLabel: string,
+): Promise<void> {
+  const staged = stageElevatedSchedulerRegistration(xml, expectedExistingXml);
+  let failure: unknown;
+  try {
+    const exitCode = await runWindowsElevatedScheduledTaskRegistration(
+      taskName,
+      staged.xml,
+      replace,
+      staged.expectedExisting,
+    );
+    if (exitCode !== 0) {
+      failure = new Error(describeElevatedRegistrationFailure(failureLabel, exitCode, dirname(staged.xml.path)));
+    }
+  } catch (error) {
+    failure = error;
+  }
+  try {
+    staged.cleanup();
+  } catch (cleanupError) {
+    if (failure) {
+      throw new AggregateError(
+        [failure, cleanupError],
+        "Elevated Task Scheduler registration failed and its staging could not be cleaned up.",
+      );
+    }
+    throw cleanupError;
+  }
+  if (failure) throw failure;
+}
+
 export function stageWindowsSchedulerRegistrationXml(
   attemptNonce: string,
   deps: WindowsSchedulerRegistrationStageDeps = {},
@@ -294,7 +486,8 @@ export async function registerFreshWindowsSchedulerTask(
       throw error;
     }
     // Register from the captured XML string inside the elevated process. Another
-    // same-user process can mutate its own temp files, but cannot change this command.
+    // same-user process can mutate its own temp files, so the captured bytes are staged
+    // privately and the elevated script verifies their digest before registering them.
     // UAC can remain open for an arbitrary amount of time. Recheck the captured predecessor
     // before launch; the elevated helper repeats the same check after consent and before Force.
     assertReplacementPrecondition();
@@ -303,15 +496,13 @@ export async function registerFreshWindowsSchedulerTask(
       xml: string,
       replaceCurrent: boolean,
       previousXml?: string,
-    ) => {
-      const exitCode = await runWindowsElevatedScheduledTaskRegistration(
-        taskName,
-        xml,
-        replaceCurrent,
-        previousXml,
-      );
-      if (exitCode !== 0) throw new Error(`Background service install failed with exit code ${exitCode}.`);
-    });
+    ) => runStagedElevatedSchedulerRegistration(
+      taskName,
+      xml,
+      replaceCurrent,
+      previousXml,
+      "Background service install failed",
+    ));
     await elevate(TASK, expectedXml, replace, expectedExistingXml);
   }
 
@@ -501,10 +692,13 @@ export async function restoreWindowsSchedulerTaskIfAbsent(registeredXml: string)
       ) {
         throw error;
       }
-      const exitCode = await runWindowsElevatedScheduledTaskRegistration(TASK, registeredXml, false);
-      if (exitCode !== 0) {
-        throw new Error(`Task Scheduler rollback failed with exit code ${exitCode}.`);
-      }
+      await runStagedElevatedSchedulerRegistration(
+        TASK,
+        registeredXml,
+        false,
+        undefined,
+        "Task Scheduler rollback failed",
+      );
     }
     const recoveredXml = statusWindowsXml();
     if (!windowsSchedulerRegistrationMatchesSnapshot(recoveredXml, registeredXml)) {
diff --git a/src/service/windows-scheduler.ts b/src/service/windows-scheduler.ts
index 0f1719aa63..5e460d1857 100644
--- a/src/service/windows-scheduler.ts
+++ b/src/service/windows-scheduler.ts
@@ -5,6 +5,7 @@ import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { ELEVATION_REQUEST_TIMEOUT_MS, OCX_ELEVATED_PROTOCOL_FAILED, raceWithTimeout, resolveTrustedWindowsSchtasksExe, startElevatedSchtasksCreateAndRun, runWindowsElevated, toWindowsSchtasksError, WindowsElevationError, type ElevatedSchedulerOutcome, type ElevatedSchtasksCreateAndRunExecution, type ElevatedSchtasksCreateAndRunResult } from "../lib/windows-elevation";
 import { statusWinswRaw } from "../lib/winsw";
+import { decodeWindowsTextBytes, type WindowsTextDecodeOptions } from "../lib/windows-text";
 import { isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { TASK, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath, writeServiceInstallState } from "./state";
 import { buildWindowsSchtasksCreateArgs, windowsTaskRegistrationOwnedByAttempt, windowsTaskRegistrationHealthy } from "./windows-taskxml";
@@ -16,28 +17,34 @@ import { WINSW_SERVICE_ID } from "../lib/winsw";
  * Decode schtasks stdout. `/query /xml` emits UTF-16LE (often with BOM) because the
  * registered task document is UTF-16; reading that as UTF-8 makes every health check
  * fail ("registration present but unhealthy") and rolls back a successful elevated create.
+ *
+ * Redirected output is NOT always UTF-16. Its encoding follows the console output code
+ * page of the spawning process tree rather than the XML declaration, so on a zh-CN host
+ * (ACP/OEMCP 936) the bytes are GBK — including inside a no-console background service.
+* Decoding those as UTF-8 turned a CJK account name in
+ * `<SessionStateChangeTrigger><UserId>` into U+FFFD, the trigger scope then failed to
+ * match the correctly resolved `[SID, MACHINE\<name>]`, and `ocx service repair`
+* aborted at its recognition gate on a registration OpenCodex had itself created. The
+ * same mojibake rolled back fresh installs at post-create verification (#4691).
+ *
+ * The fix is entirely in byte decoding, before any XML is parsed. The trigger scope stays
+ * an exact identity comparison: forgiving a replacement character there would let two
+ * different non-ASCII accounts collapse to the same value, which is a worse failure than
+ * the refusal it replaces.
+ *
+ * `decodeWindowsTextBytes` is the decoder this project already built for this class
+ * (UTF-16 -> strict UTF-8 -> the locale's legacy code page), and it already fixed the
+ * sibling `whoami`/PowerShell decode in `src/lib/windows-user-principal.ts` (#2914, and
+ * #722 for CP949). This call site was the last one still ending in a lossy UTF-8 decode.
  */
-export function decodeSchtasksOutput(buffer: Buffer): string {
-  if (buffer.length === 0) return "";
-  const bomUtf16Le = buffer.length >= 2 && buffer[0] === 0xff && buffer[1] === 0xfe;
-  const bomUtf16Be = buffer.length >= 2 && buffer[0] === 0xfe && buffer[1] === 0xff;
-  const looksUtf16Le = buffer.length >= 4
-    && buffer[1] === 0x00
-    && buffer[3] === 0x00
-    && buffer[0] !== 0x00;
-  if (bomUtf16Le || looksUtf16Le) {
-    return buffer.toString("utf16le").replace(/^\uFEFF/, "").trim();
-  }
-  if (bomUtf16Be) {
-    // Swap pairs then decode as utf16le.
-    const swapped = Buffer.alloc(buffer.length - 2);
-    for (let i = 2; i + 1 < buffer.length; i += 2) {
-      swapped[i - 2] = buffer[i + 1]!;
-      swapped[i - 1] = buffer[i]!;
-    }
-    return swapped.toString("utf16le").trim();
-  }
-  return buffer.toString("utf8").replace(/^\uFEFF/, "").trim();
+export function decodeSchtasksOutput(
+  buffer: Buffer,
+  options: WindowsTextDecodeOptions = {},
+): string {
+  // `options` exists so a test can pin the code page; every production call passes the
+  // buffer alone and uses the active Intl locale, which is available to a service with no
+  // console because the selection reads the process locale rather than a console handle.
+  return decodeWindowsTextBytes(buffer, options);
 }
 
 function runFile(file: string, args: string[]): string {
diff --git a/tests/windows/windows-elevation-spawn.test.ts b/tests/windows/windows-elevation-spawn.test.ts
index 3eaaec1258..d2550a44bc 100644
--- a/tests/windows/windows-elevation-spawn.test.ts
+++ b/tests/windows/windows-elevation-spawn.test.ts
@@ -1,11 +1,16 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import { EventEmitter } from "node:events";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
   OCX_ELEVATED_CREATE_FAILED,
   OCX_ELEVATED_PROTOCOL_CODES,
   OCX_ELEVATED_PROTOCOL_FAILED,
   OCX_ELEVATED_RUN_FAILED_ROLLBACK_FAILED,
   OCX_ELEVATED_RUN_FAILED_ROLLED_BACK,
+  OCX_ELEVATED_STAGING_UNREADABLE,
   OCX_ELEVATED_SUCCESS,
   OCX_ELEVATED_UAC_CANCELLED,
   WindowsElevationError,
@@ -25,8 +30,150 @@ import {
   finalizeWindowsSchedulerServiceRegistration,
   schedulerVerificationMaySettle,
   setFinalizeWindowsSchedulerHooksForTests,
+  stageElevatedSchedulerRegistration,
+  describeElevatedRegistrationFailure,
 } from "../../src/service";
 import type { WindowsSchedulerInstallVerification } from "../../src/service";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+/**
+ * #4692: a file an administrator process will read is itself a privilege-escalation
+ * surface, so access, redirection and tamper-evidence each have to hold.
+ */
+describe("elevated Task Scheduler payload staging", () => {
+  test("hardens before writing, digests the exact bytes, and cleans up", () => {
+    const parent = mkdtempSync(join(tmpdir(), "ocx-elevated-stage-"));
+    const stageDir = join(parent, "private-stage");
+    const calls: string[] = [];
+    try {
+      const staged = stageElevatedSchedulerRegistration(
+        "<Task><Description>new</Description></Task>",
+        "<Task><Description>previous</Description></Task>",
+        {
+          createStageDir: () => {
+            mkdirSync(stageDir, { mode: 0o700 });
+            calls.push("create-stage-dir");
+            return stageDir;
+          },
+          hardenDir: () => { calls.push("harden-dir"); },
+          writePayload: (path, bytes) => {
+            calls.push("write:" + path.slice(stageDir.length + 1));
+            writeFileSync(path, bytes, { flag: "wx" });
+          },
+          hardenPath: path => { calls.push("harden:" + path.slice(stageDir.length + 1)); },
+        },
+      );
+
+      // The directory is private before anything is written into it; hardening after the
+      // write would leave a window where the payload is readable by another account.
+      expect(calls).toEqual([
+        "create-stage-dir",
+        "harden-dir",
+        "write:register.xml",
+        "harden:register.xml",
+        "write:expected.xml",
+        "harden:expected.xml",
+      ]);
+
+      // The digest covers exactly the bytes on disk, and those bytes are UTF-16LE with no
+      // BOM: the elevated process decodes them straight into Register-ScheduledTask, so
+      // what is hashed here is what gets registered, with no trimming step in between.
+      for (const [payload, value] of [
+        [staged.xml, "<Task><Description>new</Description></Task>"],
+        [staged.expectedExisting!, "<Task><Description>previous</Description></Task>"],
+      ] as const) {
+        const onDisk = readFileSync(payload.path);
+        expect(onDisk.equals(Buffer.from(value, "utf16le"))).toBe(true);
+        expect(onDisk[0]).not.toBe(0xff);
+        expect(payload.sha256).toBe(createHash("sha256").update(onDisk).digest("hex"));
+        expect(payload.sha256).toMatch(/^[0-9a-f]{64}$/);
+      }
+      expect(staged.xml.sha256).not.toBe(staged.expectedExisting!.sha256);
+
+      staged.cleanup();
+      expect(existsSync(stageDir)).toBe(false);
+      // Idempotent: the success path calls it once, but a failure path may race it.
+      expect(() => staged.cleanup()).not.toThrow();
+    } finally {
+      removeTreeWithRetry(parent);
+    }
+  });
+
+  test("refuses a redirected path and leaves nothing behind", () => {
+    const parent = mkdtempSync(join(tmpdir(), "ocx-elevated-stage-reparse-"));
+    const stageDir = join(parent, "private-stage");
+    try {
+      // A staged payload reached through a reparse point is a payload somebody else chose
+      // the destination for. Exclusive creation already refuses an existing name, so this
+      // is the check that keeps the guarantee from resting on a reading of O_EXCL.
+      expect(() => stageElevatedSchedulerRegistration("<Task />", undefined, {
+        createStageDir: () => {
+          mkdirSync(stageDir, { mode: 0o700 });
+          return stageDir;
+        },
+        hardenDir: () => {},
+        writePayload: (path, bytes) => { writeFileSync(path, bytes, { flag: "wx" }); },
+        hardenPath: () => { throw new Error("must not harden a redirected payload"); },
+        inspect: path => ({
+          isSymbolicLink: () => path !== stageDir,
+          isFile: () => true,
+          isDirectory: () => path === stageDir,
+        }),
+      })).toThrow("redirected path");
+      expect(existsSync(stageDir)).toBe(false);
+    } finally {
+      removeTreeWithRetry(parent);
+    }
+  });
+
+  test("cleans up when a payload write fails partway", () => {
+    const parent = mkdtempSync(join(tmpdir(), "ocx-elevated-stage-partial-"));
+    const stageDir = join(parent, "private-stage");
+    try {
+      // The predecessor is the second payload, so this leaves a real file behind unless
+      // cleanup walks everything it created rather than only the one that failed.
+      expect(() => stageElevatedSchedulerRegistration("<Task />", "<Task />", {
+        createStageDir: () => {
+          mkdirSync(stageDir, { mode: 0o700 });
+          return stageDir;
+        },
+        hardenDir: () => {},
+        writePayload: (path, bytes) => {
+          if (path.endsWith("expected.xml")) throw new Error("synthetic predecessor write failure");
+          writeFileSync(path, bytes, { flag: "wx" });
+        },
+        hardenPath: () => {},
+      })).toThrow("synthetic predecessor write failure");
+      expect(existsSync(stageDir)).toBe(false);
+    } finally {
+      removeTreeWithRetry(parent);
+    }
+  });
+
+  test("an unreadable staged payload is reported with its cause and its remedy", () => {
+    // The elevated process runs hidden, so nothing it writes survives and the exit code is
+    // the entire user-facing error. Staging adds exactly one new failure -- the payload is
+    // readable only by the account that created it, so an elevation answered with another
+    // administrator's credentials cannot open it -- and reporting that as a bare number
+    // would reproduce what made #4692 expensive to diagnose in the first place.
+    const message = describeElevatedRegistrationFailure(
+      "Background service install failed",
+      OCX_ELEVATED_STAGING_UNREADABLE,
+      "C:\\Temp\\opencodex-service-stage-aaaaaa",
+    );
+    expect(message).toContain("could not read the staged task definition");
+    expect(message).toContain("C:\\Temp\\opencodex-service-stage-aaaaaa");
+    expect(message).toContain("different administrator account");
+    expect(message).toContain("Approve the prompt as the signed-in user");
+    expect(message).not.toMatch(/exit code \d+/);
+
+    // Every other code keeps the plain form; this is a named cause, not a catch-all.
+    for (const code of [1, 10, 13, 1223]) {
+      expect(describeElevatedRegistrationFailure("Task Scheduler rollback failed", code, "C:\\Temp\\x"))
+        .toBe("Task Scheduler rollback failed with exit code " + code + ".");
+    }
+  });
+});
 
 /** Linux CI fakes win32 without a real System32; keep elevation paths production-shaped. */
 const FAKE_TRUSTED_ELEVATION_EXES = {
@@ -153,7 +300,7 @@ describe("runWindowsElevated spawn contract", () => {
 
     await expect(runWindowsElevatedScheduledTaskRegistration(
       "opencodex-proxy",
-      "<Task />",
+      { path: "C:\\Temp\\opencodex-service-stage-aaaaaa\\register.xml", sha256: "0".repeat(64) },
     )).resolves.toBe(0);
 
     const startProcessIndex = commandScript.indexOf("Start-Process");
@@ -174,7 +321,7 @@ describe("runWindowsElevated spawn contract", () => {
     expect(commandScript).not.toMatch(/-ArgumentList\s+'[^']*';\s+-Verb RunAs/);
   });
 
-  test("scheduled-task registration embeds immutable XML bytes instead of a file path", async () => {
+  test("scheduled-task registration passes staged paths and digests, never inline payloads", async () => {
     let commandScript = "";
     setWindowsElevationSpawnForTests(((
       _cmd: string,
@@ -196,7 +343,9 @@ describe("runWindowsElevated spawn contract", () => {
     }) as never);
 
     const xml = "<Task><Description>fixed-definition</Description></Task>";
-    await expect(runWindowsElevatedScheduledTaskRegistration("opencodex-proxy", xml)).resolves.toBe(0);
+    const stageDir = "C:\\Temp\\opencodex-service-stage-aaaaaa";
+    const staged = { path: stageDir + "\\register.xml", sha256: "a".repeat(64) };
+    await expect(runWindowsElevatedScheduledTaskRegistration("opencodex-proxy", staged)).resolves.toBe(0);
     const match = /-EncodedCommand ([A-Za-z0-9+/=]+)/.exec(commandScript);
     expect(match).not.toBeNull();
     const elevatedScript = Buffer.from(match![1]!, "base64").toString("utf16le");
@@ -211,21 +360,76 @@ describe("runWindowsElevated spawn contract", () => {
     expect(elevatedScript).toContain("& $registerTask -TaskName $taskName -Xml $xml -ErrorAction Stop");
     expect(elevatedScript).not.toContain("-Xml $xml -Force");
     expect(elevatedScript.match(/\bRegister-ScheduledTask\b/g)).toHaveLength(2);
-    expect(elevatedScript).toContain(Buffer.from(xml, "utf16le").toString("base64"));
+
+    // #4692: the definition now travels as a path plus a digest. A pathname on its own
+    // would be a promise about content, so the elevated side has to check it: read the
+    // bytes once, hash exactly those bytes, and refuse BEFORE decoding them. Hashing and
+    // then rereading would leave the swap window this check exists to close.
+    expect(elevatedScript).toContain(staged.path);
+    expect(elevatedScript).toContain(staged.sha256);
+    expect(elevatedScript).toContain("[IO.File]::ReadAllBytes($path)");
+    expect(elevatedScript).toContain("$sha.ComputeHash($bytes)");
+    expect(elevatedScript).toContain("Task Scheduler staged payload failed its integrity check.");
+    // #4692 follow-up: the one failure this staging design introduces has to be readable.
+    // A hidden elevated process has nowhere to print, so an unreadable payload rides its
+    // own exit code instead of collapsing into a generic non-zero status.
+    expect(elevatedScript).toContain("catch [System.UnauthorizedAccessException] { exit " + OCX_ELEVATED_STAGING_UNREADABLE + " }");
+    expect(elevatedScript).toContain("catch [System.Security.SecurityException] { exit " + OCX_ELEVATED_STAGING_UNREADABLE + " }");
+    // It is not part of the create-and-run transaction's alphabet, and cannot be mistaken
+    // for UAC denial.
+    expect(OCX_ELEVATED_PROTOCOL_CODES).not.toContain(OCX_ELEVATED_STAGING_UNREADABLE);
+    expect(OCX_ELEVATED_STAGING_UNREADABLE).not.toBe(OCX_ELEVATED_UAC_CANCELLED);
+    expect(elevatedScript.indexOf("-cne $expectedHash"))
+      .toBeLessThan(elevatedScript.indexOf("[Text.Encoding]::Unicode.GetString($bytes)"));
+    // No payload rides the command line any more, in either encoding layer.
+    expect(elevatedScript).not.toContain(Buffer.from(xml, "utf16le").toString("base64"));
+    expect(elevatedScript).not.toContain("FromBase64String");
     expect(commandScript).not.toContain("/xml");
-    expect(commandScript).not.toContain("task.xml");
+
+    // The regression itself. The old form embedded base64(utf16le) of the XML inside a
+    // script that was base64(utf16le)-encoded again — about 14.2 command-line characters
+    // per XML character, twice over for a replacement — so a ~2 KB definition pushed the
+    // spawn past the Windows command-line limit and failed with ENAMETOOLONG. What is
+    // pinned here is independence, not one lucky measurement: the same staging shape must
+    // produce the same command length no matter how large the definition behind it is.
+    const smallLength = commandScript.length;
+    const largeStaged = { path: stageDir + "\\register.xml", sha256: "b".repeat(64) };
+    await expect(runWindowsElevatedScheduledTaskRegistration("opencodex-proxy", largeStaged)).resolves.toBe(0);
+    expect(commandScript.length).toBe(smallLength);
+    expect(commandScript.length).toBeLessThan(8192);
 
     const predecessor = "<Task><Description>captured-predecessor</Description></Task>";
+    const stagedPredecessor = { path: stageDir + "\\expected.xml", sha256: "c".repeat(64) };
     await expect(
-      runWindowsElevatedScheduledTaskRegistration("opencodex-proxy", xml, true, predecessor),
+      runWindowsElevatedScheduledTaskRegistration("opencodex-proxy", staged, true, stagedPredecessor),
     ).resolves.toBe(0);
     const replaceMatch = /-EncodedCommand ([A-Za-z0-9+/=]+)/.exec(commandScript);
     expect(replaceMatch).not.toBeNull();
     const replaceScript = Buffer.from(replaceMatch![1]!, "base64").toString("utf16le");
     expect(replaceScript).toContain("& $registerTask -TaskName $taskName -Xml $xml -Force");
-    expect(replaceScript).toContain(Buffer.from(predecessor, "utf16le").toString("base64"));
+    expect(replaceScript).toContain(stagedPredecessor.path);
+    expect(replaceScript).toContain(stagedPredecessor.sha256);
+    expect(replaceScript).not.toContain(Buffer.from(predecessor, "utf16le").toString("base64"));
+    // The predecessor is verified the same way before it is used as a precondition: two
+    // call sites, both digest-checked. The helper is declared as
+    // "Read-OcxStagedTaskXml([string]$path", so the trailing space matches calls only.
+    expect(replaceScript.match(/Read-OcxStagedTaskXml /g)).toHaveLength(2);
+    expect(elevatedScript.match(/Read-OcxStagedTaskXml /g)).toHaveLength(1);
     expect(replaceScript).toContain("$currentXml = & $schtasks /query /tn $taskName /xml");
     expect(replaceScript).toContain("Task Scheduler replacement precondition changed.");
+    // A replacement used to carry TWO payloads, which is what made this the reported
+    // failure. It stays bounded now.
+    expect(commandScript.length).toBeLessThan(8192);
+  });
+
+  test("an elevated replacement still refuses without a captured predecessor", () => {
+    // The post-UAC compare-before-Force is the only thing standing between a repair and
+    // overwriting a registration somebody else changed while the prompt was open.
+    expect(() => runWindowsElevatedScheduledTaskRegistration(
+      "opencodex-proxy",
+      { path: "C:\\Temp\\opencodex-service-stage-aaaaaa\\register.xml", sha256: "a".repeat(64) },
+      true,
+    )).toThrow("requires a captured existing definition");
   });
 
   test("maps exit 1223 to cancelled", async () => {
diff --git a/tests/windows/windows-scheduler-install-verification.test.ts b/tests/windows/windows-scheduler-install-verification.test.ts
index cc27196211..8b8e5440de 100644
--- a/tests/windows/windows-scheduler-install-verification.test.ts
+++ b/tests/windows/windows-scheduler-install-verification.test.ts
@@ -49,6 +49,80 @@ describe("decodeSchtasksOutput", () => {
     const text = "Folder: \\\nTaskName: opencodex-proxy";
     expect(decodeSchtasksOutput(Buffer.from(text, "utf8"))).toBe(text);
   });
+
+  /**
+   * #4691: redirected "schtasks /query /xml" follows the console output code page of the
+   * spawning process tree, not the XML declaration. On a zh-CN host (ACP/OEMCP 936) those
+   * bytes are GBK, and the old UTF-8 fallback turned a CJK account name into U+FFFD. The
+   * trigger scope then stopped matching the correctly resolved [SID, MACHINE\<name>], so
+   * "ocx service repair" refused a registration OpenCodex had created itself, and fresh
+   * installs rolled back at post-create verification.
+   */
+  test("decodes GBK schtasks XML so a CJK account name still matches its trigger scope", () => {
+    const wscript = "C:\\WINDOWS\\System32\\wscript.exe";
+    const launcher = "C:\\Users\\x\\.opencodex\\opencodex-service-launcher.vbs";
+    // Task Scheduler canonicalizes a SID-scoped trigger back to the account name on
+    // export, which is why the identity reaching the decoder is non-ASCII at all.
+    const account = "MACHINE\\张三";
+    const xml = buildWindowsTaskXml(
+      "C:\\Users\\x\\.opencodex\\opencodex-service.cmd",
+      launcher,
+      undefined,
+      account,
+    ).replace(/<Command>.*?<\/Command>/, "<Command>" + wscript + "</Command>");
+
+    // Literal CP936 bytes, for the same reason tests/windows/windows-text-decoding.test.ts
+    // uses literal hex: encoding the fixture with the decoder under test would assert
+    // nothing. 0xD5C5 0xC8FD is the account name on code page 936, and it is not valid
+    // UTF-8 — which is why the old fallback was lossy rather than merely wrong.
+    const cp936 = new Map([["张", [0xd5, 0xc5]], ["三", [0xc8, 0xfd]]]);
+    const bytes = Buffer.concat([...xml].map(ch => {
+      const legacy = cp936.get(ch);
+      if (legacy) return Buffer.from(legacy);
+      if (ch.codePointAt(0)! > 0x7f) throw new Error("fixture has no CP936 bytes for " + ch);
+      return Buffer.from(ch, "ascii");
+    }));
+
+    const decoded = decodeSchtasksOutput(bytes, { locale: "zh-CN" });
+    expect(decoded).toContain("<UserId>" + account + "</UserId>");
+    expect(decoded).not.toContain("\uFFFD");
+    expect(windowsTaskRegistrationHealthy(decoded, wscript, launcher, [TEST_WINDOWS_TASK_SID, account])).toBe(true);
+
+    // The regression itself: the historical decode mangles the name, and the scope check
+    // then fails — the "not a recognized legacy OpenCodex definition" refusal.
+    const mojibake = bytes.toString("utf8");
+    expect(mojibake).toContain("\uFFFD");
+    expect(windowsTaskRegistrationHealthy(mojibake, wscript, launcher, [TEST_WINDOWS_TASK_SID, account])).toBe(false);
+
+    // Decoding correctly does not relax ownership. A different account is still rejected,
+    // and the mojibake spelling is not accepted as an identity of its own — forgiving it
+    // would let two different non-ASCII accounts collapse to the same value.
+    expect(windowsTaskRegistrationHealthy(decoded, wscript, launcher, [TEST_WINDOWS_TASK_SID, "MACHINE\\someone-else"])).toBe(false);
+    expect(windowsTaskRegistrationHealthy(decoded, wscript, launcher, ["MACHINE\\\uFFFD\uFFFD"])).toBe(false);
+  });
+
+  test("a UTF-8 task document is not mistaken for the legacy code page", () => {
+    // The strict UTF-8 attempt runs before any code-page guess, so a CP 65001 console on
+    // the same zh-CN host still decodes correctly. #4106 was closed as not-planned because
+    // that reporter's console was 65001; this pins that the fix leaves that case alone.
+    const utf8Xml = "<Task><UserId>MACHINE\\张三</UserId></Task>";
+    expect(decodeSchtasksOutput(Buffer.from(utf8Xml, "utf8"), { locale: "zh-CN" })).toBe(utf8Xml);
+  });
+
+  test("delegating the decode leaves the UTF-16 paths intact", () => {
+    const text = "Folder: \\\nTaskName: opencodex-proxy";
+    // UTF-16LE with and without a BOM, and UTF-16BE, all still round-trip: that is what
+    // "schtasks /query /xml" emits on an ordinary host and the reason this decoder exists.
+    expect(decodeSchtasksOutput(Buffer.from("\uFEFF" + text, "utf16le"))).toBe(text);
+    expect(decodeSchtasksOutput(Buffer.from(text, "utf16le"))).toBe(text);
+    const be = Buffer.from("\uFEFF" + text, "utf16le");
+    for (let i = 0; i + 1 < be.length; i += 2) {
+      const low = be[i]!;
+      be[i] = be[i + 1]!;
+      be[i + 1] = low;
+    }
+    expect(decodeSchtasksOutput(be)).toBe(text);
+  });
 });
 
 describe("windowsSchedulerCsvIncludesTask", () => {