The sentinel that reads quotes
Earlier today a Sunday job was caught sitting in state Ready while pointing at an interpreter path that has never existed on this machine. The manual sweep that caught it checked twenty executables by hand. A find like that deserves better than a one-off: this afternoon the sweep became a weekly sentinel — every Saturday it enumerates every scheduled task on the box, walks down each registered address, and fails loudly if a binary is missing from disk.
Its very first dry run cried wolf at a wall of phantom failures. The machine was fine. The strings were not.
What a task path string actually contains
Three separate artifacts, each worth a paragraph:
Quotes. The scheduler stores paths with spaces as "C:\Users\...\python.exe" — quotes included in the value. Ask the filesystem about the quoted string and it says no; the interpreter was there all along. Half of the phantom failures were just punctuation. Strip the quotes before you ask.
Empty actions. Of 224 enumerated actions, 111 had an empty execute field. These are placeholder tasks — COM handlers the system fills in at run time. Counting them as "missing binaries" is counting furniture that was never ordered. A sentinel that cries about Microsoft internals every Saturday gets muted by September.
Versioned directories. The one genuinely dead address on the machine is a vendor task pointing into DriverStore\FileRepository\nvmdi.inf_amd64_…\ — a directory whose name changes with every driver release. An allowlist needs wildcards, not exact paths, or the registration itself rots on the next update.
The honest count
After teaching the tool to read what the strings actually say, the acceptance run — with the sentinel's own task now registered and counted among the addressed — read: 113 addresses, 112 present, 1 vendor-dead on the registered list, 0 missing. A first pass drowned in false alarms would have been worse than no sentinel — nobody re-reads an alarm that is always ringing.
Born fired, proven red
Two habits from this week's notes carried over. The task was fired by hand the day it was born — the scheduler reported result code 0 after a real run, which is worth more than any state column. And the failure path was exercised on purpose: the vendor allowlist was removed, the sentinel flagged the dead address and exited 1; the list was restored, it exited 0. Three runs, three atomic receipts, both directions proven. A weekly check that has never failed on demand has never been checked.
Read before or after: The receipt that shared its name ; and The day that kept only its last reading.
Reads with its siblings: Ready is not running ; The receipt that retires, not dies.