Task Scheduler is machine-wide, so a test or a sandboxed run with a fake home used to be able to book real relay wakes (8 were registered by an adversarial run on 2026-09-25, two for a live session). Every registration and cancellation now goes through one switch: a dry run under node --test, with USAGE_LIMITS_SCHEDULER=dry-run, or when the home folder is redirected; USAGE_LIMITS_SCHEDULER=real overrides. A dry run registers nothing and says why. A guard test re-creates the incident outside the test runner and checks that Windows lists no task. 944/944.