fix(agent99): harden Windows99 no-IME transport

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -554,6 +554,34 @@ def test_agent99_bounds_stale_ssh_processes_without_touching_tunnels() -> None:
     }
 
 
+def test_agent99_bounds_legacy_windows_probe_processes_without_command_capture() -> None:
+    source = CONTROL.read_text(encoding="utf-8")
+    config = json.loads((ROOT / "agent99.config.99.example.json").read_text())
+    deploy = DEPLOY.read_text(encoding="utf-8")
+    guard = source[source.index("function Get-AgentWindowsProbeProcessGuardConfig") :]
+    guard = guard[: guard.index("function Get-AgentObjectValue")]
+
+    assert "SELECT ProcessId,ParentProcessId,CreationDate,Name" in guard
+    assert "CommandLine LIKE '%scriptblock%Create%Console%ReadToEnd%'" in guard
+    assert "CommandLine LIKE '%-Mode $probeMode%'" in guard
+    assert 'parentName -ieq "cmd.exe"' in guard
+    assert "Select-Object -First $guard.maxStopsPerRun" in guard
+    assert "Stop-Process -Id $candidate.pid -Force" in guard
+    assert "commandLineCaptured = $false" in guard
+    assert "CommandLine =" not in guard
+    assert 'Record-AgentEvent "windows_probe_process_guard"' in guard
+    assert config["windowsProbeProcessGuard"] == {
+        "enabled": True,
+        "staleMinutes": 10,
+        "maxStopsPerRun": 20,
+    }
+    assert 'Add-DefaultProperty $config "windowsProbeProcessGuard"' in deploy
+    assert 'Add-DefaultProperty $config.windowsProbeProcessGuard "staleMinutes" 10' in deploy
+    assert 'Add-DefaultProperty $config.windowsProbeProcessGuard "maxStopsPerRun" 20' in deploy
+    assert "$windowsProbeProcesses = Get-AgentStaleWindowsProbeProcessReadback" in source
+    assert "windowsProbeProcessStaleCount = $windowsProbeProcesses.staleCount" in source
+
+
 def test_agent99_serializes_ssh_across_scheduled_task_processes() -> None:
     source = CONTROL.read_text(encoding="utf-8")
     config = json.loads((ROOT / "agent99.config.99.example.json").read_text())