[CmdletBinding()]
param([Parameter(Mandatory=$true)][string]$ExpectedNodeId)
$ErrorActionPreference='Stop'
$ProgressPreference='SilentlyContinue'
if ($env:COMPUTERNAME -cne $ExpectedNodeId) { throw 'Worker identity mismatch' }
$task=Get-ScheduledTask -TaskName 'ndc-mission-core-telemetry-recovery'
$account=[Security.Principal.NTAccount]::new($task.Principal.UserId)
$sid=$account.Translate([Security.Principal.SecurityIdentifier]).Value
if (-not $task.Settings.Enabled -or $sid -ne 'S-1-5-18') { throw 'Recovery task not enabled as SYSTEM' }
$before=Get-CimInstance Win32_Service -Filter "Name='telegraf'"
if ($before.State -ne 'Running') { throw 'A running baseline is required' }
$started=[DateTime]::UtcNow
Stop-Service telegraf
(Get-Service telegraf).WaitForStatus([ServiceProcess.ServiceControllerStatus]::Stopped,[TimeSpan]::FromSeconds(20))
$automatic=$false
try {
    while (([DateTime]::UtcNow-$started).TotalSeconds -lt 80) {
        Start-Sleep -Seconds 2
        $after=Get-CimInstance Win32_Service -Filter "Name='telegraf'"
        if ($after.State -eq 'Running' -and $after.ProcessId -ne $before.ProcessId) { $automatic=$true;break }
    }
    [ordered]@{node=$ExpectedNodeId;test='clean-service-stop';automaticRecovery=$automatic;elapsedSeconds=[Math]::Round(([DateTime]::UtcNow-$started).TotalSeconds,2);previousPid=$before.ProcessId;newPid=$after.ProcessId;state=$after.State}|ConvertTo-Json -Compress
    if (-not $automatic) { throw 'Automatic recovery failed; restoring baseline' }
} finally {
    if ((Get-Service telegraf).Status -ne 'Running') { Start-Service telegraf }
}