# Single bounded elevated window: only the authorized service-phase helper can be resumed.
$ErrorActionPreference='Stop'
$taskRoot='C:\laragon\www\portal-investidor';$private=Join-Path $taskRoot 'storage\app\private\investmoz-v2\portal-audit';$revision='41caea0f900fe0705e84e065a65f9534ff3a585ee34098f860666f522875a3a5'
$deadline=[DateTime]::UtcNow.AddMinutes(45);$last='';$utf8=[Text.UTF8Encoding]::new($false)
while([DateTime]::UtcNow -lt $deadline){Start-Sleep -Milliseconds 750;$file=Join-Path $private 'workflow-activation-administrator-command.json';if(-not(Test-Path -LiteralPath $file)){continue};$c=Get-Content -LiteralPath $file -Raw -Encoding UTF8|ConvertFrom-Json;if($c.id -eq $last){continue};$last=$c.id;if($c.revision -ne $revision){break};if($c.action -eq 'close'){break};if($c.action -ne 'resume-services'){break}
 $script=Join-Path $taskRoot 'tools\portal-workflow-activation-services-resume.ps1';if((Get-FileHash -LiteralPath $script -Algorithm SHA256).Hash.ToLowerInvariant() -ne $c.script_sha256){break}
 $p=Start-Process -FilePath "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File "C:\laragon\www\portal-investidor\tools\portal-workflow-activation-services-resume.ps1"' -PassThru;$p.WaitForExit()
 [IO.File]::WriteAllText((Join-Path $private 'workflow-activation-administrator-status.json'),(@{at=[DateTime]::UtcNow.ToString('o');command=$c.id;action=$c.action;exit=$p.ExitCode;child_pid=$p.Id;revision=$revision;arbitrary_commands_allowed=$false}|ConvertTo-Json -Compress),$utf8)
}