fix(scripts): make the alias check fail closed, and correct three stale docs (#208)

The alias check was a negative match on an allowlist of English error strings, which returned True for empty output, for $null, and for "exit status 1: Access is denied." — so an alias switch producing nothing, or failing on the symlink permission error this file's own header warns about, was reported as success while the old version kept running. That is the bug #198 was filed about, narrowed rather than removed, and it also broke whenever nvm reworded an error. It is now a positive match on "Now using node v<what is actually running>".

The floor check moves ahead of the switch and reads the constant rather than the result. Where it sat, $major was always whatever NODE_VERSION says, so it validated the switch it had just made instead of the pin it exists to guard, and could never fire.

Use-NodeLatest is now Use-PinnedNode. In a change whose whole subject is that "latest" means something people do not expect, the name was an avoidable trap.

The restore default moves beside NODE_VERSION. It deliberately is not a param default: a param block runs before the dot-source, so $script:DEFAULT_NODE_VERSION is still $null there and the restore would have quietly restored nothing — leaving the machine on the pinned version, which is the exact failure the restore exists to prevent. It is resolved after the dot-source instead, and an explicit -DefaultNodeVersion still wins.

Three documents described behaviour the code no longer has: README's "both scripts run nvm use latest", run-tests.ps1's .DESCRIPTION, and project-context.md's instruction to agents. All corrected, and project-context.md now also says not to run these scripts from an agent shell, which is how this machine once ended up with no Node at all.

Part 4 of the issue is partly stale: backend/package.json already declares engines >=20.9.0. frontend now matches it. The larger question — whether local should be pinned to the Node 20 that CI and the production image actually run — is a decision rather than an oversight and is left open on the issue.

Verified by parsing all three scripts with the PowerShell AST parser, which does not execute them. They are deliberately never run from an agent shell.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/start-local.ps1

@@ -39,7 +39,12 @@ param(
     # What -Stop puts the machine back to. nvm's default here is 18.16.1, which
     # is too old to run this project's tooling but is what everything else on
     # the machine expects.
-    [string]$DefaultNodeVersion = '18.16.1'
+    # Resolved after NodeVersion.ps1 is dot-sourced below, not here. A param
+    # block runs before anything else in the script, so $script:DEFAULT_NODE_VERSION
+    # is still $null at this point and using it as the default would silently
+    # restore nothing — leaving the machine on the pinned version, which is the
+    # exact failure the restore exists to prevent. See #208.
+    [string]$DefaultNodeVersion = ''
 )
 
 $ErrorActionPreference = 'Stop'
@@ -78,6 +83,11 @@ function Assert-Docker {
 
 . (Join-Path $PSScriptRoot 'NodeVersion.ps1')
 
+# The one home for this value is NodeVersion.ps1, beside NODE_VERSION. It cannot
+# be a param default (see the note there), so it is filled in here instead, and
+# an explicit -DefaultNodeVersion still wins.
+if (-not $DefaultNodeVersion) { $DefaultNodeVersion = $script:DEFAULT_NODE_VERSION }
+
 # Bound once so the shared switcher reports through this script's own output
 # style rather than printing in a voice of its own.
 $NodeOut = @{ Step = ${function:Write-Step}; Note = ${function:Write-Note} }
@@ -270,7 +280,7 @@ if ($Stop) {
     return
 }
 
-Use-NodeLatest @NodeOut
+Use-PinnedNode @NodeOut
 
 # Anything after the switch reverts on the way out of a failure. Without this a
 # run that dies in migrations leaves the machine on the new version with nothing