R6.11 round 3 fix: numbered backups, checked install list

Backups under .ely-old are numbered in list order, so paths near the
Windows limit still upgrade and uninstall. Uninstall checks the list
file first and puts everything back if it cannot delete it. Five
comments shortened. Round 3 was the last; ticked without review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/TASKS.md

@@ -268,5 +268,5 @@
 - [x] R6.7 ElyMark 可视与预览保留单个换行（用户报：代码块后的“你好↵测试”离开输入框后变成“你好 测试”）：照 Typora 默认（编辑时保留单个换行，导出与打印照 GFM 读作空格）；组件库的读法分屏上与输出两种
 - [x] R6.8 源码模式插入点落在字中（用户报：“测”后的插入点画在“测”中间）：代码编辑器按“列 × m 的宽”定位，中日韩字宽约两格；插入点、选区、按下、输入法框改按排版后的实际位置（组件库 `CodeEditor`）
 - [x] R6.9 ElyMark 三、四级标题不显眼（用户报）：各级字号随正文按 Typora 的倍数（2.25、1.75、1.5、1.25、1、1），一律加粗，六级为次要色（组件库渲染）
-- [ ] R6.11 Windows 升级后旧文件仍在（R6.10 本机重装查出）：安装程序只覆盖不删除，旧版 ElyMark 的 `git` 与 CEF 文件留在安装目录；安装程序记下所装的文件，升级与卸载只移去这些；文件被占用即什么也不改，失败时放回旧版
+- [x] R6.11 Windows 升级后旧文件仍在（R6.10 本机重装查出）：安装程序只覆盖不删除，旧版 ElyMark 的 `git` 与 CEF 文件留在安装目录；安装程序记下所装的文件，升级与卸载只移去这些；文件被占用即什么也不改，失败时放回旧版。第 3 轮后（最后一轮，修完不再审查）：备份按清单次序编号，近 260 字的路径照样升级与卸载；卸载先查清单本身，删不掉即放回全部
 - [ ] R6.10 重发 0.1.5（用户定：仍为 0.1.5）：删去 v0.1.5 的全部文件，标签移到修复的提交，三端全部包重建并上传，本机重装

tasks/reviews/R6.11-r3.md

@@ -0,0 +1,7 @@
+FAIL
+
+packaging/windows/installer.nsi:226 — [P2] Moving each payload file beneath `.ely-old` makes successfully installed paths too long to upgrade or uninstall. Reproduced with a valid 254-character installed file path: the first installation returns 0, but reinstall and uninstall both return 2 because the backup path is 263 characters and `Rename` fails. The original files remain intact, but this installation cannot be maintained through its installer. Use long-path-capable backup/restore operations and cover first install, reinstall and uninstall near the Windows path limit. Evidence: `.work/R6.11-r3-review/probes.log`.
+
+packaging/windows/installer.nsi:377 — [P2] The ownership manifest is omitted from the occupied-file preflight, and its deletion error is ignored. Holding `.ely-installed` open with read sharing only, then running the uninstaller, returns 0 and removes every payload file while leaving the locked manifest behind. This contradicts R6.11's requirement that an occupied file leave the installation unchanged. Check the manifest before moving payload files and handle its deletion failure transactionally; add a locked-manifest uninstall regression. Evidence: `.work/R6.11-r3-review/probes.log`.
+
+packaging/windows/files.sh:2 — [P3] Five new comments exceed the explicit ten-word limit: this header, `packaging/windows/installer.nsi:143`, `packaging/windows/installer.nsi:262`, `tests/scripts/windows-installer.sh:25`, and `tests/scripts/windows-installer.sh:134`. Running `tests/scripts/comments.py` against an unchanged copy of these files exits 1 and reports all five. Shorten these comments to at most ten words while keeping each on one line. Evidence: `.work/R6.11-r3-review/comments.log`.