R6.11: review verdicts, rounds 1 and 2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/reviews/R6.11-r1.md

@@ -0,0 +1,5 @@
+FAIL
+
+packaging/windows/installer.nsi:68 — [P1] Reinstalling deletes files Ely never installed. Reproduced with a selected directory containing `keep.exe`, `keep.dll`, `keep.json` and `git/keep.txt`: the first silent install preserves them, but the second deletes all four because the first install added `ely-mark.exe`, enabling the wildcard and recursive cleanup. The parent commit preserves them on both installs. An application executable does not establish ownership of every matching file or directory. Restrict cleanup to installation-owned paths and preserve pre-existing files across reinstalls; cover this two-install scenario in a regression test.
+
+packaging/windows/installer.nsi:68 — [P1] Cleanup errors are ignored and installation continues after partially deleting the old version. Reproduced by holding `git/cmd/git.exe` open without delete sharing: the installer returns 0, registers the new version and leaves the obsolete Git file behind. Holding `ely-mark.exe` similarly leaves the old executable while deleting its old `libcef.dll` and installing the new worker. This can leave an unusable mixed installation, contrary to PRD §4.2's requirement that the original version remain usable after an unsuccessful update. Detect occupied files before destructive cleanup, handle deletion/extraction failures explicitly, and preserve or restore the original installation on failure. Add occupied-file upgrade tests. Probe evidence: `.work/R6.11-r1-review/probes.log` and `verification.log`.

tasks/reviews/R6.11-r2.md

@@ -0,0 +1,7 @@
+FAIL
+
+packaging/windows/files.sh:7 — [P1] The ownership list claims entire directories, so reinstall and uninstall still delete files Ely never installed. Reproduced with `licenses/my-notes.md` present before installation and a stage containing only `licenses/LICENSE`: the first install preserves the document, the second deletes it, both returning 0. Uninstall likewise deletes an unrelated document added inside `licenses`. Record installed relative file paths and remove directories only when empty; add regression coverage for unrelated children inside staged directories.
+
+packaging/windows/installer.nsi:136 — [P1] The write check skips directory contents, and renaming a directory does not reliably detect a running executable inside it. Reproduced with Windows `PING.EXE` installed as `git/cmd/git.exe`: while it runs, an upgrade removing Git returns 0, installs the new worker, deletes other old Git files, and leaves the running executable in `.ely-old/git/cmd/git.exe`. This violates R6.11's requirement that occupied files leave the installation unchanged. Check every owned file recursively, including legacy directory contents, before moving anything; test a running nested executable as well as the existing non-delete-sharing handle case.
+
+packaging/windows/files.sh:27 — [P1] Rollback tracks only previously absent names, although extraction also overwrites existing files absent from the old ownership list. Reproduced by installing v1 without `extra.txt` or `zz-block.txt`, then creating a user `extra.txt` and a directory `zz-block.txt/keep.txt`. In v2 both names are payload files: extraction overwrites `extra.txt`, then fails on `zz-block.txt`. The installer exits 2 and restores the old worker, but the user's `extra.txt` remains overwritten; the before/after SHA256 snapshots differ. Reject unowned collisions before extraction or back up and restore every existing path extraction can overwrite. Extend the blocked-write test to cover an earlier successful overwrite. Evidence for all three defects: `.work/R6.11-r2-review/probes.log` and `verification.log`.