ElyOffice/tasks/reviews/R6.11-r1.md

FAIL

packaging/windows/installer.nsi:68 — [P1] Reinstalling deletes files Ely never installed. Reproduced with a selected directory containing keep.exe, keep.dll, keep.json and git/keep.txt: the first silent install preserves them, but the second deletes all four because the first install added ely-mark.exe, enabling the wildcard and recursive cleanup. The parent commit preserves them on both installs. An application executable does not establish ownership of every matching file or directory. Restrict cleanup to installation-owned paths and preserve pre-existing files across reinstalls; cover this two-install scenario in a regression test.

packaging/windows/installer.nsi:68 — [P1] Cleanup errors are ignored and installation continues after partially deleting the old version. Reproduced by holding git/cmd/git.exe open without delete sharing: the installer returns 0, registers the new version and leaves the obsolete Git file behind. Holding ely-mark.exe similarly leaves the old executable while deleting its old libcef.dll and installing the new worker. This can leave an unusable mixed installation, contrary to PRD §4.2's requirement that the original version remain usable after an unsuccessful update. Detect occupied files before destructive cleanup, handle deletion/extraction failures explicitly, and preserve or restore the original installation on failure. Add occupied-file upgrade tests. Probe evidence: .work/R6.11-r1-review/probes.log and verification.log.