ElyOffice/tasks/reviews/R6.11-r2.md

FAIL

packaging/windows/files.sh:7 — [P1] The ownership list claims entire directories, so reinstall and uninstall still delete files Ely never installed. Reproduced with licenses/my-notes.md present before installation and a stage containing only licenses/LICENSE: the first install preserves the document, the second deletes it, both returning 0. Uninstall likewise deletes an unrelated document added inside licenses. Record installed relative file paths and remove directories only when empty; add regression coverage for unrelated children inside staged directories.

packaging/windows/installer.nsi:136 — [P1] The write check skips directory contents, and renaming a directory does not reliably detect a running executable inside it. Reproduced with Windows PING.EXE installed as git/cmd/git.exe: while it runs, an upgrade removing Git returns 0, installs the new worker, deletes other old Git files, and leaves the running executable in .ely-old/git/cmd/git.exe. This violates R6.11's requirement that occupied files leave the installation unchanged. Check every owned file recursively, including legacy directory contents, before moving anything; test a running nested executable as well as the existing non-delete-sharing handle case.

packaging/windows/files.sh:27 — [P1] Rollback tracks only previously absent names, although extraction also overwrites existing files absent from the old ownership list. Reproduced by installing v1 without extra.txt or zz-block.txt, then creating a user extra.txt and a directory zz-block.txt/keep.txt. In v2 both names are payload files: extraction overwrites extra.txt, then fails on zz-block.txt. The installer exits 2 and restores the old worker, but the user's extra.txt remains overwritten; the before/after SHA256 snapshots differ. Reject unowned collisions before extraction or back up and restore every existing path extraction can overwrite. Extend the blocked-write test to cover an earlier successful overwrite. Evidence for all three defects: .work/R6.11-r2-review/probes.log and verification.log.