[Kuddev]

Result / 用户结果

Adds Windows installer updates from administrator windows, including next-launch scheduling and recovery at the original privilege level. Previously these actions rejected elevated windows; removing that guard alone could neither save their workspace nor safely execute a plan stored in ordinary writable settings.

Refs #672 and #349. This also fixes the process-exit race that could pass an empty module path to GetFullPath. Packaged Inno installation and full application recovery remain acceptance work, so this PR stays draft.

Design / 设计边界

• The Windows adapter owns administrator/SYSTEM-only storage in the ProgramData known folder, token/executable/configuration scope, directory pinning, integrity labels and the trusted PowerShell path. Downloads, metadata, helper scripts and snapshots use that same storage boundary.
• The existing prepare/commit/result protocol still authorizes installation only after a durable workspace snapshot. Ordinary session persistence remains separate; administrator scheduling saves and updates only its private snapshot.
• Restore tickets include the actual elevation identity and may pass through the existing authenticated administrator launch handover. Recovery tracks its own window IDs and retries only missing slots.
• Existing schema-1 plans without the elevation field remain ordinary. No dependency version or distribution ownership change is introduced. The storage and recovery decisions are recorded under architecture/notes/nebula_app/.

Evidence / 验证依据

• Integrated with main at 8d629559. The actual newly built test executable passed 36 targeted Windows tests across updater, private storage, session persistence, administrator handover and GPUI recovery. Its path and SHA were checked against Cargo's artifact output.
• Actual elevated-token checks passed protected-directory creation/readback/inheritance and the combined restore/scheduled-snapshot regression. The latter verifies that later administrator checkpoints preserve the ordinary workspace and that a missing private snapshot cannot fall back to it.
• The existing PowerShell helper harness passed 18 scenarios with ordinary tokens and 18 with elevated tokens: cancellation, checksum/process identity rejection, privilege mismatch, failed installation, repair, recovery and locked helpers.
• CI-native contract tests: 18 passed. Architecture against the actual main base, formatting and git diff --check passed. The new settings-writing UI fixture joins the existing serialized group alongside the provider fixture.
• The original empty-path error was reproduced with an exited native fixture. A real elevated fixture also exposed Win32 1314 when a full SACL was supplied during creation; the implementation now uses restricted DACL creation followed by the documented label-only API.
• All five native platforms and required reports passed for 7800d4ec (run). Windows ARM passed the failed-job rerun after an intermittent existing Git Bash wrapped-backspace failure; no unrelated production change was made.
• Not yet run: packaged Inno update/restart with a real user workspace. No new UI layout or hot-path rendering change is part of this PR.

Required Review / 必须确认

• Followed the contribution, architecture and project constraints.
• Split platform storage and UI recovery by responsibility; retained one update-state path authority.
• Architecture checks pass without increasing budgets.
• Success/failure regressions and platform acceptance limits are stated.
• Existing typed update messages carry diagnostic details; no new catalog entries are required.
• No new governance gate or exception was added; the existing test-serialization contract was extended for one fixture.

These checks do not replace CI or maintainer review.