fix(installer): make install update and uninstall recoverable

.github/workflows/desktop-package.yml

@@ -895,6 +895,7 @@ jobs:
             --assets-dir release-assets \
             --version "${{ needs.prepare.outputs.version }}" \
             --out-dir release-updater-assets \
+            --windows-installer-dir release-manual-assets \
             --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
 
       - name: Generate Linux binaries manifest

.github/workflows/publish-ready-desktop.yml

@@ -107,6 +107,7 @@ jobs:
           node scripts/write-minisign-public-key.mjs --out release-assets/minisign.pub
           node scripts/collect-tauri-updater-assets.mjs --assets-dir release-assets \
             --version "$RELEASE_VERSION" --out-dir release-updater-assets \
+            --windows-installer-dir release-manual-assets \
             --required-platforms windows-x86_64,linux-x86_64,linux-aarch64,linux-x86_64-deb,linux-aarch64-deb,linux-x86_64-rpm,linux-aarch64-rpm
           node scripts/generate-linux-binaries-manifest.mjs --assets-dir linux-release-assets \
             --version "$RELEASE_VERSION" --tag "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \

OpenBitFun-Installer/AGENTS.md

@@ -74,6 +74,12 @@ For ZIP dependency or extraction changes, verify compatibility with old installe
 cargo test --manifest-path OpenBitFun-Installer/src-tauri/Cargo.toml --lib installer::extract::tests
 ```
 
+For transaction recovery, lock contention, locked Windows files and downgrade
+admission, run `cargo test --manifest-path OpenBitFun-Installer/src-tauri/Cargo.toml --lib`.
+The filesystem fixtures use temporary roots; they do not exercise real UAC or
+an existing user installation. Frontend race and retry checks are included in
+`pnpm --dir OpenBitFun-Installer run test`.
+
 Run the full installer build only for packaging, payload, native bundling,
 install/uninstall flow, registry, shortcut, or extraction changes:
 

OpenBitFun-Installer/README.md

@@ -234,6 +234,48 @@ src-tauri/target/release-fast/openbitfun-installer.exe
 
 ## Customization guide
 
+### Installation, updates and recovery
+
+The default is a current-user installation. Select “Install for all users” for
+a new machine-wide installation; Windows then asks for administrator approval.
+An existing installation keeps its directory and scope. Updates to protected
+directories request elevation automatically. Canceling authorization leaves the
+existing application in place. Model and theme preferences remain with the
+original user, including when a different administrator approves maintenance.
+
+Installations record their managed files in `.openbitfun-installed.json`.
+Updates and uninstallations preserve other files and user data. A running or
+locked file produces an error and restores earlier changes. Close OpenBitFun
+before retrying. Known downgrades are refused using stored and executable version
+information; reinstalling the same version is allowed.
+
+If maintenance is interrupted, rerun the installer against the same directory.
+Its `.openbitfun-maintenance` journal restores incomplete changes before a new
+operation. An unreadable journal or failed recovery is retained with an error;
+keep that directory for repair. A cleanup warning means installation completed,
+but maintenance files remain. Retry maintenance before deleting recovery data.
+
+Windows in-app updates use the same signed standalone installer. The application
+exits after the maintenance worker is ready. Installation failures after exit
+are reported by a native dialog and retained for the next application launch.
+The restarted application runs under the original user's account.
+
+Uninstall can be entered through Windows Settings, the registered uninstall
+command, or `uninstall.exe` in the installation directory. `--quiet` selects
+non-interactive removal. Uninstall progress reflects native operations and the
+window remains open on failure. User configuration, sessions and workspaces are
+preserved. Maintenance runs without WebView2 when invoked in native mode;
+the interactive installer offers the signed Microsoft WebView2 bootstrap when
+the runtime is absent.
+
+Quiet maintenance returns exit code `0` on success, `1` on failure, and `2` when
+removal committed but backup cleanup remains. Windows can rename an executing
+uninstaller but cannot delete its image until it exits. For exit `2`, run the
+downloaded installer from outside the installation directory with
+`--uninstall "C:\path\to\OpenBitFun" --quiet` to finish cleanup. Do not delete an
+uncommitted recovery journal manually. Interactive uninstall also has a native
+fallback when WebView2 is absent and does not require downloading a runtime.
+
 ### Changing the UI Theme
 
 Shared light/dark values come from `@openbitfun/theme-openbitfun`. Installer-only named presets live in

OpenBitFun-Installer/src-tauri/Cargo.toml

@@ -29,8 +29,10 @@ tauri-plugin-dialog = "=2.7.3"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
+semver = "1"
 anyhow = "1.0"
 log = "0.4"
+tempfile = "3"
 dirs = "5.0"
 zip = { version = "9.0.3", default-features = false, features = ["deflate"] }
 openbitfun-core-types = { path = "../../src/crates/contracts/core-types" }
@@ -51,9 +53,6 @@ tauri-macros = { git = "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/tauri-apps/tauri.git", rev = "7cc68e7
 tauri-codegen = { git = "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/tauri-apps/tauri.git", rev = "7cc68e74ff6981f5c50a52a67d56c5eb2d227188" }
 tauri-plugin = { git = "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/tauri-apps/tauri.git", rev = "7cc68e74ff6981f5c50a52a67d56c5eb2d227188" }
 
-[dev-dependencies]
-tempfile = "3"
-
 [lints.rust]
 unsafe_op_in_unsafe_fn = "warn"
 unexpected_cfgs = "warn"