Harden install records and downloads (review 2026-10, D1-D7)

[ApolloF]

Fixes the DLSS Updater findings from the 2026-10-04 correctness/security review (Notes/claude/reviews/syncer-dlssupdater.md, findings D1 to D7). It doesn't overlap #4.

Finding → fix → test

Finding	Fix	Regression test
D1 (medium) Manifest paths not contained, so Uninstall or a Seaglass launch could delete or move files outside the game	InstallManifest.Contain(target, gameRoot) runs before every install, uninstall and restore: • Files and Backups.Original must resolve inside the game root. • Dirs must be strictly inside the install folder, so a recursive delete never leaves it. • Backups.Backup must be inside .dlssupdater\backup. • Rooted paths, :, and .. in entries are rejected; RootRel may only be ./.. parts. • No junction or symlink between the game root and any entry, and none on the .dlssupdater\backup path. • Proxy (from the manifest or the options) must be a known proxy name. • Any violation throws UnsafeManifestException and nothing changes. Ctx.Full also refuses paths outside the root, as defence in depth.	CraftedManifest_UninstallRefuses_AndTouchesNothingOutside (7 cases: dir .., absolute dir, dir outside the install folder, RootRel up, file .., backup original .., backup escaping the backup folder) CraftedManifest_LaunchStyleReinstall_RefusesProxyOutsideTheGame ManifestPathThroughJunction_IsRefused
D2 (medium) Same install folder reached from two game roots loses the originals	Entries are rebased onto the current game root and RootRel is updated. If the root is narrower and can't reach existing entries, the install is refused instead of misplacing them.	SameFolderFromNarrowerRoot_IsRefused_OriginalsStayRestorable SameFolderFromWiderRoot_RebasesRecord_RestoreReturnsOriginals
D3 (medium) An unreadable manifest is treated as "never installed" and backups get overwritten	InstallManifest.Read throws InvalidDataException when the file exists but can't be read; the installer uses it. Load keeps returning null for display code. New backups get a free name and never overwrite a file in the backup folder. AtomicWriteText flushes to disk before the rename.	UnreadableManifest_InstallRefuses_BackupsSurvive LostManifest_NewInstallNeverOverwritesSavedOriginals (the flush has no test)
D4 (medium) Weak integrity checks; Seaglass upgrades silently	• MFG Unlock accepts only the exact renodx-mfgunlock.addon64 asset (no "any .addon64" fallback). • GitHub assets with no published digest are refused. All current OptiScaler, MFG and Streamline releases have digests, checked via the API. • beforeLaunch uses UpdateOptions(m).KeepingInstalledVersions(m): it reinstalls the cached OptiTag/MfgTag, and leaves a component alone if that version is no longer cached. Moving to a new release takes a click in the GUI.	Mfg_AnyOtherAddonInTheRelease_IsNotAccepted Mfg_AssetWithoutDigest_IsRefused LaunchReinstall_KeepsInstalledOptiAndMfgVersions
D5 (low) Restore downgrades a DLL the game has since updated	Restore skips a file whose hash isn't the recorded InstalledSha (the game owns it now) and drops the stale backup.	RestoreDlss_KeepsAFileTheGameUpdatedSince
D6 (low) A transient HEAD failure leaves a pinned DLSS version incomplete or mixes versions	GitHubClient.ExistsAsync returns false only on a 404 and throws on anything else. A rate limit no longer skips files or falls back to main. The main fallback is kept for a genuine 404 on the latest tag.	Dlss_PinnedVersion_RateLimitedCheckFails_InsteadOfSkippingFiles Dlss_Latest_RateLimitedCheck_NeverFallsBackToMain
D7 (low) GitHub token stored in plain text	The token is stored DPAPI-encrypted (CurrentUser) as GitHubTokenProtected. A legacy plain GitHubToken is read once and rewritten encrypted.	GitHubToken_IsSavedEncrypted_AndPlainTextIsMigrated

Test seam: GitHubClient has an internal constructor that takes an HttpMessageHandler, so the store tests use a fake GitHub and nothing leaves the machine.

Fails before, passes after

• I ran the 15 behavioural tests (D1, D2, D3, D5, D7) against origin/main, with only the new exception types loosened. All 15 fail there.
• The 5 tests for D4 and D6 use the new API or test seam, so they don't compile on main.

Not done (needs the owner)

• D4: Authenticode checks (NVIDIA for nvngx_*, crosire for the ReShade setup). I couldn't check real signed files offline, so a wrong check could block every DLSS install.
• D7: loading nvapi64.dll from System32 only; I didn't touch NvAPI code.
• D7: asking before auto-importing DLLs found next to the exe. This needs a UI prompt.
• Unchanged on purpose: licensing, naming, and the DLSS 5 / MFG Unlock feature decisions.

Follow-up fixes (0ed78f7)

• Regression fixed: install folders outside the game. D1 had stopped installs into a folder picked outside the game root. Existing installs of that kind also couldn't be uninstalled or restored. Entries may now resolve inside the game root or the chosen install folder. .. in entries and any relative RootRel are accepted once the resolved path lands in one of those two folders. Ctx.Full follows the same rule. The junction, backup-folder, owned-folder and proxy checks are unchanged. Tests: InstallFolderOutsideGame_InstallUpdateUninstall_RoundTrip and InstallFolderOutsideGame_RecordWrittenByEarlierVersion_StillUninstalls.
• Pre-existing bug on main: a retried uninstall could delete an original. Uninstall deleted every file first and then restored the backups, but it never saved the record along the way. If one restore failed (a locked dll), the retry deleted originals that had already been restored. Uninstall now saves the record after each file deleted, folder removed and original restored, so a retry continues from where it stopped. Test: Uninstall_FailsPartWay_RetryKeepsOriginalsAlreadyRestored.
• All 3 new tests fail without these changes. dotnet build -warnaserror: 0 warnings, 0 errors. dotnet test: 79 passed.

Gate

• dotnet build -warnaserror: 0 warnings, 0 errors. Main was already at 0.
• dotnet test with integration tests off: 76 passed (56 existing + 20 new).
• The app wasn't run against real games, and NvAPI wasn't called.