[AnthonyRonning]

A repeat Windows NSIS install could fail after the installed app started its host. Preparation’s append-only executable probe succeeded, but activation then requested GENERIC_WRITE on every generation, including the currently mapped executable. Windows refused that redundant write guard with sharing violation 32 even though the requested generation was already current.

The unchanged activation path reproduced this in diagnostic CI: repeat-install → activation-child → generation-guards, native error 32. A separate native probe confirmed append access succeeds and generic write access fails on the same mapped private PE; ordinary existing-pointer republication passed. The original failure in #1315’s packaging run is retained.

Exact-current repeats now pin current.json and all fixed payload files read-only, repeat registration/bootstrap/parent-bound intent/hash/tree/PE/signature admission under those pins, and complete only the matching installer intent. Other generations retain their write guards; different-generation and uninstall-recovery installs keep the original atomic publication path. The existing pointer and payload bytes are preserved.

The installer smoke now retains an explicit Windows read pin on current.json through repeat installation and identity assertions, making no-republication a deterministic requirement. A native regression uses a genuinely mapped copied PE, checks metadata write denial and unchanged file IDs/hashes, and requires an explicit child-completion marker. Both native discovery and its contract test require the new case.

The mapped-image fixture also copies executable bytes into strict-DACL private temporary storage before executing the exact test, so runner workspace ACLs no longer stand in for installed-storage permissions. Activation failures now preserve fixed stage/Win32 diagnostics through NSIS without replacing their original typed errors or rollback behavior.

Validation:

• Full pinned local just ci, root just lane repo, all 45 portable Windows packaging tests, and the normal commit hook passed.
• Diagnostic Windows suites passed 87 + 5 tests, zero failed/ignored; native mapped-read fixture, access probe and pointer regression all executed. Its installer failure and red ci-ok are preserved as the before-fix result.
• Final-head CI is green on 90e4e8d108cdcbf914a6dc10da771d3098651242: ci-ok and all three requested Windows lanes passed. Native suites executed 88 + 5 tests with zero failures/ignored/filtered; the new same-current mapped-image case passed. The actual unsigned Dev NSIS smoke passed install, pointer-pinned repeat, GUI/ACP checks, host stop and state-preserving uninstall.
• Merged with explicit one-time approval at 968fed6. Actual master Desktop Builds #752 is fully green, source 968fed66115855d452e13e96c969f8418ca62847, attempt 1. All six Windows build/sign/downloaded-consumer jobs passed. Both real signed Dev and Prod installers passed provenance, fresh install, pointer-pinned repeat, CLI/GUI/ACP checks, host stop and state-preserving uninstall via windows-release.py verify ... --smoke. The combined source also contains independently merged Remove Agent third-party notice machinery #1330 (four-file v2 inner bundle); integration review, all 45 merged-source portable packaging tests and root repository checks passed. The earlier green PR results apply to reviewed head 90e4e8d1, not automatically to the combined master tree.

Rebased onto the merged CI rewrite, master 864374411b06c9bd314a72c6421fd4923100350b. Both ci:package and ci:windows are applied. This PR did not change release/publisher workflows or signing environments. No skip-CI marker or public Windows publication is included.