diff --git a/crates/codex-win-engine/src/portable.rs b/crates/codex-win-engine/src/portable.rs
index a6cec4a..35a53d8 100644
--- a/crates/codex-win-engine/src/portable.rs
+++ b/crates/codex-win-engine/src/portable.rs
@@ -552,11 +552,20 @@ fn restore_previous_install(
     backup: &Path,
     had_previous: bool,
 ) -> Result<(), EngineError> {
+    // Never delete the failed/new tree and then discover that the old tree we
+    // promised to restore is gone. Missing rollback material is ambiguous and
+    // must not emit positive rollback evidence.
+    if had_previous && !backup.exists() {
+        return Err(EngineError::Install(format!(
+            "portable rollback backup is missing: {}",
+            backup.display()
+        )));
+    }
     if install_root.exists() {
         fs::remove_dir_all(install_root)
             .map_err(|e| io_err("remove failed portable install", e))?;
     }
-    if had_previous && backup.exists() {
+    if had_previous {
         fs::rename(backup, install_root)
             .map_err(|e| io_err("restore portable rollback backup", e))?;
     }
@@ -567,10 +576,27 @@ fn rollback_install_error(
     install_root: &Path,
     backup: &Path,
     had_previous: bool,
+    observer: &mut PortableObserver<'_>,
     err: EngineError,
 ) -> EngineError {
     match restore_previous_install(install_root, backup, had_previous) {
-        Ok(()) => EngineError::Install(format!("{err}; previous install was restored")),
+        Ok(()) => {
+            let restored = if had_previous {
+                "previous install was restored"
+            } else {
+                "new install was removed and the absent state was restored"
+            };
+            match observer(PortableBoundary::RollbackCompleted {
+                install_root: install_root.to_path_buf(),
+                backup: backup.to_path_buf(),
+                had_previous,
+            }) {
+                Ok(()) => EngineError::Install(format!("{err}; {restored}")),
+                Err(evidence_err) => EngineError::Install(format!(
+                    "{err}; {restored}, but recording rollback evidence failed: {evidence_err}"
+                )),
+            }
+        }
         Err(rollback_err) => {
             EngineError::Install(format!("{err}; rollback failed: {rollback_err}"))
         }
@@ -664,6 +690,13 @@ pub enum PortableBoundary {
         backup: PathBuf,
         had_previous: bool,
     },
+    /// A later failure was fully rolled back. The install root now matches its
+    /// pre-operation state (the old tree was restored, or a fresh tree removed).
+    RollbackCompleted {
+        install_root: PathBuf,
+        backup: PathBuf,
+        had_previous: bool,
+    },
 }
 
 pub type PortableObserver<'a> = dyn FnMut(PortableBoundary) -> Result<(), EngineError> + 'a;
@@ -673,6 +706,7 @@ pub enum PortableFault {
     BeforeMoveOld,
     AfterMoveOld,
     OnMoveNew,
+    AfterMoveNew,
 }
 
 thread_local! {
@@ -764,15 +798,13 @@ pub fn install_portable_from_msix_with_observer(
         backup: backup.clone(),
         had_previous,
     }) {
-        if had_previous {
-            if let Err(rb) = restore_previous_install(install_root, &backup, had_previous) {
-                log::error!(
-                    "portable observer failed after move-old and rollback also failed: obs={obs_err} rollback={rb}"
-                );
-                // Crash window left for startup recovery.
-            }
-        }
-        return Err(obs_err);
+        return Err(rollback_install_error(
+            install_root,
+            &backup,
+            had_previous,
+            observer,
+            obs_err,
+        ));
     }
     if fault == Some(PortableFault::AfterMoveOld) {
         // Leave the crash window intact for recovery tests (no auto-rollback).
@@ -786,9 +818,14 @@ pub fn install_portable_from_msix_with_observer(
         had_previous,
     })?;
     if fault == Some(PortableFault::OnMoveNew) {
-        let _ = restore_previous_install(install_root, &backup, had_previous);
         let _ = fs::remove_dir_all(&work_dir);
-        return Err(portable_fault_err("on-move-new"));
+        return Err(rollback_install_error(
+            install_root,
+            &backup,
+            had_previous,
+            observer,
+            portable_fault_err("on-move-new"),
+        ));
     }
 
     match fs::rename(&payload, install_root) {
@@ -804,11 +841,27 @@ pub fn install_portable_from_msix_with_observer(
             }
         }
         Err(err) => {
-            let _ = restore_previous_install(install_root, &backup, had_previous);
-            return Err(io_err("install portable payload (rolled back)", err));
+            return Err(rollback_install_error(
+                install_root,
+                &backup,
+                had_previous,
+                observer,
+                io_err("install portable payload", err),
+            ));
         }
     }
 
+    if fault == Some(PortableFault::AfterMoveNew) {
+        let _ = fs::remove_dir_all(&work_dir);
+        return Err(rollback_install_error(
+            install_root,
+            &backup,
+            had_previous,
+            observer,
+            portable_fault_err("after-move-new"),
+        ));
+    }
+
     let relaunched = match health_check_portable_install(install_root, manage_process && relaunch) {
         Ok(relaunched) => relaunched,
         Err(err) => {
@@ -817,6 +870,7 @@ pub fn install_portable_from_msix_with_observer(
                 install_root,
                 &backup,
                 had_previous,
+                observer,
                 err,
             ));
         }
@@ -1381,6 +1435,7 @@ mod tests {
                     PortableBoundary::AfterMoveOld { .. } => "after-old",
                     PortableBoundary::BeforeMoveNew { .. } => "before-new",
                     PortableBoundary::AfterMoveNew { .. } => "after-new",
+                    PortableBoundary::RollbackCompleted { .. } => "rollback-completed",
                 });
                 Ok(())
             },
@@ -1392,4 +1447,140 @@ mod tests {
         );
         let _ = fs::remove_dir_all(&root);
     }
+
+    #[test]
+    fn successful_fresh_install_rollback_emits_absent_state_evidence() {
+        let root = std::env::temp_dir().join(format!(
+            "codex-portable-fresh-rollback-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_dir_all(&root);
+        fs::create_dir_all(&root).unwrap();
+        let msix = root.join("codex.msix");
+        let install_root = root.join("Codex");
+        write_fake_msix(&msix);
+        let mut kinds = Vec::new();
+
+        inject_portable_fault(Some(PortableFault::AfterMoveNew));
+        let err = install_portable_from_msix_with_observer(
+            &msix,
+            &install_root,
+            false,
+            false,
+            &mut |boundary| {
+                kinds.push(match boundary {
+                    PortableBoundary::BeforeMoveOld { .. } => "before-old",
+                    PortableBoundary::AfterMoveOld { .. } => "after-old",
+                    PortableBoundary::BeforeMoveNew { .. } => "before-new",
+                    PortableBoundary::AfterMoveNew { .. } => "after-new",
+                    PortableBoundary::RollbackCompleted { .. } => "rollback-completed",
+                });
+                Ok(())
+            },
+        )
+        .unwrap_err();
+
+        assert!(err.to_string().contains("absent state was restored"));
+        assert_eq!(
+            kinds,
+            [
+                "before-old",
+                "after-old",
+                "before-new",
+                "after-new",
+                "rollback-completed"
+            ]
+        );
+        assert!(
+            !install_root.exists(),
+            "a fully rolled-back fresh install must be absent and safe to retry"
+        );
+        assert!(
+            !fs::read_dir(&root).unwrap().any(|entry| entry
+                .unwrap()
+                .file_name()
+                .to_string_lossy()
+                .starts_with("Codex.rollback-")),
+            "a fresh rollback must not leave rollback material"
+        );
+
+        let _ = fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn missing_upgrade_backup_never_reports_rollback_completion() {
+        let root = std::env::temp_dir().join(format!(
+            "codex-portable-missing-rollback-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_dir_all(&root);
+        fs::create_dir_all(&root).unwrap();
+        let install_root = root.join("Codex");
+        let backup = root.join("Codex.rollback-missing");
+        fs::create_dir_all(&install_root).unwrap();
+        fs::write(install_root.join("new-marker.txt"), b"new").unwrap();
+        let mut boundaries = Vec::new();
+
+        let err = rollback_install_error(
+            &install_root,
+            &backup,
+            true,
+            &mut |boundary| {
+                boundaries.push(boundary);
+                Ok(())
+            },
+            portable_fault_err("after-move-new"),
+        );
+
+        assert!(err.to_string().contains("rollback backup is missing"));
+        assert!(boundaries.is_empty(), "failed rollback must emit no evidence");
+        assert!(
+            install_root.join("new-marker.txt").exists(),
+            "failed rollback must preserve the current tree for recovery"
+        );
+
+        let _ = fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn successful_upgrade_rollback_restores_old_tree_before_evidence() {
+        let root = std::env::temp_dir().join(format!(
+            "codex-portable-upgrade-rollback-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_dir_all(&root);
+        fs::create_dir_all(&root).unwrap();
+        let install_root = root.join("Codex");
+        let backup = root.join("Codex.rollback-old");
+        fs::create_dir_all(&install_root).unwrap();
+        fs::write(install_root.join("new-marker.txt"), b"new").unwrap();
+        fs::create_dir_all(&backup).unwrap();
+        fs::write(backup.join("old-marker.txt"), b"old").unwrap();
+        let mut saw_restored_tree = false;
+
+        let err = rollback_install_error(
+            &install_root,
+            &backup,
+            true,
+            &mut |boundary| {
+                assert!(matches!(
+                    boundary,
+                    PortableBoundary::RollbackCompleted {
+                        had_previous: true,
+                        ..
+                    }
+                ));
+                saw_restored_tree = install_root.join("old-marker.txt").exists()
+                    && !install_root.join("new-marker.txt").exists();
+                Ok(())
+            },
+            portable_fault_err("after-move-new"),
+        );
+
+        assert!(err.to_string().contains("previous install was restored"));
+        assert!(saw_restored_tree, "evidence must follow the completed restore");
+        assert!(!backup.exists());
+
+        let _ = fs::remove_dir_all(&root);
+    }
 }
diff --git a/src-tauri/src/app/install_tx.rs b/src-tauri/src/app/install_tx.rs
index 8a203d8..d069880 100644
--- a/src-tauri/src/app/install_tx.rs
+++ b/src-tauri/src/app/install_tx.rs
@@ -291,6 +291,20 @@ impl InstallTransaction {
         }
     }
 
+    fn remove_file_checked(&self) -> Result<(), AppError> {
+        let path = tx_path_for(&self.id).ok_or_else(|| {
+            AppError::Internal("无法定位 install-transactions 数据目录".to_string())
+        })?;
+        match fs::remove_file(&path) {
+            Ok(()) => Ok(()),
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(()),
+            Err(err) => Err(AppError::Internal(format!(
+                "删除事务日志失败（{}）: {err}",
+                path.display()
+            ))),
+        }
+    }
+
     pub fn load_from_path(path: &Path) -> Result<Self, AppError> {
         let bytes = fs::read(path)
             .map_err(|e| AppError::Internal(format!("读取事务日志失败: {e}")))?;
@@ -590,10 +604,11 @@ impl ActiveInstallTx {
     /// Record a successful rollback and clear the log.
     pub fn mark_rolled_back(mut self) -> Result<(), AppError> {
         if let Some(mut tx) = self.inner.take() {
-            tx.step = InstallTxStep::RolledBack;
-            tx.updated_unix = now_unix();
-            let _ = tx.persist();
-            tx.remove_file();
+            // Persist the terminal state before clearing the journal. If this
+            // write fails, propagate it so the operation remains outcome-unknown
+            // instead of claiming a fully recorded rollback.
+            tx.advance(InstallTxStep::RolledBack)?;
+            tx.remove_file_checked()?;
         }
         Ok(())
     }
diff --git a/src-tauri/src/app/mac_update.rs b/src-tauri/src/app/mac_update.rs
index cc45c1c..ae19d77 100644
--- a/src-tauri/src/app/mac_update.rs
+++ b/src-tauri/src/app/mac_update.rs
@@ -1663,6 +1663,20 @@ pub fn retry_macos_ancillary(
     path: Option<&str>,
     purge_user_data: bool,
 ) -> Result<crate::app::operation_outcome::AncillaryRetryReport, AppError> {
+    retry_macos_ancillary_with_detector(actions, path, purge_user_data, || {
+        detect_managed_installed().or_else(detect_installed)
+    })
+}
+
+fn retry_macos_ancillary_with_detector<F>(
+    actions: &[String],
+    path: Option<&str>,
+    purge_user_data: bool,
+    detect_install: F,
+) -> Result<crate::app::operation_outcome::AncillaryRetryReport, AppError>
+where
+    F: FnOnce() -> Option<InstalledCodex>,
+{
     use crate::app::operation_outcome::AncillaryRetryReport;
 
     let mut outcome = OperationOutcome {
@@ -1680,7 +1694,7 @@ pub fn retry_macos_ancillary(
     if actions.iter().any(|a| a == recovery::RECORD_PROVENANCE) {
         // Re-record currently detected install as managed — same as adopt, but
         // as an explicit recovery path for "installed, record failed".
-        match detect_managed_installed().or_else(detect_installed) {
+        match detect_install() {
             Some(installed) => {
                 let mut store = ProvenanceStore::load();
                 store.record(
@@ -1708,6 +1722,10 @@ pub fn retry_macos_ancillary(
                 messages.push("未检测到 Codex，无法写入托管记录".to_string());
             }
         }
+        // Every failed record attempt remains retryable, including the
+        // no-install-detected branch above. Keep this invariant outside the
+        // individual match arms so future failure paths cannot omit the CTA.
+        outcome.retain_failed_provenance_recovery(recovery::RECORD_PROVENANCE);
     }
 
     if actions.iter().any(|a| a == recovery::CLEAR_PROVENANCE) {
@@ -1804,6 +1822,24 @@ mod disk_preflight_tests {
         assert!(preflight_mac_disk_with_available(&p, |_| Ok(None)).is_ok());
         assert!(preflight_mac_disk_with_available(&p, |_| Ok(Some(mac_space_budget(&p)))).is_ok());
     }
+
+    #[test]
+    fn retry_record_provenance_without_detected_install_keeps_retry_action() {
+        let report = retry_macos_ancillary_with_detector(
+            &[recovery::RECORD_PROVENANCE.to_string()],
+            None,
+            false,
+            || None,
+        )
+        .expect("a missing install is a retryable ancillary result");
+
+        assert!(report.outcome.provenance.is_failed());
+        assert!(report
+            .outcome
+            .recovery_actions
+            .iter()
+            .any(|action| action == recovery::RECORD_PROVENANCE));
+    }
 }
 
 // The full-update unpack branch is new logic (the delta/gate/swap tail reuses
diff --git a/src-tauri/src/app/operation_outcome.rs b/src-tauri/src/app/operation_outcome.rs
index e0e9648..923f9c5 100644
--- a/src-tauri/src/app/operation_outcome.rs
+++ b/src-tauri/src/app/operation_outcome.rs
@@ -126,6 +126,15 @@ impl OperationOutcome {
         }
     }
 
+    /// Preserve the retry action for every failed provenance branch. Keeping
+    /// this check after a multi-branch attempt prevents a newly-added error
+    /// path (including "nothing detected") from stranding the UI without a CTA.
+    pub fn retain_failed_provenance_recovery(&mut self, action: &str) {
+        if self.provenance.is_failed() {
+            self.push_recovery(action);
+        }
+    }
+
     /// True when the primary op succeeded but at least one ancillary step failed.
     pub fn is_partial(&self) -> bool {
         self.primary_ok && (self.provenance.is_failed() || self.cleanup.is_failed())
@@ -182,4 +191,19 @@ mod tests {
         outcome.push_recovery(recovery::CLEANUP_METADATA);
         assert_eq!(outcome.recovery_actions.len(), 1);
     }
+
+    #[test]
+    fn failed_provenance_always_retains_its_retry_action() {
+        let mut failed = OperationOutcome::full_success("present", Some("external"));
+        failed.provenance = StepOutcome::failed("record target missing");
+        failed.retain_failed_provenance_recovery(recovery::RECORD_PROVENANCE);
+        assert_eq!(
+            failed.recovery_actions,
+            vec![recovery::RECORD_PROVENANCE.to_string()]
+        );
+
+        let mut succeeded = OperationOutcome::full_success("present", Some("managed"));
+        succeeded.retain_failed_provenance_recovery(recovery::RECORD_PROVENANCE);
+        assert!(succeeded.recovery_actions.is_empty());
+    }
 }
diff --git a/src-tauri/src/app/oplock.rs b/src-tauri/src/app/oplock.rs
index 09a4856..5dde09c 100644
--- a/src-tauri/src/app/oplock.rs
+++ b/src-tauri/src/app/oplock.rs
@@ -1,3 +1,4 @@
+use std::collections::VecDeque;
 use std::fs::{File, OpenOptions};
 use std::io::{self, Seek, SeekFrom, Write};
 use std::path::{Path, PathBuf};
@@ -11,6 +12,7 @@ use crate::app::op_phase::{OperationPhase, QuitPolicy};
 
 static TOKEN_COUNTER: AtomicU64 = AtomicU64::new(1);
 const DEFAULT_STALE_AFTER_SECS: u64 = 5 * 60;
+const COMPLETION_HISTORY_LIMIT: usize = 16;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "kebab-case")]
@@ -57,6 +59,7 @@ pub struct OperationManager {
 
 struct Inner {
     active: Option<ActiveOp>,
+    completed: VecDeque<OperationCompletion>,
     lock_file: Result<File, String>,
 }
 
@@ -87,6 +90,28 @@ pub struct OperationSnapshot {
     pub interruptible: bool,
 }
 
+/// Terminal backend evidence retained across renderer reloads. The frontend
+/// may release a fresh-install safety guard only for `FailedBeforeCommit` or a
+/// positively proven `RolledBack`; once an unresolved mutation is observed (or
+/// an ambiguous platform call starts), an invoke rejection cannot prove disk state.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum OperationCompletionState {
+    Succeeded,
+    FailedBeforeCommit,
+    RolledBack,
+    OutcomeUnknown,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct OperationCompletion {
+    pub id: String,
+    pub kind: OperationKind,
+    pub phase: OperationPhase,
+    pub state: OperationCompletionState,
+}
+
 struct ActiveOp {
     token: String,
     kind: OperationKind,
@@ -101,6 +126,17 @@ struct ActiveOp {
     holders: u32,
     /// Progress through the op lifecycle; drives quit policy.
     phase: OperationPhase,
+    /// True once the operation has definitely changed installed app state.
+    /// Completion classification must use this evidence, not the quit phase:
+    /// `Committing` may be published before the first write so closing the app
+    /// is blocked across the final pre-write crash window.
+    mutation_started: bool,
+    /// True only after a mutation was observed and the engine subsequently
+    /// proved that the install root was restored to its pre-operation state.
+    mutation_rolled_back: bool,
+    /// True once a platform call has begun whose failure cannot prove that the
+    /// installed app is unchanged (for example Add-AppxPackage).
+    outcome_ambiguous: bool,
     /// Last reported download progress (if any).
     progress: Option<OperationProgress>,
     /// True after a pause was requested while the lease is still held.
@@ -155,6 +191,7 @@ impl OperationManager {
         Self {
             inner: Arc::new(Mutex::new(Inner {
                 active: None,
+                completed: VecDeque::new(),
                 lock_file,
             })),
             stale_after_secs,
@@ -313,6 +350,87 @@ impl OperationManager {
         Ok(())
     }
 
+    /// Record positive evidence that installed app state has changed.
+    pub fn mark_mutation_started(&self, token: &OperationToken) -> Result<(), OperationError> {
+        let mut inner = self
+            .inner
+            .lock()
+            .map_err(|_| OperationError::Lock("operation mutex poisoned".to_string()))?;
+        let Some(active) = inner.active.as_mut() else {
+            return Err(OperationError::InvalidToken);
+        };
+        if active.token != token.0 {
+            return Err(OperationError::InvalidToken);
+        }
+        if !active.mutation_started {
+            log::info!(
+                "operation mutation started kind={} token_prefix={}",
+                active.kind.as_str(),
+                token_prefix(&token.0)
+            );
+            active.mutation_started = true;
+        }
+        // Any later mutation invalidates rollback evidence from an earlier
+        // attempt in the same operation.
+        active.mutation_rolled_back = false;
+        Ok(())
+    }
+
+    /// Record positive evidence that every observed portable install-root
+    /// mutation was restored. This does not clear `outcome_ambiguous`: a prior
+    /// platform call such as Add-AppxPackage may still have changed system state.
+    pub fn mark_mutation_rolled_back(
+        &self,
+        token: &OperationToken,
+    ) -> Result<(), OperationError> {
+        let mut inner = self
+            .inner
+            .lock()
+            .map_err(|_| OperationError::Lock("operation mutex poisoned".to_string()))?;
+        let Some(active) = inner.active.as_mut() else {
+            return Err(OperationError::InvalidToken);
+        };
+        if active.token != token.0 {
+            return Err(OperationError::InvalidToken);
+        }
+        // Some rollback callbacks also clear a Prepared journal before the
+        // first rename. They are safe failures, but not "rolled back" unless
+        // this operation actually recorded a mutation first.
+        if active.mutation_started {
+            log::info!(
+                "operation mutation rolled back kind={} token_prefix={}",
+                active.kind.as_str(),
+                token_prefix(&token.0)
+            );
+            active.mutation_rolled_back = true;
+        }
+        Ok(())
+    }
+
+    /// Record that a platform mutation call has started and its eventual error
+    /// cannot establish the pre-call disk state.
+    pub fn mark_outcome_ambiguous(&self, token: &OperationToken) -> Result<(), OperationError> {
+        let mut inner = self
+            .inner
+            .lock()
+            .map_err(|_| OperationError::Lock("operation mutex poisoned".to_string()))?;
+        let Some(active) = inner.active.as_mut() else {
+            return Err(OperationError::InvalidToken);
+        };
+        if active.token != token.0 {
+            return Err(OperationError::InvalidToken);
+        }
+        if !active.outcome_ambiguous {
+            log::info!(
+                "operation outcome became ambiguous kind={} token_prefix={}",
+                active.kind.as_str(),
+                token_prefix(&token.0)
+            );
+            active.outcome_ambiguous = true;
+        }
+        Ok(())
+    }
+
     /// Unified quit/close policy for window close, menu quit, and quit command.
     ///
     /// Reads busy/phase/kind under a **single** mutex hold so a concurrent
@@ -382,6 +500,59 @@ impl OperationManager {
         })
     }
 
+    /// Record the terminal outcome before the lease is released. Keeping a
+    /// small token-keyed history lets a replacement renderer distinguish a
+    /// true no-mutation failure from an ambiguous platform/mutation error.
+    pub fn record_completion(
+        &self,
+        token: &OperationToken,
+        succeeded: bool,
+    ) -> Result<OperationCompletion, OperationError> {
+        let mut inner = self
+            .inner
+            .lock()
+            .map_err(|_| OperationError::Lock("operation mutex poisoned".to_string()))?;
+        let Some(active) = inner.active.as_ref() else {
+            return Err(OperationError::InvalidToken);
+        };
+        if active.token != token.0 {
+            return Err(OperationError::InvalidToken);
+        }
+        let completion = OperationCompletion {
+            id: active.token.clone(),
+            kind: active.kind,
+            phase: active.phase,
+            state: if succeeded {
+                OperationCompletionState::Succeeded
+            } else if active.outcome_ambiguous {
+                OperationCompletionState::OutcomeUnknown
+            } else if active.mutation_started && active.mutation_rolled_back {
+                OperationCompletionState::RolledBack
+            } else if active.mutation_started {
+                OperationCompletionState::OutcomeUnknown
+            } else {
+                OperationCompletionState::FailedBeforeCommit
+            },
+        };
+        inner.completed.push_back(completion.clone());
+        while inner.completed.len() > COMPLETION_HISTORY_LIMIT {
+            inner.completed.pop_front();
+        }
+        Ok(completion)
+    }
+
+    pub fn completion(&self, token: &OperationToken) -> Option<OperationCompletion> {
+        let Ok(inner) = self.inner.lock() else {
+            return None;
+        };
+        inner
+            .completed
+            .iter()
+            .rev()
+            .find(|completion| completion.id == token.0)
+            .cloned()
+    }
+
     /// Record the latest download progress for a validated token.
     pub fn set_progress(
         &self,
@@ -470,6 +641,9 @@ impl OperationManager {
             claimed,
             holders: 0,
             phase: OperationPhase::Preparing,
+            mutation_started: false,
+            mutation_rolled_back: false,
+            outcome_ambiguous: false,
             progress: None,
             paused: false,
         });
@@ -580,7 +754,9 @@ fn write_lock_diagnostics(
 
 #[cfg(test)]
 mod tests {
-    use super::{OperationError, OperationKind, OperationManager, OperationToken};
+    use super::{
+        OperationCompletionState, OperationError, OperationKind, OperationManager, OperationToken,
+    };
     use std::fs;
     use std::sync::atomic::{AtomicU64, Ordering};
 
@@ -897,4 +1073,121 @@ mod tests {
 
         let _ = fs::remove_dir_all(path.parent().unwrap());
     }
+
+    #[test]
+    fn terminal_completion_uses_mutation_evidence_independently_of_quit_phase() {
+        use crate::app::op_phase::OperationPhase;
+
+        let path = lock_path("completion");
+        let manager = OperationManager::new(path.clone());
+
+        let before_commit = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&before_commit).unwrap();
+        manager
+            .set_phase(&before_commit, OperationPhase::Downloading)
+            .unwrap();
+        let completion = manager.record_completion(&before_commit, false).unwrap();
+        assert_eq!(
+            completion.state,
+            OperationCompletionState::FailedBeforeCommit
+        );
+        manager.end(before_commit.clone()).unwrap();
+        assert_eq!(manager.completion(&before_commit), Some(completion));
+
+        let committing_without_write = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&committing_without_write).unwrap();
+        manager
+            .set_phase(&committing_without_write, OperationPhase::Committing)
+            .unwrap();
+        let completion = manager
+            .record_completion(&committing_without_write, false)
+            .unwrap();
+        assert_eq!(
+            completion.state,
+            OperationCompletionState::FailedBeforeCommit
+        );
+        manager.end(committing_without_write).unwrap();
+
+        let after_mutation = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&after_mutation).unwrap();
+        manager.mark_mutation_started(&after_mutation).unwrap();
+        let completion = manager.record_completion(&after_mutation, false).unwrap();
+        assert_eq!(completion.state, OperationCompletionState::OutcomeUnknown);
+        manager.end(after_mutation.clone()).unwrap();
+        assert_eq!(manager.completion(&after_mutation), Some(completion));
+
+        let rolled_back = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&rolled_back).unwrap();
+        manager.mark_mutation_started(&rolled_back).unwrap();
+        assert!(matches!(
+            manager.mark_mutation_rolled_back(&OperationToken("wrong".to_string())),
+            Err(OperationError::InvalidToken)
+        ));
+        manager.mark_mutation_rolled_back(&rolled_back).unwrap();
+        let completion = manager.record_completion(&rolled_back, false).unwrap();
+        assert_eq!(completion.state, OperationCompletionState::RolledBack);
+        manager.end(rolled_back.clone()).unwrap();
+        assert_eq!(manager.completion(&rolled_back), Some(completion));
+
+        let rollback_before_mutation = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&rollback_before_mutation).unwrap();
+        manager
+            .mark_mutation_rolled_back(&rollback_before_mutation)
+            .unwrap();
+        let completion = manager
+            .record_completion(&rollback_before_mutation, false)
+            .unwrap();
+        assert_eq!(
+            completion.state,
+            OperationCompletionState::FailedBeforeCommit
+        );
+        manager.end(rollback_before_mutation).unwrap();
+
+        let ambiguous_rollback = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&ambiguous_rollback).unwrap();
+        manager
+            .mark_outcome_ambiguous(&ambiguous_rollback)
+            .unwrap();
+        manager.mark_mutation_started(&ambiguous_rollback).unwrap();
+        manager
+            .mark_mutation_rolled_back(&ambiguous_rollback)
+            .unwrap();
+        let completion = manager
+            .record_completion(&ambiguous_rollback, false)
+            .unwrap();
+        assert_eq!(completion.state, OperationCompletionState::OutcomeUnknown);
+        manager.end(ambiguous_rollback).unwrap();
+
+        let mutation_after_rollback = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&mutation_after_rollback).unwrap();
+        manager.mark_mutation_started(&mutation_after_rollback).unwrap();
+        manager
+            .mark_mutation_rolled_back(&mutation_after_rollback)
+            .unwrap();
+        manager.mark_mutation_started(&mutation_after_rollback).unwrap();
+        let completion = manager
+            .record_completion(&mutation_after_rollback, false)
+            .unwrap();
+        assert_eq!(completion.state, OperationCompletionState::OutcomeUnknown);
+        manager.end(mutation_after_rollback).unwrap();
+
+        let ambiguous_call = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&ambiguous_call).unwrap();
+        manager
+            .mark_outcome_ambiguous(&ambiguous_call)
+            .unwrap();
+        let completion = manager.record_completion(&ambiguous_call, false).unwrap();
+        assert_eq!(completion.state, OperationCompletionState::OutcomeUnknown);
+        manager.end(ambiguous_call.clone()).unwrap();
+        assert_eq!(manager.completion(&ambiguous_call), Some(completion));
+
+        let succeeded = manager.begin_detached(OperationKind::Update).unwrap();
+        manager.validate(&succeeded).unwrap();
+        let completion = manager.record_completion(&succeeded, true).unwrap();
+        assert_eq!(completion.state, OperationCompletionState::Succeeded);
+        manager.end(succeeded.clone()).unwrap();
+        assert_eq!(manager.completion(&succeeded), Some(completion));
+
+        let _ = fs::remove_dir_all(path.parent().unwrap());
+    }
 }
diff --git a/src-tauri/src/app/win_update.rs b/src-tauri/src/app/win_update.rs
index 9736a07..d90c66e 100644
--- a/src-tauri/src/app/win_update.rs
+++ b/src-tauri/src/app/win_update.rs
@@ -39,6 +39,19 @@ use crate::errors::AppError;
 /// Optional hook for the command layer to publish operation phases (quit policy).
 pub type PhaseHook<'a> = dyn Fn(OperationPhase) + Send + Sync + 'a;
 
+/// Completion evidence is intentionally separate from `OperationPhase`.
+/// `Committing` blocks app exit before the first rename/platform call, while
+/// these events describe whether a rejected command can still prove that the
+/// installed app was left unchanged.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum OperationEvidence {
+    MutationStarted,
+    MutationRolledBack,
+    OutcomeAmbiguous,
+}
+
+pub type EvidenceHook<'a> = dyn Fn(OperationEvidence) + Send + Sync + 'a;
+
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct WinUpdateReport {
@@ -1010,6 +1023,7 @@ pub fn perform_windows_update_with_install_mode_and_network(
         progress,
         network,
         None,
+        None,
     )
 }
 
@@ -1023,6 +1037,7 @@ pub fn perform_windows_update_with_install_mode_network_and_phase(
     progress: &dyn Fn(DownloadProgress),
     network: &NetworkConfig,
     phase: Option<&PhaseHook<'_>>,
+    evidence: Option<&EvidenceHook<'_>>,
 ) -> Result<WinPerformReport, AppError> {
     let set_phase = |p: OperationPhase| {
         if let Some(hook) = phase {
@@ -1083,16 +1098,25 @@ pub fn perform_windows_update_with_install_mode_network_and_phase(
         });
     }
 
-    // Point of no return. Honor a cancel one last time BEFORE closing Codex or
-    // sideloading — closes the gap after staging where a fully-cached MSIX skips
-    // the download loop (so its cancel flag never arms) yet still reaches here.
+    // Honor a cancel one last time before closing Codex or beginning install
+    // preparation. A fully-cached MSIX can skip the download loop (so its cancel
+    // flag never arms) yet still reach here. Keep the operation pre-commit until
+    // the selected route actually mutates the installed application.
     check_win_update_abort()?;
-    set_phase(OperationPhase::Committing);
+    set_phase(OperationPhase::Applying);
 
     if stage.route == "portable-fallback" {
         log::warn!("Windows route changed to portable fallback from_route=msix-sideload to_route=portable-fallback");
         close_existing_codex_before_portable_fallback(settings, current_installed.as_ref())?;
-        return install_portable_after_stage(settings, stage, None, None, current_installed, phase);
+        return install_portable_after_stage(
+            settings,
+            stage,
+            None,
+            None,
+            current_installed,
+            phase,
+            evidence,
+        );
     }
 
     let staged_path = stage
@@ -1121,8 +1145,15 @@ pub fn perform_windows_update_with_install_mode_network_and_phase(
             "Skipped MSIX sideload before attempting it: {}. Routed to the portable build, which carries its own runtime and does not need these framework packages.",
             precheck.reason
         ));
-        let mut report =
-            install_portable_after_stage(settings, stage, None, None, current_installed, phase)?;
+        let mut report = install_portable_after_stage(
+            settings,
+            stage,
+            None,
+            None,
+            current_installed,
+            phase,
+            evidence,
+        )?;
         report.action = WinPerformAction::PortableFallbackMissingFramework;
         return Ok(report);
     }
@@ -1144,6 +1175,13 @@ pub fn perform_windows_update_with_install_mode_network_and_phase(
                 .map_err(engine_err)?;
         }
     }
+    // Add-AppxPackage is the first operation on the MSIX route that can mutate
+    // installed package state. From here an error cannot prove the old state is
+    // intact, so renderer recovery must treat the outcome as ambiguous.
+    set_phase(OperationPhase::Committing);
+    if let Some(hook) = evidence {
+        hook(OperationEvidence::OutcomeAmbiguous);
+    }
     let sideload =
         install_msix_sideload(PathBuf::from(&staged_path).as_path()).map_err(engine_err)?;
 
@@ -1181,6 +1219,7 @@ pub fn perform_windows_update_with_install_mode_network_and_phase(
                 Some(health),
                 current_installed,
                 phase,
+                evidence,
             )?;
             match remove_msix_package() {
                 Ok(remove) if remove.success => {
@@ -1279,7 +1318,15 @@ pub fn perform_windows_update_with_install_mode_network_and_phase(
         return Ok(report);
     }
 
-    install_portable_after_stage(settings, stage, Some(sideload), None, current_installed, phase)
+    install_portable_after_stage(
+        settings,
+        stage,
+        Some(sideload),
+        None,
+        current_installed,
+        phase,
+        evidence,
+    )
 }
 
 fn install_portable_after_stage(
@@ -1289,10 +1336,8 @@ fn install_portable_after_stage(
     health: Option<MsixHealthReport>,
     previous_installed: Option<InstalledWindowsCodex>,
     phase: Option<&PhaseHook<'_>>,
+    evidence: Option<&EvidenceHook<'_>>,
 ) -> Result<WinPerformReport, AppError> {
-    if let Some(hook) = phase {
-        hook(OperationPhase::Committing);
-    }
     let staged_path = stage
         .staged_path
         .as_ref()
@@ -1304,10 +1349,31 @@ fn install_portable_after_stage(
         .unwrap_or_else(|| settings.install_root.clone());
     let install_root_path = PathBuf::from(&install_root);
     let msix_path = PathBuf::from(staged_path);
-    // Persist the transaction log on BeforeMoveOld (first destructive rename)
-    // using the real paths chosen by the engine.
+    // Persist the transaction log before the first possible rename using the
+    // real paths chosen by the engine. Once that journal is durable, publish
+    // `Committing` before the first rename so the app cannot exit in the narrow
+    // gap between the boundary callback and the filesystem call. Completion
+    // remains pre-write until a later boundary proves a rename succeeded.
     let mut tx: Option<ActiveInstallTx> = None;
     let mut observer = |boundary: PortableBoundary| -> Result<(), codex_win_engine::EngineError> {
+        if matches!(&boundary, PortableBoundary::RollbackCompleted { .. }) {
+            // Disk rollback is already complete. Persist and clear the durable
+            // journal first; only then publish evidence that permits a retry.
+            if let Some(active) = tx.take() {
+                active
+                    .mark_rolled_back()
+                    .map_err(|e| codex_win_engine::EngineError::Io(e.to_string()))?;
+            }
+            if let Some(hook) = evidence {
+                hook(OperationEvidence::MutationRolledBack);
+            }
+            return Ok(());
+        }
+        if portable_boundary_mutated_install_root(&boundary) {
+            if let Some(hook) = evidence {
+                hook(OperationEvidence::MutationStarted);
+            }
+        }
         match boundary {
             PortableBoundary::BeforeMoveOld {
                 install_root,
@@ -1325,6 +1391,9 @@ fn install_portable_after_stage(
                 )
                 .map_err(|e| codex_win_engine::EngineError::Io(e.to_string()))?;
                 tx = Some(started);
+                if let Some(hook) = phase {
+                    hook(OperationPhase::Committing);
+                }
                 Ok(())
             }
             PortableBoundary::AfterMoveOld { .. } => {
@@ -1344,6 +1413,7 @@ fn install_portable_after_stage(
                 }
                 Ok(())
             }
+            PortableBoundary::RollbackCompleted { .. } => unreachable!("handled above"),
         }
     };
     let portable = install_portable_from_msix_with_observer(
@@ -1449,6 +1519,22 @@ fn install_portable_after_stage(
     Ok(report)
 }
 
+/// Whether a completed portable-engine boundary proves the install root was
+/// mutated. An upgrade crosses this boundary after moving the old tree; a fresh
+/// install has no old tree, so it crosses only after moving the new payload in.
+fn portable_boundary_mutated_install_root(boundary: &PortableBoundary) -> bool {
+    matches!(
+        boundary,
+        PortableBoundary::AfterMoveOld {
+            had_previous: true,
+            ..
+        } | PortableBoundary::AfterMoveNew {
+            had_previous: false,
+            ..
+        }
+    )
+}
+
 pub fn win_install_status(settings: &AppSettings) -> WinInstallStatus {
     let store = ProvenanceStore::load();
     let installed = detect_managed_codex(settings, &store);
@@ -1711,6 +1797,20 @@ pub fn retry_windows_ancillary(
     path: Option<&str>,
     purge_user_data: bool,
 ) -> Result<AncillaryRetryReport, AppError> {
+    retry_windows_ancillary_with_detector(actions, path, purge_user_data, || {
+        win_install_status(settings)
+    })
+}
+
+fn retry_windows_ancillary_with_detector<F>(
+    actions: &[String],
+    path: Option<&str>,
+    purge_user_data: bool,
+    detect_status: F,
+) -> Result<AncillaryRetryReport, AppError>
+where
+    F: FnOnce() -> WinInstallStatus,
+{
     let mut outcome = OperationOutcome {
         primary_ok: true,
         app_state: "unknown".to_string(),
@@ -1724,7 +1824,7 @@ pub fn retry_windows_ancillary(
     let mut messages = Vec::new();
 
     if actions.iter().any(|a| a == recovery::RECORD_PROVENANCE) {
-        let status = win_install_status(settings);
+        let status = detect_status();
         match status.installed {
             Some(installed) => {
                 let recorded =
@@ -1751,6 +1851,9 @@ pub fn retry_windows_ancillary(
                 messages.push("未检测到 Codex，无法写入托管记录".to_string());
             }
         }
+        // A failed record attempt is always retryable. In particular, the
+        // no-install-detected branch must not strand the UI without its CTA.
+        outcome.retain_failed_provenance_recovery(recovery::RECORD_PROVENANCE);
     }
 
     if actions.iter().any(|a| a == recovery::CLEAR_PROVENANCE) {
@@ -1826,13 +1929,14 @@ pub fn retry_windows_ancillary(
 mod tests {
     use super::{
         bind_manifest_checksums, check_win_update_abort, detect_existing_windows_install_at_path,
-        detect_managed_codex, outcome_from_portable_uninstall, WinAbortGuard, WinPerformAction,
-        WIN_UPDATE_ABORT,
+        detect_managed_codex, outcome_from_portable_uninstall,
+        portable_boundary_mutated_install_root, retry_windows_ancillary_with_detector,
+        WinAbortGuard, WinPerformAction, WinInstallStatus, WIN_UPDATE_ABORT,
     };
     use crate::app::operation_outcome::{recovery, StepOutcome};
     use crate::app::provenance::ProvenanceStore;
     use crate::domain::settings::AppSettings;
-    use codex_win_engine::{PortableUninstallReport, WindowsRelease};
+    use codex_win_engine::{PortableBoundary, PortableUninstallReport, WindowsRelease};
     use std::path::PathBuf;
     use std::sync::atomic::Ordering;
 
@@ -1876,6 +1980,60 @@ mod tests {
         );
     }
 
+    #[test]
+    fn portable_mutation_evidence_requires_a_successful_install_root_rename() {
+        let install_root = PathBuf::from(r"C:\Codex");
+        let payload = PathBuf::from(r"C:\staging\Codex");
+        let backup = PathBuf::from(r"C:\Codex.rollback");
+
+        assert!(!portable_boundary_mutated_install_root(
+            &PortableBoundary::BeforeMoveOld {
+                install_root: install_root.clone(),
+                payload: payload.clone(),
+                backup: backup.clone(),
+                had_previous: false,
+            }
+        ));
+        assert!(!portable_boundary_mutated_install_root(
+            &PortableBoundary::AfterMoveOld {
+                install_root: install_root.clone(),
+                payload: payload.clone(),
+                backup: backup.clone(),
+                had_previous: false,
+            }
+        ));
+        assert!(portable_boundary_mutated_install_root(
+            &PortableBoundary::AfterMoveOld {
+                install_root: install_root.clone(),
+                payload: payload.clone(),
+                backup: backup.clone(),
+                had_previous: true,
+            }
+        ));
+        assert!(!portable_boundary_mutated_install_root(
+            &PortableBoundary::BeforeMoveNew {
+                install_root: install_root.clone(),
+                payload: payload.clone(),
+                backup: backup.clone(),
+                had_previous: false,
+            }
+        ));
+        assert!(portable_boundary_mutated_install_root(
+            &PortableBoundary::AfterMoveNew {
+                install_root: install_root.clone(),
+                backup: backup.clone(),
+                had_previous: false,
+            }
+        ));
+        assert!(!portable_boundary_mutated_install_root(
+            &PortableBoundary::RollbackCompleted {
+                install_root,
+                backup,
+                had_previous: false,
+            }
+        ));
+    }
+
     #[test]
     fn serializes_win_perform_actions_as_frontend_contract() {
         let cases = [
@@ -2106,4 +2264,26 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  OpenAI.Codex_2
         assert!(!outcome.is_partial());
         assert_eq!(outcome.app_state, "present");
     }
+
+    #[test]
+    fn retry_record_provenance_without_detected_install_keeps_retry_action() {
+        let report = retry_windows_ancillary_with_detector(
+            &[recovery::RECORD_PROVENANCE.to_string()],
+            None,
+            false,
+            || WinInstallStatus {
+                installed: None,
+                status: "none".to_string(),
+            },
+        )
+        .expect("a missing install is a retryable ancillary result");
+
+        assert!(report.outcome.provenance.is_failed());
+        assert!(report
+            .outcome
+            .recovery_actions
+            .iter()
+            .any(|action| action == recovery::RECORD_PROVENANCE));
+
+    }
 }
diff --git a/src-tauri/src/commands.rs b/src-tauri/src/commands.rs
index b7e1d3b..5fa3c43 100644
--- a/src-tauri/src/commands.rs
+++ b/src-tauri/src/commands.rs
@@ -23,8 +23,8 @@ use crate::app::mac_update::{
 use crate::app::op_phase::{OperationPhase, QuitPolicy};
 use crate::app::operation_outcome::{AncillaryRetryReport, AncillaryRetryRequest};
 use crate::app::oplock::{
-    OperationError, OperationGuard, OperationKind, OperationManager, OperationProgress,
-    OperationSnapshot, OperationToken,
+    OperationCompletion, OperationError, OperationGuard, OperationKind, OperationManager,
+    OperationProgress, OperationSnapshot, OperationToken,
 };
 use crate::app::paths;
 use crate::app::provenance::ProvenanceStore;
@@ -40,7 +40,7 @@ use crate::app::win_update::{
     retry_windows_ancillary, stage_windows_update_with_install_mode_and_network,
     uninstall_windows_codex, win_adopt as adopt_windows_install,
     win_adopt_path as adopt_windows_path, win_install_status,
-    DownloadProgress as WinDownloadProgress, WinAutoStageReport, WinInstallStatus,
+    DownloadProgress as WinDownloadProgress, OperationEvidence, WinAutoStageReport, WinInstallStatus,
     WinPerformExpectation, WinPerformReport, WinStageReport, WinUninstallReport, WinUpdateReport,
 };
 use crate::domain::settings::AppSettings as DomainAppSettings;
@@ -288,22 +288,42 @@ fn begin_guard(state: &ManagerState, kind: OperationKind) -> Result<OperationGua
 }
 
 struct DetachedGuard {
+    completion_tracking: bool,
     operations: OperationManager,
+    succeeded: bool,
     token: Option<OperationToken>,
 }
 
 impl DetachedGuard {
     fn validate(state: &ManagerState, token: OperationToken) -> Result<Self, CommandError> {
+        Self::validate_inner(state, token, false)
+    }
+
+    fn validate_tracked(state: &ManagerState, token: OperationToken) -> Result<Self, CommandError> {
+        Self::validate_inner(state, token, true)
+    }
+
+    fn validate_inner(
+        state: &ManagerState,
+        token: OperationToken,
+        completion_tracking: bool,
+    ) -> Result<Self, CommandError> {
         let operations = state.operations.clone();
         operations
             .validate(&token)
             .map_err(destructive_token_error)?;
         Ok(Self {
+            completion_tracking,
             operations,
+            succeeded: false,
             token: Some(token),
         })
     }
 
+    fn mark_succeeded(&mut self) {
+        self.succeeded = true;
+    }
+
     fn set_phase(&self, phase: OperationPhase) {
         if let Some(token) = self.token.as_ref() {
             let _ = self.operations.set_phase(token, phase);
@@ -363,6 +383,11 @@ fn emit_op_download_progress(
 impl Drop for DetachedGuard {
     fn drop(&mut self) {
         if let Some(token) = self.token.take() {
+            if self.completion_tracking {
+                if let Err(error) = self.operations.record_completion(&token, self.succeeded) {
+                    log::error!("failed to record terminal operation outcome: {error}");
+                }
+            }
             let _ = self.operations.end(token);
         }
     }
@@ -1168,6 +1193,17 @@ pub fn get_operation_snapshot(
     Ok(state.operations.snapshot())
 }
 
+/// Token-keyed terminal evidence for a renderer that lost the original invoke
+/// promise. `failed-before-commit` and `rolled-back` prove that retrying a fresh
+/// install is safe; unresolved committing/finishing failures remain outcome-unknown.
+#[tauri::command]
+pub fn get_operation_completion(
+    state: State<'_, ManagerState>,
+    token: OperationToken,
+) -> Result<Option<OperationCompletion>, CommandError> {
+    Ok(state.operations.completion(&token))
+}
+
 /// The user confirmed quitting from the close dialog — flag it and exit so the
 /// CloseRequested / ExitRequested guards stop intercepting and let it go.
 /// Still refuses when the backend is in a non-interruptible install phase.
@@ -1712,7 +1748,7 @@ pub async fn win_perform_update(
             AppError::Internal("拒绝执行：Windows 更新必须带显式 confirm".to_string()).into(),
         );
     }
-    let op = DetachedGuard::validate(&state, token)?;
+    let mut op = DetachedGuard::validate_tracked(&state, token)?;
     op.set_phase(OperationPhase::Preparing);
     let endpoints = windows_endpoints_for_settings(&state)?;
     let mut settings = windows_domain_settings_for_persisted(&state);
@@ -1755,6 +1791,20 @@ pub async fn win_perform_update(
                 let _ = ops.set_phase(token, phase);
             }
         };
+        let evidence_hook = |evidence: OperationEvidence| {
+            if let Some(token) = phase_token.as_ref() {
+                let result = match evidence {
+                    OperationEvidence::MutationStarted => ops.mark_mutation_started(token),
+                    OperationEvidence::MutationRolledBack => {
+                        ops.mark_mutation_rolled_back(token)
+                    }
+                    OperationEvidence::OutcomeAmbiguous => ops.mark_outcome_ambiguous(token),
+                };
+                if let Err(error) = result {
+                    log::error!("failed to record Windows operation evidence: {error}");
+                }
+            }
+        };
         perform_windows_update_with_install_mode_network_and_phase(
             &endpoints,
             &settings,
@@ -1764,6 +1814,7 @@ pub async fn win_perform_update(
             &report,
             &network,
             Some(&phase_hook),
+            Some(&evidence_hook),
         )
     })
     .await
@@ -1785,6 +1836,7 @@ pub async fn win_perform_update(
         // must not turn a successful install into an error.
         let _ = crate::app::staging::clear_download_cache();
     }
+    op.mark_succeeded();
     Ok(report)
 }
 
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index aff96e3..0198ff9 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -172,6 +172,7 @@ pub fn run() {
             commands::arm_destructive,
             commands::end_operation,
             commands::get_operation_snapshot,
+            commands::get_operation_completion,
             commands::confirm_quit,
             commands::win_default_install_root,
             commands::win_pick_install_dir,
diff --git a/src/app/i18n.test.tsx b/src/app/i18n.test.tsx
index d26f9e4..ae7d4e3 100644
--- a/src/app/i18n.test.tsx
+++ b/src/app/i18n.test.tsx
@@ -2,7 +2,17 @@ import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { describe, expect, it } from "vitest";
 
-import { CATALOG, dirOf, I18nProvider, LANGS, matchTag, pickLang, useI18n } from "./i18n";
+import {
+  CATALOG,
+  dirOf,
+  I18nProvider,
+  LANGS,
+  matchTag,
+  pickLang,
+  useI18n,
+  type Lang,
+  type TKey,
+} from "./i18n";
 
 describe("matchTag", () => {
   it("maps traditional-Chinese regions and scripts to zh-TW", () => {
@@ -84,6 +94,111 @@ describe("catalog placeholders", () => {
   });
 });
 
+const SAFETY_CRITICAL_PREFIXES = [
+  "install.partial.",
+  "settings.health.",
+  "uninstall.status.",
+  "uninstall.partial.",
+] as const;
+
+const SOURCE_LANGS = ["en", "zh-CN"] as const satisfies readonly Lang[];
+const SAFETY_SOURCE_COPY_ALLOWLIST = new Map<string, string>([
+  // Map each exception to the exact source key whose normalized copy may match.
+  ["zh-TW:settings.health.ok", "zh-CN:settings.health.ok"], // 「正常」 is idiomatic in both Chinese variants.
+  ["ja:settings.health.ok", "zh-CN:settings.health.ok"], // 「正常」 is also the native Japanese status label.
+]);
+
+function normalizedCopy(value: string): string {
+  return value.normalize("NFC").replace(/\s+/g, " ").trim();
+}
+
+const safetyCriticalKeys = (Object.keys(CATALOG.en) as TKey[]).filter((key) =>
+  SAFETY_CRITICAL_PREFIXES.some((prefix) => key.startsWith(prefix)),
+);
+
+describe("safety-critical catalog copy", () => {
+  it("does not copy an English or Simplified-Chinese source paragraph into another locale", () => {
+    const translatedLangs = LANGS.map((item) => item.code).filter(
+      (lang) => !SOURCE_LANGS.includes(lang as (typeof SOURCE_LANGS)[number]),
+    );
+    const sourceOwnersByCopy = new Map<string, string[]>();
+    for (const source of SOURCE_LANGS) {
+      for (const key of safetyCriticalKeys) {
+        const copy = normalizedCopy(CATALOG[source][key]);
+        sourceOwnersByCopy.set(copy, [
+          ...(sourceOwnersByCopy.get(copy) ?? []),
+          `${source}:${key}`,
+        ]);
+      }
+    }
+
+    const unapprovedCopies: string[] = [];
+    const usedAllowlistEntries = new Set<string>();
+
+    for (const lang of translatedLangs) {
+      for (const key of safetyCriticalKeys) {
+        const candidate = normalizedCopy(CATALOG[lang][key]);
+        const copiedFrom = sourceOwnersByCopy.get(candidate);
+        const allowlistEntry = `${lang}:${key}`;
+        const approvedSourceOwner = SAFETY_SOURCE_COPY_ALLOWLIST.get(allowlistEntry);
+
+        if (copiedFrom != null) {
+          if (approvedSourceOwner && copiedFrom.includes(approvedSourceOwner)) {
+            usedAllowlistEntries.add(allowlistEntry);
+          } else {
+            unapprovedCopies.push(`${allowlistEntry} duplicates ${copiedFrom.join(", ")}`);
+          }
+        }
+      }
+    }
+
+    expect(unapprovedCopies).toEqual([]);
+    expect(
+      [...SAFETY_SOURCE_COPY_ALLOWLIST.keys()].filter(
+        (entry) => !usedAllowlistEntries.has(entry),
+      ),
+    ).toEqual([]);
+  });
+
+  it("keeps partial-uninstall recovery actions distinct in every language", () => {
+    const recoveryKeys = [
+      "uninstall.partial.retryCleanup",
+      "uninstall.partial.retryProvenance",
+      "uninstall.partial.retryPurge",
+      "uninstall.partial.retryRecord",
+    ] as const satisfies readonly TKey[];
+
+    for (const { code } of LANGS) {
+      const labels = recoveryKeys.map((key) => normalizedCopy(CATALOG[code][key]));
+      expect(new Set(labels).size, code).toBe(recoveryKeys.length);
+      expect(CATALOG[code]["settings.health.resetConfirm.body.settings"], code).not.toBe(
+        CATALOG[code]["settings.health.resetConfirm.body.provenance"],
+      );
+      expect(CATALOG[code]["settings.health.reset"], code).not.toBe(
+        CATALOG[code]["settings.health.clearProvenance"],
+      );
+    }
+  });
+
+  it("keeps recovery instructions bound to their rendered action labels", () => {
+    for (const { code } of LANGS) {
+      expect(placeholders(CATALOG[code]["install.partial.note"]), code).toContain("action");
+      expect(placeholders(CATALOG[code]["install.partial.pending"]), code).toContain("action");
+      expect(
+        placeholders(CATALOG[code]["settings.health.resetConfirm.body.provenance"]),
+        code,
+      ).toContain("action");
+    }
+  });
+
+  it("ships native safety-copy sentinels for the required flow locales", () => {
+    expect(CATALOG.fr["install.partial.note"]).toContain("enregistrement de gestion");
+    expect(CATALOG.ar["settings.health.resetConfirm.body.provenance"]).toContain("سجلات التثبيت");
+    expect(CATALOG.es["uninstall.partial.retryPurge"]).toContain("datos de usuario");
+    expect(CATALOG["zh-TW"]["settings.health.restoreConfirm.body"]).toContain("目前損毀");
+  });
+});
+
 function DirProbe() {
   const { setLang } = useI18n();
   return (
diff --git a/src/app/i18n.tsx b/src/app/i18n.tsx
index 96355f4..c6a79b3 100644
--- a/src/app/i18n.tsx
+++ b/src/app/i18n.tsx
@@ -133,7 +133,8 @@ const ZH = {
   "progress.finishing": "下载完成,正在安装,请勿关闭",
   "install.done.title": "已安装 Codex",
   "install.done.open": "打开 Codex",
-  "install.partial.note": "应用已装上，但托管记录写入失败。请点「开始管理」重试记录，勿重复安装。",
+  "install.partial.note": "应用已装上，但托管记录写入失败。请点「{action}」，勿重复安装。",
+  "install.partial.pending": "安装流程已结束，但暂时无法确认 Codex 是否已写入磁盘。请点「{action}」重新检测；确认前请勿重复安装。",
   "install.partial.record": "重试写入托管记录",
 
   "success.title": "已更新",
@@ -208,11 +209,12 @@ const ZH = {
   "settings.health.unknownSource": "未知更新源已归一为自动",
   "settings.health.restore": "从 .bak 恢复",
   "settings.health.reset": "重置为默认",
+  "settings.health.clearProvenance": "清除托管记录",
   "settings.health.restoreConfirm.title": "从备份恢复 {which}？",
   "settings.health.restoreConfirm.body": "将用上一次成功保存的 .bak 覆盖当前文件。当前损坏或异常内容会被丢弃；恢复后会重新读取并核验。",
   "settings.health.resetConfirm.title": "重置 {which}？",
   "settings.health.resetConfirm.body.settings": "将丢弃当前设置并写回出厂默认（更新源、检查频率、安装方式等）。可再从 .bak 尝试恢复（若仍存在）。",
-  "settings.health.resetConfirm.body.provenance": "将清空本应用的托管记录。已安装的 Codex 不会被删除，但会被视为「未管理」，需重新「开始管理」后才能更新/卸载。",
+  "settings.health.resetConfirm.body.provenance": "将清空本应用的托管记录。已安装的 Codex 不会被删除，但会被视为「未管理」，需重新「{action}」后才能更新/卸载。",
   "settings.health.working": "处理中…",
   "settings.health.verified": "已重新读取并核验",
   "settings.health.noBackup": "没有可用的 .bak 备份",
@@ -257,6 +259,9 @@ const ZH = {
   "uninstall.status.error": "无法确认安装状态（查询失败）。不会把它当成外部安装；请重试或回到主界面检查。",
   "uninstall.status.none": "未检测到由本应用管理的 Codex 安装。",
   "uninstall.partial.title": "应用已卸载，但部分清理未完成",
+  "uninstall.partial.summary": "Codex 已卸载，但附属清理尚未完成。请仅重试下方对应步骤，无需再次卸载。",
+  "uninstall.partial.retryPending": "仍有恢复步骤未完成。请仅重试下方剩余步骤。",
+  "uninstall.partial.retryDone": "所选恢复步骤已完成。",
   "uninstall.partial.retryCleanup": "仅重试清理（快捷方式/卸载项）",
   "uninstall.partial.retryProvenance": "仅重试清除托管记录",
   "uninstall.partial.retryPurge": "仅重试清除用户数据",
@@ -411,7 +416,8 @@ const EN: Record<Key, string> = {
   "progress.finishing": "Download complete — installing, don't close",
   "install.done.title": "Codex installed",
   "install.done.open": "Open Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
+  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use “{action}” — do not reinstall.",
+  "install.partial.pending": "Installation finished, but Codex could not yet be confirmed on disk. Use “{action}” to check again; do not reinstall until it is confirmed.",
   "install.partial.record": "Retry managed record",
 
   "success.title": "Updated",
@@ -486,11 +492,12 @@ const EN: Record<Key, string> = {
   "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
   "settings.health.restore": "Restore from .bak",
   "settings.health.reset": "Reset to defaults",
+  "settings.health.clearProvenance": "Clear managed records",
   "settings.health.restoreConfirm.title": "Restore {which} from backup?",
   "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
   "settings.health.resetConfirm.title": "Reset {which}?",
   "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
+  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you use “{action}” again.",
   "settings.health.working": "Working…",
   "settings.health.verified": "Re-read and verified",
   "settings.health.noBackup": "No .bak backup available",
@@ -535,6 +542,9 @@ const EN: Record<Key, string> = {
   "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
   "uninstall.status.none": "No manager-managed Codex install was detected.",
   "uninstall.partial.title": "App removed, but some cleanup did not finish",
+  "uninstall.partial.summary": "Codex was removed, but ancillary cleanup is incomplete. Retry only the matching step below; do not uninstall again.",
+  "uninstall.partial.retryPending": "Some recovery steps are still incomplete. Retry only the remaining steps below.",
+  "uninstall.partial.retryDone": "The selected recovery step completed.",
   "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
   "uninstall.partial.retryProvenance": "Retry clearing managed records only",
   "uninstall.partial.retryPurge": "Retry purging user data only",
@@ -686,8 +696,9 @@ const FR: Record<Key, string> = {
   "progress.finishing": "Téléchargement terminé — installation, ne pas fermer",
   "install.done.title": "Codex installé",
   "install.done.open": "Ouvrir Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "L’application est installée, mais l’enregistrement de gestion n’a pas pu être sauvegardé. Utilisez « {action} » — ne réinstallez pas l’application.",
+  "install.partial.pending": "L’installation est terminée, mais la présence de Codex sur le disque n’a pas encore pu être confirmée. Utilisez « {action} » pour vérifier à nouveau ; ne réinstallez pas avant confirmation.",
+  "install.partial.record": "Réessayer l’enregistrement de gestion",
 
   "success.title": "Mis à jour",
   "success.flow": "Mis à jour {from} → {to}",
@@ -751,25 +762,26 @@ const FR: Record<Key, string> = {
   "settings.more.configUnavailable": "Non disponible dans cette version",
   "settings.saveError": "Impossible d'enregistrer les réglages",
   "settings.retry": "Réessayer",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "État de la configuration",
+  "settings.health.ok": "Correct",
+  "settings.health.recovered": "Restauré depuis la sauvegarde",
+  "settings.health.corrupt": "Endommagé",
+  "settings.health.settings": "Fichier de paramètres",
+  "settings.health.provenance": "Enregistrements d’installation gérée",
+  "settings.health.detail": "Détails",
+  "settings.health.unknownSource": "La source de mise à jour inconnue a été remplacée par Automatique",
+  "settings.health.restore": "Restaurer depuis .bak",
+  "settings.health.reset": "Rétablir les valeurs par défaut",
+  "settings.health.clearProvenance": "Effacer les enregistrements de gestion",
+  "settings.health.restoreConfirm.title": "Restaurer {which} depuis la sauvegarde ?",
+  "settings.health.restoreConfirm.body": "Remplace le fichier actuel par le dernier .bak enregistré avec succès. Le contenu endommagé ou inattendu actuel sera supprimé ; l’état sera relu et vérifié ensuite.",
+  "settings.health.resetConfirm.title": "Réinitialiser {which} ?",
+  "settings.health.resetConfirm.body.settings": "Supprime les paramètres actuels et rétablit les valeurs d’usine (source de mise à jour, fréquence des vérifications, mode d’installation, etc.). Vous pourrez encore tenter une restauration .bak si une sauvegarde subsiste.",
+  "settings.health.resetConfirm.body.provenance": "Efface les enregistrements d’installation gérée de cette application. Codex n’est pas supprimé, mais apparaîtra comme non géré jusqu’à ce que vous utilisiez à nouveau « {action} » ; jusque-là, sa mise à jour et sa désinstallation seront indisponibles.",
+  "settings.health.working": "Traitement…",
+  "settings.health.verified": "Relu et vérifié",
+  "settings.health.noBackup": "Aucune sauvegarde .bak disponible",
+  "settings.health.banner": "La configuration requiert votre attention : l’état des paramètres ou des enregistrements d’installation gérée est anormal. Restaurez-les ou réinitialisez-les ci-dessous.",
   "settings.appearance.header": "Apparence",
   "settings.appearance.theme": "Thème",
   "settings.appearance.system": "Système",
@@ -806,14 +818,17 @@ const FR: Record<Key, string> = {
   "uninstall.heading": "Désinstaller Codex",
   "uninstall.warn": "Ceci supprime l'application Codex de votre ordinateur.",
   "uninstall.needAdopt": "Ce Codex est une installation externe. Prenez-le en charge depuis l'écran principal, puis revenez pour le désinstaller.",
-  "uninstall.status.loading": "正在检查安装状态…",
-  "uninstall.status.error": "无法确认安装状态（查询失败）。不会把它当成外部安装；请重试或回到主界面检查。",
-  "uninstall.status.none": "未检测到由本应用管理的 Codex 安装。",
-  "uninstall.partial.title": "应用已卸载，但部分清理未完成",
-  "uninstall.partial.retryCleanup": "仅重试清理（快捷方式/卸载项）",
-  "uninstall.partial.retryProvenance": "仅重试清除托管记录",
-  "uninstall.partial.retryPurge": "仅重试清除用户数据",
-  "uninstall.partial.retryRecord": "仅重试写入托管记录",
+  "uninstall.status.loading": "Vérification de l’état de l’installation…",
+  "uninstall.status.error": "Impossible de confirmer l’état de l’installation (échec de la vérification). Elle n’est pas considérée comme une installation externe — réessayez ou vérifiez l’écran d’accueil.",
+  "uninstall.status.none": "Aucune installation de Codex gérée par cette application n’a été détectée.",
+  "uninstall.partial.title": "L’application a été supprimée, mais une partie du nettoyage n’est pas terminée",
+  "uninstall.partial.summary": "Codex a été supprimé, mais le nettoyage annexe est incomplet. Réessayez uniquement l’étape correspondante ci-dessous ; ne relancez pas la désinstallation.",
+  "uninstall.partial.retryPending": "Certaines étapes de récupération restent incomplètes. Réessayez uniquement les étapes restantes ci-dessous.",
+  "uninstall.partial.retryDone": "L’étape de récupération sélectionnée est terminée.",
+  "uninstall.partial.retryCleanup": "Réessayer uniquement le nettoyage (raccourcis / entrée de désinstallation)",
+  "uninstall.partial.retryProvenance": "Réessayer uniquement l’effacement des enregistrements de gestion",
+  "uninstall.partial.retryPurge": "Réessayer uniquement l’effacement des données utilisateur",
+  "uninstall.partial.retryRecord": "Réessayer uniquement l’écriture de l’enregistrement de gestion",
   "uninstall.keepData": "Conserver mes données",
   "uninstall.keepDataNote": "Connexion, sessions et configuration ({path}) sont conservées ; une réinstallation reprend où vous en étiez.",
   "uninstall.dataPath": "Emplacement des données",
@@ -962,8 +977,9 @@ const ZH_TW: Record<Key, string> = {
   "progress.finishing": "下載完成,正在安裝,請勿關閉",
   "install.done.title": "Codex 已安裝",
   "install.done.open": "開啟 Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "應用程式已安裝，但無法寫入受管理記錄。請按「{action}」，請勿重複安裝。",
+  "install.partial.pending": "安裝流程已結束，但目前無法確認 Codex 是否已寫入磁碟。請按「{action}」重新偵測；確認前請勿重複安裝。",
+  "install.partial.record": "重試寫入受管理記錄",
 
   "success.title": "更新完成",
   "success.flow": "已更新 {from} → {to}",
@@ -1031,25 +1047,26 @@ const ZH_TW: Record<Key, string> = {
   "settings.more.configUnavailable": "目前版本尚未提供",
   "settings.saveError": "設定儲存失敗",
   "settings.retry": "重試",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "設定健康狀態",
+  "settings.health.ok": "正常",
+  "settings.health.recovered": "已從備份還原",
+  "settings.health.corrupt": "已損毀",
+  "settings.health.settings": "設定檔",
+  "settings.health.provenance": "受管理記錄",
+  "settings.health.detail": "詳細資料",
+  "settings.health.unknownSource": "未知的更新來源已正規化為自動",
+  "settings.health.restore": "從 .bak 還原",
+  "settings.health.reset": "重設為預設值",
+  "settings.health.clearProvenance": "清除受管理記錄",
+  "settings.health.restoreConfirm.title": "從備份還原 {which}？",
+  "settings.health.restoreConfirm.body": "將使用上一次成功儲存的 .bak 覆寫目前檔案。目前損毀或異常的內容會被捨棄；還原後會重新讀取並驗證狀態。",
+  "settings.health.resetConfirm.title": "重設 {which}？",
+  "settings.health.resetConfirm.body.settings": "將捨棄目前設定並寫入出廠預設值（更新來源、檢查頻率、安裝方式等）。若備份仍存在，可再嘗試從 .bak 還原。",
+  "settings.health.resetConfirm.body.provenance": "將清除本應用程式的受管理記錄。已安裝的 Codex 不會被刪除，但在重新「{action}」前會顯示為未管理，且無法更新或解除安裝。",
+  "settings.health.working": "處理中…",
+  "settings.health.verified": "已重新讀取並驗證",
+  "settings.health.noBackup": "沒有可用的 .bak 備份",
+  "settings.health.banner": "設定需要處理：設定檔或受管理記錄的狀態異常。請在下方還原或重設。",
   "settings.appearance.header": "外觀",
   "settings.appearance.theme": "主題",
   "settings.appearance.system": "跟隨系統",
@@ -1087,14 +1104,17 @@ const ZH_TW: Record<Key, string> = {
   "uninstall.warn": "這將從你的電腦移除 Codex 應用程式。",
   "uninstall.needAdopt":
     "這是外部安裝的 Codex。請先在主畫面點選「開始管理」，再回來卸載。",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "正在檢查安裝狀態…",
+  "uninstall.status.error": "無法確認安裝狀態（查詢失敗）。不會將其視為外部安裝；請重試或返回主畫面檢查。",
+  "uninstall.status.none": "未偵測到由本應用程式管理的 Codex 安裝。",
+  "uninstall.partial.title": "應用程式已解除安裝，但部分清理尚未完成",
+  "uninstall.partial.summary": "Codex 已解除安裝，但附屬清理尚未完成。請僅重試下方對應步驟，無需再次解除安裝。",
+  "uninstall.partial.retryPending": "仍有復原步驟未完成。請僅重試下方剩餘步驟。",
+  "uninstall.partial.retryDone": "所選復原步驟已完成。",
+  "uninstall.partial.retryCleanup": "僅重試清理（捷徑／解除安裝項目）",
+  "uninstall.partial.retryProvenance": "僅重試清除受管理記錄",
+  "uninstall.partial.retryPurge": "僅重試清除使用者資料",
+  "uninstall.partial.retryRecord": "僅重試寫入受管理記錄",
   "uninstall.keepData": "保留我的資料",
   "uninstall.keepDataNote":
     "登入狀態、工作階段與設定（{path}）都會保留；重新安裝後可繼續使用。",
@@ -1248,8 +1268,9 @@ const DE: Record<Key, string> = {
   "progress.finishing": "Download abgeschlossen – wird installiert, nicht schließen",
   "install.done.title": "Codex installiert",
   "install.done.open": "Codex öffnen",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "Die App ist installiert, aber der Verwaltungsdatensatz konnte nicht gespeichert werden. Wählen Sie „{action}“ – installieren Sie die App nicht erneut.",
+  "install.partial.pending": "Die Installation ist abgeschlossen, aber Codex konnte auf dem Datenträger noch nicht bestätigt werden. Wählen Sie „{action}“, um erneut zu prüfen; installieren Sie die App bis zur Bestätigung nicht erneut.",
+  "install.partial.record": "Verwaltungsdatensatz erneut schreiben",
 
   "success.title": "Aktualisiert",
   "success.flow": "Aktualisiert {from} → {to}",
@@ -1317,25 +1338,26 @@ const DE: Record<Key, string> = {
   "settings.more.configUnavailable": "In dieser Version nicht verfügbar",
   "settings.saveError": "Einstellungen konnten nicht gespeichert werden",
   "settings.retry": "Erneut versuchen",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "Konfigurationszustand",
+  "settings.health.ok": "In Ordnung",
+  "settings.health.recovered": "Aus Sicherung wiederhergestellt",
+  "settings.health.corrupt": "Beschädigt",
+  "settings.health.settings": "Einstellungsdatei",
+  "settings.health.provenance": "Datensätze verwalteter Installationen",
+  "settings.health.detail": "Einzelheiten",
+  "settings.health.unknownSource": "Unbekannte Updatequelle wurde auf Automatisch zurückgesetzt",
+  "settings.health.restore": "Aus .bak wiederherstellen",
+  "settings.health.reset": "Auf Standardwerte zurücksetzen",
+  "settings.health.clearProvenance": "Verwaltungsdatensätze löschen",
+  "settings.health.restoreConfirm.title": "{which} aus Sicherung wiederherstellen?",
+  "settings.health.restoreConfirm.body": "Ersetzt die aktuelle Datei durch die letzte erfolgreich gespeicherte .bak-Datei. Beschädigte oder unerwartete aktuelle Inhalte werden verworfen; anschließend wird der Zustand neu eingelesen und überprüft.",
+  "settings.health.resetConfirm.title": "{which} zurücksetzen?",
+  "settings.health.resetConfirm.body.settings": "Verwirft die aktuellen Einstellungen und schreibt die Werkseinstellungen (Updatequelle, Prüfintervall, Installationsmodus usw.). Wenn noch eine Sicherung vorhanden ist, können Sie weiterhin eine Wiederherstellung aus .bak versuchen.",
+  "settings.health.resetConfirm.body.provenance": "Löscht die Datensätze verwalteter Installationen dieser App. Das installierte Codex wird nicht gelöscht, erscheint jedoch als nicht verwaltet, bis Sie erneut „{action}“ wählen; bis dahin sind Update und Deinstallation nicht möglich.",
+  "settings.health.working": "Wird verarbeitet…",
+  "settings.health.verified": "Neu eingelesen und überprüft",
+  "settings.health.noBackup": "Keine .bak-Sicherung verfügbar",
+  "settings.health.banner": "Die Konfiguration erfordert Aufmerksamkeit: Einstellungen oder Datensätze verwalteter Installationen sind fehlerhaft. Stellen Sie sie unten wieder her oder setzen Sie sie zurück.",
   "settings.appearance.header": "Darstellung",
   "settings.appearance.theme": "Design",
   "settings.appearance.system": "System",
@@ -1373,14 +1395,17 @@ const DE: Record<Key, string> = {
   "uninstall.warn": "Dadurch wird die Codex App von deinem Computer entfernt.",
   "uninstall.needAdopt":
     "Dies ist ein extern installiertes Codex. Übernimm zuerst die Verwaltung im Hauptbildschirm, dann komme hierher zurück.",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "Installationsstatus wird geprüft…",
+  "uninstall.status.error": "Der Installationsstatus konnte nicht bestätigt werden (Prüfung fehlgeschlagen). Dies wird nicht als externe Installation behandelt – versuchen Sie es erneut oder prüfen Sie den Startbildschirm.",
+  "uninstall.status.none": "Keine von dieser App verwaltete Codex-Installation erkannt.",
+  "uninstall.partial.title": "App entfernt, aber einige Bereinigungen sind noch nicht abgeschlossen",
+  "uninstall.partial.summary": "Codex wurde entfernt, aber die zusätzliche Bereinigung ist unvollständig. Wiederholen Sie nur den passenden Schritt unten; deinstallieren Sie nicht erneut.",
+  "uninstall.partial.retryPending": "Einige Wiederherstellungsschritte sind noch unvollständig. Wiederholen Sie nur die verbleibenden Schritte unten.",
+  "uninstall.partial.retryDone": "Der ausgewählte Wiederherstellungsschritt wurde abgeschlossen.",
+  "uninstall.partial.retryCleanup": "Nur Bereinigung erneut versuchen (Verknüpfungen / Deinstallationseintrag)",
+  "uninstall.partial.retryProvenance": "Nur Löschen der Verwaltungsdatensätze erneut versuchen",
+  "uninstall.partial.retryPurge": "Nur Löschen der Benutzerdaten erneut versuchen",
+  "uninstall.partial.retryRecord": "Nur Schreiben des Verwaltungsdatensatzes erneut versuchen",
   "uninstall.keepData": "Meine Daten behalten",
   "uninstall.keepDataNote":
     "Anmeldung, Sitzungen und Konfiguration ({path}) bleiben erhalten; nach einer Neuinstallation kannst du weitermachen.",
@@ -1534,8 +1559,9 @@ const KO: Record<Key, string> = {
   "progress.finishing": "다운로드 완료 — 설치 중, 닫지 마세요",
   "install.done.title": "Codex 설치 완료",
   "install.done.open": "Codex 열기",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "앱은 설치되었지만 관리 기록을 저장하지 못했습니다. ‘{action}’ 버튼을 눌러 주세요. 앱을 다시 설치하지 마세요.",
+  "install.partial.pending": "설치 작업은 끝났지만 디스크에 Codex가 설치되었는지 아직 확인하지 못했습니다. ‘{action}’ 버튼을 눌러 다시 확인하세요. 확인되기 전에는 다시 설치하지 마세요.",
+  "install.partial.record": "관리 기록 저장 다시 시도",
 
   "success.title": "업데이트 완료",
   "success.flow": "{from} → {to} 업데이트 완료",
@@ -1603,25 +1629,26 @@ const KO: Record<Key, string> = {
   "settings.more.configUnavailable": "이 버전에서는 사용할 수 없습니다",
   "settings.saveError": "설정을 저장하지 못했습니다",
   "settings.retry": "다시 시도",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "구성 상태",
+  "settings.health.ok": "정상",
+  "settings.health.recovered": "백업에서 복원됨",
+  "settings.health.corrupt": "손상됨",
+  "settings.health.settings": "설정 파일",
+  "settings.health.provenance": "관리 설치 기록",
+  "settings.health.detail": "세부 정보",
+  "settings.health.unknownSource": "알 수 없는 업데이트 소스를 자동으로 변경함",
+  "settings.health.restore": ".bak에서 복원",
+  "settings.health.reset": "기본값으로 재설정",
+  "settings.health.clearProvenance": "관리 기록 삭제",
+  "settings.health.restoreConfirm.title": "백업에서 {which} 복원?",
+  "settings.health.restoreConfirm.body": "마지막으로 저장에 성공한 .bak 파일로 현재 파일을 덮어씁니다. 현재의 손상되거나 예상치 못한 내용은 삭제되며, 복원 후 상태를 다시 읽고 확인합니다.",
+  "settings.health.resetConfirm.title": "{which} 재설정?",
+  "settings.health.resetConfirm.body.settings": "현재 설정을 삭제하고 공장 기본값(업데이트 소스, 확인 주기, 설치 방식 등)을 기록합니다. 백업이 남아 있으면 .bak 복원을 다시 시도할 수 있습니다.",
+  "settings.health.resetConfirm.body.provenance": "이 앱의 관리 설치 기록을 삭제합니다. 설치된 Codex는 삭제되지 않지만 ‘{action}’을 다시 수행할 때까지 관리되지 않는 앱으로 표시되며, 그때까지 업데이트하거나 제거할 수 없습니다.",
+  "settings.health.working": "처리 중…",
+  "settings.health.verified": "다시 읽고 확인함",
+  "settings.health.noBackup": "사용 가능한 .bak 백업 없음",
+  "settings.health.banner": "구성을 확인해야 합니다. 설정 또는 관리 설치 기록 상태가 비정상입니다. 아래에서 복원하거나 재설정하세요.",
   "settings.appearance.header": "외관",
   "settings.appearance.theme": "테마",
   "settings.appearance.system": "시스템",
@@ -1659,14 +1686,17 @@ const KO: Record<Key, string> = {
   "uninstall.warn": "이 작업은 컴퓨터에서 Codex 앱을 제거합니다.",
   "uninstall.needAdopt":
     "외부에서 설치된 Codex입니다. 먼저 메인 화면에서 '관리 시작'을 누른 후 제거해 주세요.",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "설치 상태 확인 중…",
+  "uninstall.status.error": "설치 상태를 확인하지 못했습니다(조회 실패). 외부 설치로 간주하지 않습니다. 다시 시도하거나 홈 화면에서 확인하세요.",
+  "uninstall.status.none": "이 앱에서 관리하는 Codex 설치를 찾지 못했습니다.",
+  "uninstall.partial.title": "앱은 제거되었지만 일부 정리가 완료되지 않았습니다",
+  "uninstall.partial.summary": "Codex는 제거되었지만 부가 정리가 완료되지 않았습니다. 아래에서 해당 단계만 다시 시도하고 제거를 반복하지 마세요.",
+  "uninstall.partial.retryPending": "일부 복구 단계가 아직 완료되지 않았습니다. 아래의 남은 단계만 다시 시도하세요.",
+  "uninstall.partial.retryDone": "선택한 복구 단계가 완료되었습니다.",
+  "uninstall.partial.retryCleanup": "정리만 다시 시도(바로 가기/제거 항목)",
+  "uninstall.partial.retryProvenance": "관리 기록 삭제만 다시 시도",
+  "uninstall.partial.retryPurge": "사용자 데이터 삭제만 다시 시도",
+  "uninstall.partial.retryRecord": "관리 기록 쓰기만 다시 시도",
   "uninstall.keepData": "데이터 유지",
   "uninstall.keepDataNote":
     "로그인 상태, 세션 및 구성({path})이 보존되며, 재설치 후에도 이어서 사용할 수 있습니다.",
@@ -1812,8 +1842,9 @@ const JA: Record<Key, string> = {
   "progress.finishing": "ダウンロード完了 — インストール中です。閉じないでください",
   "install.done.title": "Codex をインストールしました",
   "install.done.open": "Codex を開く",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "アプリはインストールされていますが、管理記録を保存できませんでした。「{action}」を選んでください。再インストールはしないでください。",
+  "install.partial.pending": "インストール処理は完了しましたが、Codex がディスク上にあることをまだ確認できません。「{action}」を選んで再確認してください。確認できるまで再インストールしないでください。",
+  "install.partial.record": "管理記録の保存を再試行",
   "success.title": "アップデート完了",
   "success.flow": "{from} → {to} に更新",
   "success.manualLaunch": "Codex を手動で起動してください",
@@ -1878,25 +1909,26 @@ const JA: Record<Key, string> = {
   "settings.more.configUnavailable": "このリリースでは利用できません",
   "settings.saveError": "設定を保存できませんでした",
   "settings.retry": "再試行",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "構成の状態",
+  "settings.health.ok": "正常",
+  "settings.health.recovered": "バックアップから復元済み",
+  "settings.health.corrupt": "破損",
+  "settings.health.settings": "設定ファイル",
+  "settings.health.provenance": "管理対象インストールの記録",
+  "settings.health.detail": "詳細",
+  "settings.health.unknownSource": "不明な更新元を「自動」に変更しました",
+  "settings.health.restore": ".bak から復元",
+  "settings.health.reset": "既定値にリセット",
+  "settings.health.clearProvenance": "管理記録を消去",
+  "settings.health.restoreConfirm.title": "バックアップから {which} を復元しますか？",
+  "settings.health.restoreConfirm.body": "現在のファイルを、最後に正常に保存された .bak で上書きします。現在の破損した内容や予期しない内容は破棄され、復元後に状態を再読み込みして検証します。",
+  "settings.health.resetConfirm.title": "{which} をリセットしますか？",
+  "settings.health.resetConfirm.body.settings": "現在の設定を破棄し、工場出荷時の既定値（更新元、確認頻度、インストール方式など）を書き込みます。バックアップが残っている場合は、引き続き .bak からの復元を試せます。",
+  "settings.health.resetConfirm.body.provenance": "このアプリの管理対象インストール記録を消去します。インストール済みの Codex は削除されませんが、もう一度「{action}」するまで未管理として表示され、更新やアンインストールはできません。",
+  "settings.health.working": "処理中…",
+  "settings.health.verified": "再読み込みして検証済み",
+  "settings.health.noBackup": "利用できる .bak バックアップがありません",
+  "settings.health.banner": "構成を確認してください。設定または管理対象インストール記録の状態に問題があります。以下から復元またはリセットしてください。",
   "settings.appearance.header": "外観",
   "settings.appearance.theme": "テーマ",
   "settings.appearance.system": "システム設定に従う",
@@ -1931,14 +1963,17 @@ const JA: Record<Key, string> = {
   "uninstall.heading": "Codex をアンインストール",
   "uninstall.warn": "Codex アプリをこのコンピューターから削除します。",
   "uninstall.needAdopt": "これは外部インストールの Codex です。まずメイン画面で「管理を開始」してから、アンインストールに戻ってください。",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "インストール状態を確認中…",
+  "uninstall.status.error": "インストール状態を確認できませんでした（確認に失敗）。外部インストールとは見なしません。再試行するか、ホーム画面で確認してください。",
+  "uninstall.status.none": "このアプリが管理する Codex のインストールは検出されませんでした。",
+  "uninstall.partial.title": "アプリは削除されましたが、一部のクリーンアップが完了していません",
+  "uninstall.partial.summary": "Codex は削除されましたが、付随するクリーンアップが完了していません。以下の該当手順だけを再試行し、アンインストールを繰り返さないでください。",
+  "uninstall.partial.retryPending": "一部の復旧手順がまだ完了していません。以下の残りの手順だけを再試行してください。",
+  "uninstall.partial.retryDone": "選択した復旧手順が完了しました。",
+  "uninstall.partial.retryCleanup": "クリーンアップのみ再試行（ショートカット／アンインストール項目）",
+  "uninstall.partial.retryProvenance": "管理記録の消去のみ再試行",
+  "uninstall.partial.retryPurge": "ユーザーデータの消去のみ再試行",
+  "uninstall.partial.retryRecord": "管理記録の書き込みのみ再試行",
   "uninstall.keepData": "データを保持する",
   "uninstall.keepDataNote": "サインイン情報、セッション、設定（{path}）は保持されます。再インストール後も続きから使えます。",
   "uninstall.dataPath": "データの場所",
@@ -2078,8 +2113,9 @@ const RU: Record<Key, string> = {
   "progress.finishing": "Загрузка завершена — установка, не закрывайте",
   "install.done.title": "Codex установлен",
   "install.done.open": "Открыть Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "Приложение установлено, но запись об управлении не удалось сохранить. Нажмите «{action}» — не переустанавливайте приложение.",
+  "install.partial.pending": "Установка завершена, но наличие Codex на диске пока не подтверждено. Нажмите «{action}», чтобы проверить снова; не переустанавливайте приложение до подтверждения.",
+  "install.partial.record": "Повторить сохранение записи об управлении",
   "success.title": "Обновлено",
   "success.flow": "Обновлено {from} → {to}",
   "success.manualLaunch": "Запустите Codex вручную",
@@ -2144,25 +2180,26 @@ const RU: Record<Key, string> = {
   "settings.more.configUnavailable": "Недоступно в этом выпуске",
   "settings.saveError": "Не удалось сохранить настройки",
   "settings.retry": "Повторить",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "Состояние конфигурации",
+  "settings.health.ok": "Исправно",
+  "settings.health.recovered": "Восстановлено из резервной копии",
+  "settings.health.corrupt": "Повреждено",
+  "settings.health.settings": "Файл настроек",
+  "settings.health.provenance": "Записи об управляемых установках",
+  "settings.health.detail": "Подробности",
+  "settings.health.unknownSource": "Неизвестный источник обновлений заменён на автоматический",
+  "settings.health.restore": "Восстановить из .bak",
+  "settings.health.reset": "Сбросить до значений по умолчанию",
+  "settings.health.clearProvenance": "Удалить записи об управлении",
+  "settings.health.restoreConfirm.title": "Восстановить {which} из резервной копии?",
+  "settings.health.restoreConfirm.body": "Текущий файл будет заменён последним успешно сохранённым файлом .bak. Текущее повреждённое или непредвиденное содержимое будет удалено; затем состояние будет повторно прочитано и проверено.",
+  "settings.health.resetConfirm.title": "Сбросить {which}?",
+  "settings.health.resetConfirm.body.settings": "Текущие настройки будут удалены и заменены заводскими значениями (источник обновлений, частота проверки, способ установки и т. д.). Если резервная копия сохранилась, восстановление из .bak по-прежнему можно будет выполнить.",
+  "settings.health.resetConfirm.body.provenance": "Записи об управляемых установках этого приложения будут удалены. Установленный Codex удалён не будет, но будет отображаться как неуправляемый, пока вы снова не выберете «{action}»; до этого обновление и удаление будут недоступны.",
+  "settings.health.working": "Обработка…",
+  "settings.health.verified": "Повторно прочитано и проверено",
+  "settings.health.noBackup": "Нет доступной резервной копии .bak",
+  "settings.health.banner": "Конфигурация требует внимания: состояние настроек или записей об управляемых установках нарушено. Восстановите или сбросьте их ниже.",
   "settings.appearance.header": "Внешний вид",
   "settings.appearance.theme": "Тема",
   "settings.appearance.system": "Системная",
@@ -2197,14 +2234,17 @@ const RU: Record<Key, string> = {
   "uninstall.heading": "Удаление Codex",
   "uninstall.warn": "Это удалит приложение Codex с вашего компьютера.",
   "uninstall.needAdopt": "Этот Codex установлен внешним образом. Сначала нажмите «Взять под управление» на главном экране, затем вернитесь сюда для удаления.",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "Проверка состояния установки…",
+  "uninstall.status.error": "Не удалось подтвердить состояние установки (сбой проверки). Она не считается внешней установкой — повторите попытку или проверьте главный экран.",
+  "uninstall.status.none": "Управляемая этим приложением установка Codex не обнаружена.",
+  "uninstall.partial.title": "Приложение удалено, но часть очистки не завершена",
+  "uninstall.partial.summary": "Codex удалён, но дополнительная очистка не завершена. Повторите только соответствующий шаг ниже; не запускайте удаление снова.",
+  "uninstall.partial.retryPending": "Некоторые шаги восстановления ещё не завершены. Повторите только оставшиеся шаги ниже.",
+  "uninstall.partial.retryDone": "Выбранный шаг восстановления завершён.",
+  "uninstall.partial.retryCleanup": "Повторить только очистку (ярлыки / запись удаления)",
+  "uninstall.partial.retryProvenance": "Повторить только удаление записей об управлении",
+  "uninstall.partial.retryPurge": "Повторить только удаление пользовательских данных",
+  "uninstall.partial.retryRecord": "Повторить только сохранение записи об управлении",
   "uninstall.keepData": "Сохранить мои данные",
   "uninstall.keepDataNote": "Данные для входа, сессии и конфигурация ({path}) сохранятся; после переустановки всё продолжит работать.",
   "uninstall.dataPath": "Расположение данных",
@@ -2344,8 +2384,9 @@ const AR: Record<Key, string> = {
   "progress.finishing": "اكتمل التنزيل — جارٍ التثبيت، لا تغلق النافذة",
   "install.done.title": "تم تثبيت Codex",
   "install.done.open": "فتح Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "تم تثبيت التطبيق، لكن تعذّر حفظ سجل الإدارة. استخدم «{action}» — لا تُعِد تثبيت التطبيق.",
+  "install.partial.pending": "انتهت عملية التثبيت، لكن لم يتأكد بعد وجود \u2066Codex\u2069 على القرص. استخدم «{action}» لإعادة التحقق؛ لا تُعِد التثبيت قبل التأكد.",
+  "install.partial.record": "إعادة محاولة حفظ سجل الإدارة",
   "success.title": "تم التحديث",
   "success.flow": "تم التحديث {from} ← {to}",
   "success.manualLaunch": "يُرجى تشغيل Codex يدوياً",
@@ -2410,25 +2451,26 @@ const AR: Record<Key, string> = {
   "settings.more.configUnavailable": "غير متوفر في هذا الإصدار",
   "settings.saveError": "تعذر حفظ الإعدادات",
   "settings.retry": "إعادة المحاولة",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "سلامة الإعدادات",
+  "settings.health.ok": "سليم",
+  "settings.health.recovered": "تمت الاستعادة من النسخة الاحتياطية",
+  "settings.health.corrupt": "تالف",
+  "settings.health.settings": "ملف الإعدادات",
+  "settings.health.provenance": "سجلات التثبيت المُدار",
+  "settings.health.detail": "التفاصيل",
+  "settings.health.unknownSource": "تم تحويل مصدر التحديث غير المعروف إلى «تلقائي»",
+  "settings.health.restore": "استعادة من \u2066.bak\u2069",
+  "settings.health.reset": "إعادة الضبط إلى الإعدادات الافتراضية",
+  "settings.health.clearProvenance": "مسح سجلات الإدارة",
+  "settings.health.restoreConfirm.title": "استعادة {which} من النسخة الاحتياطية؟",
+  "settings.health.restoreConfirm.body": "يستبدل الملف الحالي بآخر ملف \u2066.bak\u2069 حُفظ بنجاح. سيُحذف المحتوى الحالي التالف أو غير المتوقع، ثم تُعاد قراءة الحالة والتحقق منها.",
+  "settings.health.resetConfirm.title": "إعادة ضبط {which}؟",
+  "settings.health.resetConfirm.body.settings": "يؤدي ذلك إلى حذف الإعدادات الحالية وكتابة إعدادات المصنع الافتراضية (مصدر التحديث، وتكرار الفحص، ووضع التثبيت، وما إلى ذلك). يمكنك محاولة الاستعادة من \u2066.bak\u2069 إذا بقيت نسخة احتياطية.",
+  "settings.health.resetConfirm.body.provenance": "يؤدي ذلك إلى مسح سجلات التثبيت المُدار لهذا التطبيق. لن يُحذف \u2066Codex\u2069 المثبّت، لكنه سيظهر كتثبيت غير مُدار إلى أن تستخدم «{action}» مرة أخرى؛ وحتى ذلك الحين لن تتمكن من تحديثه أو إلغاء تثبيته.",
+  "settings.health.working": "جارٍ المعالجة…",
+  "settings.health.verified": "تمت إعادة القراءة والتحقق",
+  "settings.health.noBackup": "لا تتوفر نسخة احتياطية \u2066.bak\u2069",
+  "settings.health.banner": "تحتاج الإعدادات إلى الانتباه: حالة ملف الإعدادات أو سجلات التثبيت المُدار غير سليمة. استعدها أو أعد ضبطها أدناه.",
   "settings.appearance.header": "المظهر",
   "settings.appearance.theme": "السمة",
   "settings.appearance.system": "حسب النظام",
@@ -2463,14 +2505,17 @@ const AR: Record<Key, string> = {
   "uninstall.heading": "إلغاء تثبيت Codex",
   "uninstall.warn": "سيُزيل هذا تطبيق Codex من جهازك.",
   "uninstall.needAdopt": "هذا Codex مثبَّت خارجياً. ابدأ إدارته من الشاشة الرئيسية أولاً، ثم عد لإلغاء التثبيت.",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "جارٍ التحقق من حالة التثبيت…",
+  "uninstall.status.error": "تعذّر تأكيد حالة التثبيت (فشل الفحص). لن يُعامل كتثبيت خارجي — أعد المحاولة أو تحقّق من الشاشة الرئيسية.",
+  "uninstall.status.none": "لم يُكتشف أي تثبيت لـ \u2066Codex\u2069 يديره هذا التطبيق.",
+  "uninstall.partial.title": "تمت إزالة التطبيق، لكن بعض أعمال التنظيف لم تكتمل",
+  "uninstall.partial.summary": "تمت إزالة \u2066Codex\u2069، لكن التنظيف الإضافي لم يكتمل. أعد محاولة الخطوة المطابقة أدناه فقط، ولا تُعِد إلغاء التثبيت.",
+  "uninstall.partial.retryPending": "لا تزال بعض خطوات الاسترداد غير مكتملة. أعد محاولة الخطوات المتبقية أدناه فقط.",
+  "uninstall.partial.retryDone": "اكتملت خطوة الاسترداد المحددة.",
+  "uninstall.partial.retryCleanup": "إعادة محاولة التنظيف فقط (الاختصارات / إدخال إلغاء التثبيت)",
+  "uninstall.partial.retryProvenance": "إعادة محاولة مسح سجلات الإدارة فقط",
+  "uninstall.partial.retryPurge": "إعادة محاولة مسح بيانات المستخدم فقط",
+  "uninstall.partial.retryRecord": "إعادة محاولة كتابة سجل الإدارة فقط",
   "uninstall.keepData": "الاحتفاظ ببياناتي",
   "uninstall.keepDataNote": "سيُحتفظ بتسجيل الدخول والجلسات والإعدادات ({path})؛ يمكن استئنافها بعد إعادة التثبيت.",
   "uninstall.dataPath": "موقع البيانات",
@@ -2610,8 +2655,9 @@ const ES: Record<Key, string> = {
   "progress.finishing": "Descarga completa — instalando, no cierres",
   "install.done.title": "Codex instalado",
   "install.done.open": "Abrir Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "La aplicación está instalada, pero no se pudo guardar el registro de administración. Usa «{action}»; no reinstales la aplicación.",
+  "install.partial.pending": "La instalación terminó, pero aún no se pudo confirmar que Codex esté en el disco. Usa «{action}» para comprobarlo de nuevo; no reinstales la aplicación hasta confirmarlo.",
+  "install.partial.record": "Reintentar el registro de administración",
   "success.title": "Actualizado",
   "success.flow": "Actualizado {from} → {to}",
   "success.manualLaunch": "Inicia Codex manualmente",
@@ -2676,25 +2722,26 @@ const ES: Record<Key, string> = {
   "settings.more.configUnavailable": "No disponible en esta versión",
   "settings.saveError": "No se pudo guardar la configuración",
   "settings.retry": "Reintentar",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "Estado de la configuración",
+  "settings.health.ok": "Correcta",
+  "settings.health.recovered": "Restaurada desde la copia de seguridad",
+  "settings.health.corrupt": "Dañada",
+  "settings.health.settings": "Archivo de ajustes",
+  "settings.health.provenance": "Registros de instalaciones administradas",
+  "settings.health.detail": "Detalles",
+  "settings.health.unknownSource": "La fuente de actualizaciones desconocida se cambió a Automática",
+  "settings.health.restore": "Restaurar desde .bak",
+  "settings.health.reset": "Restablecer valores predeterminados",
+  "settings.health.clearProvenance": "Borrar registros de administración",
+  "settings.health.restoreConfirm.title": "¿Restaurar {which} desde la copia de seguridad?",
+  "settings.health.restoreConfirm.body": "Sustituye el archivo actual por el último .bak guardado correctamente. Se descartará el contenido actual dañado o inesperado; después se volverá a leer y verificar el estado.",
+  "settings.health.resetConfirm.title": "¿Restablecer {which}?",
+  "settings.health.resetConfirm.body.settings": "Descarta los ajustes actuales y escribe los valores de fábrica (fuente de actualizaciones, frecuencia de comprobación, modo de instalación, etc.). Si aún existe una copia, podrás intentar restaurar el .bak.",
+  "settings.health.resetConfirm.body.provenance": "Elimina los registros de instalaciones administradas de esta aplicación. Codex no se desinstala, pero aparecerá como no administrado hasta que vuelvas a usar «{action}»; hasta entonces no podrás actualizarlo ni desinstalarlo.",
+  "settings.health.working": "Procesando…",
+  "settings.health.verified": "Leída de nuevo y verificada",
+  "settings.health.noBackup": "No hay ninguna copia .bak disponible",
+  "settings.health.banner": "La configuración requiere atención: los ajustes o los registros de instalaciones administradas no están en buen estado. Restáuralos o restablécelos a continuación.",
   "settings.appearance.header": "Apariencia",
   "settings.appearance.theme": "Tema",
   "settings.appearance.system": "Sistema",
@@ -2729,14 +2776,17 @@ const ES: Record<Key, string> = {
   "uninstall.heading": "Desinstalar Codex",
   "uninstall.warn": "Esto elimina la app Codex de tu equipo.",
   "uninstall.needAdopt": "Este Codex es externo. Primero gestiónalo desde la pantalla principal y luego vuelve para desinstalarlo.",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "Comprobando el estado de la instalación…",
+  "uninstall.status.error": "No se pudo confirmar el estado de la instalación (falló la comprobación). No se considera una instalación externa; reinténtalo o comprueba la pantalla de inicio.",
+  "uninstall.status.none": "No se detectó ninguna instalación de Codex administrada por esta aplicación.",
+  "uninstall.partial.title": "La aplicación se eliminó, pero parte de la limpieza no terminó",
+  "uninstall.partial.summary": "Codex se eliminó, pero la limpieza auxiliar no terminó. Reintenta solo el paso correspondiente de abajo; no vuelvas a desinstalar.",
+  "uninstall.partial.retryPending": "Algunos pasos de recuperación siguen incompletos. Reintenta solo los pasos restantes de abajo.",
+  "uninstall.partial.retryDone": "El paso de recuperación seleccionado terminó.",
+  "uninstall.partial.retryCleanup": "Reintentar solo la limpieza (accesos directos / entrada de desinstalación)",
+  "uninstall.partial.retryProvenance": "Reintentar solo la eliminación de los registros de administración",
+  "uninstall.partial.retryPurge": "Reintentar solo la eliminación de los datos de usuario",
+  "uninstall.partial.retryRecord": "Reintentar solo la escritura del registro de administración",
   "uninstall.keepData": "Conservar mis datos",
   "uninstall.keepDataNote": "El inicio de sesión, las sesiones y la configuración ({path}) se conservan; al reinstalar, continúas donde lo dejaste.",
   "uninstall.dataPath": "Ubicación de datos",
@@ -2876,8 +2926,9 @@ const PT_BR: Record<Key, string> = {
   "progress.finishing": "Download concluído — instalando, não feche",
   "install.done.title": "Codex instalado",
   "install.done.open": "Abrir Codex",
-  "install.partial.note": "The app is on disk, but the managed record could not be saved. Use Start managing to retry the record — do not reinstall.",
-  "install.partial.record": "Retry managed record",
+  "install.partial.note": "O aplicativo está instalado, mas não foi possível salvar o registro de gerenciamento. Use “{action}” — não reinstale o aplicativo.",
+  "install.partial.pending": "A instalação terminou, mas ainda não foi possível confirmar o Codex no disco. Use “{action}” para verificar novamente; não reinstale o aplicativo até a confirmação.",
+  "install.partial.record": "Tentar salvar o registro de gerenciamento novamente",
   "success.title": "Atualizado",
   "success.flow": "Atualizado {from} → {to}",
   "success.manualLaunch": "Inicie o Codex manualmente",
@@ -2942,25 +2993,26 @@ const PT_BR: Record<Key, string> = {
   "settings.more.configUnavailable": "Indisponível nesta versão",
   "settings.saveError": "Não foi possível salvar as configurações",
   "settings.retry": "Tentar novamente",
-  "settings.health.header": "Configuration health",
-  "settings.health.ok": "OK",
-  "settings.health.recovered": "Recovered from backup",
-  "settings.health.corrupt": "Corrupt",
-  "settings.health.settings": "Settings file",
-  "settings.health.provenance": "Managed-install records",
-  "settings.health.detail": "Details",
-  "settings.health.unknownSource": "Unknown update source was normalized to Automatic",
-  "settings.health.restore": "Restore from .bak",
-  "settings.health.reset": "Reset to defaults",
-  "settings.health.restoreConfirm.title": "Restore {which} from backup?",
-  "settings.health.restoreConfirm.body": "Replaces the current file with the last successful .bak. Current corrupt or unexpected content is discarded; health is re-read and verified afterward.",
-  "settings.health.resetConfirm.title": "Reset {which}?",
-  "settings.health.resetConfirm.body.settings": "Discards current settings and writes factory defaults (update source, check cadence, install mode, etc.). You can still try .bak restore if a backup remains.",
-  "settings.health.resetConfirm.body.provenance": "Clears this app's managed-install records. Installed Codex is not deleted, but will appear unmanaged until you Start managing again.",
-  "settings.health.working": "Working…",
-  "settings.health.verified": "Re-read and verified",
-  "settings.health.noBackup": "No .bak backup available",
-  "settings.health.banner": "Configuration needs attention: settings or managed-install records look unhealthy. Restore or reset below.",
+  "settings.health.header": "Integridade da configuração",
+  "settings.health.ok": "Íntegra",
+  "settings.health.recovered": "Restaurada do backup",
+  "settings.health.corrupt": "Corrompida",
+  "settings.health.settings": "Arquivo de configurações",
+  "settings.health.provenance": "Registros de instalações gerenciadas",
+  "settings.health.detail": "Detalhes",
+  "settings.health.unknownSource": "A fonte de atualização desconhecida foi alterada para Automático",
+  "settings.health.restore": "Restaurar do .bak",
+  "settings.health.reset": "Redefinir para os padrões",
+  "settings.health.clearProvenance": "Limpar registros de gerenciamento",
+  "settings.health.restoreConfirm.title": "Restaurar {which} do backup?",
+  "settings.health.restoreConfirm.body": "Substitui o arquivo atual pelo último .bak salvo com sucesso. O conteúdo atual corrompido ou inesperado será descartado; depois, a integridade será relida e verificada.",
+  "settings.health.resetConfirm.title": "Redefinir {which}?",
+  "settings.health.resetConfirm.body.settings": "Descarta as configurações atuais e grava os padrões de fábrica (fonte de atualização, frequência de verificação, modo de instalação etc.). Se ainda houver um backup, você poderá tentar restaurar o .bak.",
+  "settings.health.resetConfirm.body.provenance": "Limpa os registros de instalações gerenciadas deste aplicativo. O Codex instalado não será removido, mas aparecerá como não gerenciado até você usar “{action}” novamente; até lá, não poderá atualizá-lo nem desinstalá-lo.",
+  "settings.health.working": "Processando…",
+  "settings.health.verified": "Relida e verificada",
+  "settings.health.noBackup": "Nenhum backup .bak disponível",
+  "settings.health.banner": "A configuração requer atenção: as configurações ou os registros de instalações gerenciadas não estão íntegros. Restaure-os ou redefina-os abaixo.",
   "settings.appearance.header": "Aparência",
   "settings.appearance.theme": "Tema",
   "settings.appearance.system": "Sistema",
@@ -2995,14 +3047,17 @@ const PT_BR: Record<Key, string> = {
   "uninstall.heading": "Desinstalar Codex",
   "uninstall.warn": "Isso remove o aplicativo Codex do seu computador.",
   "uninstall.needAdopt": "Este é um Codex externo. Primeiro clique em \"Começar a gerenciar\" na tela principal e depois volte para desinstalar.",
-  "uninstall.status.loading": "Checking install status…",
-  "uninstall.status.error": "Could not confirm install status (probe failed). This is not treated as an external install — retry or check the home screen.",
-  "uninstall.status.none": "No manager-managed Codex install was detected.",
-  "uninstall.partial.title": "App removed, but some cleanup did not finish",
-  "uninstall.partial.retryCleanup": "Retry cleanup only (shortcuts / uninstall entry)",
-  "uninstall.partial.retryProvenance": "Retry clearing managed records only",
-  "uninstall.partial.retryPurge": "Retry purging user data only",
-  "uninstall.partial.retryRecord": "Retry writing managed record only",
+  "uninstall.status.loading": "Verificando o estado da instalação…",
+  "uninstall.status.error": "Não foi possível confirmar o estado da instalação (falha na verificação). Ela não será tratada como instalação externa — tente novamente ou verifique a tela inicial.",
+  "uninstall.status.none": "Nenhuma instalação do Codex gerenciada por este aplicativo foi detectada.",
+  "uninstall.partial.title": "O aplicativo foi removido, mas parte da limpeza não foi concluída",
+  "uninstall.partial.summary": "O Codex foi removido, mas a limpeza auxiliar não foi concluída. Tente novamente apenas a etapa correspondente abaixo; não desinstale outra vez.",
+  "uninstall.partial.retryPending": "Algumas etapas de recuperação ainda não foram concluídas. Tente novamente apenas as etapas restantes abaixo.",
+  "uninstall.partial.retryDone": "A etapa de recuperação selecionada foi concluída.",
+  "uninstall.partial.retryCleanup": "Tentar novamente apenas a limpeza (atalhos / entrada de desinstalação)",
+  "uninstall.partial.retryProvenance": "Tentar novamente apenas a remoção dos registros de gerenciamento",
+  "uninstall.partial.retryPurge": "Tentar novamente apenas a remoção dos dados do usuário",
+  "uninstall.partial.retryRecord": "Tentar novamente apenas a gravação do registro de gerenciamento",
   "uninstall.keepData": "Manter meus dados",
   "uninstall.keepDataNote": "Login, sessões e configurações ({path}) são mantidos; reinstalar retoma de onde parou.",
   "uninstall.dataPath": "Local dos dados",
diff --git a/src/app/views/Home.tsx b/src/app/views/Home.tsx
index 67420ad..71be6e2 100644
--- a/src/app/views/Home.tsx
+++ b/src/app/views/Home.tsx
@@ -259,7 +259,7 @@ function MacHome({ onOpenSettings }: { onOpenSettings: () => void }) {
       // install on disk; never treat it as a hard failure (would invite reinstall).
       const outcome = status.outcome;
       if (outcome?.primaryOk && outcome.recoveryActions.includes("record_provenance")) {
-        setNotice(t("install.partial.note"));
+        setNotice(t("install.partial.note", { action: t("install.partial.record") }));
         setJustInstalled(true);
       } else {
         setJustInstalled(true);
@@ -575,7 +575,9 @@ function MacHome({ onOpenSettings }: { onOpenSettings: () => void }) {
         <div className="scroll" ref={scopeRef}>
           {actionError ? <FailureBanner failure={actionError} /> : null}
           {notice || needsRecord ? (
-            <StatusBanner tone="warn">{notice ?? t("install.partial.note")}</StatusBanner>
+            <StatusBanner tone="warn">
+              {notice ?? t("install.partial.note", { action: t("install.partial.record") })}
+            </StatusBanner>
           ) : null}
           <section className="hero" style={{ marginTop: 16 }} key={scene}>
             <Ring icon="check" variant="success" />
diff --git a/src/app/views/Settings.test.tsx b/src/app/views/Settings.test.tsx
index 652833a..caf2566 100644
--- a/src/app/views/Settings.test.tsx
+++ b/src/app/views/Settings.test.tsx
@@ -3,8 +3,8 @@ import userEvent from "@testing-library/user-event";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { managerApi } from "../../services/managerApi";
-import { DEFAULT_SETTINGS, type AppSettings } from "../../shared/types";
-import { I18nProvider } from "../i18n";
+import { DEFAULT_SETTINGS, type AppSettings, type ConfigHealth } from "../../shared/types";
+import { CATALOG, I18nProvider, type Lang } from "../i18n";
 import { ThemeProvider } from "../theme";
 import { Settings } from "./Settings";
 
@@ -17,6 +17,9 @@ vi.mock("../../services/managerApi", async (importOriginal) => {
       setSettings: vi.fn(),
       getAutostart: vi.fn(),
       setAutostart: vi.fn(),
+      getConfigHealth: vi.fn(),
+      restoreConfigBackup: vi.fn(),
+      resetConfig: vi.fn(),
       winDefaultInstallRoot: vi.fn(),
       winPickInstallDir: vi.fn(),
       winSetInstallRoot: vi.fn(),
@@ -27,6 +30,26 @@ vi.mock("../../services/managerApi", async (importOriginal) => {
 
 const api = vi.mocked(managerApi);
 
+const HEALTHY_CONFIG: ConfigHealth = {
+  settingsStatus: "ok",
+  provenanceStatus: "ok",
+  unknownSource: null,
+  detail: null,
+  settingsBackupAvailable: false,
+  provenanceBackupAvailable: false,
+};
+
+const BROKEN_CONFIG: ConfigHealth = {
+  settingsStatus: "corrupt",
+  provenanceStatus: "corrupt",
+  unknownSource: null,
+  detail: "invalid JSON",
+  settingsBackupAvailable: true,
+  provenanceBackupAvailable: true,
+};
+
+const SAFETY_FLOW_LANGS = ["fr", "ar", "es", "zh-TW"] as const satisfies readonly Lang[];
+
 function settings(overrides: Partial<AppSettings> = {}): AppSettings {
   return { ...DEFAULT_SETTINGS, ...overrides };
 }
@@ -63,8 +86,14 @@ describe("Settings runtime contract", () => {
     api.setSettings.mockReset();
     api.getAutostart.mockReset();
     api.setAutostart.mockReset();
+    api.getConfigHealth.mockReset();
+    api.restoreConfigBackup.mockReset();
+    api.resetConfig.mockReset();
     api.getAutostart.mockResolvedValue(false);
     api.setSettings.mockImplementation(async (next) => next);
+    api.getConfigHealth.mockResolvedValue(HEALTHY_CONFIG);
+    api.restoreConfigBackup.mockResolvedValue(HEALTHY_CONFIG);
+    api.resetConfig.mockResolvedValue(HEALTHY_CONFIG);
   });
 
   it("keeps the form non-editable until settings hydrate", async () => {
@@ -225,4 +254,44 @@ describe("Settings runtime contract", () => {
     );
     expect(screen.getByRole("radio", { name: /镜像/ })).toHaveAttribute("aria-checked", "true");
   });
+
+  it.each(SAFETY_FLOW_LANGS)(
+    "shows and completes the managed-record reset consequence flow in %s",
+    async (lang) => {
+      const user = userEvent.setup();
+      localStorage.setItem("cam.lang", lang);
+      api.getSettings.mockResolvedValue(settings());
+      api.getConfigHealth
+        .mockResolvedValueOnce(BROKEN_CONFIG)
+        .mockResolvedValue(HEALTHY_CONFIG);
+
+      renderSettings();
+
+      expect(await screen.findByText(CATALOG[lang]["settings.health.banner"])).toBeInTheDocument();
+      const resetLabel = CATALOG[lang]["settings.health.clearProvenance"];
+      expect(
+        screen.getByRole("button", { name: CATALOG[lang]["settings.health.reset"] }),
+      ).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: resetLabel }));
+
+      const title = CATALOG[lang]["settings.health.resetConfirm.title"].replace(
+        "{which}",
+        CATALOG[lang]["settings.health.provenance"],
+      );
+      const dialog = screen.getByRole("dialog", { name: title });
+      const provenanceBody = CATALOG[lang]["settings.health.resetConfirm.body.provenance"].replace(
+        "{action}",
+        CATALOG[lang]["home.external.cta"],
+      );
+      expect(
+        within(dialog).getByText(provenanceBody),
+      ).toBeInTheDocument();
+
+      await user.click(within(dialog).getByRole("button", { name: resetLabel }));
+
+      await waitFor(() => expect(api.resetConfig).toHaveBeenCalledWith("provenance"));
+      expect(await screen.findByText(CATALOG[lang]["settings.health.verified"])).toBeInTheDocument();
+      expect(document.documentElement.dir).toBe(lang === "ar" ? "rtl" : "ltr");
+    },
+  );
 });
diff --git a/src/app/views/Settings.tsx b/src/app/views/Settings.tsx
index 7440806..330391c 100644
--- a/src/app/views/Settings.tsx
+++ b/src/app/views/Settings.tsx
@@ -394,7 +394,11 @@ export function Settings({
                   >
                     {healthBusy === `reset:${row.which}`
                       ? t("settings.health.working")
-                      : t("settings.health.reset")}
+                      : t(
+                          row.which === "provenance"
+                            ? "settings.health.clearProvenance"
+                            : "settings.health.reset",
+                        )}
                   </button>
                 </div>
               </div>
@@ -921,7 +925,9 @@ export function Settings({
                 ? t("settings.health.restoreConfirm.body")
                 : healthConfirm.which === "settings"
                   ? t("settings.health.resetConfirm.body.settings")
-                  : t("settings.health.resetConfirm.body.provenance")}
+                  : t("settings.health.resetConfirm.body.provenance", {
+                      action: t("home.external.cta"),
+                    })}
             </p>
             <div className="row2">
               <button className="btn ghost" onClick={() => setHealthConfirm(null)}>
@@ -935,7 +941,11 @@ export function Settings({
               >
                 {healthConfirm.kind === "restore"
                   ? t("settings.health.restore")
-                  : t("settings.health.reset")}
+                  : t(
+                      healthConfirm.which === "provenance"
+                        ? "settings.health.clearProvenance"
+                        : "settings.health.reset",
+                    )}
               </button>
             </div>
           </>
diff --git a/src/app/views/Uninstall.test.tsx b/src/app/views/Uninstall.test.tsx
index 9803c1f..d6f8201 100644
--- a/src/app/views/Uninstall.test.tsx
+++ b/src/app/views/Uninstall.test.tsx
@@ -4,7 +4,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { managerApi } from "../../services/managerApi";
 import { emptyOperationOutcome } from "../../shared/types";
-import { I18nProvider } from "../i18n";
+import { CATALOG, I18nProvider, type Lang } from "../i18n";
 import { Uninstall } from "./Uninstall";
 
 vi.mock("../../services/managerApi", () => ({
@@ -24,6 +24,7 @@ const winStatus = vi.mocked(managerApi.winStatus);
 const macUninstall = vi.mocked(managerApi.macUninstall);
 const winUninstall = vi.mocked(managerApi.winUninstall);
 const retryAncillary = vi.mocked(managerApi.retryAncillary);
+const SAFETY_FLOW_LANGS = ["fr", "ar", "es", "zh-TW"] as const satisfies readonly Lang[];
 
 function setPlatform(platform: string) {
   Object.defineProperty(navigator, "platform", { configurable: true, value: platform });
@@ -236,4 +237,134 @@ describe("Uninstall", () => {
       ),
     );
   });
+
+  it("keeps both an unattempted action and the attempted action when retry still fails", async () => {
+    const user = userEvent.setup();
+    setPlatform("MacIntel");
+    macUninstall.mockResolvedValue({
+      removed: true,
+      keptCodexHome: true,
+      message: "removed with two ancillary failures",
+      outcome: emptyOperationOutcome({
+        primaryOk: true,
+        appState: "absent",
+        installClass: "none",
+        provenance: { state: "failed", detail: "record failed" },
+        cleanup: { state: "failed", detail: "cleanup failed" },
+        recoveryActions: ["cleanup_metadata", "record_provenance"],
+      }),
+    });
+    // Deliberately omit recoveryActions: the failed step status must still keep
+    // the attempted CTA, while the untouched cleanup action is merged back in.
+    retryAncillary.mockResolvedValue({
+      message: "record still failed",
+      outcome: emptyOperationOutcome({
+        primaryOk: true,
+        appState: "present",
+        installClass: "external",
+        provenance: { state: "failed", detail: "disk full" },
+        recoveryActions: [],
+      }),
+    });
+
+    renderUninstall();
+    await screen.findByText("Data location");
+    await user.click(screen.getByRole("button", { name: "Uninstall" }));
+    await user.click(screen.getByRole("button", { name: "Continue" }));
+    await user.click(
+      screen.getByRole("button", { name: "Retry writing managed record only" }),
+    );
+
+    expect(
+      await screen.findByText(/some recovery steps are still incomplete/i),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole("button", { name: "Retry cleanup only (shortcuts / uninstall entry)" }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole("button", { name: "Retry writing managed record only" }),
+    ).toBeInTheDocument();
+  });
+
+  it.each(SAFETY_FLOW_LANGS)(
+    "preserves unattempted recovery actions after one successful retry in %s",
+    async (lang) => {
+      const user = userEvent.setup();
+      localStorage.setItem("cam.lang", lang);
+      setPlatform("MacIntel");
+      macUninstall.mockResolvedValue({
+        removed: true,
+        keptCodexHome: true,
+        message: "removed with recovery actions",
+        outcome: emptyOperationOutcome({
+          primaryOk: true,
+          appState: "absent",
+          installClass: "none",
+          cleanup: { state: "failed", detail: "ancillary cleanup failed" },
+          recoveryActions: [
+            "cleanup_metadata",
+            "clear_provenance",
+            "purge_user_data",
+            "record_provenance",
+          ],
+          warnings: ["ancillary cleanup failed"],
+        }),
+      });
+
+      renderUninstall();
+
+      await screen.findByText(CATALOG[lang]["uninstall.dataPath"]);
+      await user.click(screen.getByRole("button", { name: CATALOG[lang]["uninstall.confirm"] }));
+      await user.click(screen.getByRole("button", { name: CATALOG[lang]["uninstall.continue"] }));
+
+      expect(
+        await screen.findByText(CATALOG[lang]["uninstall.partial.title"]),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByText(CATALOG[lang]["uninstall.partial.summary"], { selector: ".desc" }),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByText("removed with recovery actions", { selector: ".errdetails" }),
+      ).toBeInTheDocument();
+      const recoveryKeys = [
+        "uninstall.partial.retryCleanup",
+        "uninstall.partial.retryProvenance",
+        "uninstall.partial.retryPurge",
+        "uninstall.partial.retryRecord",
+      ] as const;
+      for (const key of recoveryKeys) {
+        expect(screen.getByRole("button", { name: CATALOG[lang][key] })).toBeInTheDocument();
+      }
+
+      await user.click(
+        screen.getByRole("button", {
+          name: CATALOG[lang]["uninstall.partial.retryProvenance"],
+        }),
+      );
+      await waitFor(() =>
+        expect(retryAncillary).toHaveBeenCalledWith(
+          expect.objectContaining({ actions: ["clear_provenance"], purgeUserData: false }),
+        ),
+      );
+      expect(
+        await screen.findByText(CATALOG[lang]["uninstall.partial.retryPending"], {
+          selector: ".desc",
+        }),
+      ).toBeInTheDocument();
+      expect(
+        screen.queryByRole("button", {
+          name: CATALOG[lang]["uninstall.partial.retryProvenance"],
+        }),
+      ).not.toBeInTheDocument();
+      for (const key of [
+        "uninstall.partial.retryCleanup",
+        "uninstall.partial.retryPurge",
+        "uninstall.partial.retryRecord",
+      ] as const) {
+        expect(screen.getByRole("button", { name: CATALOG[lang][key] })).toBeInTheDocument();
+      }
+      expect(screen.getByText("cleanup ok", { selector: ".errdetails" })).toBeInTheDocument();
+      expect(document.documentElement.dir).toBe(lang === "ar" ? "rtl" : "ltr");
+    },
+  );
 });
diff --git a/src/app/views/Uninstall.tsx b/src/app/views/Uninstall.tsx
index fe5dd63..a40c003 100644
--- a/src/app/views/Uninstall.tsx
+++ b/src/app/views/Uninstall.tsx
@@ -18,6 +18,45 @@ function hasTauriRuntime(): boolean {
   );
 }
 
+const PROVENANCE_RECOVERY_ACTIONS = new Set(["record_provenance", "clear_provenance"]);
+const CLEANUP_RECOVERY_ACTIONS = new Set(["cleanup_metadata", "purge_user_data"]);
+
+/** Merge a scoped ancillary retry back into the original partial outcome.
+ * The backend reports only the actions attempted in this request; actions the
+ * user has not retried yet must remain visible, and a failed attempted action
+ * remains available even if a backend forgets to echo its recovery key. */
+function mergeAncillaryRetryOutcome(
+  previous: OperationOutcome,
+  attempted: string[],
+  retried: OperationOutcome,
+): OperationOutcome {
+  const attemptedSet = new Set(attempted);
+  const unattempted = previous.recoveryActions.filter((action) => !attemptedSet.has(action));
+  const failedAttempted = attempted.filter((action) => {
+    if (PROVENANCE_RECOVERY_ACTIONS.has(action)) return retried.provenance.state === "failed";
+    if (CLEANUP_RECOVERY_ACTIONS.has(action)) return retried.cleanup.state === "failed";
+    return false;
+  });
+  const recoveryActions = [
+    ...new Set([...unattempted, ...retried.recoveryActions, ...failedAttempted]),
+  ];
+  const hasUnattemptedProvenance = unattempted.some((action) =>
+    PROVENANCE_RECOVERY_ACTIONS.has(action),
+  );
+  const hasUnattemptedCleanup = unattempted.some((action) =>
+    CLEANUP_RECOVERY_ACTIONS.has(action),
+  );
+
+  return {
+    ...retried,
+    path: retried.path ?? previous.path,
+    provenance: hasUnattemptedProvenance ? previous.provenance : retried.provenance,
+    cleanup: hasUnattemptedCleanup ? previous.cleanup : retried.cleanup,
+    warnings: [...new Set([...previous.warnings, ...retried.warnings])],
+    recoveryActions,
+  };
+}
+
 export function Uninstall({ onBack }: { onBack: () => void }) {
   const { t } = useI18n();
   const platform = currentPlatform();
@@ -28,6 +67,7 @@ export function Uninstall({ onBack }: { onBack: () => void }) {
   const [keepData, setKeepData] = useState(true);
   const [busy, setBusy] = useState(false);
   const [done, setDone] = useState<string | null>(null);
+  const [doneDetail, setDoneDetail] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [pathCopied, setPathCopied] = useState(false);
   // Install probe: Loading / Managed / External / None / Error — never treat a
@@ -68,6 +108,7 @@ export function Uninstall({ onBack }: { onBack: () => void }) {
     setBusy(true);
     setError(null);
     setPartialOutcome(null);
+    setDoneDetail(null);
     try {
       // mac keeps ~/.codex via keepCodexHome; win purges via purgeUserData (the
       // inverse) — both surface the backend message as the source of truth.
@@ -75,7 +116,8 @@ export function Uninstall({ onBack }: { onBack: () => void }) {
         const r = await managerApi.winUninstall(true, !keepData);
         if (r.success && outcomeIsPartial(r.outcome)) {
           setPartialOutcome(r.outcome);
-          setDone(r.message);
+          setDone(t("uninstall.partial.summary"));
+          setDoneDetail(r.message);
           return;
         }
         if (!r.success) {
@@ -87,7 +129,8 @@ export function Uninstall({ onBack }: { onBack: () => void }) {
         const r = await managerApi.macUninstall(keepData);
         if (r.removed && outcomeIsPartial(r.outcome)) {
           setPartialOutcome(r.outcome);
-          setDone(r.message);
+          setDone(t("uninstall.partial.summary"));
+          setDoneDetail(r.message);
           return;
         }
         if (!r.removed) {
@@ -113,12 +156,17 @@ export function Uninstall({ onBack }: { onBack: () => void }) {
         path: partialOutcome?.path ?? null,
         purgeUserData: actions.includes("purge_user_data"),
       });
-      setDone(report.message);
-      if (outcomeIsPartial(report.outcome)) {
-        setPartialOutcome(report.outcome);
+      const mergedOutcome = partialOutcome
+        ? mergeAncillaryRetryOutcome(partialOutcome, actions, report.outcome)
+        : report.outcome;
+      if (mergedOutcome.recoveryActions.length > 0 || outcomeIsPartial(mergedOutcome)) {
+        setDone(t("uninstall.partial.retryPending"));
+        setPartialOutcome(mergedOutcome);
       } else {
+        setDone(t("uninstall.partial.retryDone"));
         setPartialOutcome(null);
       }
+      setDoneDetail(report.message);
     } catch (cause) {
       setError(userErrorMessage(cause, t));
     } finally {
@@ -162,6 +210,12 @@ export function Uninstall({ onBack }: { onBack: () => void }) {
               <div className="headline">{t("uninstall.heading")}</div>
               <div className="desc">{done}</div>
             </section>
+            {doneDetail ? (
+              <details className="manual-existing-meta">
+                <summary>{t("home.error.details")}</summary>
+                <pre className="errdetails">{doneDetail}</pre>
+              </details>
+            ) : null}
             {partialOutcome ? (
               <>
                 <StatusBanner tone="warn">{t("uninstall.partial.title")}</StatusBanner>
diff --git a/src/app/views/WinHome.test.tsx b/src/app/views/WinHome.test.tsx
index 223ddfb..025f39b 100644
--- a/src/app/views/WinHome.test.tsx
+++ b/src/app/views/WinHome.test.tsx
@@ -9,6 +9,7 @@ import type {
   AppSettings,
   CapabilityCheck,
   InstalledWindowsCodex,
+  OperationCompletion,
   WinCapabilityReport,
   WindowsUpdatePlan,
   WinInstallStatus,
@@ -27,9 +28,11 @@ vi.mock("../../services/managerApi", async (importOriginal) => {
   return {
     ...actual,
     managerApi: {
+      armDestructive: vi.fn(),
       getSettings: vi.fn(),
       setSettings: vi.fn(),
       getOperationSnapshot: vi.fn(() => Promise.resolve(null)),
+      getOperationCompletion: vi.fn(() => Promise.resolve(null)),
       winStatus: vi.fn(),
       winPlanUpdate: vi.fn(),
       winPerformUpdate: vi.fn(),
@@ -155,9 +158,22 @@ function renderWinHome() {
   );
 }
 
+function deferred<T>() {
+  let resolve!: (value: T | PromiseLike<T>) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
 describe("WinHome state machine", () => {
   beforeEach(() => {
     localStorage.setItem("cam.lang", "zh-CN");
+    sessionStorage.clear();
+    api.armDestructive.mockResolvedValue("win-op-1");
+    api.getOperationCompletion.mockResolvedValue(null);
     api.getSettings.mockResolvedValue(settings());
     api.winDefaultInstallRoot.mockResolvedValue(DEFAULT_SETTINGS.installRoot);
     api.winStatus.mockResolvedValue(STATUS_MANAGED);
@@ -187,6 +203,7 @@ describe("WinHome state machine", () => {
           route: "msix-sideload",
         },
         undefined,
+        "win-op-1",
       ),
     );
   });
@@ -211,6 +228,417 @@ describe("WinHome state machine", () => {
     await waitFor(() => expect(api.winAdopt).toHaveBeenCalledTimes(1));
   });
 
+  it("keeps partial-install guidance aligned with the rendered recovery action", async () => {
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockResolvedValue({ installed: INSTALLED, status: "external" });
+    api.winPlanUpdate
+      .mockResolvedValueOnce(report({ installed: null }))
+      .mockResolvedValue(
+        report({ plan: { ...PLAN_UPDATE, upToDate: true, latestVersion: "1.0.0" } }),
+      );
+    api.winPerformUpdate.mockResolvedValue({
+      ...PERFORM_OK,
+      message: "installed; managed record failed",
+      outcome: emptyOperationOutcome({
+        primaryOk: true,
+        appState: "present",
+        installClass: "external",
+        provenance: { state: "failed", detail: "write failed" },
+        recoveryActions: ["record_provenance"],
+      }),
+    });
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+
+    expect(await screen.findByText(/请点「开始管理」，勿重复安装/)).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "开始管理" })).toBeInTheDocument();
+    expect(screen.getByText("已安装 Codex", { selector: ".rb-title" })).toBeInTheDocument();
+    expect(
+      screen.queryByText("installed; managed record failed", { selector: ".rb-detail" }),
+    ).not.toBeInTheDocument();
+    const diagnostics = screen
+      .getByText("installed; managed record failed", { selector: ".errdetails" })
+      .closest("details");
+    expect(diagnostics).not.toHaveAttribute("open");
+  });
+
+  it("keeps English backend prose collapsed in a non-English partial-install UI", async () => {
+    localStorage.setItem("cam.lang", "fr");
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockResolvedValue({ installed: INSTALLED, status: "external" });
+    api.winPlanUpdate.mockResolvedValueOnce(report({ installed: null })).mockResolvedValue(
+      report({
+        plan: { ...PLAN_UPDATE, upToDate: true, latestVersion: "1.0.0" },
+      }),
+    );
+    api.winPerformUpdate.mockResolvedValue({
+      ...PERFORM_OK,
+      message: "installed; managed record failed",
+      outcome: emptyOperationOutcome({
+        primaryOk: true,
+        appState: "present",
+        installClass: "external",
+        provenance: { state: "failed", detail: "write failed" },
+        recoveryActions: ["record_provenance"],
+      }),
+    });
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /Installer Codex/ }));
+
+    expect(screen.getByText("Codex installé", { selector: ".rb-title" })).toBeInTheDocument();
+    expect(
+      screen.queryByText("installed; managed record failed", { selector: ".rb-detail" }),
+    ).not.toBeInTheDocument();
+    const diagnostics = screen
+      .getByText("installed; managed record failed", { selector: ".errdetails" })
+      .closest("details");
+    expect(diagnostics).not.toHaveAttribute("open");
+  });
+
+  it("does not let a pre-update managed snapshot clear a new partial-outcome guard", async () => {
+    api.getSettings.mockResolvedValue(settings({ askBefore: false }));
+    api.winStatus
+      .mockResolvedValueOnce(STATUS_MANAGED)
+      .mockResolvedValue({ installed: INSTALLED, status: "external" });
+    api.winPlanUpdate
+      .mockResolvedValueOnce(report())
+      .mockResolvedValue(
+        report({ plan: { ...PLAN_UPDATE, upToDate: true, latestVersion: "2.0.0" } }),
+      );
+    api.winPerformUpdate.mockResolvedValue({
+      ...PERFORM_OK,
+      message: "updated; managed record failed",
+      outcome: emptyOperationOutcome({
+        primaryOk: true,
+        appState: "present",
+        installClass: "external",
+        provenance: { state: "failed", detail: "write failed" },
+        recoveryActions: ["record_provenance"],
+      }),
+    });
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /立即更新/ }));
+
+    expect(await screen.findByText(/请点「开始管理」，勿重复安装/)).toBeInTheDocument();
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toContain("win-op-1");
+  });
+
+  it("requires re-detection instead of offering reinstall when a partial install is not found", async () => {
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockResolvedValue({ installed: INSTALLED, status: "external" });
+    api.winPlanUpdate
+      .mockResolvedValueOnce(report({ installed: null }))
+      .mockResolvedValueOnce(report({ installed: null }))
+      .mockResolvedValue(
+        report({ plan: { ...PLAN_UPDATE, upToDate: true, latestVersion: "1.0.0" } }),
+      );
+    api.winPerformUpdate.mockResolvedValue({
+      ...PERFORM_OK,
+      installed: null,
+      message: "installed but not detected for managed record",
+      outcome: emptyOperationOutcome({
+        primaryOk: true,
+        appState: "unknown",
+        installClass: null,
+        provenance: { state: "failed", detail: "install not detected" },
+        recoveryActions: ["record_provenance"],
+      }),
+    });
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+
+    expect(await screen.findByText(/暂时无法确认 Codex 是否已写入磁盘/)).toHaveTextContent(
+      "请点「重新检查」重新检测；确认前请勿重复安装",
+    );
+    expect(screen.queryByRole("button", { name: /安装 Codex/ })).not.toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: "重新检查" }));
+
+    expect(await screen.findByText(/请点「开始管理」，勿重复安装/)).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "开始管理" })).toBeInTheDocument();
+  });
+
+  it("keeps the partial-install recovery lock across a renderer reload", async () => {
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus.mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.winPerformUpdate.mockReturnValue(new Promise<WinPerformReport>(() => {}));
+
+    const user = userEvent.setup();
+    const firstRenderer = renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+    await waitFor(() => expect(api.winPerformUpdate).toHaveBeenCalledTimes(1));
+
+    firstRenderer.unmount();
+    renderWinHome();
+
+    expect(await screen.findByText(/暂时无法确认 Codex 是否已写入磁盘/)).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "重新检查" })).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /安装 Codex/ })).not.toBeInTheDocument();
+  });
+
+  it("keeps reinstall blocked when invoke rejects after commit with an unknown outcome", async () => {
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus.mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.getOperationCompletion.mockResolvedValue({
+      id: "win-op-1",
+      kind: "update",
+      phase: "finishing",
+      state: "outcome-unknown",
+    });
+    api.winPerformUpdate.mockRejectedValue({
+      code: "internal_error",
+      message: "install-root settings save failed after install",
+    });
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+
+    expect(await screen.findByText(/暂时无法确认 Codex 是否已写入磁盘/)).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /安装 Codex/ })).not.toBeInTheDocument();
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toContain("win-op-1");
+  });
+
+  it("releases the guard after a backend-proven pre-commit failure and allows retry", async () => {
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus.mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.getOperationCompletion.mockResolvedValue({
+      id: "win-op-1",
+      kind: "update",
+      phase: "downloading",
+      state: "failed-before-commit",
+    });
+    api.winPerformUpdate
+      .mockRejectedValueOnce({ code: "network_error", message: "download failed" })
+      .mockResolvedValueOnce(PERFORM_OK);
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+
+    const retry = await screen.findByRole("button", { name: /安装 Codex/ });
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toBeNull();
+    await user.click(retry);
+    await waitFor(() => expect(api.winPerformUpdate).toHaveBeenCalledTimes(2));
+  });
+
+  it("releases the guard after a backend-proven rollback and allows retry", async () => {
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus.mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.getOperationCompletion.mockResolvedValue({
+      id: "win-op-1",
+      kind: "update",
+      phase: "finishing",
+      state: "rolled-back",
+    });
+    api.winPerformUpdate
+      .mockRejectedValueOnce({
+        code: "internal_error",
+        message: "portable health check failed; absent state restored",
+      })
+      .mockResolvedValueOnce(PERFORM_OK);
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+
+    const retry = await screen.findByRole("button", { name: /安装 Codex/ });
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toBeNull();
+    await user.click(retry);
+    await waitFor(() => expect(api.winPerformUpdate).toHaveBeenCalledTimes(2));
+  });
+
+  it("releases a reloaded guard after backend proves the install failed before commit", async () => {
+    sessionStorage.setItem(
+      "cam.win.provenance-recovery",
+      JSON.stringify({ state: "unknown", token: "failed-op" }),
+    );
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus.mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.getOperationCompletion.mockImplementation((token) =>
+      Promise.resolve(
+        token === "failed-op"
+          ? {
+              id: "failed-op",
+              kind: "update",
+              phase: "downloading",
+              state: "failed-before-commit",
+            }
+          : null,
+      ),
+    );
+    api.armDestructive.mockResolvedValue("retry-op");
+
+    const user = userEvent.setup();
+    renderWinHome();
+    const install = await screen.findByRole("button", { name: /安装 Codex/ });
+    await user.click(install);
+
+    await waitFor(() => expect(api.winPerformUpdate).toHaveBeenCalled());
+  });
+
+  it("does not let an old reconciliation clear a newer token", async () => {
+    const oldCompletion = deferred<OperationCompletion | null>();
+    const newCompletion = deferred<OperationCompletion | null>();
+    const oldStatusProbe = deferred<WinInstallStatus>();
+    sessionStorage.setItem(
+      "cam.win.provenance-recovery",
+      JSON.stringify({ state: "unknown", token: "old-op" }),
+    );
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockReturnValueOnce(oldStatusProbe.promise)
+      .mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.getOperationCompletion.mockImplementation((token) =>
+      token === "old-op" ? oldCompletion.promise : newCompletion.promise,
+    );
+
+    renderWinHome();
+    await waitFor(() => expect(api.getOperationCompletion).toHaveBeenCalledWith("old-op"));
+
+    sessionStorage.setItem(
+      "cam.win.provenance-recovery",
+      JSON.stringify({ state: "unknown", token: "new-op" }),
+    );
+    await act(async () => {
+      oldCompletion.resolve({
+        id: "old-op",
+        kind: "update",
+        phase: "downloading",
+        state: "failed-before-commit",
+      });
+      await oldCompletion.promise;
+    });
+
+    // Clearing old-op adopts the replacement marker into React state. Keep its
+    // reconciliation pending while the old status probe and old finally settle:
+    // neither is allowed to release the newer generation's busy state.
+    await waitFor(() => expect(api.getOperationCompletion).toHaveBeenCalledWith("new-op"));
+    await act(async () => {
+      oldStatusProbe.resolve({ installed: null, status: "none" });
+      await oldStatusProbe.promise;
+    });
+
+    await waitFor(() =>
+      expect(sessionStorage.getItem("cam.win.provenance-recovery")).toContain("new-op"),
+    );
+    expect(screen.getByText("正在检查…", { selector: ".headline" })).toBeInTheDocument();
+
+    await act(async () => {
+      newCompletion.resolve(null);
+      await newCompletion.promise;
+    });
+    expect(await screen.findByText(/暂时无法确认 Codex 是否已写入磁盘/)).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /安装 Codex/ })).not.toBeInTheDocument();
+  });
+
+  it("keeps recovery busy until both status and plan probes settle", async () => {
+    const statusProbe = deferred<WinInstallStatus>();
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockReturnValueOnce(statusProbe.promise);
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.getOperationCompletion.mockResolvedValue({
+      id: "win-op-1",
+      kind: "update",
+      phase: "finishing",
+      state: "outcome-unknown",
+    });
+    api.winPerformUpdate.mockRejectedValue({
+      code: "internal_error",
+      message: "invoke returned after commit",
+    });
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+    await waitFor(() => expect(api.winPlanUpdate).toHaveBeenCalledTimes(2));
+
+    // The plan probe has completed, but the status probe still owns this
+    // recovery generation. Reinstall must remain unavailable.
+    expect(screen.queryByRole("button", { name: /安装 Codex/ })).not.toBeInTheDocument();
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toContain("win-op-1");
+
+    await act(async () => {
+      statusProbe.resolve({ installed: null, status: "none" });
+      await statusProbe.promise;
+    });
+    expect(await screen.findByRole("button", { name: "重新检查" })).toBeInTheDocument();
+  });
+
+  it("does not let an old perform finally release a newer recovery generation", async () => {
+    const oldCompletion = deferred<OperationCompletion | null>();
+    const newCompletion = deferred<OperationCompletion | null>();
+    const oldStatusProbe = deferred<WinInstallStatus>();
+    api.getSettings.mockResolvedValue(settings({ checkOnStartup: false }));
+    api.winStatus
+      .mockResolvedValueOnce({ installed: null, status: "none" })
+      .mockReturnValueOnce(oldStatusProbe.promise)
+      .mockResolvedValue({ installed: null, status: "none" });
+    api.winPlanUpdate.mockResolvedValue(report({ installed: null }));
+    api.winPerformUpdate.mockRejectedValue({ code: "network_error", message: "late failure" });
+    api.getOperationCompletion.mockImplementation((token) =>
+      token === "win-op-1" ? oldCompletion.promise : newCompletion.promise,
+    );
+
+    const user = userEvent.setup();
+    renderWinHome();
+    await user.click(await screen.findByRole("button", { name: /安装 Codex/ }));
+    await waitFor(() => expect(api.getOperationCompletion).toHaveBeenCalledWith("win-op-1"));
+
+    sessionStorage.setItem(
+      "cam.win.provenance-recovery",
+      JSON.stringify({ state: "unknown", token: "new-op" }),
+    );
+    await act(async () => {
+      oldCompletion.resolve({
+        id: "win-op-1",
+        kind: "update",
+        phase: "downloading",
+        state: "failed-before-commit",
+      });
+      await oldCompletion.promise;
+    });
+    await waitFor(() => expect(api.getOperationCompletion).toHaveBeenCalledWith("new-op"));
+
+    await act(async () => {
+      oldStatusProbe.resolve({ installed: null, status: "none" });
+      await oldStatusProbe.promise;
+    });
+    // The old run has now unwound through its finally. Its generation no longer
+    // owns busy/resetStop, so the newer reconciliation remains visibly active.
+    expect(screen.getByText("正在检查…", { selector: ".headline" })).toBeInTheDocument();
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toContain("new-op");
+
+    await act(async () => {
+      newCompletion.resolve(null);
+      await newCompletion.promise;
+    });
+    expect(await screen.findByRole("button", { name: "重新检查" })).toBeInTheDocument();
+  });
+
   it("treats a stale expectation as a notice and re-checks", async () => {
     const user = userEvent.setup();
     api.getSettings.mockResolvedValue(settings({ askBefore: false }));
@@ -226,6 +654,7 @@ describe("WinHome state machine", () => {
     expect(
       await screen.findByText("已是最新", { selector: ".headline" }),
     ).toBeInTheDocument();
+    expect(sessionStorage.getItem("cam.win.provenance-recovery")).toBeNull();
   });
 
   it("warns when MSIX is planned but App Installer is missing, and flips to portable", async () => {
diff --git a/src/app/views/WinHome.tsx b/src/app/views/WinHome.tsx
index a2eb536..096d55b 100644
--- a/src/app/views/WinHome.tsx
+++ b/src/app/views/WinHome.tsx
@@ -12,7 +12,7 @@ import type {
   WinPerformReport,
   WinUpdateReport,
 } from "../../shared/types";
-import { DEFAULT_SETTINGS } from "../../shared/types";
+import { DEFAULT_SETTINGS, outcomeIsPartial } from "../../shared/types";
 import { resolveFailure, userErrorMessage, type FailureSurface } from "../errorCopy";
 import { Icon, CodexGlyph } from "../icons";
 import { useI18n, dirOf, type TKey } from "../i18n";
@@ -32,6 +32,40 @@ import { useFocusRecheck, installIdentity } from "./useFocusRecheck";
 import { useOperationReattach } from "./useOperationReattach";
 
 type Kind = "loading" | "error" | "none" | "idle" | "update" | "external" | "uptodate";
+type Busy = "plan" | "perform" | "adopt" | "install" | "launch" | null;
+type ProvenanceRecoveryState = "present" | "unknown";
+interface ProvenanceRecovery {
+  state: ProvenanceRecoveryState;
+  token: string | null;
+}
+
+const WIN_PROVENANCE_RECOVERY_KEY = "cam.win.provenance-recovery";
+
+function readStoredProvenanceRecovery(): ProvenanceRecovery | null {
+  try {
+    const value = window.sessionStorage.getItem(WIN_PROVENANCE_RECOVERY_KEY);
+    if (value === "present" || value === "unknown") {
+      return { state: value, token: null };
+    }
+    const parsed = value ? (JSON.parse(value) as Partial<ProvenanceRecovery>) : null;
+    return parsed &&
+      (parsed.state === "present" || parsed.state === "unknown") &&
+      (typeof parsed.token === "string" || parsed.token === null)
+      ? { state: parsed.state, token: parsed.token }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function storeProvenanceRecovery(value: ProvenanceRecovery | null) {
+  try {
+    if (value) window.sessionStorage.setItem(WIN_PROVENANCE_RECOVERY_KEY, JSON.stringify(value));
+    else window.sessionStorage.removeItem(WIN_PROVENANCE_RECOVERY_KEY);
+  } catch {
+    // The in-memory guard still protects this renderer when storage is unavailable.
+  }
+}
 
 // Windows counterpart of MacHome — same design system + state machine, driven by
 // the win_* backend (codex-win-engine): MSIX sideload or portable fallback.
@@ -45,12 +79,16 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   const [updatedVer, setUpdatedVer] = useState<{ from: string; to: string } | null>(null);
   const [settings, setSettings] = useState<AppSettings>(DEFAULT_SETTINGS);
   const [defaultInstallRoot, setDefaultInstallRoot] = useState(DEFAULT_SETTINGS.installRoot);
-  const [busy, setBusy] = useState<"plan" | "perform" | "adopt" | "install" | "launch" | null>(
-    null,
-  );
+  const [busy, setBusy] = useState<Busy>(null);
   const [checkError, setCheckError] = useState<FailureSurface | null>(null);
   const [actionError, setActionError] = useState<FailureSurface | null>(null);
   const [notice, setNotice] = useState<string | null>(null);
+  // A successful install whose managed record could not be written stays in a
+  // guarded recovery mode until adoption succeeds. Persist the marker for the
+  // lifetime of this app window so a renderer reload cannot expose reinstall.
+  const [provenanceRecovery, setProvenanceRecovery] =
+    useState<ProvenanceRecovery | null>(readStoredProvenanceRecovery);
+  const provenanceRecoveryPending = provenanceRecovery !== null;
   const [confirmOpen, setConfirmOpen] = useState(false);
   const [installDirOpen, setInstallDirOpen] = useState(false);
   const [installDirBusy, setInstallDirBusy] = useState(false);
@@ -69,6 +107,39 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   // Synchronous guard for launch double-clicks (state alone can miss a second
   // click before setBusy("launch") re-renders).
   const launchInFlightRef = useRef(false);
+  // A recovery token created by this renderer is reconciled by runPerform
+  // itself. Only a replacement renderer should run the mount-time recovery
+  // probe; otherwise setting the marker would immediately duplicate the
+  // command's own final status/plan probes.
+  const locallyStartedOperationRef = useRef<string | null>(null);
+  // Every async owner of the main action/progress surface gets a monotonically
+  // increasing generation. A late completion may update neither busy nor
+  // transfer state after a newer operation has taken ownership.
+  const operationGenerationRef = useRef(0);
+  const busyRef = useRef<Busy>(null);
+  const reattachGenerationRef = useRef<number | null>(null);
+  const reattachEndedAsOwnerRef = useRef(false);
+  const beginOperation = useCallback((next: Exclude<Busy, null>) => {
+    const generation = operationGenerationRef.current + 1;
+    operationGenerationRef.current = generation;
+    busyRef.current = next;
+    setBusy(next);
+    return generation;
+  }, []);
+  const ownsOperation = useCallback(
+    (generation: number) => operationGenerationRef.current === generation,
+    [],
+  );
+  const setOwnedBusy = useCallback((generation: number, next: Busy) => {
+    if (operationGenerationRef.current !== generation) return false;
+    busyRef.current = next;
+    setBusy(next);
+    return true;
+  }, []);
+  const finishOperation = useCallback(
+    (generation: number) => setOwnedBusy(generation, null),
+    [setOwnedBusy],
+  );
   const confirmTitleId = useId();
   const confirmBodyId = useId();
   const installDirTitleId = useId();
@@ -99,34 +170,122 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
     onError: setActionError,
   });
 
-  const check = useCallback(async () => {
-    setBusy("plan");
+  const runCheck = useCallback(async (generation: number) => {
+    if (!ownsOperation(generation)) return false;
     setCheckError(null);
     setActionError(null);
     setNotice(null);
     try {
-      setReport(await managerApi.winPlanUpdate());
+      const next = await managerApi.winPlanUpdate();
+      if (!ownsOperation(generation)) return false;
+      setReport(next);
       return true;
     } catch (cause) {
+      if (!ownsOperation(generation)) return false;
       setReport(null);
       setCheckError(resolveFailure(cause, t));
       return false;
+    }
+  }, [ownsOperation, t]);
+
+  const check = useCallback(async () => {
+    if (busyRef.current !== null) return false;
+    const generation = beginOperation("plan");
+    try {
+      return await runCheck(generation);
     } finally {
-      setBusy(null);
+      finishOperation(generation);
     }
-  }, [t]);
+  }, [beginOperation, finishOperation, runCheck]);
 
-  const refreshStatus = useCallback(async () => {
+  const refreshStatus = useCallback(async (generation?: number) => {
+    const canApply = () => generation === undefined || ownsOperation(generation);
     try {
-      setStatus(await managerApi.winStatus());
-      setStatusFailed(false);
+      const next = await managerApi.winStatus();
+      if (canApply()) {
+        setStatus(next);
+        setStatusFailed(false);
+      }
+      return next;
     } catch {
-      setStatusFailed(true);
+      if (canApply()) setStatusFailed(true);
+      return null;
     } finally {
-      setStatusLoaded(true);
+      if (canApply()) setStatusLoaded(true);
     }
+  }, [ownsOperation]);
+
+  const clearProvenanceRecovery = useCallback((expectedToken: string | null) => {
+    // Storage is the cross-renderer authority. Re-read it at clear time so an
+    // old reconciliation can never remove a marker written by a newer run.
+    const stored = readStoredProvenanceRecovery();
+    const storedMatches = stored?.token === expectedToken;
+    if (storedMatches) storeProvenanceRecovery(null);
+    if (locallyStartedOperationRef.current === expectedToken) {
+      locallyStartedOperationRef.current = null;
+    }
+    setProvenanceRecovery((current) => {
+      if (current?.token !== expectedToken) return current;
+      // If another renderer/run replaced storage while this probe was pending,
+      // adopt that newer marker into memory instead of clearing the guard.
+      return stored && !storedMatches ? stored : null;
+    });
   }, []);
 
+  const reconcileProvenanceRecovery = useCallback(
+    async (token: string, ownerGeneration?: number) => {
+      const managesBusy = ownerGeneration === undefined;
+      const generation = ownerGeneration ?? beginOperation("plan");
+      try {
+        const returnedCompletion = await managerApi.getOperationCompletion(token).catch(() => null);
+        const completion = returnedCompletion?.id === token ? returnedCompletion : null;
+        if (!ownsOperation(generation)) return completion;
+        if (
+          completion?.state === "failed-before-commit" ||
+          completion?.state === "rolled-back"
+        ) {
+          clearProvenanceRecovery(token);
+        }
+        // A succeeded or mutation-ambiguous rejected command still needs disk truth:
+        // managed clears the guard, external offers adoption, and unknown/none
+        // stays guarded so reinstall is never inferred from an invoke failure.
+        // Neither probe owns busy independently: reconciliation keeps the same
+        // generation until BOTH have settled.
+        const [nextStatus] = await Promise.all([
+          refreshStatus(generation),
+          runCheck(generation),
+        ]);
+        if (
+          ownsOperation(generation) &&
+          nextStatus?.installed &&
+          nextStatus.status === "managed"
+        ) {
+          clearProvenanceRecovery(token);
+        }
+        return completion;
+      } finally {
+        if (managesBusy) finishOperation(generation);
+      }
+    },
+    [
+      beginOperation,
+      clearProvenanceRecovery,
+      finishOperation,
+      ownsOperation,
+      refreshStatus,
+      runCheck,
+    ],
+  );
+
+  const refreshStatusAndPlan = useCallback(async () => {
+    const generation = beginOperation("plan");
+    try {
+      return await Promise.all([refreshStatus(generation), runCheck(generation)]);
+    } finally {
+      finishOperation(generation);
+    }
+  }, [beginOperation, finishOperation, refreshStatus, runCheck]);
+
   useEffect(() => {
     void (async () => {
       const s = await managerApi.getSettings().catch(() => DEFAULT_SETTINGS);
@@ -161,10 +320,6 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   useEffect(() => {
     reportRef.current = report;
   }, [report]);
-  const busyRef = useRef(busy);
-  useEffect(() => {
-    busyRef.current = busy;
-  }, [busy]);
   const checkRef = useRef(check);
   useEffect(() => {
     checkRef.current = check;
@@ -174,13 +329,45 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   // by operation id, and poll until the backend lease ends.
   useOperationReattach({
     startDlListen,
-    applySnapshotProgress,
-    resetStop,
-    setBusy: (next) => setBusy(next),
-    setPaused,
+    applySnapshotProgress: (progress) => {
+      const generation = reattachGenerationRef.current;
+      if (generation !== null && ownsOperation(generation)) {
+        applySnapshotProgress(progress);
+      }
+    },
+    resetStop: () => {
+      const generation = reattachGenerationRef.current;
+      if (generation !== null && ownsOperation(generation)) resetStop();
+    },
+    setBusy: (next) => {
+      const generation = reattachGenerationRef.current;
+      if (next === null) {
+        reattachEndedAsOwnerRef.current =
+          generation !== null && finishOperation(generation);
+        reattachGenerationRef.current = null;
+        return;
+      }
+      if (generation === null) {
+        reattachGenerationRef.current = beginOperation(next);
+      } else {
+        setOwnedBusy(generation, next);
+      }
+    },
+    setPaused: (next) => {
+      const generation = reattachGenerationRef.current;
+      if (
+        (generation !== null && ownsOperation(generation)) ||
+        (generation === null && reattachEndedAsOwnerRef.current)
+      ) {
+        setPaused(next);
+      }
+    },
     onOperationEnded: () => {
-      void checkRef.current();
-      void refreshStatus();
+      if (!reattachEndedAsOwnerRef.current) return;
+      reattachEndedAsOwnerRef.current = false;
+      const token = readStoredProvenanceRecovery()?.token;
+      if (token) void reconcileProvenanceRecovery(token);
+      else void refreshStatusAndPlan();
     },
     isLocallyBusy: () => {
       const b = busyRef.current;
@@ -188,6 +375,16 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
     },
   });
 
+  useEffect(() => {
+    const token = provenanceRecovery?.token;
+    if (!token || locallyStartedOperationRef.current === token) return;
+    void (async () => {
+      const active = await managerApi.getOperationSnapshot().catch(() => null);
+      if (active?.id === token) return;
+      await reconcileProvenanceRecovery(token);
+    })();
+  }, [provenanceRecovery?.token, reconcileProvenanceRecovery]);
+
   // Window focus → silently re-detect the local install and re-check if the
   // install identity (version OR path) drifted out-of-band. Parity with the mac
   // home, which has had this since the atomic-snapshot rework; without it the
@@ -230,18 +427,30 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   }, [settings.periodicCheck, settings.periodicCheckIntervalSeconds]);
 
   const adopt = useCallback(async () => {
-    setBusy("adopt");
+    const generation = beginOperation("adopt");
+    const recoveryToken = readStoredProvenanceRecovery()?.token ?? provenanceRecovery?.token ?? null;
     setCheckError(null);
     setActionError(null);
     setNotice(null);
     try {
-      setStatus(await managerApi.winAdopt());
+      const next = await managerApi.winAdopt();
+      if (ownsOperation(generation)) {
+        setStatus(next);
+        clearProvenanceRecovery(recoveryToken);
+      }
     } catch (cause) {
-      setActionError(resolveFailure(cause, t));
+      if (ownsOperation(generation)) setActionError(resolveFailure(cause, t));
     } finally {
-      setBusy(null);
+      finishOperation(generation);
     }
-  }, [t]);
+  }, [
+    beginOperation,
+    clearProvenanceRecovery,
+    finishOperation,
+    ownsOperation,
+    provenanceRecovery?.token,
+    t,
+  ]);
 
   // The probe recommended MSIX, but this PC looks like it's missing the Store /
   // App Installer components — the MSIX can install yet fail to launch (the very
@@ -264,7 +473,14 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   // MSIX sideload or portable fallback — is decided by the backend plan).
   const runPerform = useCallback(
     async (mode: "perform" | "install", installRoot?: string) => {
-      setBusy(mode);
+      // React state may not have committed between two discrete clicks yet;
+      // the synchronous ref closes that double-start window.
+      if (busyRef.current !== null) return;
+      const generation = beginOperation(mode);
+      // The new owner starts from a clean transfer state. Any older finally is
+      // generation-guarded and therefore cannot erase progress emitted after
+      // this point.
+      resetStop();
       setActionError(null);
       setNotice(null);
       setPaused(null);
@@ -275,8 +491,15 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
       const fromVersion =
         mode === "perform" ? report?.installed?.version ?? status?.installed?.version ?? "" : "";
       const toVersion = report?.plan?.latestVersion ?? "";
-      const unlisten = await startDlListen();
+      let unlisten = () => {};
+      let operationToken: string | null = null;
       try {
+        const attachedUnlisten = await startDlListen();
+        if (!ownsOperation(generation)) {
+          attachedUnlisten();
+          return;
+        }
+        unlisten = attachedUnlisten;
         const expected = report?.plan
           ? {
               currentVersion: report.plan.currentVersion,
@@ -285,26 +508,51 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
               route: report.plan.route,
             }
           : undefined;
-        const result = await managerApi.winPerformUpdate(true, expected, installRoot);
-        setPerform(result);
-        setUpdatedVer(
-          mode === "perform" && fromVersion && toVersion
-            ? { from: fromVersion, to: toVersion }
-            : null,
+        operationToken = await managerApi.armDestructive("update");
+        locallyStartedOperationRef.current = operationToken;
+        const armedRecovery: ProvenanceRecovery = { state: "unknown", token: operationToken };
+        storeProvenanceRecovery(armedRecovery);
+        setProvenanceRecovery(armedRecovery);
+        const result = await managerApi.winPerformUpdate(
+          true,
+          expected,
+          installRoot,
+          operationToken,
         );
-        setConfirmOpen(false);
-        setInstallDirOpen(false);
         // Partial success (app installed, provenance failed): keep success path
         // and surface a recovery notice — never treat as hard failure.
-        if (
+        const needsProvenanceRecovery =
           result.success &&
-          result.outcome?.recoveryActions?.includes("record_provenance")
-        ) {
-          setNotice(t("install.partial.note"));
+          result.outcome?.recoveryActions?.includes("record_provenance");
+        if (ownsOperation(generation)) {
+          setPerform(result);
+          setUpdatedVer(
+            mode === "perform" && fromVersion && toVersion
+              ? { from: fromVersion, to: toVersion }
+              : null,
+          );
+          setConfirmOpen(false);
+          setInstallDirOpen(false);
+        }
+        if (needsProvenanceRecovery && ownsOperation(generation)) {
+          // Guard the action area before either probe can settle; there must be
+          // no render where a completed-but-unrecorded install offers reinstall.
+          const recoveryState: ProvenanceRecoveryState =
+            result.outcome?.appState === "present" || result.installed ? "present" : "unknown";
+          const recovery = { state: recoveryState, token: operationToken };
+          storeProvenanceRecovery(recovery);
+          setProvenanceRecovery(recovery);
+        } else if (!needsProvenanceRecovery) {
+          clearProvenanceRecovery(operationToken);
         }
-        await refreshStatus();
-        await check();
+        await refreshStatus(generation);
+        await runCheck(generation);
       } catch (cause) {
+        const code = errorCode(cause);
+        const explicitlyPreMutation = code === "stale_expectation" || isDownloadCancelled(cause);
+        if (operationToken && explicitlyPreMutation) clearProvenanceRecovery(operationToken);
+        else if (operationToken) await reconcileProvenanceRecovery(operationToken, generation);
+        if (!ownsOperation(generation)) return;
         setConfirmOpen(false);
         setInstallDirOpen(false);
         const stop = downloadStopRef.current;
@@ -314,9 +562,9 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
           setPaused({ kind: mode, dl: dlRef.current, installRoot });
         } else if (stop && isDownloadCancelled(cause)) {
           setNotice(t("progress.cancelled"));
-        } else if (errorCode(cause) === "stale_expectation") {
-          await refreshStatus();
-          if (await check()) {
+        } else if (code === "stale_expectation") {
+          await refreshStatus(generation);
+          if (await runCheck(generation)) {
             setNotice(t("home.stale.rechecked"));
           }
         } else {
@@ -324,11 +572,25 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
         }
       } finally {
         unlisten();
-        setBusy(null);
-        resetStop();
+        if (finishOperation(generation)) resetStop();
       }
     },
-    [status, report, refreshStatus, check, startDlListen, resetStop, dlRef, downloadStopRef, t],
+    [
+      status,
+      report,
+      refreshStatus,
+      runCheck,
+      startDlListen,
+      resetStop,
+      dlRef,
+      downloadStopRef,
+      clearProvenanceRecovery,
+      reconcileProvenanceRecovery,
+      beginOperation,
+      finishOperation,
+      ownsOperation,
+      t,
+    ],
   );
 
   // 〔继续〕from the paused state — re-run the same operation (same install
@@ -363,20 +625,28 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
     if (report?.plan?.route === "msix-sideload") {
       return false;
     }
-    setBusy("plan");
+    const generation = beginOperation("plan");
     setCheckError(null);
     setActionError(null);
     try {
       const next = await managerApi.winPlanUpdate();
+      if (!ownsOperation(generation)) return null;
       setReport(next);
       return next.plan?.route === "portable-fallback";
     } catch (cause) {
-      setCheckError(resolveFailure(cause, t));
+      if (ownsOperation(generation)) setCheckError(resolveFailure(cause, t));
       return null;
     } finally {
-      setBusy(null);
+      finishOperation(generation);
     }
-  }, [report?.plan?.route, settings.windowsInstallMode, t]);
+  }, [
+    beginOperation,
+    finishOperation,
+    ownsOperation,
+    report?.plan?.route,
+    settings.windowsInstallMode,
+    t,
+  ]);
 
   const requestInstall = useCallback(async () => {
     const needsLocation = await freshInstallNeedsLocation();
@@ -390,6 +660,16 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
     await runPerform("install");
   }, [freshInstallNeedsLocation, runPerform]);
 
+  const recheckProvenanceRecovery = useCallback(async () => {
+    const token = provenanceRecovery?.token;
+    if (token) await reconcileProvenanceRecovery(token);
+    else await refreshStatusAndPlan();
+  }, [
+    provenanceRecovery?.token,
+    reconcileProvenanceRecovery,
+    refreshStatusAndPlan,
+  ]);
+
   const installToCurrentRoot = useCallback(async () => {
     await runPerform("install", settings.installRoot);
   }, [runPerform, settings.installRoot]);
@@ -424,6 +704,14 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
       installed.version === status.installed.version,
   );
   const isManaged = statusMatchesInstalled && status?.status === "managed";
+  useEffect(() => {
+    // Token-bearing guards are released only by reconcile's fresh backend
+    // status. The currently rendered managed snapshot may predate an in-flight
+    // update and is not authoritative for that token. This effect exists only
+    // for legacy token-less markers written by older renderers.
+    if (!provenanceRecovery || provenanceRecovery.token !== null || !isManaged) return;
+    clearProvenanceRecovery(null);
+  }, [clearProvenanceRecovery, isManaged, provenanceRecovery]);
   const skippedCandidate = useMemo(() => winSkippedUpdateCandidate(plan), [plan]);
   const updateSuppressed = skippedUpdateMatches(settings.skippedCodexUpdate, skippedCandidate);
   const updateAvailable = Boolean(plan) && !plan?.upToDate && !updateSuppressed;
@@ -467,6 +755,9 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   const version = installed?.version || plan?.latestVersion || "";
   const sourceLabel = t(`source.${settings.source}` as TKey);
   const installRootIsDefault = samePath(settings.installRoot, defaultInstallRoot);
+  const provenanceRecoveryAction = t(
+    kind === "external" ? "home.external.cta" : "home.recheck",
+  );
 
   // A re-check (or the first auto-check) while an app is already known: the hero
   // morphs to the checking state so the status visibly reacts, then settles back.
@@ -514,6 +805,7 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
 
   const adoptManualExisting = useCallback(async () => {
     if (!manualExistingCandidate) return;
+    const recoveryToken = readStoredProvenanceRecovery()?.token ?? provenanceRecovery?.token ?? null;
     setManualExistingBusy("adopt");
     setManualExistingError(null);
     try {
@@ -521,6 +813,7 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
       setStatus(next);
       setStatusLoaded(true);
       setStatusFailed(false);
+      clearProvenanceRecovery(recoveryToken);
       setManualExistingOpen(false);
       setManualExistingCandidate(null);
       await check();
@@ -529,7 +822,13 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
     } finally {
       setManualExistingBusy(null);
     }
-  }, [check, manualExistingCandidate, t]);
+  }, [
+    check,
+    clearProvenanceRecovery,
+    manualExistingCandidate,
+    provenanceRecovery?.token,
+    t,
+  ]);
 
   const skipCurrentUpdate = useCallback(async () => {
     if (!skippedCandidate) return;
@@ -546,18 +845,20 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
     }
   }, [settings, skippedCandidate, t]);
   const onLaunch = () => {
-    if (busy !== null || launchInFlightRef.current) return;
+    if (busyRef.current !== null || launchInFlightRef.current) return;
     // Surface a failed open (PowerShell/AUMID or portable-exe error) via the
     // error banner like every other action, not an unhandled rejection.
     launchInFlightRef.current = true;
     setActionError(null);
-    setBusy("launch");
+    const generation = beginOperation("launch");
     void managerApi
       .winLaunch()
-      .catch((cause) => setActionError(resolveFailure(cause, t)))
+      .catch((cause) => {
+        if (ownsOperation(generation)) setActionError(resolveFailure(cause, t));
+      })
       .finally(() => {
         launchInFlightRef.current = false;
-        setBusy(null);
+        finishOperation(generation);
       });
   };
   const launching = busy === "launch";
@@ -589,12 +890,23 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
   const success = !rechecking && kind === "uptodate";
   // A Windows install/update is "clean" only when it actually changed something
   // without a detour — not a stale-plan no-op (stage.upToDate) and not an
-  // MSIX→portable fallback. Non-clean successes keep the backend's explanation
-  // (message + notes) and stay pinned; only clean ones self-dismiss.
+  // MSIX→portable fallback. Non-clean successes stay pinned; only clean ones
+  // self-dismiss. A partial outcome's backend prose is diagnostic evidence, not
+  // localized safety guidance, so it lives behind the disclosure below.
+  const winPartial = Boolean(perform && outcomeIsPartial(perform.outcome));
   const winClean =
-    Boolean(perform?.success) && !perform?.stage?.upToDate && !perform?.fallbackAttempted;
+    Boolean(perform?.success) &&
+    !perform?.stage?.upToDate &&
+    !perform?.fallbackAttempted &&
+    !winPartial;
   const winResultDetail =
-    perform && !winClean ? perform.notes.filter(Boolean).join(" · ") || undefined : undefined;
+    perform && !winClean && !winPartial
+      ? perform.notes.filter(Boolean).join(" · ") || undefined
+      : undefined;
+  const winResultDiagnostics =
+    perform && winPartial
+      ? [perform.message, ...perform.notes].filter(Boolean).join("\n") || undefined
+      : undefined;
   // Char-split only LTR scripts — splitting cursive RTL (Arabic) breaks joining.
   const splitHeadline = !isShimmer && dirOf(lang) === "ltr";
   useHomeMotion(scopeRef, scene, { splitHeadline, success });
@@ -641,25 +953,44 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
         inert={confirmOpen || installDirOpen || manualExistingOpen ? true : undefined}
       >
         {perform ? (
-          <ResultBanner
-            tone={perform.success ? "ok" : "err"}
-            // Clean success → the version bump / install line. Anything non-clean
-            // (no-op, fallback, or failure) keeps the backend's message so the
-            // reason is never lost.
-            title={
-              winClean
-                ? updatedVer
-                  ? t("success.flow", { from: updatedVer.from, to: updatedVer.to })
-                  : t("install.done.title")
-                : perform.message
-            }
-            detail={winResultDetail}
-            autoDismissMs={winClean ? 6000 : undefined}
-            onClose={() => {
-              setPerform(null);
-              setUpdatedVer(null);
-            }}
-          />
+          <>
+            <ResultBanner
+              tone={perform.success ? "ok" : "err"}
+              // Partial outcomes use localized product copy. The backend's raw
+              // message remains available only in the collapsed diagnostics.
+              title={
+                winPartial
+                  ? t("install.done.title")
+                  : winClean
+                    ? updatedVer
+                      ? t("success.flow", { from: updatedVer.from, to: updatedVer.to })
+                      : t("install.done.title")
+                    : perform.message
+              }
+              detail={winResultDetail}
+              autoDismissMs={winClean ? 6000 : undefined}
+              onClose={() => {
+                setPerform(null);
+                setUpdatedVer(null);
+              }}
+            />
+            {winResultDiagnostics ? (
+              <details className="manual-existing-meta">
+                <summary>{t("home.error.details")}</summary>
+                <pre className="errdetails">{winResultDiagnostics}</pre>
+              </details>
+            ) : null}
+          </>
+        ) : null}
+        {provenanceRecoveryPending ? (
+          <StatusBanner tone="warn">
+            {t(
+              provenanceRecovery?.state === "unknown" && kind !== "external"
+                ? "install.partial.pending"
+                : "install.partial.note",
+              { action: provenanceRecoveryAction },
+            )}
+          </StatusBanner>
         ) : null}
         {notice ? <StatusBanner tone="info">{notice}</StatusBanner> : null}
         {actionError ? <FailureBanner failure={actionError} /> : null}
@@ -789,7 +1120,13 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
           </div>
         ) : null}
 
-        <div className={`actions${!rechecking && kind === "update" ? " update-actions" : ""}`}>
+        <div
+          className={`actions${
+            !rechecking && !provenanceRecoveryPending && kind === "update"
+              ? " update-actions"
+              : ""
+          }`}
+        >
           {/* While a check runs we keep a STABLE pair of buttons so nothing
               reflows under the hero. */}
           {rechecking ? (
@@ -801,7 +1138,17 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
               </button>
             </>
           ) : null}
-          {!rechecking && kind === "update" ? (
+          {!rechecking && provenanceRecoveryPending && kind !== "external" ? (
+            <button
+              className="btn primary big"
+              onClick={() => void recheckProvenanceRecovery()}
+              disabled={busy !== null}
+            >
+              <Icon name="refresh" />
+              {t("home.recheck")}
+            </button>
+          ) : null}
+          {!rechecking && !provenanceRecoveryPending && kind === "update" ? (
             <>
               <button className="btn ghost big" onClick={check} disabled={busy !== null}>
                 <Icon name="refresh" />
@@ -817,7 +1164,7 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
               </button>
             </>
           ) : null}
-          {!rechecking && kind === "idle" ? (
+          {!rechecking && !provenanceRecoveryPending && kind === "idle" ? (
             <>
               {launchButton("primary")}
               <button className="btn ghost" onClick={check} disabled={busy !== null}>
@@ -835,13 +1182,13 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
               {launchButton("ghost")}
             </>
           ) : null}
-          {!rechecking && kind === "none" ? (
+          {!rechecking && !provenanceRecoveryPending && kind === "none" ? (
             <button className="btn primary big" onClick={requestInstall} disabled={busy !== null}>
               <Icon name="download" />
               {t("home.none.cta")}
             </button>
           ) : null}
-          {!rechecking && kind === "uptodate" ? (
+          {!rechecking && !provenanceRecoveryPending && kind === "uptodate" ? (
             <>
               {launchButton("primary")}
               <button className="btn ghost" onClick={check} disabled={busy !== null}>
@@ -852,7 +1199,7 @@ export function WinHome({ onOpenSettings }: { onOpenSettings: () => void }) {
           ) : null}
           {/* "请稍后重试" must come with a way to retry. When Codex is installed
               the user can still launch it despite the failed check. */}
-          {!rechecking && kind === "error" ? (
+          {!rechecking && !provenanceRecoveryPending && kind === "error" ? (
             installed ? (
               <>
                 {launchButton("primary")}
diff --git a/src/services/managerApi.ts b/src/services/managerApi.ts
index c1662f7..2489baf 100644
--- a/src/services/managerApi.ts
+++ b/src/services/managerApi.ts
@@ -16,6 +16,7 @@ import type {
   MacUpdateReport,
   OperationKind,
   OperationSnapshot,
+  OperationCompletion,
   OperationToken,
   WinInstallStatus,
   WinPerformReport,
@@ -506,6 +507,13 @@ export const managerApi = {
     }
     return invoke<OperationSnapshot | null>("get_operation_snapshot");
   },
+  /** Token-keyed terminal evidence retained after a renderer loses its invoke. */
+  getOperationCompletion(token: OperationToken): Promise<OperationCompletion | null> {
+    if (!hasTauriRuntime()) {
+      return Promise.resolve(null);
+    }
+    return invoke<OperationCompletion | null>("get_operation_completion", { token });
+  },
   macPlanUpdate(simulatedBuild?: number): Promise<MacUpdateReport> {
     if (!hasTauriRuntime()) {
       return Promise.resolve({ ...FALLBACK_PLAN, simulatedBuild: simulatedBuild ?? null });
@@ -874,6 +882,7 @@ export const managerApi = {
       route: string;
     },
     installRoot?: string,
+    operationToken?: OperationToken,
   ): Promise<WinPerformReport> {
     if (!hasTauriRuntime()) {
       return confirm
@@ -883,7 +892,7 @@ export const managerApi = {
     if (!confirm) {
       return Promise.reject(new Error("explicit confirmation is required"));
     }
-    const token = await managerApi.armDestructive("update");
+    const token = operationToken ?? (await managerApi.armDestructive("update"));
     return invoke<WinPerformReport>("win_perform_update", {
       confirm,
       token,
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 87e4601..2c5af56 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -26,6 +26,20 @@ export interface OperationSnapshot {
   interruptible: boolean;
 }
 
+export type OperationCompletionState =
+  | "succeeded"
+  | "failed-before-commit"
+  | "rolled-back"
+  | "outcome-unknown";
+
+/** Terminal backend evidence retained after the active lease disappears. */
+export interface OperationCompletion {
+  id: string;
+  kind: OperationKind;
+  phase: OperationPhase;
+  state: OperationCompletionState;
+}
+
 /**
  * Serialized error returned by failing Tauri commands. Mirrors the backend
  * `CommandError` struct (src-tauri/src/errors.rs), which serializes