[Sev7eNup]

First of three setup/switcher PRs from the 2026-10-28 audit. The desktop and switcher PRs are stacked on this one, so merge this first.

What changes

• Local TLS in setup (D01): the install health probe and the wizard's first login go through a new LocalServerHttp.ps1 helper. It accepts only the configured server certificate (by thumbprint), refuses redirects and proxies, and only talks to loopback HTTPS. The process-wide TrustAllCerts policy is gone. Nothing changes for the operator: the certificate may still name the public host or be self-signed, TLS 1.2 and 1.3 are still offered on Windows PowerShell 5.1 as the old probe did, and a rejected first login still shows the server's own message.
• Identity change rollback (Restore install-directory ACLs when server identity changes roll back #735): the installer snapshots the install root DACL before it changes it. A failed reinstall from gMSA A to B restores that DACL before the old binaries are copied back, so A can start them again.
• Repeatable uninstall, server part (Stop installer uninstallation when service cleanup fails #714): a failed sc.exe delete stops the script before files are removed. The installation marker and deploy\ are removed last, only after everything else is gone. The Inno uninstaller aborts (non-zero exit, Apps & features entry kept) when the cleanup fails, cannot start, or its script is missing while the marker still exists. Because the script runs hidden, it now keeps a transcript at %TEMP%\nodepilot-server-uninstall.log (deleted after a clean run), and the abort message names that file.
• PurgeData on German Windows (Make Windows data purge ownership recovery locale independent #731): ownership is taken with takeown /A item by item instead of takeown /R /D Y, which German Windows rejects. If any native step fails, nothing under the data directory is deleted.
• gMSA repair advice (Preserve existing principals in gMSA and RBCD repair guidance #713): the suggested command reads the existing PrincipalsAllowedToRetrieveManagedPassword and adds this host instead of replacing the list. The deploy README drops the blanket RBCD recipe, in line with the guidance Remove blanket delegation grants from direct service-identity WinRM guidance #707 already put on the website.

The wizard loads the new helper only in install mode, so its other steps do not compile C#. CHANGELOG and the website's uninstall section are updated. The new harness runs in both CI PowerShell steps.

Testing

Windows PowerShell 5.1, locally:

• Test-LocalServerHttp.ps1 (21 checks), Test-ArtifactSecurity.ps1, Test-DeploymentTemplates.ps1, server/Test-ServerWizardCompile.ps1: pass.
• Test-SetupAdapter.ps1 stops on this machine at the unrelated "occupied port" check, the same way on main. I ran the new gMSA remediation case on its own against Preflight.ps1, including a quote in the account name: pass.
• docs-ui: 227 tests pass.

Lab (signed 1.5.4-audit1 build of the same changes, GW1 and the German host):

• D30: failed gMSA A→B reinstall leaves the install root DACL as before and the service runs as A again (/healthz/ready 200); an update with an unchanged identity also passes.
• D09: with service deletion denied via sc sdset, the uninstall exits 1 and keeps the service, the files, deploy\, the marker and the Apps & features entry; the retry removes everything.
• D26: old takeown /R /D Y fails on German Windows; the new helper unlocks and deletes a SYSTEM-owned folder.

PowerShell 7 runs and the rest of Test-SetupAdapter.ps1 are covered by CI. The full release lab matrix runs before the next tag as usual.

Closes #713
Closes #731
Closes #735
Refs #714 (closed by the desktop PR)

🤖 Generated with Claude Code